summaryrefslogtreecommitdiffstats
path: root/hw
Commit message (Collapse)AuthorAgeFilesLines
* sdhci: Set a default frequency clockKevin O'Connor2014-12-151-2/+2
| | | | | | | | The Linux SDHCI PCI driver will only register the device if there is a clock frequency set. So, set a default frequency of 52Mhz. Signed-off-by: Kevin O'Connor <kevin@koconnor.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* serial: only resample THR interrupt on rising edge of IER.THRIPaolo Bonzini2014-12-151-9/+16
| | | | | | | | | | | | | There is disagreement on whether LSR.THRE should be resampled when IER.THRI goes from 1 to 1. Bochs only does it if IER.THRI goes from 0 to 1; PCE does it even if IER.THRI is unchanged. But the Windows driver seems to always go from 1 to 0 and back to 1, so do things in agreement with Bochs, because the handling of thr_ipending was reported in 2010 (https://lists.gnu.org/archive/html/qemu-devel/2010-03/msg01914.html) as breaking DR-DOS Plus. Reported-by: Roy Tam <roytam@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* serial: update LSR on enabling/disabling FIFOsPaolo Bonzini2014-12-151-0/+3
| | | | | | | | | | | | | | When the transmit FIFO is emptied or enabled, the transmitter hold register is empty. When it is disabled, it is also emptied and in addition the previous contents of the transmitter hold register are discarded. In either case, the THRE bit in LSR must be set and THRI raised. When the receive FIFO is emptied or enabled, the data ready and break bits must be cleared in LSR. Likewise when the receive FIFO is disabled. Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* serial: clean up THRE/TEMT handlingPaolo Bonzini2014-12-151-14/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | - assert TEMT is cleared before sending a character; we'll get one from TSR if tsr_retry > 0, from the FIFO or THR otherwise - assert THRE cleared and FIFO not empty (if enabled) before fetching a character to send. This effectively reverts dffacd46, but the check makes no sense and commit f702e62 (serial: change retry logic to avoid concurrency, 2014-07-11) must have made it unnecessary. The commit message for f702e62 talks about multiple calls to qemu_chr_fe_add_watch triggering s->tsr_retry >= MAX_XMIT_RETRY, but other failures were possible. For example, if you have multiple calls, the subsequent ones will see s->tsr_retry == 0 and will find THRE and/or TEMT on entry. - for clarity, raise THRI immediately after the code sets THRE - check THRE to see if another character has to be sent. This makes the assertions more obvious and also means TEMT has to be set as soon as the loop ends. It makes the loop send both TSR and THR if flow-control happens in non-FIFO mode. Previously, THR would be lost. - clear TEMT together with THRE even in the non-FIFO case The last two items are bugfixes, but they were just found by inspection and do not squash known bugs. Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* serial: reset thri_pending on IER writes with THRI=0Paolo Bonzini2014-12-151-2/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is responsible for failure of migration from 2.2 to 2.1, because thr_ipending is always one in practice. serial.c is setting thr_ipending unconditionally. However, thr_ipending is not used at all if THRI=0, and it will be overwritten again the next time THRE or THRI changes. For that reason, we can set thr_ipending to zero every time THRI is reset. There is disagreement on whether LSR.THRE should be resampled when IER.THRI goes from 1 to 1. This patch does not touch the code, leaving that for QEMU 2.3+. This has no semantic change and is enough to fix migration in the common case where the interrupt is not pending or is reported in IIR. It does not change the migration format, so 2.2.0 -> 2.1 will remain broken but we can fix 2.2.1 -> 2.1 without breaking 2.2.1 <-> 2.2.0. The case that remains broken (the one in which the subsection is strictly necessary) is when THRE=1, the THRI interrupt has *not* been acknowledged yet, and a higher-priority interrupt comes. In this case, you need the subsection to tell the source that the lower-priority THRI interrupt is pending. The subsection's breakage of migration, in this case, prevents continuing the VM on the destination with an invalid state. Cc: qemu-stable@nongnu.org Reported-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* kvm/apic: fix 2.2->2.1 migrationPaolo Bonzini2014-12-152-3/+12
