]> Git Repo - qemu.git/log
qemu.git
8 years agolinux-user: Add debug code to exercise restarting system calls
Timothy E Baldwin [Thu, 12 May 2016 17:47:45 +0000 (18:47 +0100)]
linux-user: Add debug code to exercise restarting system calls

If DEBUG_ERESTARTSYS is set restart all system calls once. This
is pure debug code for exercising the syscall restart code paths
in the per-architecture cpu main loops.

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
[PMM: Add comment and a commented-out #define next to the commented-out
 generic DEBUG #define; remove the check on TARGET_USE_ERESTARTSYS;
 tweak comment message]
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Support for restarting system calls for Microblaze targets
Timothy E Baldwin [Thu, 12 May 2016 17:47:44 +0000 (18:47 +0100)]
linux-user: Support for restarting system calls for Microblaze targets

Update the Microblaze main loop and sigreturn code:
 * on TARGET_ERESTARTSYS, wind guest PC backwards to repeat syscall insn
 * set all guest CPU state within signal.c code on sigreturn
 * handle TARGET_QEMU_ESIGRETURN in the main loop as the indication
   that the main loop should not touch any guest CPU state

Note that this in passing fixes a bug where we were corrupting
the guest r[3] on sigreturn with the guest's r[10] because
do_sigreturn() was returning env->regs[10] but the register for
syscall return values is env->regs[3].

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
Reviewed-by: Edgar E. Iglesias <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
[PMM: Commit message tweaks; drop TARGET_USE_ERESTARTSYS define;
 drop whitespace changes]
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Set r14 on exit from microblaze syscall
Peter Maydell [Thu, 12 May 2016 17:47:43 +0000 (18:47 +0100)]
linux-user: Set r14 on exit from microblaze syscall

All syscall exits on microblaze result in r14 being equal to the
PC we return to, because the kernel syscall exit instruction "rtbd"
does this. (This is true even for sigreturn(); note that r14 is
not a userspace-usable register as the kernel may clobber it at
any point.)

Emulate the setting of r14 on exit; this isn't really a guest
visible change for valid guest code because r14 isn't reliably
observable anyway. However having the code and the comment helps
to explain why it's ok for the ERESTARTSYS handling not to undo
the changes to r14 that happen on syscall entry.

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Support for restarting system calls for tilegx targets
Peter Maydell [Thu, 12 May 2016 17:47:42 +0000 (18:47 +0100)]
linux-user: Support for restarting system calls for tilegx targets

Update the tilegx main loop and sigreturn code:
 * on TARGET_ERESTARTSYS, wind guest PC backwards to repeat syscall insn
 * return -TARGET_QEMU_ESIGRETURN from sigreturn rather than current R_RE
 * handle TARGET_QEMU_ESIGRETURN in the main loop as the indication
   that the main loop should not touch any guest CPU state

Note that this fixes a bug where a sigreturn which happened to have
an errno value in TILEGX_R_RE would incorrectly cause TILEGX_R_ERR
to get set.

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Support for restarting system calls for CRIS targets
Timothy E Baldwin [Thu, 12 May 2016 17:47:41 +0000 (18:47 +0100)]
linux-user: Support for restarting system calls for CRIS targets

Update the CRIS main loop and sigreturn code:
 * on TARGET_ERESTARTSYS, wind guest PC backwards to repeat syscall insn
 * set all guest CPU state within signal.c code on sigreturn
 * handle TARGET_QEMU_ESIGRETURN in the main loop as the indication
   that the main loop should not touch any guest CPU state

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
Reviewed-by: Peter Maydell <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
[PMM: tweak commit message; drop TARGET_USE_ERESTARTSYS define]
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Support for restarting system calls for S390 targets
Timothy E Baldwin [Thu, 12 May 2016 17:47:40 +0000 (18:47 +0100)]
linux-user: Support for restarting system calls for S390 targets

Update the S390 main loop and sigreturn code:
 * on TARGET_ERESTARTSYS, wind guest PC backwards to repeat syscall insn
 * set all guest CPU state within signal.c code on sigreturn
 * handle TARGET_QEMU_ESIGRETURN in the main loop as the indication
   that the main loop should not touch any guest CPU state

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
Reviewed-by: Peter Maydell <[email protected]>
[PMM: tweak commit message; remove stray double semicolon; drop
 TARGET_USE_ERESTARTSYS define]
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Support for restarting system calls for M68K targets
Timothy E Baldwin [Thu, 12 May 2016 17:47:39 +0000 (18:47 +0100)]
linux-user: Support for restarting system calls for M68K targets

Update the M68K main loop and sigreturn code:
 * on TARGET_ERESTARTSYS, wind guest PC backwards to repeat syscall insn
 * set all guest CPU state within signal.c code on sigreturn
 * handle TARGET_QEMU_ESIGRETURN in the main loop as the indication
   that the main loop should not touch any guest CPU state

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
Reviewed-by: Peter Maydell <[email protected]>
[PMM: tweak commit message; drop TARGET_USE_ERESTARTSYS define]
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Support for restarting system calls for OpenRISC targets
Timothy E Baldwin [Thu, 12 May 2016 17:47:38 +0000 (18:47 +0100)]
linux-user: Support for restarting system calls for OpenRISC targets

Update the OpenRISC main loop code:
 * on TARGET_ERESTARTSYS, wind guest PC backwards to repeat syscall insn
 * handle TARGET_QEMU_ESIGRETURN in the main loop as the indication
   that the main loop should not touch any guest CPU state

(We don't implement sigreturn on this target so there is no
code there to update.)

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
Reviewed-by: Peter Maydell <[email protected]>
[PMM: tweak commit message; drop TARGET_USE_ERESTARTSYS define]
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Support for restarting system calls for UniCore32 targets
Timothy E Baldwin [Thu, 12 May 2016 17:47:37 +0000 (18:47 +0100)]
linux-user: Support for restarting system calls for UniCore32 targets

Update the UniCore32 main loop code:
 * on TARGET_ERESTARTSYS, wind guest PC backwards to repeat syscall insn
 * handle TARGET_QEMU_ESIGRETURN in the main loop as the indication
   that the main loop should not touch any guest CPU state

(We don't support signals on this target so there is no sigreturn code
to update.)

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
Reviewed-by: Peter Maydell <[email protected]>
[PMM: tweak commit message; drop TARGET_USE_ERESTARTSYS define]
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Support for restarting system calls for Alpha targets
Timothy E Baldwin [Thu, 12 May 2016 17:47:36 +0000 (18:47 +0100)]
linux-user: Support for restarting system calls for Alpha targets

Update the Alpha main loop and sigreturn code:
 * on TARGET_ERESTARTSYS, wind guest PC backwards to repeat syscall insn
 * handle TARGET_QEMU_ESIGRETURN in the main loop as the indication
   that the main loop should not touch any guest CPU state

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
Reviewed-by: Peter Maydell <[email protected]>
[PMM: tweak commit message; drop TARGET_USE_ERESTARTSYS define;
 PC is env->pc, not env->ir[IR_PV]]
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Support for restarting system calls for SH4 targets
Timothy E Baldwin [Thu, 12 May 2016 17:47:35 +0000 (18:47 +0100)]
linux-user: Support for restarting system calls for SH4 targets

Update the SH4 main loop and sigreturn code:
 * on TARGET_ERESTARTSYS, wind guest PC backwards to repeat syscall insn
 * set all guest CPU state within signal.c code on sigreturn
 * handle TARGET_QEMU_ESIGRETURN in the main loop as the indication
   that the main loop should not touch any guest CPU state

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
Reviewed-by: Peter Maydell <[email protected]>
[PMM: tweak commit message; drop TARGET_USE_ERESTARTSYS define]
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Support for restarting system calls for SPARC targets
Timothy E Baldwin [Thu, 12 May 2016 17:47:34 +0000 (18:47 +0100)]
linux-user: Support for restarting system calls for SPARC targets

Update the SPARC main loop and sigreturn code:
 * on TARGET_ERESTARTSYS, wind guest PC backwards to repeat syscall insn
 * set all guest CPU state within signal.c code on sigreturn
 * handle TARGET_QEMU_ESIGRETURN in the main loop as the indication
   that the main loop should not touch any guest CPU state

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
[PMM: Commit message tweaks; drop TARGET_USE_ERESTARTSYS define]
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Support for restarting system calls for PPC targets
Timothy E Baldwin [Thu, 12 May 2016 17:47:33 +0000 (18:47 +0100)]
linux-user: Support for restarting system calls for PPC targets

Update the PPC main loop code:
 * on TARGET_ERESTARTSYS, wind guest PC backwards to repeat syscall insn

(We already handle TARGET_QEMU_ESIGRETURN.)

