Commit Graph

9639 Commits

Author SHA1 Message Date
Marcelo Tosatti 1eeacd413a kvmclock: clock should count only if vm is running
kvmclock should not count while vm is paused, because:

1) if the vm is paused for long periods, timekeeping
math can overflow while converting the (large) clocksource
delta to nanoseconds.

2) Users rely on CLOCK_MONOTONIC to count run time, that is,
time which OS has been in a runnable state (see CLOCK_BOOTTIME).

Change kvmclock driver so as to save clock value when vm transitions
from runnable to stopped state, and to restore clock value from stopped
to runnable transition.

Cc: qemu-stable@nongnu.org
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 00f4d64ee7)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-08-12 17:21:01 -05:00
Christian Borntraeger 5e2053dd15 s390/ipl: Fix boot order
The latest ipl code adaptions collided with some of the virtio
refactoring rework. This resulted in always booting the first
disk. Let's fix booting from a given ID.
The new code also checks for command lines without bootindex to
avoid random behaviour when accessing dev_st (==0).

Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Alexander Graf <agraf@suse.de>
(cherry picked from commit 5c8ded6ef5)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-08-12 15:18:30 -05:00
Gerd Hoffmann 045ccf7056 usb-host-libusb: set USB_DEV_FLAG_IS_HOST
... like host-{linux,bsd}.c do.

Cc: qemu-stable@nongnu.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 628e54857a)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-08-12 15:15:49 -05:00
KONRAD Frederic 1e3043a702 virtio-scsi: forward scsibus for virtio-scsi-pci.
This fix a bug with scsi hotplug on virtio-scsi-pci:

As virtio-scsi-pci doesn't have any scsi bus, we need to forward scsi-hot-add
to the virtio-scsi-device plugged on the virtio-bus.

Cc: qemu-stable@nongnu.org
Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-08-12 15:11:49 -05:00
Anthony PERARD a678b16bb3 qxl: Fix QXLRam initialisation.
The qxl driver expect NULL for QXLRam.memory_configs, but this is never
initialized.

If memory is set to 0xc2c2.., it leads to a spice-critical error when
trying to start qxl.

Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit 329f97fc4f)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-08-12 14:58:42 -05:00
Peter Maydell 4bf0901ff8 arm/boot: Free dtb blob memory after use
The dtb blob returned by load_device_tree() is in memory allocated
with g_malloc(). Free it accordingly once we have copied its
contents into the guest memory. To make this easy, we need also to
clean up the error handling in load_dtb() so that we consistently
handle errors in the same way (by printing a message and then
returning -1, rather than either plowing on or exiting immediately).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Message-id: 1371209256-11408-1-git-send-email-peter.maydell@linaro.org
(cherry picked from commit c23045ded7)

Conflicts:

	hw/arm/boot.c

* updated to include #ifdef for CONFIG_FDT

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-08-12 14:44:19 -05:00
Christian Borntraeger 717086d0e8 s390/virtio-ccw: Fix virtio reset
On virtio reset we must reset the indicator to avoid stale interrupts,
e.g. after a reset.

Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
(cherry picked from commit 6504a93011)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-08-12 14:36:08 -05:00
Michael Roth cc0bd7ec83 wdt_i6300esb: fix vmstate versioning
When this VMSD was introduced it's version fields were set to
sizeof(I6300State), making them essentially random from build to build,
version to version.

To fix this, we lock in a high version id and low minimum version id to
support old->new migration from all prior versions of this device's
state. This should work since the device state has not changed since
its introduction.

The potentially breaks migration from 1.5+ to 1.5, but since the
versioning was essentially random prior to this patch, new->old
migration was not consistently functional to begin with.

Reported-by: Nicholas Thomas <nick@bytemark.co.uk>
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit c1990468d5)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-18 14:38:30 -05:00
Cole Robinson 12e5b2b5da virtio-rng: Fix crash with non-default backend
'default_backend' isn't always set, but 'rng' is, so use that.