| | | | | | | | | | | The wait_for_sipi field is set back to 1 after an INIT, so it was not effective to reset it in kvm_apic_realize. Introduce a reset callback and reset wait_for_sipi there. Reported-by: Igor Mammedov <imammedo@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target-i386: add f16c and rdrand to Haswell and BroadwellPaolo Bonzini2014-12-152-0/+8
| | | | | | | | Both were added in Ivy Bridge (for which we do not have a CPU model yet!). Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target-i386: add VME to all CPUsPaolo Bonzini2014-12-152-0/+28
| | | | | | | | | vm86 mode extensions date back to the 486. All models should have them. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* pc: add 2.3 machine typesPaolo Bonzini2014-12-152-7/+48
| | | | | | | The next patch will differentiate them. Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* scsi-disk: provide maximum transfer lengthPaolo Bonzini2014-12-151-0/+27
| | | | | | | | | | The QEMU block layer has a limit of INT_MAX bytes per transfer. Expose it in the block limits VPD page for both regular transfers and WRITE SAME. Reported-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* scsi: Use g_new() & friends where that makes obvious senseMarkus Armbruster2014-12-152-2/+2
| | | | | | | | | | | | | | | g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer, for two reasons. One, it catches multiplication overflowing size_t. Two, it returns T * rather than void *, which lets the compiler catch more type errors. This commit only touches allocations with size arguments of the form sizeof(T). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* scsi: Fuse g_malloc(); memset() into g_malloc0()Markus Armbruster2014-12-151-4/+2
| | | | | | | | | | | | | | | | Coccinelle semantic patch: @@ expression LHS, SZ; @@ - LHS = g_malloc(SZ); - memset(LHS, 0, SZ); + LHS = g_malloc0(SZ); Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* scsi: Drop superfluous conditionals around g_free()Markus Armbruster2014-12-151-4/+2
| | | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* x86: Use g_new() & friends where that makes obvious senseMarkus Armbruster2014-12-151-2/+1
| | | | | | | | | | | | | | g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer, for two reasons. One, it catches multiplication overflowing size_t. Two, it returns T * rather than void *, which lets the compiler catch more type errors. This commit only touches allocations with size arguments of the form sizeof(T). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* x86: Drop superfluous conditionals around g_free()Markus Armbruster2014-12-151-3/+1
| | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* valgrind/i386: avoid false positives on KVM_SET_PIT ioctlChristian Borntraeger2014-12-151-1/+1
| | | | | | | | struct kvm_pit_state2 contains pad fields. Let's use a designated initializer to avoid false positives from valgrind/memcheck. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* valgrind/i386: avoid false positives on KVM_SET_CLOCK ioctlChristian Borntraeger2014-12-151-2/+1
| | | | | | | | kvm_clock_data contains pad fields. Let's use a designated initializer to avoid false positives from valgrind/memcheck. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* vfio: use kvm_resamplefds_enabled()Eric Auger2014-12-151-3/+2
| | | | | | | | Use the kvm_resamplefds_enabled function Signed-off-by: Eric Auger <eric.auger@linaro.org> Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* KVM_CAP_IRQFD and KVM_CAP_IRQFD_RESAMPLE checksEric Auger2014-12-152-2/+0
| | | | | | | | | | | | | | | | | | | | | | | Compute kvm_irqfds_allowed by checking the KVM_CAP_IRQFD extension. Remove direct settings in architecture specific files. Add a new kvm_resamplefds_allowed variable, initialized by checking the KVM_CAP_IRQFD_RESAMPLE extension. Add a corresponding kvm_resamplefds_enabled() function. A special notice for s390 where KVM_CAP_IRQFD was not immediatly advirtised when irqfd capability was introduced in the kernel. KVM_CAP_IRQ_ROUTING was advertised instead. This was fixed in "KVM: s390: announce irqfd capability", ebc3226202d5956a5963185222982d435378b899 whereas irqfd support was brought in 84223598778ba08041f4297fda485df83414d57e, "KVM: s390: irq routing for adapter interrupts". Both commits first appear in 3.15 so there should not be any kernel version impacted by this QEMU modification. Signed-off-by: Eric Auger <eric.auger@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* Add bootloader name to multiboot implementationDrew DeVault2014-12-151-5/+27