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
Reviewed-by: Peter Maydell <[email protected]>
[PMM: tweak commit message; drop TARGET_USE_ERESTARTSYS define]
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Support for restarting system calls for MIPS targets
Timothy E Baldwin [Thu, 12 May 2016 17:47:32 +0000 (18:47 +0100)]
linux-user: Support for restarting system calls for MIPS targets

Update the MIPS main loop code:
 * on TARGET_ERESTARTSYS, wind guest PC backwards to repeat syscall insn

(We already handle TARGET_QEMU_ESIGRETURN.)

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
Reviewed-by: Peter Maydell <[email protected]>
[PMM: tweak commit message; drop TARGET_USE_ERESTARTSYS define]
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Support for restarting system calls for ARM targets
Timothy E Baldwin [Thu, 12 May 2016 17:47:31 +0000 (18:47 +0100)]
linux-user: Support for restarting system calls for ARM targets

Update the 32-bit and 64-bit ARM main loop and sigreturn code:
 * on TARGET_ERESTARTSYS, wind guest PC backwards to repeat syscall insn
 * set all guest CPU state within signal.c code on sigreturn
 * handle TARGET_QEMU_ESIGRETURN in the main loop as the indication
   that the main loop should not touch any guest CPU state

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
Reviewed-by: Peter Maydell <[email protected]>
[PMM: tweak commit message; drop TARGET_USE_ERESTARTSYS define]
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Support for restarting system calls for x86 targets
Timothy E Baldwin [Thu, 12 May 2016 17:47:30 +0000 (18:47 +0100)]
linux-user: Support for restarting system calls for x86 targets

Update the x86 main loop and sigreturn code:
 * on TARGET_ERESTARTSYS, wind guest PC backwards to repeat syscall insn
 * set all guest CPU state within signal.c code rather than passing it
   back out as the "return code" from do_sigreturn()
 * handle TARGET_QEMU_ESIGRETURN in the main loop as the indication
   that the main loop should not touch EAX

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
Reviewed-by: Peter Maydell <[email protected]>
[PMM: Commit message tweaks; drop TARGET_USE_ERESTARTSYS define]
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Renumber TARGET_QEMU_ESIGRETURN, make it not arch-specific
Timothy E Baldwin [Thu, 12 May 2016 17:47:29 +0000 (18:47 +0100)]
linux-user: Renumber TARGET_QEMU_ESIGRETURN, make it not arch-specific

Currently we define a QEMU-internal errno TARGET_QEMU_ESIGRETURN
only on the MIPS and PPC targets; move this to errno_defs.h
so it is available for all architectures, and renumber it to 513.
We pick 513 because this is safe from future use as a system call return
value: Linux uses it as ERESTART_NOINTR internally and never allows that
errno to escape to userspace.

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
[PMM: TARGET_ERESTARTSYS split out into preceding patch, add comment]
Reviewed-by: Peter Maydell <[email protected]>
Reviewed-by: Laurent Vivier <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Define TARGET_ERESTART* errno values
Timothy E Baldwin [Thu, 12 May 2016 17:47:28 +0000 (18:47 +0100)]
linux-user: Define TARGET_ERESTART* errno values

Define TARGET_ERESTARTSYS; like the kernel, we will use this to
indicate that a guest system call should be restarted. We use
the same value the kernel does for this, 512.

Signed-off-by: Timothy Edward Baldwin <[email protected]>
[PMM: split out from the patch which moves and renumbers
 TARGET_QEMU_ESIGRETURN, add comment on usage]
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Reindent signal handling
Timothy E Baldwin [Thu, 12 May 2016 17:47:27 +0000 (18:47 +0100)]
linux-user: Reindent signal handling

Some of the signal handling was a mess with a mixture of tabs and 8 space
indents.

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
Reviewed-by: Peter Maydell <[email protected]>
[PMM: just rebased]
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
8 years agolinux-user: Consistently return host errnos from do_openat()
Peter Maydell [Thu, 12 May 2016 17:47:26 +0000 (18:47 +0100)]
linux-user: Consistently return host errnos from do_openat()

The function do_openat() is not consistent about whether it is
returning a host errno or a guest errno in case of failure.
Standardise on returning -1 with errno set (ie caller has
to call get_errno()).

Signed-off-by: Peter Maydell <[email protected]>
Reported-by: Timothy Edward Baldwin <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
Reviewed-by: Laurent Vivier <[email protected]>
8 years agolinux-user: Check array bounds in errno conversion
Timothy E Baldwin [Thu, 12 May 2016 17:47:25 +0000 (18:47 +0100)]
linux-user: Check array bounds in errno conversion

Check array bounds in host_to_target_errno() and target_to_host_errno().

Signed-off-by: Timothy Edward Baldwin <[email protected]>
Message-id: 1441497448[email protected]
[PMM: Add a lower-bound check, use braces on if(), tweak commit message]
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Riku Voipio <[email protected]>
Reviewed-by: Laurent Vivier <[email protected]>
8 years agoMerge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging
Peter Maydell [Tue, 24 May 2016 12:06:32 +0000 (13:06 +0100)]
Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

X86 queue, 2016-05-23

# gpg: Signature made Mon 23 May 2016 23:48:27 BST using RSA key ID 984DC5A6
# gpg: Good signature from "Eduardo Habkost <[email protected]>"

* remotes/ehabkost/tags/x86-pull-request:
  target-i386: kvm: Eliminate kvm_msr_entry_set()
  target-i386: kvm: Simplify MSR setting functions
  target-i386: kvm: Simplify MSR array construction
  target-i386: kvm: Increase MSR_BUF_SIZE
  target-i386: kvm: Allocate kvm_msrs struct once per VCPU
  target-i386: Call cpu_exec_init() on realize
  target-i386: Move TCG initialization to realize time
  target-i386: Move TCG initialization check to tcg_x86_init()
  cpu: Eliminate cpudef_init(), cpudef_setup()
  target-i386: Set constant model_id for qemu64/qemu32/athlon
  pc: Set CPU model-id on compat_props for pc <= 2.4
  osdep: Move default qemu_hw_version() value to a macro
  target-i386: kvm: Use X86XSaveArea struct for xsave save/load
  target-i386: Use xsave structs for ext_save_area
  target-i386: Define structs for layout of xsave area

Signed-off-by: Peter Maydell <[email protected]>
8 years agoMerge remote-tracking branch 'remotes/amit-migration/tags/migration-2.7-1' into staging
Peter Maydell [Tue, 24 May 2016 11:21:07 +0000 (12:21 +0100)]
Merge remote-tracking branch 'remotes/amit-migration/tags/migration-2.7-1' into staging

migration fixes:

- ensure src block devices continue fine after a failed migration
- fail on migration blockers; helps 9p savevm/loadvm
- move autoconverge commands out of experimental state
- move the migration-specific qjson in migration/