$ ./x86_64-softmmu/qemu-system-x86_64 -object rng-random,id=rng0,filename=/dev/random -device virtio-rng-pci,rng=rng0
Segmentation fault (core dumped)

Regressed with virtio refactoring in 59ccd20a9a

CC: qemu-stable@nongnu.org
Signed-off-by: Cole Robinson <crobinso@redhat.com>
Acked-by: Amit Shah <amit.shah@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Message-id: bf4505014a0a941dbd3c62068f3cf2c496b69e6a.1370023944.git.crobinso@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 5b456438f5)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-18 13:03:12 -05:00
Stefan Hajnoczi 5e690bb974 vhost-scsi: fix k->set_guest_notifiers() NULL dereference
Coverity picked up a copy-paste bug.  In vhost_scsi_start() we check for
!k->set_guest_notifiers and error out.  The check probably got copied
but instead of erroring we actually use the function pointer!

Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Cc: Asias He <asias@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 0e22a2d189)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-18 12:59:44 -05:00
Pavel Hrdina 129db3679c scsi-disk: scsi-block device for scsi pass-through should not be removable
This patch adds a new SCSI_DISK_F_NO_REMOVABLE_DEVOPS feature. By this
feature we can set that the scsi-block (scsi pass-through) device will still
be removable from the guest side, but from monitor it cannot be removed.

Cc: qemu-stable@nongnu.org
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 18e673b8f3)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-18 12:58:11 -05:00
Pavel Hrdina 637d640fbb scsi-generic: check the return value of bdrv_aio_ioctl in execute_command
This fixes the bug introduced by this commit ad54ae80c7.
The bdrv_aio_ioctl() still could return null and we should return an error
in that case.

Cc: qemu-stable@nongnu.org
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit d836f8d35d)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-18 12:57:30 -05:00
Paolo Bonzini 9c4f5dd03a scsi-generic: fix sign extension of READ CAPACITY(10) data
Issuing the READ CAPACITY(10) command in the guest will cause QEMU
to update its knowledge of the maximum accessible LBA in the disk.
The recorded maximum LBA will be wrong if the disk is bigger than
1TB, because ldl_be_p returns a signed int.

When this is fixed, a latent bug will be unmasked.  If the READ
CAPACITY(10) command reported an overflow (0xFFFFFFFF), we must
not overwrite the previously-known maximum accessible LBA, or the guest
will fail to access the disk above the first 2TB.

Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 53254e569f)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-18 12:56:37 -05:00
Pavel Hrdina 3abd71cd98 scsi: reset cdrom tray statuses on scsi_disk_reset
Tray statuses should be also reset. Some guests may lock the tray and
right after resetting the guest it should be unlocked and closed. This
is done on power-on, reset and resume from suspend/hibernate on bare-metal.

This fix is already committed for IDE CD.
Check the commit a7f3d65b65.

Test results on bare-metal:
  - on reset/power-on the CD-ROM tray is closed even before the monitor
    is turned on
  - on resume from suspend/hibernate the tray is also closed before
    the monitor is turned on

From test results it seems that this behavior is OS and probably BIOS
independent.

Cc: qemu-stable@nongnu.org
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 7721c7f7c2)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-18 12:56:05 -05:00
Igor Mammedov 75e4aa9405 pc: Fix crash when attempting to hotplug CPU with negative ID
QMP command "{ 'execute': 'cpu-add', 'arguments': { 'id': -1 }}" may cause
QEMU SIGSEGV at:
 piix4_cpu_hotplug_req ()
    ...
    g->sts[cpu_id / 8] |= (1 << (cpu_id % 8));
    ...

Since for PC in current implementation id should be in range [0...maxcpus)
and maxcpus is already checked, add check for lower bound and error out
on incorrect value.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
(cherry picked from commit 8de433cb08)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-17 18:01:42 -05:00
Markus Armbruster 055a7fce65 smbios: Check R in -smbios type=0, release=R parses okay
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Laszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-7-git-send-email-armbru@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 6e5c4540d1)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-17 18:01:42 -05:00
Markus Armbruster 93bc624384 smbios: Fix -smbios type=0, release=... for big endian hosts
Classic endianness bug due to careless dirty coding: assuming reading
a byte from an int variable gets the least significant byte.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Laszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-6-git-send-email-armbru@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 527cd96f15)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-17 18:01:42 -05:00
Markus Armbruster 61fbaee1a7 smbios: Clean up smbios_add_field() parameters
Having size precede the associated pointer is odd.  Swap them, and fix
up the types.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Laszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-5-git-send-email-armbru@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit ebc85e3f72)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-17 18:01:42 -05:00
Markus Armbruster 685ee2d940 smbios: Convert to error_report()
Improves diagnistics from ad hoc messages like

    Invalid SMBIOS UUID string

to

    qemu-system-x86_64: -smbios type=1,uuid=gaga: Invalid UUID

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Laszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-4-git-send-email-armbru@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 5bb95e4186)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-17 18:01:42 -05:00
Stefan Hajnoczi 6b6f105349 ivshmem: add missing error exit(2)
If the user fails to specify 'chardev' or 'shm' then we cannot continue.
Exit right away so that we don't invoke shm_open(3) with a NULL pointer.