| | | | | | | | | The name is set to "qemu". Signed-off-by: Drew DeVault <sir@cmpwn.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Drew DeVault <sircmpwn@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell2014-11-2416-1013/+1907
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pc, pci, misc bugfixes A bunch of bugfixes for 2.2. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon 24 Nov 2014 18:59:47 GMT using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: pc: acpi: mark all possible CPUs as enabled in SRAT pcie: fix improper use of negative value pcie: fix typo in pcie_cap_deverr_init() target-i386: move generic memory hotplug methods to DSDTs acpi-build: mark RAM dirty on table update hw/pci: fix crash on shpc error flow pc: count in 1Gb hugepage alignment when sizing hotplug-memory container pc: explicitly check maxmem limit when adding DIMM pc: pc-dimm: use backend alignment during address auto allocation pc: align DIMM's address/size by backend's alignment value memory: expose alignment used for allocating RAM as MemoryRegion API pc: limit DIMM address and size to page aligned values pc: make pc_dimm_plug() more readble pc: kvm: check if KVM has free memory slots to avoid abort() qemu-char: fix tcp_get_fds Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * pc: acpi: mark all possible CPUs as enabled in SRATIgor Mammedov2014-11-241-8/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If QEMU is started with -numa ... Windows only notices that CPU has been hot-added but it will not online such CPUs. It's caused by the fact that possible CPUs are flagged as not enabled in SRAT and Windows honoring that information doesn't use corresponding CPU. ACPI 5.0 Spec regarding to flag says: " Table 5-47 Local APIC Flags ... Enabled: if zero, this processor is unusable, and the operating system support will not attempt to use it. " Fix QEMU to adhere to spec and mark possible CPUs as enabled in SRAT. With that Windows onlines hot-added CPUs as expected. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pcie: fix improper use of negative valueGonglei2014-11-241-1/+1
| | | | | | | | | | | | Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pcie: fix typo in pcie_cap_deverr_init()Gonglei2014-11-241-1/+1
| | | | | | | | | | | | | | | | | | Reported-by: https://bugs.launchpad.net/qemu/+bug/1393440 Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * target-i386: move generic memory hotplug methods to DSDTsPaolo Bonzini2014-11-248-992/+1789
| | | | | | | | | | | | | | | | | | | | This makes it simpler to keep the SSDT byte-for-byte identical for a given machine type, which is a goal we want to have for 2.2 and newer types. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * acpi-build: mark RAM dirty on table updateMichael S. Tsirkin2014-11-242-6/+13
| | | | | | | | | | | | | | | | | | acpi build modifies internal FW CFG RAM on first access but we forgot to mark it dirty. If this RAM has been migrated already, it won't be migrated again, returning corrupted tables to guest. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/pci: fix crash on shpc error flowMarcel Apfelbaum2014-11-241-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the pci bridge enters in error flow as part of init process it will only delete the shpc mmio subregion but not remove it from the properties list, resulting in segmentation fault when the bridge runs the exit function. Example: add a pci bridge without specifing the chassis number: <qemu-bin> ... -device pci-bridge,id=p1 Result: (qemu) qemu-system-x86_64: -device pci-bridge,id=p1: Bridge chassis not specified. Each bridge is required to be assigned a unique chassis id > 0. qemu-system-x86_64: -device pci-bridge,id=p1: Device initialization failed. Segmentation fault (core dumped) if (child->class->unparent) { #0 0x00005555558d629b in object_finalize_child_property (obj=0x555556d2e830, name=0x555556d30630 "shpc-mmio[0]", opaque=0x555556a42fc8) at qom/object.c:1078 #1 0x00005555558d4b1f in object_property_del_all (obj=0x555556d2e830) at qom/object.c:367 #2 0x00005555558d4ca1 in object_finalize (data=0x555556d2e830) at qom/object.c:412 #3 0x00005555558d55a1 in object_unref (obj=0x555556d2e830) at qom/object.c:720 #4 0x000055555572c907 in qdev_device_add (opts=0x5555563544f0) at qdev-monitor.c:566 #5 0x0000555555744f16 in device_init_func (opts=0x5555563544f0, opaque=0x0) at vl.c:2213 #6 0x00005555559cf5f0 in qemu_opts_foreach (list=0x555555e0f8e0 <qemu_device_opts>, func=0x555555744efa <device_init_func>, opaque=0x0, abort_on_failure=1) at util/qemu-option.c:1057 #7 0x000055555574a11b in main (argc=16, argv=0x7fffffffdde8, envp=0x7fffffffde70) at vl.c:423 Unparent the shpc mmio region as part of shpc cleanup. Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Amos Kong <akong@redhat.com>