# gpg: Signature made Mon 23 May 2016 18:15:09 BST using RSA key ID 657EF670
# gpg: Good signature from "Amit Shah <[email protected]>"
# gpg:                 aka "Amit Shah <[email protected]>"
# gpg:                 aka "Amit Shah <[email protected]>"

* remotes/amit-migration/tags/migration-2.7-1:
  migration: regain control of images when migration fails to complete
  savevm: fail if migration blockers are present
  migration: Promote improved autoconverge commands out of experimental state
  migration/qjson: Drop gratuitous use of QOM
  migration: Move qjson.[ch] to migration/

Signed-off-by: Peter Maydell <[email protected]>
8 years agoMerge remote-tracking branch 'remotes/amit-virtio-rng/tags/rng-2.7-1' into staging
Peter Maydell [Tue, 24 May 2016 10:38:22 +0000 (11:38 +0100)]
Merge remote-tracking branch 'remotes/amit-virtio-rng/tags/rng-2.7-1' into staging

rng: rename RndRandom to RndRandom

# gpg: Signature made Mon 23 May 2016 16:44:58 BST using RSA key ID 657EF670
# gpg: Good signature from "Amit Shah <[email protected]>"
# gpg:                 aka "Amit Shah <[email protected]>"
# gpg:                 aka "Amit Shah <[email protected]>"

* remotes/amit-virtio-rng/tags/rng-2.7-1:
  rng-random: rename RndRandom to RngRandom

Signed-off-by: Peter Maydell <[email protected]>
8 years agoMerge remote-tracking branch 'remotes/xtensa/tags/20160523-opencores_eth' into staging
Peter Maydell [Tue, 24 May 2016 09:19:45 +0000 (10:19 +0100)]
Merge remote-tracking branch 'remotes/xtensa/tags/20160523-opencores_eth' into staging

opencores_eth cleanups:
- use mii.h
- reduce stack usage in open_eth_start_xmit.

# gpg: Signature made Mon 23 May 2016 20:14:20 BST using RSA key ID F83FA044
# gpg: Good signature from "Max Filippov <[email protected]>"
# gpg:                 aka "Max Filippov <[email protected]>"

* remotes/xtensa/tags/20160523-opencores_eth:
  hw/net/opencores_eth: Allocating Large sized arrays to heap
  hw/net/opencores_eth: use mii.h

Signed-off-by: Peter Maydell <[email protected]>
8 years agotarget-i386: kvm: Eliminate kvm_msr_entry_set()
Eduardo Habkost [Wed, 16 Dec 2015 19:06:46 +0000 (17:06 -0200)]
target-i386: kvm: Eliminate kvm_msr_entry_set()

Inline the function inside kvm_msr_entry_add().

Reviewed-by: Paolo Bonzini <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
8 years agotarget-i386: kvm: Simplify MSR setting functions
Eduardo Habkost [Wed, 16 Dec 2015 19:06:45 +0000 (17:06 -0200)]
target-i386: kvm: Simplify MSR setting functions

Simplify kvm_put_tscdeadline_msr() and
kvm_put_msr_feature_control() using kvm_msr_buf and the
kvm_msr_entry_add() helper.

Reviewed-by: Paolo Bonzini <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
8 years agotarget-i386: kvm: Simplify MSR array construction
Eduardo Habkost [Wed, 16 Dec 2015 19:06:44 +0000 (17:06 -0200)]
target-i386: kvm: Simplify MSR array construction

Add a helper function that appends new entries to the MSR buffer
and checks for the buffer size limit.

Reviewed-by: Paolo Bonzini <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
8 years agotarget-i386: kvm: Increase MSR_BUF_SIZE
Eduardo Habkost [Wed, 16 Dec 2015 19:06:43 +0000 (17:06 -0200)]
target-i386: kvm: Increase MSR_BUF_SIZE

We are dangerously close to the array limits in kvm_put_msrs()
and kvm_get_msrs(): with the default mcg_cap configuration, we
can set up to 148 MSRs in kvm_put_msrs(), and if we allow mcg_cap
to be changed, we can write up to 236 MSRs.

Use 4096 bytes for the buffer, that can hold 255 kvm_msr_entry
structs.

Reviewed-by: Paolo Bonzini <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
8 years agotarget-i386: kvm: Allocate kvm_msrs struct once per VCPU
Eduardo Habkost [Wed, 16 Dec 2015 19:06:42 +0000 (17:06 -0200)]
target-i386: kvm: Allocate kvm_msrs struct once per VCPU

Instead of using 2400 bytes in the stack for 150 MSR entries in
kvm_get_msrs() and kvm_put_msrs(), allocate a buffer once for
each VCPU.

Reviewed-by: Paolo Bonzini <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
8 years agotarget-i386: Call cpu_exec_init() on realize
Eduardo Habkost [Fri, 13 Feb 2015 01:04:50 +0000 (23:04 -0200)]
target-i386: Call cpu_exec_init() on realize

QOM instance_init functions are not supposed to have any side-effects,
as new objects may be created at any moment for querying property
information (see qmp_device_list_properties()).

Calling cpu_exec_init() also affects QEMU's ability to handle errors
during CPU creation, as some actions done by cpu_exec_init() can't be
reverted.

Move cpu_exec_init() call to realize so a simple object_new() won't
trigger it, and so that it is called after some basic validation of CPU
parameters.

Reviewed-by: Igor Mammedov <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
8 years agotarget-i386: Move TCG initialization to realize time
Eduardo Habkost [Fri, 13 Feb 2015 00:57:44 +0000 (22:57 -0200)]
target-i386: Move TCG initialization to realize time

QOM instance_init functions are not supposed to have any side-effects,
as new objects may be created at any moment for querying property
information (see qmp_device_list_properties()).

Move TCG initialization to realize time so it won't be called when just
doing object_new() on a X86CPU subclass.

Reviewed-by: Igor Mammedov <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
8 years agotarget-i386: Move TCG initialization check to tcg_x86_init()
Eduardo Habkost [Thu, 5 Mar 2015 16:43:16 +0000 (13:43 -0300)]
target-i386: Move TCG initialization check to tcg_x86_init()

Instead of requiring cpu.c to check if TCG was already initialized,
simply let the function be called multiple times.

Suggested-by: Igor Mammedov <[email protected]>
Reviewed-by: Igor Mammedov <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
8 years agocpu: Eliminate cpudef_init(), cpudef_setup()
Eduardo Habkost [Fri, 30 Oct 2015 20:10:57 +0000 (18:10 -0200)]
cpu: Eliminate cpudef_init(), cpudef_setup()

x86_cpudef_init() doesn't do anything anymore, cpudef_init(),
cpudef_setup(), and x86_cpudef_init() can be finally removed.

Signed-off-by: Eduardo Habkost <[email protected]>
8 years agotarget-i386: Set constant model_id for qemu64/qemu32/athlon
Eduardo Habkost [Sat, 9 Apr 2016 19:44:20 +0000 (16:44 -0300)]
target-i386: Set constant model_id for qemu64/qemu32/athlon

Newer PC machines don't set hw_version, and older machines set
model-id on compat_props explicitly, so we don't need the
x86_cpudef_setup() code that sets model_id using
qemu_hw_version() anymore.

Signed-off-by: Eduardo Habkost <[email protected]>
8 years agohw/net/opencores_eth: Allocating Large sized arrays to heap
Zhou Jie [Wed, 27 Apr 2016 02:07:48 +0000 (10:07 +0800)]
hw/net/opencores_eth: Allocating Large sized arrays to heap

open_eth_start_xmit has a huge stack usage of 65536 bytes approx.
Moving large arrays to heap to reduce stack usage.

Reduce size of a buffer allocated on stack to 0x600 bytes, which is the
maximal frame length when HUGEN bit is not set in MODER, only allocate
buffer on heap when that is too small. Thus heap is not used in typical
use case.