It would be nice to replace exit(1) with error returns in the PCI device
.init() function, but leave that for another patch since exit(1) is
currently used elsewhere.

Spotted by Coverity.

Cc: Cam Macdonell <cam@cs.ualberta.ca>
Cc: qemu-stable@nongnu.org
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit baefb8bf8e)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-17 16:40:54 -05:00
Michael S. Tsirkin eeaa8d33e4 q35: set fw_name
PCI host bridges need to set fw_name to be discoverable
by bios for boot device selection.

In particular, seabios expects root device to be called
"/pci/@i0cf8", so let's set it up like that for Q35.

Cc: qemu-stable@nongnu.org
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Tested-by: Amos Kong <akong@redhat.com>
(cherry picked from commit 68c0e134a0)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-12 15:39:40 -05:00
Wendy Liang 6f3718c73b xilinx_axidma: Do not set DMA .notify to NULL after notify
If a stream notify function is not ready, it may re-populate the notify call-
back to indicate it should be re-polled later. This break in this usage, as
immediately following the notify() call, .notify is set to NULL. reverse the
ordering of the notify call and NULL assignment accordingly.

[PC: Reworked commit message]

Signed-off-by: Wendy Liang <jliang@xilinx.com>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
(cherry picked from commit 4f293bd6e5)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-11 18:22:30 -05:00
Cornelia Huck 1fb147f443 virtio-ccw: Fix unsetting of indicators.
Interpretation of the ccws to register (configuration) indicators contained
a thinko: We want to disallow reading from 0, but setting the indicator
pointer to 0 is fine.

Let's fix the handling for CCW_CMD_SET{,_CONF}_IND.

Cc: qemu-stable@nongnu.org
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
(cherry picked from commit d1db1fa8df)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-11 18:17:25 -05:00
Cornelia Huck 72762f2811 s390x/css: Fix concurrent sense.
Fix an off-by-one error when indicating availablity of concurrent
sense data.

Cc: qemu-stable@nongnu.org
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
(cherry picked from commit 8312976e73)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-11 18:11:30 -05:00
Stefan Hajnoczi 9ca80c7f29 vmxnet3: fix NICState cleanup
Use qemu_del_nic() instead of qemu_del_net_client() to correctly free
the entire NICState.

Cc: qemu-stable@nongnu.org
Reported-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 3ffee3cd5f)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-11 18:03:56 -05:00
Michael Marineau a548bacfba Fix usage of USB_DEV_FLAG_IS_HOST flag.
USB_DEV_FLAG_IS_HOST is the bit number, not value. Booting with a
"Fitbit Base Station" USB dongle was triggering this assert.

Signed-off-by: Michael Marineau <mike@marineau.org>
Cc: qemu-stable@nongnu.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 756335292f)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-11 17:35:19 -05:00
Ed Maste 9b5751ec09 host-libusb: Correct test for USB packet state
USB_RET_ASYNC is -6, so inflight was always false.

Signed-off-by: Ed Maste <emaste@freebsd.org>
Cc: qemu-stable@nongnu.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 45ec267160)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-11 17:34:11 -05:00
Amos Kong 032ce1baac qdev: fix get_fw_dev_path to support to add nothing to fw_dev_path
Recent virtio refactoring in QEMU made virtio-bus become the parent bus
of scsi-bus, and virtio-bus doesn't have get_fw_dev_path implementation,
typename will be added to fw_dev_path by default, the new fw_dev_path
could not be identified by seabios. It causes that bootindex parameter
of scsi device doesn't work.

This patch implements get_fw_dev_path() in BusClass, it will be called
if bus doesn't implement the method, tyename will be added to
fw_dev_path. If the implemented method returns NULL, nothing will be
added to fw_dev_path.

It also implements virtio_bus_get_fw_dev_path() to return NULL. Then
QEMU will still pass original style of fw_dev_path to seabios.