| * pc: count in 1Gb hugepage alignment when sizing hotplug-memory containerIgor Mammedov2014-11-241-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | if DIMMs with different size/alignment are interleaved in creation order, it could lead to hotplug-memory container fragmentation and following inability to use all RAM upto maxmem. For example: -m 4G,slots=3,maxmem=7G -object memory-backend-file,id=mem-1,size=256M,mem-path=/pagesize-2MB -device pc-dimm,id=mem1,memdev=mem-1 -object memory-backend-file,id=mem-2,size=1G,mem-path=/pagesize-1GB -device pc-dimm,id=mem2,memdev=mem-2 -object memory-backend-file,id=mem-3,size=256M,mem-path=/pagesize-2MB -device pc-dimm,id=mem3,memdev=mem-3 fragments hotplug-memory container and doesn't allow to use 1GB hugepage backend to consume remainig 1Gb. To ease managment factor count in max 1Gb alignment for each memory slot when sizing hotplug-memory region so that regadless of fragmentaion it would be possible to add max aligned DIMM. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pc: explicitly check maxmem limit when adding DIMMIgor Mammedov2014-11-241-0/+45
| | | | | | | | | | | | | | | | | | | | | | | | Currently maxmem limit is not checked and depends on hotplug region container not being able to fit more RAM than maxmem. Do check explicitly so that it would be possible to change hotplug container size later to deal with fragmentation. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pc: pc-dimm: use backend alignment during address auto allocationIgor Mammedov2014-11-231-1/+4
| | | | | | | | | | | | Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pc: align DIMM's address/size by backend's alignment valueIgor Mammedov2014-11-233-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Performance wise it's better to align GVA by the backend's page size. Also do not allow to create DIMM device with suboptimal size (i.e. not aligned to backends page size) to aviod memory loss. Do above only for 2.2 and newer machine types to avoid breaking working configs with 2.1 machine type. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pc: limit DIMM address and size to page aligned valuesIgor Mammedov2014-11-232-2/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When running in KVM mode, kvm_set_phys_mem() will silently fail if registered MemoryRegion address/size is not page aligned. Causing memory hotplug failure in guest. Mapping non aligned MemoryRegion in TCG mode 'works', but sane guest OS still expects page aligned memory module and fails to initialize it if it's not aligned. So do not allow non aligned (i.e. valid) address/size values for DIMM to avoid either KVM failure or guest issues caused by it. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pc: make pc_dimm_plug() more readbleIgor Mammedov2014-11-231-2/+3
| | | | | | | | | | | | | | | | | | | | split addr initialization from declaration so that later when new local vars are added property getter wouldn't drift off of error check. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pc: kvm: check if KVM has free memory slots to avoid abort()Igor Mammedov2014-11-231-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When more memory devices are used than available KVM memory slots, QEMU crashes with: kvm_alloc_slot: no free slot available Aborted (core dumped) Fix this by checking that KVM has a free slot before attempting to map memory in guest address space. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | apic: fix incorrect handling of ExtINT interrupts wrt processor priorityPaolo Bonzini2014-11-241-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes another failure with ExtINT, demonstrated by QNX. The failure mode is as follows: - IPI sent to cpu 0 (bit set in APIC irr) - IPI accepted by cpu 0 (bit cleared in irr, set in isr) - IPI sent to cpu 0 (bit set in both irr and isr) - PIC interrupt sent to cpu 0 The PIC interrupt causes CPU_INTERRUPT_HARD to be set, but apic_irq_pending observes that the highest pending APIC interrupt priority (the IPI) is the same as the processor priority (since the IPI is still being handled), so apic_get_interrupt returns a spurious interrupt rather than the pending PIC interrupt. The result is an endless sequence of spurious interrupts, since nothing will clear CPU_INTERRUPT_HARD. Instead, ExtINT interrupts should have ignored the processor priority. Calling apic_check_pic early in apic_get_interrupt ensures that apic_deliver_pic_intr is called instead of delivering the spurious interrupt. apic_deliver_pic_intr then clears CPU_INTERRUPT_HARD if needed. Reported-by: Richard Bilson <rbilson@qnx.com> Tested-by: Richard Bilson <rbilson@qnx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | apic: fix loss of IPI due to masked ExtINTPaolo Bonzini2014-11-241-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes an obscure failure of the QNX kernel on QEMU x86 SMP. In QNX, all hardware interrupts come via the PIC, and are delivered by the cpu 0 LAPIC in ExtINT mode, while IPIs are delivered by the LAPIC in fixed mode. This bug happens as follows: - cpu 0 masks a particular PIC interrupt - IPI sent to cpu 0 (CPU_INTERRUPT_HARD is set) - before the IPI is accepted, the masked interrupt line is asserted by the device Since the interrupt is masked, apic_deliver_pic_intr will clear CPU_INTERRUPT_HARD. The IPI will still be set in the APIC irr, but since CPU_INTERRUPT_HARD is not set the cpu will not notice. Depending on the scenario this can cause a system hang, i.e. if cpu 0 is expected to unmask the interrupt. In order to fix this, do a full check of the APIC before an EXTINT is acknowledged. This can result in clearing CPU_INTERRUPT_HARD, but can also result in delivering the lost IPI. Reported-by: Richard Bilson <rbilson@qnx.com> Tested-by: Richard Bilson <rbilson@qnx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | apic: avoid getting out of halted state on masked PIC interruptsPaolo Bonzini2014-11-241-3/+5
|/ | | | | | | | | | | | | | | | | | | | After the next patch, if a masked PIC interrupts causes CPU_INTERRUPT_POLL to be set, the CPU will spuriously get out of halted state. While this is technically valid, we should avoid that. Make CPU_INTERRUPT_POLL run apic_update_irq in the right thread and then look at CPU_INTERRUPT_HARD. If CPU_INTERRUPT_HARD does not get set, do not report the CPU as having work. Also move the handling of software-disabled APIC from apic_update_irq to apic_irq_pending, and always trigger CPU_INTERRUPT_POLL. This will be important once we will add a case that resets CPU_INTERRUPT_HARD from apic_update_irq. We want to run it even if we go through CPU_INTERRUPT_POLL, and even if the local APIC is software disabled. Reported-by: Richard Bilson <rbilson@qnx.com> Tested-by: Richard Bilson <rbilson@qnx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* rtl8139: fix Pointer to local outside scopeGonglei2014-11-211-0/+4
| | | | | | | | | | | | | | | | | | Coverity spot: Assigning: iov = struct iovec [3]({{buf, 12UL}, {(void *)dot1q_buf, 4UL}, {buf + 12, size - 12}}) (address of temporary variable of type struct iovec [3]). out_of_scope: Temporary variable of type struct iovec [3] goes out of scope. Pointer to local outside scope (RETURN_LOCAL) use_invalid: Using iov, which points to an out-of-scope temporary variable of type struct iovec [3]. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* pcnet: fix Negative array index readGonglei2014-11-211-25/+30
| | | | | | | | | | | | s->xmit_pos maybe assigned to a negative value (-1), but in this branch variable s->xmit_pos as an index to array s->buffer. Let's add a check for s->xmit_pos. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* hw/arm/virt: set stdout-path instead of linux,stdout-pathLeif Lindholm2014-11-201-1/+1
| | | | | | | | | | | | | | | ePAPR 1.1 defines the stdout-path property, making the os-specific linux,stdout-path property redundant. Change the DT setup for ARM virt to use the generic property - supported by Linux since 3.15. The old QEMU behaviour was not present in any released version of QEMU, and was only added to QEMU after the kernel changed, so this should not break any existing setups. Signed-off-by: Leif Lindholm <leif.lindholm@linaro.org> [PMM: add note to commit about the old behaviour never hving been in a released version of QEMU] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/ide/core.c: Prevent SIGSEGV during migrationDon Slutz2014-11-181-1/+1