Signed-off-by: Zhou Jie <[email protected]>
Signed-off-by: Max Filippov <[email protected]>
8 years agohw/net/opencores_eth: use mii.h
Max Filippov [Sun, 3 Apr 2016 23:12:51 +0000 (02:12 +0300)]
hw/net/opencores_eth: use mii.h

Drop local definitions of MII registers and use constants from mii.h for
registers and register bits. No functional changes.

Signed-off-by: Max Filippov <[email protected]>
8 years agomigration: regain control of images when migration fails to complete
Greg Kurz [Wed, 18 May 2016 13:44:36 +0000 (15:44 +0200)]
migration: regain control of images when migration fails to complete

We currently have an error path during migration that can cause
the source QEMU to abort:

migration_thread()
  migration_completion()
    runstate_is_running() ----------------> true if guest is running
    bdrv_inactivate_all() ----------------> inactivate images
    qemu_savevm_state_complete_precopy()
     ... qemu_fflush()
           socket_writev_buffer() --------> error because destination fails
         qemu_fflush() -------------------> set error on migration stream
  migration_completion() -----------------> set migrate state to FAILED
migration_thread() -----------------------> break migration loop
  vm_start() -----------------------------> restart guest with inactive
                                            images

and you get:

qemu-system-ppc64: socket_writev_buffer: Got err=104 for (32768/18446744073709551615)
qemu-system-ppc64: /home/greg/Work/qemu/qemu-master/block/io.c:1342:bdrv_co_do_pwritev: Assertion `!(bs->open_flags & 0x0800)' failed.
Aborted (core dumped)

If we try postcopy with a similar scenario, we also get the writev error
message but QEMU leaves the guest paused because entered_postcopy is true.

We could possibly do the same with precopy and leave the guest paused.
But since the historical default for migration errors is to restart the
source, this patch adds a call to bdrv_invalidate_cache_all() instead.

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <146357896785.6003.11983081732454362715[email protected]>
Signed-off-by: Amit Shah <[email protected]>
8 years agopc: Set CPU model-id on compat_props for pc <= 2.4
Eduardo Habkost [Sat, 9 Apr 2016 19:26:38 +0000 (16:26 -0300)]
pc: Set CPU model-id on compat_props for pc <= 2.4

Instead of relying on x86_cpudef_setup() calling
qemu_hw_version(), just make old machines set model-id explicitly
on compat_props for qemu64, qemu32, and athlon. This will allow
us to eliminate x86_cpudef_setup() later.

Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
8 years agoosdep: Move default qemu_hw_version() value to a macro
Eduardo Habkost [Sat, 9 Apr 2016 19:42:44 +0000 (16:42 -0300)]
osdep: Move default qemu_hw_version() value to a macro

The macro will be used by code that will stop calling
qemu_hw_version() at runtime and just need a constant value.

Signed-off-by: Eduardo Habkost <[email protected]>
8 years agotarget-i386: kvm: Use X86XSaveArea struct for xsave save/load
Eduardo Habkost [Mon, 23 Nov 2015 12:43:26 +0000 (10:43 -0200)]
target-i386: kvm: Use X86XSaveArea struct for xsave save/load

Instead of using offset macros and bit operations in a uint32_t
array, use the X86XSaveArea struct to perform the loading/saving
operations in kvm_put_xsave() and kvm_get_xsave().

Signed-off-by: Eduardo Habkost <[email protected]>
8 years agotarget-i386: Use xsave structs for ext_save_area
Eduardo Habkost [Sat, 28 Nov 2015 16:32:26 +0000 (14:32 -0200)]
target-i386: Use xsave structs for ext_save_area

This doesn't introduce any change in the code, as the offsets and
struct sizes match what was present in the table. This can be
validated by the QEMU_BUILD_BUG_ON lines on target-i386/cpu.h,
which ensures the struct sizes and offsets match the existing
values in ext_save_area.

Signed-off-by: Eduardo Habkost <[email protected]>
8 years agotarget-i386: Define structs for layout of xsave area
Eduardo Habkost [Thu, 19 Nov 2015 18:52:33 +0000 (16:52 -0200)]
target-i386: Define structs for layout of xsave area

Add structs that define the layout of the xsave areas used by
Intel processors. Add some QEMU_BUILD_BUG_ON lines to ensure the
structs match the XSAVE_* macros in target-i386/kvm.c and the
offsets and sizes at target-i386/cpu.c:ext_save_areas.

Signed-off-by: Eduardo Habkost <[email protected]>
8 years agosavevm: fail if migration blockers are present
Greg Kurz [Wed, 4 May 2016 19:44:19 +0000 (21:44 +0200)]
savevm: fail if migration blockers are present

QEMU has currently two ways to prevent migration to occur:
- migration blocker when it depends on runtime state
- VMStateDescription.unmigratable when migration is not supported at all

This patch gathers all the logic into a single function to be called from
both the savevm and the migrate paths.

This fixes a bug with 9p, at least, where savevm would succeed and the
following would happen in the guest after loadvm:

$ ls /host
ls: cannot access /host: Protocol error

With this patch:

(qemu) savevm foo
Migration is disabled when VirtFS export path '/' is mounted in the guest
using mount_tag 'host'

Signed-off-by: Greg Kurz <[email protected]>
Reviewed-by: Paolo Bonzini <[email protected]>
Message-Id: <146239057139.11271.9011797645454781543[email protected]>

[Update subject according to Paolo's suggestion - Amit]

Signed-off-by: Amit Shah <[email protected]>
8 years agoMerge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging
Peter Maydell [Mon, 23 May 2016 15:15:51 +0000 (16:15 +0100)]
Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

* NMI cleanups (Bandan)
* RAMBlock/Memory cleanups and fixes (Dominik, Gonglei, Fam, me)
* first part of linuxboot support for fw_cfg DMA (Richard)
* IOAPIC fix (Peter Xu)
* iSCSI SG_IO fix (Vadim)
* Various infrastructure bug fixes (Zhijian, Peter M., Stefan)
* CVE fixes (Prasad)

# gpg: Signature made Mon 23 May 2016 16:06:18 BST using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <[email protected]>"
# gpg:                 aka "Paolo Bonzini <[email protected]>"

* remotes/bonzini/tags/for-upstream: (24 commits)
  cpus: call the core nmi injection function
  nmi: remove x86 specific nmi handling
  target-i386: add a generic x86 nmi handler
  coccinelle: add g_assert_cmp* to macro file
  iscsi: pass SCSI status back for SG_IO
  esp: check dma length before reading scsi command(CVE-2016-4441)
  esp: check command buffer length before write(CVE-2016-4439)
  scripts/signrom.py: Check for magic in option ROMs.
  scripts/signrom.py: Allow option ROM checksum script to write the size header.
  Remove config-devices.mak on 'make clean'
  cpus.c: Use pthread_sigmask() rather than sigprocmask()
  memory: remove unnecessary masking of MemoryRegion ram_addr
  memory: Drop FlatRange.romd_mode
  memory: Remove code for mr->may_overlap
  exec: adjust rcu_read_lock requirement
  memory: drop find_ram_block()
  vl: change runstate only if new state is different from current state
  ioapic: clear remote irr bit for edge-triggered interrupts
  ioapic: keep RO bits for IOAPIC entry
  target-i386: key sfence availability on CPUID_SSE, not CPUID_SSE2
  ...

Signed-off-by: Peter Maydell <[email protected]>
8 years agocpus: call the core nmi injection function
Bandan Das [Fri, 20 May 2016 16:28:37 +0000 (12:28 -0400)]
cpus: call the core nmi injection function

We can call the common function here directly since
x86 specific actions will be taken care of by the arch
specific nmi handler

Signed-off-by: Bandan Das <[email protected]>
Message-Id: <1463761717[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agonmi: remove x86 specific nmi handling
Bandan Das [Fri, 20 May 2016 16:28:36 +0000 (12:28 -0400)]
nmi: remove x86 specific nmi handling

nmi_monitor_handle is wired to call the x86 nmi
handler. So, we can directly use it at call sites.

