summaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2014-08-15dataplane: stop trying on notifier errorCornelia Huck1-1/+10
If we fail to set up guest or host notifiers, there's no use trying again every time the guest kicks, so disable dataplane in that case. Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15dataplane: fail notifier setting gracefullyCornelia Huck1-4/+11
The dataplane code is currently doing a hard exit if it fails to set up either guest or host notifiers. In practice, this may mean that a guest suddenly dies after a dataplane device failed to come up (e.g., when a file descriptor limit is hit for tne nth device). Let's just try to unwind the setup instead and return. Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15dataplane: print why starting failedCornelia Huck1-5/+8
Setting up guest or host notifiers may fail, but the user will have no idea why: Let's print the error returned by the callback. Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15cmd646: synchronise UDMA interrupt status with DMA interrupt statusMark Cave-Ayland1-0/+24
Make sure that both registers are synchronised when being accessed through PCI configuration space. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15cmd646: allow MRDMODE interrupt status bits clearing from PCI config spaceMark Cave-Ayland1-2/+30
Make sure that we also update the normal DMA interrupt status bits at the same time, and alter the IRQ if being cleared accordingly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15cmd646: switch cmd646_update_irq() to accept PCIDevice instead of PCIIDEStateMark Cave-Ayland1-5/+4
This is in preparation for adding configuration space accessors which accept PCIDevice as a parameter. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15cmd646: synchronise DMA interrupt status with UDMA interrupt statusMark Cave-Ayland1-0/+22
Make sure that the standard DMA interrupt status bits reflect any changes made to the UDMA interrupt status bits. The CMD646U2 datasheet claims that these bits are equivalent, and they must be synchronised for guests that manipulate both registers. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15cmd646: add constants for CNTRL register accessMark Cave-Ayland1-2/+5
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15q35: Enable the ioapic device to be seen by qtest.John Snow1-1/+1
Currently, the ioapic device can not be found in a qtest environment when requesting "irq_interrupt_in ioapic" via the qtest socket. By mirroring how the ioapic is added in i44ofx (hw/i440/pc_piix.c), as a child of "q35," the device is able to be seen by qtest. Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15ahci: construct PIO Setup FIS for PIO commandsPaolo Bonzini1-0/+70
PIO commands should put a PIO Setup FIS in the receive area when data transfer ends. Currently QEMU does not do this and only places the D2H FIS at the end of the operation. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15ide: make all commands go through cmd_donePaolo Bonzini4-24/+16
AHCI has code to fill in the D2H FIS trigger the IRQ all over the place. Centralize this in a single cmd_done callback by generalizing the existing async_cmd_done callback. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15ide: stop PIO transfer on errorsPaolo Bonzini1-3/+2
This will provide a hook for sending the result of the command via the FIS receive area. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15ahci: remove duplicate PORT_IRQ_* constantsPaolo Bonzini2-24/+3
These are defined twice, just use one set consistently. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15ide: move retry constants out of BM_STATUS_* namespacePaolo Bonzini3-23/+23
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15ide: move BM_STATUS bits to pci.[ch]Paolo Bonzini3-11/+11
They are not used by AHCI, and should not be even available there. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15ide: fold add_status callback into set_inactivePaolo Bonzini6-34/+15
It is now called only after the set_inactive callback. Put the two together. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15ide: remove wrong setting of BM_STATUS_INTPaolo Bonzini2-5/+0
Similar to the case removed in commit 69c38b8 (ide/core: Remove explicit setting of BM_STATUS_INT, 2011-05-19), the only remaining use of add_status(..., BM_STATUS_INT) is for short PRDs. The flag should not be raised in this case. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15ide: wrap start_dma callbackPaolo Bonzini3-11/+11
Make it optional and prepare for the next patches. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15ide: simplify start_transfer callbacksPaolo Bonzini5-24/+5
Drop the unused return value and make the callback optional. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15ide: simplify async_cmd_done callbacksPaolo Bonzini2-4/+2
Drop the unused return value. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15ide: simplify set_inactive callbacksPaolo Bonzini5-13/+5