| | | | | | | | | | | | The other callers to blk_set_enable_write_cache() in this file already check for s->blk == NULL. Signed-off-by: Don Slutz <dslutz@verizon.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1416259239-13281-1-git-send-email-dslutz@verizon.com Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2014-11-175-6/+23
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A smattering of fixes for problems that Coverity reported. # gpg: Signature made Mon 17 Nov 2014 17:03:25 GMT using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: hcd-musb: fix dereference null return value target-cris/translate.c: fix out of bounds read shpc: fix error propaagation qemu-char: fix MISSING_COMMA acl: fix memory leak nvme: remove superfluous check loader: fix NEGATIVE_RETURNS qga: fix false negative argument passing mips_mipssim: fix use-after-free for filename l2tpv3: fix fd leak l2tpv3: fix possible double free libcacard: fix resource leak Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hcd-musb: fix dereference null return valuePaolo Bonzini2014-11-171-2/+6
| | | | | | | | | | | | | | | | | | usb_ep_get and usb_handle_packet can deal with a NULL device, but we have to avoid dereferencing NULL pointers when building the id. Thanks to Gonglei for an initial stab at fixing this. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * shpc: fix error propaagationGonglei2014-11-171-1/+2
| | | | | | | | | | Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * nvme: remove superfluous checkGonglei2014-11-171-2/+1
| | | | | | | | | | | | | | | | | | | | Operands don't affect result (CONSTANT_EXPRESSION_RESULT) ((n->bar.aqa >> AQA_ASQS_SHIFT) & AQA_ASQS_MASK) > 4095 is always false regardless of the values of its operands. This occurs as the logical second operand of '||'. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * loader: fix NEGATIVE_RETURNSGonglei2014-11-171-0/+13
| | | | | | | | | | | | | | | | | | lseek will return -1 on error, g_malloc0(size) and read(,,size) paramenters cannot be negative. We should add a check for return value of lseek(). Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * mips_mipssim: fix use-after-free for filenameGonglei2014-11-171-1/+1
| | | | | | | | | | | | | | May pass freed pointer filename as an argument to error_report. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | Merge remote-tracking branch 'remotes/sstabellini/xen-2014-11-14' into stagingPeter Maydell2014-11-143-17/+70
|\ \ | | | | | | | | | | | | | | | | | | | | | * remotes/sstabellini/xen-2014-11-14: xen_disk: fix unmapping of persistent grants pc: piix4_pm: init legacy PCI hotplug when running on Xen Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | xen_disk: fix unmapping of persistent grantsRoger Pau Monne2014-11-141-6/+66
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes two issues with persistent grants and the disk PV backend (Qdisk): - Keep track of memory regions where persistent grants have been mapped since we need to unmap them as a whole. It is not possible to unmap a single grant if it has been batch-mapped. A new check has also been added to make sure persistent grants are only used if the whole mapped region can be persistently mapped in the batch_maps case. - Unmap persistent grants before switching to the closed state, so the frontend can also free them. Signed-off-by: Roger Pau Monné <roger.pau@citrix.com> Reported-by: George Dunlap <george.dunlap@eu.citrix.com> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Cc: George Dunlap <george.dunlap@eu.citrix.com> Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
| * | pc: piix4_pm: init legacy PCI hotplug when running on XenIgor Mammedov2014-11-142-11/+4
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If user starts QEMU with "-machine pc,accel=xen", then compat property in xenfv won't work and it would cause error: "Unsupported bus. Bus doesn't have property 'acpi-pcihp-bsel' set" when PCI device is added with -device on QEMU CLI. From: Igor Mammedov <imammedo@redhat.com> In case of Xen instead of using compat property, just use the fact that xen doesn't use QEMU's fw_cfg/acpi tables to switch piix4_pm into legacy PCI hotplug mode when Xen is enabled. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Li Liang <liang.z.li@intel.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
OpenPOWER on IntegriCloud