Signed-off-by: Bandan Das <[email protected]>
Message-Id: <1463761717[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agotarget-i386: add a generic x86 nmi handler
Bandan Das [Fri, 20 May 2016 16:28:35 +0000 (12:28 -0400)]
target-i386: add a generic x86 nmi handler

Instead of having x86 ifdefs in core nmi code, this
change adds a arch specific handler that the nmi common
code can call.

Signed-off-by: Bandan Das <[email protected]>
Message-Id: <1463761717[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agococcinelle: add g_assert_cmp* to macro file
Paolo Bonzini [Wed, 18 May 2016 09:11:55 +0000 (11:11 +0200)]
coccinelle: add g_assert_cmp* to macro file

This helps applying semantic patches to unit tests.

Signed-off-by: Paolo Bonzini <[email protected]>
8 years agoiscsi: pass SCSI status back for SG_IO
Vadim Rozenfeld [Fri, 13 May 2016 11:03:22 +0000 (13:03 +0200)]
iscsi: pass SCSI status back for SG_IO

Signed-off-by: Vadim Rozenfeld <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agoesp: check dma length before reading scsi command(CVE-2016-4441)
Prasad J Pandit [Thu, 19 May 2016 10:39:31 +0000 (16:09 +0530)]
esp: check dma length before reading scsi command(CVE-2016-4441)

The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte
FIFO buffer. It is used to handle command and data transfer.
Routine get_cmd() uses DMA to read scsi commands into this buffer.
Add check to validate DMA length against buffer size to avoid any
overrun.

Fixes CVE-2016-4441.

Reported-by: Li Qiang <[email protected]>
Cc: [email protected]
Signed-off-by: Prasad J Pandit <[email protected]>
Message-Id: <1463654371[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agoesp: check command buffer length before write(CVE-2016-4439)
Prasad J Pandit [Thu, 19 May 2016 10:39:30 +0000 (16:09 +0530)]
esp: check command buffer length before write(CVE-2016-4439)

The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte
FIFO buffer. It is used to handle command and data transfer. While
writing to this command buffer 's->cmdbuf[TI_BUFSZ=16]', a check
was missing to validate input length. Add check to avoid OOB write
access.

Fixes CVE-2016-4439.

Reported-by: Li Qiang <[email protected]>
Cc: [email protected]
Signed-off-by: Prasad J Pandit <[email protected]>
Message-Id: <1463654371[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agoscripts/signrom.py: Check for magic in option ROMs.
Richard W.M. Jones [Wed, 11 May 2016 21:06:46 +0000 (22:06 +0100)]
scripts/signrom.py: Check for magic in option ROMs.

Because of the risk that compilers might not emit the asm() block at
the beginning of the option ROM, check that the ROM contains the
required magic signature.

Signed-off-by: Richard W.M. Jones <[email protected]>
Message-Id: <1463000807[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agoscripts/signrom.py: Allow option ROM checksum script to write the size header.
Richard W.M. Jones [Wed, 11 May 2016 21:06:45 +0000 (22:06 +0100)]
scripts/signrom.py: Allow option ROM checksum script to write the size header.

Modify the signrom.py script so that if the size byte in the header is
0 (ie. not set) then the script will set the size.  If the size byte
is non-zero then we do the same as before, so this doesn't require
changes to any existing ROM sourcecode.

Signed-off-by: Richard W.M. Jones <[email protected]>
Message-Id: <1463000807[email protected]>

8 years agoRemove config-devices.mak on 'make clean'
Peter Maydell [Tue, 17 May 2016 11:27:31 +0000 (12:27 +0100)]
Remove config-devices.mak on 'make clean'

Our dependency mechanism works like this:
 * on first build there is neither a .o nor a .d
 * we create the .d as a side effect of creating the .o
 * for rebuilds we know when we need to update the .o,
   which also updates the .d

This system requires that you're never in a situation where there is
a .o file but no .d (because then we will never realise we need to
build the .d, and we will not have the dependency information about
when to rebuild the .o).

This is working fine for our object files, but we also try to use it
for $TARGET/config-devices.mak (where the dependency file is
in $TARGET-config-devices.mak.d). Unfortunately "make clean" doesn't
remove config-devices.mak, which means that it puts us in the
forbidden situation of "object file exists but not its .d file".
This in turn means that we will fail to notice when we need to rebuild:
  mkdir build/depbug
  (cd build/depbug && '../../configure')
  make -C build/depbug -j8
  make -C build/depbug clean
  echo "CONFIG_CANARY = y" >> default-configs/arm-softmmu.mak
  make -C build/depbug
  grep CANARY build/depbug/aarch64-softmmu/config-devices.mak

The CANARY token should show up in config-devices.mak but does not.

Fix this bug by making "make clean" delete the config-devices.mak files.
config-all-devices.mak doesn't have the same problem since it has
no .d file, but delete it too, since it is created by "make" and
logically should be removed by "make clean".

(Note that it is important not to remove config-devices.mak until
after we have recursively run 'make clean' in the subdirectories.)

Signed-off-by: Peter Maydell <[email protected]>
Message-Id: <1463484451[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agocpus.c: Use pthread_sigmask() rather than sigprocmask()
Peter Maydell [Mon, 16 May 2016 17:33:59 +0000 (18:33 +0100)]
cpus.c: Use pthread_sigmask() rather than sigprocmask()

On Linux, sigprocmask() and pthread_sigmask() are in practice the
same thing (they only set the signal mask for the calling thread),
but the documentation states that the behaviour of sigprocmask() in a
multithreaded process is undefined. Use pthread_sigmask() instead
(which is what we do in almost all places in QEMU that alter the
signal mask already).

Signed-off-by: Peter Maydell <[email protected]>
Message-Id: <1463420039[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agomemory: remove unnecessary masking of MemoryRegion ram_addr
Paolo Bonzini [Tue, 1 Mar 2016 09:44:50 +0000 (10:44 +0100)]
memory: remove unnecessary masking of MemoryRegion ram_addr

mr->ram_block->offset is already aligned to both host and target size
(see qemu_ram_alloc_internal).  Remove further masking as it is
unnecessary.

Reviewed-by: Fam Zheng <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agomemory: Drop FlatRange.romd_mode
Fam Zheng [Fri, 25 Mar 2016 10:10:29 +0000 (18:10 +0800)]
memory: Drop FlatRange.romd_mode

Its value is alway set to mr->romd_mode, so the removed comparisons are
fully superseded by "a->mr == b->mr".

Signed-off-by: Fam Zheng <[email protected]>
Message-Id: <1458900629[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agomemory: Remove code for mr->may_overlap
Fam Zheng [Fri, 25 Mar 2016 10:10:28 +0000 (18:10 +0800)]
memory: Remove code for mr->may_overlap

The collision check does nothing and hasn't been used. Remove the
variable together with related code.

Signed-off-by: Fam Zheng <[email protected]>
Message-Id: <1458900629[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agoexec: adjust rcu_read_lock requirement
Gonglei [Tue, 10 May 2016 02:05:00 +0000 (10:05 +0800)]
exec: adjust rcu_read_lock requirement

qemu_ram_unset_idstr() doesn't need rcu lock anymore,
meanwhile make the range of rcu lock in
qemu_ram_set_idstr() as small as possible.

Signed-off-by: Gonglei <[email protected]>
Message-Id: <1462845901[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agomemory: drop find_ram_block()
Gonglei [Tue, 10 May 2016 02:04:59 +0000 (10:04 +0800)]
memory: drop find_ram_block()

On the one hand, we have already qemu_get_ram_block() whose function
is similar. On the other hand, we can directly use mr->ram_block but
searching RAMblock by ram_addr which is a kind of waste.