Drop the unused return value and make the callback optional. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15ide: simplify reset callbacksPaolo Bonzini5-13/+6
Drop the unused return value and make the callback optional. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15ide: stash aiocb for flushesPaolo Bonzini1-1/+3
This ensures that operations are completed after a reset Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' ↵Peter Maydell1-0/+6
into staging Tracing pull request * remotes/stefanha/tags/tracing-pull-request: virtio-rng: add some trace events trace: add some tcg tracing support trace: teach lttng backend to use format strings trace: [tcg] Include TCG-tracing header on all targets trace: [tcg] Include event definitions in "trace.h" trace: [tcg] Generate TCG tracing routines trace: [tcg] Include TCG-tracing helpers trace: [tcg] Define TCG tracing helper routine wrappers trace: [tcg] Define TCG tracing helper routines trace: [tcg] Declare TCG tracing helper routines trace: [tcg] Add 'tcg' event property trace: [tcg] Argument type transformation machinery trace: [tcg] Argument type transformation rules trace: [tcg] Add documentation trace: install simpletrace SystemTap tapset simpletrace: add simpletrace.py --no-header option trace: add tracetool simpletrace_stap format trace: extract stap_escape() function for reuse Conflicts: Makefile.objs
2014-08-15Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell1-0/+1
Block patches # gpg: Signature made Fri 15 Aug 2014 14:07:42 BST using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: (59 commits) block: Catch !bs->drv in bdrv_check() iotests: Add test for image header overlap qcow2: Catch !*host_offset for data allocation qcow2: Return useful error code in refcount_init() mirror: Handle failure for potentially large allocations vpc: Handle failure for potentially large allocations vmdk: Handle failure for potentially large allocations vhdx: Handle failure for potentially large allocations vdi: Handle failure for potentially large allocations rbd: Handle failure for potentially large allocations raw-win32: Handle failure for potentially large allocations raw-posix: Handle failure for potentially large allocations qed: Handle failure for potentially large allocations qcow2: Handle failure for potentially large allocations qcow1: Handle failure for potentially large allocations parallels: Handle failure for potentially large allocations nfs: Handle failure for potentially large allocations iscsi: Handle failure for potentially large allocations dmg: Handle failure for potentially large allocations curl: Handle failure for potentially large allocations ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-15xen_disk: fix possible null-ptr dereferenceGonglei (Arei)1-0/+1
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-12virtio-rng: add some trace eventsAmit Shah1-0/+6
Add some trace events to virtio-rng for easier debugging Signed-off-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Amos Kong <akong@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-09hw/timer: Move extern declaration from .c to .h fileStefan Weil1-3/+0
This fixes a warning from smatch (static code analyser). Fix also the comment with the renamed source file name. Signed-off-by: Stefan Weil <sw@weilnetz.de> hw/timer/tusb6010.c | 3 --- include/hw/usb.h | 7 ++++++- 2 files changed, 6 insertions(+), 4 deletions(-) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-08-09virtio: Move extern declaration to header fileStefan Weil1-2/+0
This fixes a warning from smatch (static code analyser). Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-08-09hw/timer/imx_*: fix TIMER_MAX clash with system symbolMichael Tokarev2-24/+24
The symbol TIMER_MAX used in imx_epit.c and imx_gpt.c clashes with system symbol with the same name. Because all qemu source files includes qemu-common.h which, in turn, includes limits.h, which is not unusual to define it. Rename local symbol to have a reasonable prefix. Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-08-05vfio: Don't cache MSIMessageAlex Williamson1-6/+2
Commit 40509f7f added a test to avoid updating KVM MSI routes when the MSIMessage is unchanged and f4d45d47 switched to relying on this rather than doing our own comparison. Our cached msg is effectively unused now. Remove it. Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2014-08-05vfio: Fix MSI-X vector expansionAlex Williamson1-9/+29
When new MSI-X vectors are enabled we need to disable MSI-X and re-enable it with the correct number of vectors. That means we need to reprogram the eventfd triggers for each vector. Prior to f4d45d47 vector->use tracked whether a vector was masked or unmasked and we could always pick the KVM path when available for unmasked vectors. Now vfio doesn't track mask state itself and vector->use and virq remains configured even for masked vectors. Therefore we need to ask the MSI-X code whether a vector is masked in order to select the correct signaling path. As noted in the comment, MSI relies on hardware to handle masking. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Cc: qemu-stable@nongnu.org # QEMU 2.1