Signed-off-by: Amos Kong <akong@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 1369814202-10346-1-git-send-email-akong@redhat.com
--
v2: only add nothing to fw_dev_path when get_fw_dev_path() is
    implemented and returns NULL. then it will not effect other devices
    don't have get_fw_dev_path() implementation.
v3: implement default get_fw_dev_path() in BusClass
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit bbfa18fca4)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-11 17:30:29 -05:00
Stefano Stabellini 327e75b537 xen: start PCI hole at 0xe0000000 (same as pc_init1 and qemu-xen-traditional)
We are currently setting the PCI hole to start at HVM_BELOW_4G_RAM_END,
that is 0xf0000000.
Start the PCI hole at 0xe0000000 instead, that is the same value used by
pc_init1 and qemu-xen-traditional.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
CC: qemu-stable@nongnu.org
(cherry picked from commit 9f24a8030a)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-11 17:25:03 -05:00
Andreas Färber 0565700d78 ide: Set BSY bit during FLUSH
The implementation of the ATA FLUSH command invokes a flush at the block
layer, which may on raw files on POSIX entail a synchronous fdatasync().
This may in some cases take so long that the SLES 11 SP1 guest driver
reports I/O errors and filesystems get corrupted or remounted read-only.

Avoid this by setting BUSY_STAT, so that the guest is made aware we are
in the middle of an operation and no ATA commands are attempted to be
processed concurrently.

Addresses BNC#637297.

Suggested-by: Gonglei (Arei) <arei.gonglei@huawei.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit f68ec8379e)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-11 17:01:20 -05:00
Stefano Stabellini 38ec6c1071 xen_machine_pv: do not create a dummy CPU in machine->init
This fixes a regression introduced by:

commit 62fc403f11
Author: Igor Mammedov <imammedo@redhat.com>
Date:   Mon Apr 29 18:54:13 2013 +0200

    target-i386: Attach ICC bus to CPU on its creation

    X86CPU should have parent bus so it could provide bus for child APIC.

The commit makes it mandatory to pass a valid ICC bus to cpu_x86_create,
but cpu_x86_init just passes NULL to it.
xen_machine_pv uses cpu_x86_init, therefore it has been broken.

This patch fixes the problem by removing the dummy CPU creation
altogether from xen_init_pv, relying on the fact that QEMU can now cope
with a machine without an emulated CPU.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
CC: imammedo@redhat.com
CC: qemu-stable@nongnu.org
(cherry picked from commit 58ee9b0ae0)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-11 16:57:59 -05:00
Stefan Hajnoczi 749806d1a7 rtl8139: flush queued packets when RxBufPtr is written
Net queues support efficient "receive disable".  For example, tap's file
descriptor will not be polled while its peer has receive disabled.  This
saves CPU cycles for needlessly copying and then dropping packets which
the peer cannot receive.

rtl8139 is missing the qemu_flush_queued_packets() call that wakes the
queue up when receive becomes possible again.

As a result, the Windows 7 guest driver reaches a state where the
rtl8139 cannot receive packets.  The driver has actually refilled the
receive buffer but we never resume reception.

The bug can be reproduced by running a large FTP 'get' inside a Windows
7 guest:

  $ qemu -netdev tap,id=tap0,...
         -device rtl8139,netdev=tap0

The Linux guest driver does not trigger the bug, probably due to a
different buffer management strategy.

Reported-by: Oliver Francke <oliver.francke@filoo.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 00b7ade807)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-11 16:46:51 -05:00
Aneesh Kumar K.V a6fc2cd986 hw/9pfs: use O_NOFOLLOW for mapped readlink operation
With mapped security models like mapped-xattr and mapped-file, we save the
symlink target as file contents. Now if we ever expose a normal directory
with mapped security model and find real symlinks in export path, never
follow them and return proper error.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
(cherry picked from commit aed858ce10)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-11 16:45:59 -05:00
Aneesh Kumar K.V eabdf85d86 hw/9pfs: Fix segfault with 9p2000.u
When guest tries to chmod a block or char device file over 9pfs,
the qemu process segfaults. With 9p2000.u protocol we use wstat to
change mode bits and client don't send extension information for
chmod. We need to check for size field to check whether extension
info is present or not.

Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Acked-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
(cherry picked from commit c7e587b73e)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-06-11 16:39:23 -05:00
Ed Maste 3568ac2a6e Rename hexdump to avoid FreeBSD libutil conflict
On FreeBSD libutil is used for openpty(), but it also provides a hexdump()
which conflicts with QEMU's.

Signed-off-by: Ed Maste <emaste@freebsd.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1368718348-15199-1-git-send-email-emaste@freebsd.org
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-05-20 08:20:08 -05:00
Aurelien Jarno b9b5df6f0c ide/macio: fix wrong opaque with TRIM support
Commit 215e47b9 enabled TRIM by default, which revealed a bug in TRIM
support for the IDE macio emulation driver, introduced in d353fb72.

The call to dma_bdrv_io() is using a wrong opaque of type IDEState
instead of DBDMA_io. This patch fixes that.

Fixes LP#1179104

Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Tested-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2013-05-20 01:54:14 +02:00
KONRAD Frederic 6d46895b51 virtio: add virtio_bus_get_dev_path.
This adds virtio_bus_get_dev_path to fix migration id string which is wrong
since the virtio refactoring.

Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1368723967-21050-1-git-send-email-fred.konrad@greensocs.com
Cc: mdroth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-05-16 14:18:38 -05:00
Peter Maydell 913b4b6bf3 hw/pci-host/versatile.c: Provide property for forcing broken IRQ mapping
Although we try our best to automatically detect broken versions
of Linux which assume the old broken IRQ mapping we used to implement
for our model of the Versatile PCI controller, it turns out that
some particularly new kernels manage to outwit the autodetection.

We therefore provide a property for enabling the old broken IRQ
mapping, so that if users happen to have such a kernel they can
work around its deficiencies with the command line option:
  -global versatile_pci.broken-irq-mapping=1

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1368545616-22344-4-git-send-email-peter.maydell@linaro.org
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-05-15 08:49:59 -05:00
Peter Maydell bc04d89165 hw/pci-host/versatile.c: Update autodetect to detect newer kernels
Newer versatilepb kernels still don't get the IRQ mapping right
for the PCI controller, but they get it differently wrong (they add
a fixed +64 offset to everything they write to PCI_INTERRUPT_LINE).
Update the autodetection to handle these too, and include a more
detailed comment on the various different behaviours that might
be present.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1368545616-22344-3-git-send-email-peter.maydell@linaro.org
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-05-15 08:49:59 -05:00
Peter Maydell 33201b51cb Revert "versatile_pci: Put the host bridge PCI device at slot 29"
This reverts commit 5f37ef92b7.
It turns out that some kernels incorrectly depend on the
old QEMU behaviour of not putting the host PCI bridge device
where the hardware puts it, because they use a swizzling IRQ
mapping which is incorrect but happens to match up with old
broken QEMU when the slot number mod 4 is zero. Since we
start PCI devices at 11, if we put the host bridge at 29
then the first real PCI device goes at 11 and doesn't work.
Not putting the host bridge at 29 means it defaults to 11,
so the first real PCI device is at 12 and works.

Since continuing with the old behaviour doesn't cause problems
for kernels which do work with hardware, the simplest fix for
this is to revert the change.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1368545616-22344-2-git-send-email-peter.maydell@linaro.org
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-05-15 08:49:59 -05:00
KONRAD Frederic 800ced8cac virtio-net-x: forward the netclient name and type.
This forwards the name and the type of virtio-net-x to fix the bad
behaviour of "info network" command.

Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com>
Message-id: 1368619970-23892-3-git-send-email-fred.konrad@greensocs.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-05-15 08:48:25 -05:00
KONRAD Frederic 8a253ec26e virtio-net: add virtio_net_set_netclient_name.
This adds virtio_net_set_netclient_name, which is used to set the
name and type shown in "info network" command.

Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com>
Message-id: 1368619970-23892-2-git-send-email-fred.konrad@greensocs.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-05-15 08:48:25 -05:00
Paolo Bonzini d8e846e17c spitz: fix compilation failure due to pty.h namespace pollution
pty.h is polluting the global namespace with a CTRL macro.  spitz
thus fails compilation with the patch at
http://article.gmane.org/gmane.comp.emulators.qemu/211337 and
this patch fixes it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1368533545-650-1-git-send-email-pbonzini@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-05-14 08:53:16 -05:00
Gerd Hoffmann 2d3b989529 acpi: add dummy write function for acpi timer
Otherwise the guest can crash qemu (NULL pointer dereference).

https://bugzilla.redhat.com/show_bug.cgi?id=947691

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 1368534544-11826-1-git-send-email-kraxel@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-05-14 08:53:09 -05:00
Paolo Bonzini 9e1c2ec8fd Revert "pc: Kill the "use flash device for BIOS unless KVM" misfeature"
This reverts commit 9953f8822c.
While Markus's analysis is entirely correct, there are 1.6 patches
that fix the bug for real and without requiring machine type hacks.
Let's think of the children who will have to read this code, and
avoid a complicated mess of semantics that differ between <1.5,
1.5, and >1.5.

Conflicts:
	hw/i386/pc_piix.c
	hw/i386/pc_q35.c
	include/hw/i386/pc.h

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Acked-by: Anthony Liguori <aliguori@us.ibm.com>
Message-id: 1368189483-7915-1-git-send-email-pbonzini@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-05-13 09:52:43 -05:00
Anthony Liguori f6e136e47a Merge remote-tracking branch 'mjt/trivial-patches-next' into staging
# By Dong Xu Wang (2) and others
# Via Michael Tokarev
* mjt/trivial-patches-next:
  osdep.h: include sys/types.h for ssize_t definition
  remove double semicolons
  clean unnecessary code: don't check g_strdup arg for NULL
  docs: mention AddressSpaces in docs/memory.txt
  audio: update documentation after removing --audio-card-list option
  m25p80.c: Sync Flash chip list with Linux
  bsd-user: OS-agnostic 64-bit SYSCTL types

Message-id: 518F61B9.9050803@msgid.tls.msk.ru
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-05-13 09:44:25 -05:00
Dong Xu Wang c7e775e4dd remove double semicolons
Signed-off-by: Dong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2013-05-12 13:25:55 +04:00
Ed Maste 3e758c1df0 m25p80.c: Sync Flash chip list with Linux
Add new devices for various manufacturers, and re-sort Spansion list to
match the order in Linux, which requires chips with a non-zero extended ID
to come first.

With this commit the outstanding differences to Linux rev 55bf75b are:

- Erase size flag differences in s25sl032p, s25sl064p, s25fl016k, s25fl064k
  (These devices have only some blocks that support small erase sizes.)
- Linux lacks n25q128
- Devices without a Jedec ID have been excluded

Signed-off-by: Ed Maste <emaste@freebsd.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2013-05-12 13:25:55 +04:00
Hans de Goede 0a2b5e3a78 qxl: Call spice_qxl_driver_unload from qxl_enter_vga_mode
With a SPICE_DISPLAY_CAP_MONITORS_CONFIG capable client, the client needs to
know what part of the primary to use for each monitor. If the guest driver
does not support this, the server sends messages to the client for a
single monitor spanning the entire primary.

As soon as the guest calls spice_qxl_monitors_config_async once, the server
sets the red_worker driver_has_monitors_config flag and stops doing this.

This is a problem when the driver gets unloaded, for example after a reboot
or when switching to a text vc with usermode mode-setting under Linux.

To reproduce this start a multi-mon capable Linux guest which uses
usermode mode-setting and then once X has started switch to a text vc. Note
how the client window does not only not resize, if you try to resize it
manually you always keep blackborders since the aspect is wrong.

This patch calls a new spice-server method called spice_qxl_driver_unload
which clears the driver_has_monitors_config flag inside the server, thereby
fixing this.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2013-05-09 11:46:53 +02:00
Anthony Liguori cad2b59c19 Merge remote-tracking branch 'kwolf/for-anthony' into staging
# By Kevin Wolf (7) and Fam Zheng (3)
# Via Kevin Wolf
* kwolf/for-anthony:
  qemu-iotests: fix 017 018 for vmdk
  qemu-iotests: exclude vmdk and qcow from 043
  qemu-iotests: exclude vmdk for test 042
  qtest/ide-test: Test short and long PRDTs
  qtest/ide-test: Add simple DMA read/write test case
  qtest: Add IDE test case
  libqos/pci: Enable bus mastering
  ide: Reset BMIDEA bit when the bus master is stopped
  de_DE.po: Add missing leading spaces
  ahci: Don't allow creating slave drives

Message-id: 1368023344-29731-1-git-send-email-kwolf@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-05-08 15:54:36 -05:00