Signed-off-by: Gonglei <[email protected]>
Reviewed-by: Fam Zheng <[email protected]>
Message-Id: <1462845901[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agovl: change runstate only if new state is different from current state
Li Zhijian [Thu, 14 Apr 2016 03:25:52 +0000 (11:25 +0800)]
vl: change runstate only if new state is different from current state

Previously, qemu will abort at following scenario:
(qemu) stop
(qemu) system_reset
(qemu) system_reset
(qemu) 2016-04-13T20:54:38.979158Z qemu-system-x86_64: invalid runstate transition: 'prelaunch' -> 'prelaunch'

Signed-off-by: Li Zhijian <[email protected]>
Acked-by: Paolo Bonzini <[email protected]>
Message-Id: <1460604352[email protected]>
Cc: [email protected]
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agoioapic: clear remote irr bit for edge-triggered interrupts
Peter Xu [Tue, 10 May 2016 10:21:22 +0000 (18:21 +0800)]
ioapic: clear remote irr bit for edge-triggered interrupts

This is to better emulate IOAPIC version 0x1X hardware. Linux kernel
leveraged this "feature" to do explicit EOI since EOI register is still
not introduced at that time. This will also fix the issue that level
triggered interrupts failed to work when IR enabled (tested with Linux
kernel version 4.5).

Reviewed-by: Radim Krčmář <[email protected]>
Signed-off-by: Peter Xu <[email protected]>
Message-Id: <1462875682[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agoioapic: keep RO bits for IOAPIC entry
Peter Xu [Tue, 10 May 2016 10:21:21 +0000 (18:21 +0800)]
ioapic: keep RO bits for IOAPIC entry

Currently IOAPIC RO bits can be written. To be better aligned with
hardware, we should let them read-only.

Reviewed-by: Radim Krčmář <[email protected]>
Signed-off-by: Peter Xu <[email protected]>
Message-Id: <1462875682[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agotarget-i386: key sfence availability on CPUID_SSE, not CPUID_SSE2
Paolo Bonzini [Mon, 16 May 2016 09:11:29 +0000 (11:11 +0200)]
target-i386: key sfence availability on CPUID_SSE, not CPUID_SSE2

sfence was introduced before lfence and mfence.  This fixes Linux
2.4's measurement of checksumming speeds for the pIII_sse
algorithm:

md: linear personality registered as nr 1
md: raid0 personality registered as nr 2
md: raid1 personality registered as nr 3
md: raid5 personality registered as nr 4
raid5: measuring checksumming speed
   8regs     :   384.400 MB/sec
   32regs    :   259.200 MB/sec
invalid operand: 0000
CPU:    0
EIP:    0010:[<c0240b2a>]    Not tainted
EFLAGS: 00000246
eax: c15d8000   ebx: 00000000   ecx: 00000000   edx: c15d5000
esi: 8005003b   edi: 00000004   ebp: 00000000   esp: c15bdf50
ds: 0018   es: 0018   ss: 0018
Process swapper (pid: 1, stackpage=c15bd000)
Stack: 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000
       00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000
       00000000 00000206 c0241c6c 00001000 c15d4000 c15d7000 c15d4000
c15d4000
Call Trace:    [<c0241c6c>] [<c0105000>] [<c0241db4>] [<c010503b>]
[<c0105000>]
  [<c0107416>] [<c0105030>]

Code: 0f ae f8 0f 10 04 24 0f 10 4c 24 10 0f 10 54 24 20 0f 10 5c
 <0>Kernel panic: Attempted to kill init!

Reported-by: Stefan Weil <[email protected]>
Fixes: 121f3157887f92268a3d6169e2d4601f9292020b
Cc: [email protected]
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agoconfigure: Allow builds with extra warnings
Stefan Weil [Thu, 28 Apr 2016 21:33:41 +0000 (23:33 +0200)]
configure: Allow builds with extra warnings

The clang compiler supports a useful compiler option -Weverything,
and GCC also has other warnings not enabled by -Wall.

If glib header files trigger a warning, however, testing glib with
-Werror will always fail. A size mismatch is also detected without
-Werror, so simply remove it.

Cc: [email protected]
Signed-off-by: Stefan Weil <[email protected]>
Message-Id: <1461879221[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agoi386: kvmvapic: initialise imm32 variable
Prasad J Pandit [Thu, 7 Apr 2016 07:20:08 +0000 (12:50 +0530)]
i386: kvmvapic: initialise imm32 variable

When processing Task Priorty Register(TPR) access, it could leak
automatic stack variable 'imm32' in patch_instruction().
Initialise the variable to avoid it.

Reported by: Donghai Zdh <[email protected]>
Cc: [email protected]
Signed-off-by: Prasad J Pandit <[email protected]>
Message-Id: <1460013608[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agodocs/atomics.txt: Update pointer to linux macro
Pranith Kumar [Mon, 2 May 2016 14:20:52 +0000 (10:20 -0400)]
docs/atomics.txt: Update pointer to linux macro

Add a missing end brace and update doc to point to the latest access
macro. ACCESS_ONCE() is deprecated.

Signed-off-by: Pranith Kumar <[email protected]>
Message-Id: <1462198852[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agoexec.c: Ensure right alignment also for file backed ram
Dominik Dingel [Mon, 25 Apr 2016 11:55:38 +0000 (13:55 +0200)]
exec.c: Ensure right alignment also for file backed ram

While in the anonymous ram case we already take care of the right alignment
such an alignment gurantee does not exist for file backed ram allocation.

Instead, pagesize is used for alignment. On s390 this is not enough for gmap,
as we need to satisfy an alignment up to segments.

Reported-by: Halil Pasic <[email protected]>
Signed-off-by: Dominik Dingel <[email protected]>
Message-Id: <1461585338[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agoMerge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20160523-1' into staging
Peter Maydell [Mon, 23 May 2016 14:53:02 +0000 (15:53 +0100)]
Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20160523-1' into staging

usb: add xen pvUSB backend, add num-ports check to ohci.

# gpg: Signature made Mon 23 May 2016 14:02:25 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <[email protected]>"
# gpg:                 aka "Gerd Hoffmann <[email protected]>"
# gpg:                 aka "Gerd Hoffmann (private) <[email protected]>"

* remotes/kraxel/tags/pull-usb-20160523-1:
  usb/ohci: Fix crash with when specifying too many num-ports
  xen: add pvUSB backend
  xen: write information about supported backends
  xen: introduce dummy system device

Signed-off-by: Peter Maydell <[email protected]>
8 years agoMerge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20160523-1' into staging
Peter Maydell [Mon, 23 May 2016 13:50:40 +0000 (14:50 +0100)]
Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20160523-1' into staging

vga: fix CVE-2016-3712 regression, misc virtio-gpu fixes.

# gpg: Signature made Mon 23 May 2016 13:30:26 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <[email protected]>"
# gpg:                 aka "Gerd Hoffmann <[email protected]>"
# gpg:                 aka "Gerd Hoffmann (private) <[email protected]>"

* remotes/kraxel/tags/pull-vga-20160523-1:
  vga: add sr_vbe register set
  virtio-gpu: fix ui idx check
  virtio-gpu: use VIRTIO_GPU_MAX_SCANOUTS
  virtio-gpu: check max_outputs only
  virtio-gpu: check max_outputs value
  virtio-vga: propagate on gpu realized error
  virtio-gpu: check early scanout id

Signed-off-by: Peter Maydell <[email protected]>
8 years agousb/ohci: Fix crash with when specifying too many num-ports
Thomas Huth [Mon, 23 May 2016 09:23:07 +0000 (11:23 +0200)]
usb/ohci: Fix crash with when specifying too many num-ports

QEMU currently crashes when an OHCI controller is instantiated with
too many ports, e.g. "-device pci-ohci,num-ports=100,masterbus=1".
Thus add a proper check in usb_ohci_init() to make sure that we
do not use more than OHCI_MAX_PORTS = 15 ports here.

Ticket: https://bugs.launchpad.net/qemu/+bug/1581308
Signed-off-by: Thomas Huth <[email protected]>
Message-id: 1463995387[email protected]
Signed-off-by: Gerd Hoffmann <[email protected]>
8 years agovga: add sr_vbe register set
Gerd Hoffmann [Tue, 17 May 2016 08:54:54 +0000 (10:54 +0200)]
vga: add sr_vbe register set

Commit "fd3c136 vga: make sure vga register setup for vbe stays intact
(CVE-2016-3712)." causes a regression.  The win7 installer is unhappy
because it can't freely modify vga registers any more while in vbe mode.

This patch introduces a new sr_vbe register set.  The vbe_update_vgaregs
will fill sr_vbe[] instead of sr[].  Normal vga register reads and
writes go to sr[].  Any sr register read access happens through a new
sr() helper function which will read from sr_vbe[] with vbe active and
from sr[] otherwise.

This way we can allow guests update sr[] registers as they want, without
allowing them disrupt vbe video modes that way.

Cc: [email protected]
Reported-by: Thomas Lamprecht <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>
Message-id: 1463475294[email protected]

8 years agoxen: add pvUSB backend
Juergen Gross [Thu, 12 May 2016 14:13:41 +0000 (16:13 +0200)]
xen: add pvUSB backend

Add a backend for para-virtualized USB devices for xen domains.

The backend is using host-libusb to forward USB requests from a
domain via libusb to the real device(s) passed through.

Signed-off-by: Juergen Gross <[email protected]>
Acked-by: Anthony PERARD <[email protected]>
Message-id: 1463062421[email protected]
Signed-off-by: Gerd Hoffmann <[email protected]>
8 years agovirtio-gpu: fix ui idx check
Marc-André Lureau [Thu, 19 May 2016 10:26:00 +0000 (12:26 +0200)]
virtio-gpu: fix ui idx check

Fix off-by-one value check (0 is the first scanout).

Signed-off-by: Marc-André Lureau <[email protected]>
Message-id: 1463653560[email protected]
Signed-off-by: Gerd Hoffmann <[email protected]>
8 years agoxen: write information about supported backends
Juergen Gross [Thu, 12 May 2016 14:13:40 +0000 (16:13 +0200)]
xen: write information about supported backends

Add a Xenstore directory for each supported pv backend. This will allow
Xen tools to decide which backend type to use in case there are
multiple possibilities.

The information is added under
/local/domain/<backend-domid>/device-model/<domid>/backends
before the "running" state is written to Xenstore. Using a directory
for each backend enables us to add parameters for specific backends
in the future.

This interface is documented in the Xen source repository in the file
docs/misc/qemu-backends.txt

In order to reuse the Xenstore directory creation already present in
hw/xen/xen_devconfig.c move the related functions to
hw/xen/xen_backend.c where they fit better.

Signed-off-by: Juergen Gross <[email protected]>
Acked-by: Anthony PERARD <[email protected]>
Reviewed-by: Wei Liu <[email protected]>
Message-id: 1463062421[email protected]
Signed-off-by: Gerd Hoffmann <[email protected]>
8 years agovirtio-gpu: use VIRTIO_GPU_MAX_SCANOUTS
Marc-André Lureau [Thu, 19 May 2016 10:25:59 +0000 (12:25 +0200)]
virtio-gpu: use VIRTIO_GPU_MAX_SCANOUTS

The value is defined in virtio_gpu.h already (changing from 4 to 16).

Signed-off-by: Marc-André Lureau <[email protected]>
Message-id: 1463653560[email protected]
Signed-off-by: Gerd Hoffmann <[email protected]>
8 years agoxen: introduce dummy system device
Juergen Gross [Thu, 12 May 2016 14:13:39 +0000 (16:13 +0200)]
xen: introduce dummy system device

Introduce a new dummy system device serving as parent for virtual
buses. This will enable new pv backends to introduce virtual buses
which are removable again opposed to system buses which are meant
to stay once added.

Signed-off-by: Juergen Gross <[email protected]>
Acked-by: Anthony PERARD <[email protected]>
Reviewed-by: Wei Liu <[email protected]>
Message-id: 1463062421[email protected]
Signed-off-by: Gerd Hoffmann <[email protected]>
8 years agovirtio-gpu: check max_outputs only
Marc-André Lureau [Thu, 19 May 2016 10:25:58 +0000 (12:25 +0200)]
virtio-gpu: check max_outputs only

The scanout id should not be above the configured num_scanouts.

Signed-off-by: Marc-André Lureau <[email protected]>
Message-id: 1463653560[email protected]
Signed-off-by: Gerd Hoffmann <[email protected]>
8 years agovirtio-gpu: check max_outputs value
Marc-André Lureau [Thu, 19 May 2016 10:25:57 +0000 (12:25 +0200)]
virtio-gpu: check max_outputs value

The value must be less than VIRTIO_GPU_MAX_SCANOUT.

Signed-off-by: Marc-André Lureau <[email protected]>
Message-id: 1463653560[email protected]
Signed-off-by: Gerd Hoffmann <[email protected]>
8 years agovirtio-vga: propagate on gpu realized error
Marc-André Lureau [Thu, 19 May 2016 10:25:56 +0000 (12:25 +0200)]
virtio-vga: propagate on gpu realized error

Signed-off-by: Marc-André Lureau <[email protected]>
Message-id: 1463653560[email protected]
Signed-off-by: Gerd Hoffmann <[email protected]>
8 years agovirtio-gpu: check early scanout id
Marc-André Lureau [Thu, 19 May 2016 10:25:55 +0000 (12:25 +0200)]
virtio-gpu: check early scanout id

Before accessing the g->scanout array, in order to avoid potential
out-of-bounds access.

Signed-off-by: Marc-André Lureau <[email protected]>
Message-id: 1463653560[email protected]
Signed-off-by: Gerd Hoffmann <[email protected]>
8 years agomigration: Promote improved autoconverge commands out of experimental state
Jason J. Herne [Thu, 21 Apr 2016 18:07:18 +0000 (14:07 -0400)]
migration: Promote improved autoconverge commands out of experimental state

The new autoconverge throttling commands have been tested for a release now. It
is time to move them out of the experimental state.

Signed-off-by: Jason J. Herne <[email protected]>
Message-Id: <1461262038[email protected]>
Signed-off-by: Amit Shah <[email protected]>
8 years agoMerge remote-tracking branch 'remotes/ehabkost/tags/machine-pull-request' into staging
Peter Maydell [Mon, 23 May 2016 09:30:41 +0000 (10:30 +0100)]
Merge remote-tracking branch 'remotes/ehabkost/tags/machine-pull-request' into staging

Machine Core queue, 2016-05-20

# gpg: Signature made Fri 20 May 2016 21:26:49 BST using RSA key ID 984DC5A6
# gpg: Good signature from "Eduardo Habkost <[email protected]>"

* remotes/ehabkost/tags/machine-pull-request: (21 commits)
  Use &error_fatal when initializing crypto on qemu-{img,io,nbd}
  vl: Use &error_fatal when parsing monitor options
  vl: Use &error_fatal when parsing VNC options
  machine: add properties to compat_props incrementaly
  vl: Simplify global property registration
  vl: Make display_remote a local variable
  vl: Move DisplayType typedef to vl.c
  vl: Make display_type a local variable
  vl: Replace DT_NOGRAPHIC with machine option
  milkymist: Move DT_NOGRAPHIC check outside milkymist_tmu2_create()
  spice: Initialization stubs on qemu-spice.h
  gtk: Initialization stubs
  cocoa: cocoa_display_init() stub
  sdl: Initialization stubs
  curses: curses_display_init() stub
  vnc: Initialization stubs
  vl: Add DT_COCOA DisplayType value
  vl: Replace *_vga_available() functions with class_names field
  vl: Table-based select_vgahw()
  vl: Use exit(1) when requested VGA interface is unavailable
  ...

Signed-off-by: Peter Maydell <[email protected]>
8 years agomigration/qjson: Drop gratuitous use of QOM
Markus Armbruster [Wed, 4 May 2016 16:49:18 +0000 (18:49 +0200)]
migration/qjson: Drop gratuitous use of QOM

All the use of QOM buys us here is the ability to destroy the thing
with object_unref(OBJECT(vmdesc)).  Not worth the notational overhead.

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Message-Id: <1462380558[email protected]>
Signed-off-by: Amit Shah <[email protected]>
8 years agomigration: Move qjson.[ch] to migration/
Markus Armbruster [Wed, 4 May 2016 16:49:17 +0000 (18:49 +0200)]
migration: Move qjson.[ch] to migration/

Type QJSON lets you build JSON text.  Its interface mirrors (a subset
of) abstract JSON syntax.

QAPI output visitors also produce JSON text.  They assert their
preconditions and invariants, and therefore abort on incorrect use.

Contrastingly, QJSON does *not* detect incorrect use.  It happily
produces invalid JSON then.  This is what migration wants.

QJSON was designed for migration, and migration is its only user.
Move it to migration/ for proper coverage by MAINTAINERS, and to deter
accidental use outside migration.

[Pointed out by Eric: QJSON was added in commits 0457d07..b174257
 -- Amit]

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Message-Id: <1462380558[email protected]>
Signed-off-by: Amit Shah <[email protected]>
8 years agorng-random: rename RndRandom to RngRandom
Wei Jiangang [Fri, 15 Apr 2016 01:36:08 +0000 (09:36 +0800)]
rng-random: rename RndRandom to RngRandom

Usually, Random Number Generator is abbreviated to RNG/rng.
so replacing RndRandom with RngRandom seems more reasonable
and keep consistent with RngBackend.

Signed-off-by: Wei Jiangang <[email protected]>
Reviewed-by: Pankaj Gupta <[email protected]>
Message-Id: <1460684168[email protected]>
Signed-off-by: Amit Shah <[email protected]>
8 years agoUse &error_fatal when initializing crypto on qemu-{img,io,nbd}
Eduardo Habkost [Thu, 12 May 2016 14:10:04 +0000 (11:10 -0300)]
Use &error_fatal when initializing crypto on qemu-{img,io,nbd}

In addition to making the code simpler, this will replace the
long error messages:
  cannot initialize crypto: Unable to initialize GNUTLS library: [...]
  cannot initialize crypto: Unable to initialize gcrypt
with shorter messages:
  Unable to initialize GNUTLS library: [...]
  Unable to initialize gcrypt

Signed-off-by: Eduardo Habkost <[email protected]>
8 years agovl: Use &error_fatal when parsing monitor options
Eduardo Habkost [Thu, 12 May 2016 14:10:00 +0000 (11:10 -0300)]
vl: Use &error_fatal when parsing monitor options

Signed-off-by: Eduardo Habkost <[email protected]>
8 years agovl: Use &error_fatal when parsing VNC options
Eduardo Habkost [Thu, 12 May 2016 14:09:59 +0000 (11:09 -0300)]
vl: Use &error_fatal when parsing VNC options

Signed-off-by: Eduardo Habkost <[email protected]>
8 years agomachine: add properties to compat_props incrementaly
Igor Mammedov [Thu, 28 Jan 2016 10:58:08 +0000 (11:58 +0100)]
machine: add properties to compat_props incrementaly

Switch to adding compat properties incrementaly instead of
completly overwriting compat_props per machine type.
That removes data duplication which we have due to nested
[PC|SPAPR]_COMPAT_* macros.

It also allows to set default device properties from
default foo_machine_options() hook, which will be used
in following patch for putting VMGENID device as
a function if ISA bridge on pc/q35 machines.

Suggested-by: Eduardo Habkost <[email protected]>
Signed-off-by: Igor Mammedov <[email protected]>
Acked-by: Cornelia Huck <[email protected]>
Reviewed-by: Eduardo Habkost <[email protected]>
[ehabkost: Fixed CCW_COMPAT_* and PC_COMPAT_0_* defines]
Signed-off-by: Eduardo Habkost <[email protected]>
8 years agovl: Simplify global property registration
Eduardo Habkost [Thu, 28 Jan 2016 15:11:04 +0000 (13:11 -0200)]
vl: Simplify global property registration

There's no need to use qdev_prop_register_global_list() and an
array, if we are registering a single GlobalProperty struct. Use
qdev_prop_register_global() instead.

Reviewed-by: Igor Mammedov <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
8 years agovl: Make display_remote a local variable
Eduardo Habkost [Tue, 19 Apr 2016 19:55:28 +0000 (16:55 -0300)]
vl: Make display_remote a local variable

The variable is used only inside main(), so it can be local.

Signed-off-by: Eduardo Habkost <[email protected]>
8 years agovl: Move DisplayType typedef to vl.c
Eduardo Habkost [Tue, 19 Apr 2016 19:55:27 +0000 (16:55 -0300)]
vl: Move DisplayType typedef to vl.c

Now the type is only used inside vl.c and doesn't need to be in a
header file.

Signed-off-by: Eduardo Habkost <[email protected]>
8 years agovl: Make display_type a local variable
Eduardo Habkost [Tue, 19 Apr 2016 19:55:26 +0000 (16:55 -0300)]
vl: Make display_type a local variable

Now display_type is only used inside main(), and don't need to be a
global variable.

Signed-off-by: Eduardo Habkost <[email protected]>
8 years agovl: Replace DT_NOGRAPHIC with machine option
Eduardo Habkost [Tue, 19 Apr 2016 19:55:25 +0000 (16:55 -0300)]
vl: Replace DT_NOGRAPHIC with machine option

All DisplayType values are just UI options that don't affect any
hardware emulation code, except for DT_NOGRAPHIC. Replace
DT_NOGRAPHIC with DT_NONE plus a new "-machine graphics=on|off"
option, so hardware emulation code don't need to use the
display_type variable.

Cc: Michael Walle <[email protected]>
Cc: Blue Swirl <[email protected]>
Cc: Mark Cave-Ayland <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
8 years agomilkymist: Move DT_NOGRAPHIC check outside milkymist_tmu2_create()
Eduardo Habkost [Tue, 19 Apr 2016 19:55:24 +0000 (16:55 -0300)]
milkymist: Move DT_NOGRAPHIC check outside milkymist_tmu2_create()

DT_NOGRAPHIC handling will be moved to a MachineState field, and
it will be easier to change milkymist_init() to check that field.

Cc: Michael Walle <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
8 years agospice: Initialization stubs on qemu-spice.h
Eduardo Habkost [Tue, 19 Apr 2016 19:55:23 +0000 (16:55 -0300)]
spice: Initialization stubs on qemu-spice.h

This reduces the number of CONFIG_SPICE #ifdefs in vl.c.

Cc: Gerd Hoffmann <[email protected]>
Reviewed-by: Gerd Hoffmann <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
8 years agogtk: Initialization stubs
Eduardo Habkost [Tue, 19 Apr 2016 19:55:22 +0000 (16:55 -0300)]
gtk: Initialization stubs

This reduces the number of CONFIG_GTK #ifdefs in vl.c.

Signed-off-by: Eduardo Habkost <[email protected]>
8 years agococoa: cocoa_display_init() stub
Eduardo Habkost [Tue, 19 Apr 2016 19:55:21 +0000 (16:55 -0300)]
cocoa: cocoa_display_init() stub

One less #ifdef in vl.c.

Signed-off-by: Eduardo Habkost <[email protected]>
This page took 0.093495 seconds and 4 git commands to generate.