2014-08-04sd: sdhci: Fix ADMA dma_memory_read accessPeter Crosthwaite1-1/+2
This dma_memory_read was giving too big a size when begin was non-zero. This could cause segfaults in some circumstances. Fix. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-04hw/arm/virt: formatting: memory mapAndrew Jones1-8/+8
Add some spacing and zeros to make it easier to read and modify the map. This patch has no functional changes. The review looks ugly, but it's actually pretty easy to confirm all the addresses are as they should be - thanks to the new formatting ;-) Signed-off-by: Andrew Jones <drjones@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-04hw/arm/boot: Set PC correctly when loading AArch64 ELF filesPeter Maydell1-2/+6
The code in do_cpu_reset() correctly handled AArch64 CPUs when running Linux kernels, but was missing code in the branch of the if() that deals with loading ELF files. Correctly jump to the ELF entry point on reset rather than leaving the reset PC at zero. Reported-by: Christopher Covington <cov@codeaurora.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Christopher Covington <cov@codeaurora.org> Cc: qemu-stable@nongnu.org
2014-08-04Merge remote-tracking branch 'remotes/amit-virtio-rng/for-2.2' into stagingPeter Maydell1-13/+12
* remotes/amit-virtio-rng/for-2.2: virtio-rng: replace error_set calls with error_setg virtio-rng: Move error-checking forward to prevent memory leak Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-04virtio-rng: replace error_set calls with error_setgJohn Snow1-5/+4
Under recommendation from Luiz Capitulino, we are changing the error_set calls to error_setg while we are fixing up the error handling pathways of virtio-rng. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
2014-08-04virtio-rng: Move error-checking forward to prevent memory leakJohn Snow1-10/+10
This patch pushes the error-checking forward and the virtio initialization backward in the device realization function in order to prevent memory leaks for hot plug scenarios. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
2014-08-01qemu: support xen hvm direct kernel bootChunyan Liu3-0/+33
qemu side patch to support xen HVM direct kernel boot: if -kernel exists, calls xen_load_linux(), which will read kernel/initrd and add a linuxboot.bin or multiboot.bin option rom. The linuxboot.bin/multiboot.bin will load kernel/initrd and jump to execute kernel directly. It's working when xen uses seabios. During this work, found the 'kvmvapic' is in option_rom list, it should not be there in xen case. Set s->vapic_control = 0 in xen_apic_realize() to handle that. Signed-off-by: Chunyan Liu <cyliu@suse.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-29hw/arm/virt: fix pl031 addr typoAndrew Jones1-1/+1
pl031's base address should be 0x9010000, not 0x90010000, otherwise it sits in ram when configuring a guest with greater than 1G. Signed-off-by: Andrew Jones <drjones@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-29piix: set legacy table size for 1.7Michael S. Tsirkin1-0/+1
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-29acpi-build: tweak acpi migration limitsMichael S. Tsirkin1-7/+9
- Tweak error message for legacy machine type: Basically if table size exceeds the limits we set all bets are off for migration: e.g. it can start failing even within given qemu minor version simply because of a bugfix. - Increase table size to 128k. - Make sure we notice it long before we start getting close to the 128k limit: warn at 64k. - Don't fail if we exceed the limit: most people don't care about migration, even less people care about cross version miration. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-29pc: future-proof migration-compatibility of ACPI tablesPaolo Bonzini1-1/+9
This patch avoids that similar changes break QEMU again in the future. QEMU will now hard-code 64k as the maximum ACPI table size, which (despite being an order of magnitude smaller than 640k) should be enough for everyone. Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-29acpi-build: minor code cleanupMichael S. Tsirkin1-6/+12
Fix up and add comments to clarify code, plus a trivial code change for clarity. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-29pc: acpi: generate AML only for PCI0 devices if PCI bridge hotplug is disabledIgor Mammedov1-5/+21
Fixes migration regression from QEMU-1.7 to a newer QEMUs. SSDT table size in QEMU-1.7 doesn't change regardless of a number of PCI bridge devices present at startup. However in QEMU-2.0 since addition of hotplug on PCI bridges, each PCI bridge adds ~1875 bytes to SSDT table, including pc-i440fx-1.7 machine type where PCI bridge hotplug disabled via compat property. It breaks migration from "QEMU-1.7" to "QEMU-2.[01] -M pc-i440fx-1.7" since RAMBlock size of ACPI tables on target becomes larger then on source and migration fails with: "Length mismatch: /rom@etc/acpi/tables: 2000 in != 3000" error. Fix this by generating AML only for PCI0 bus if hotplug on PCI bridges is disabled and preserves PCI brigde description in AML as it was done in QEMU-1.7 for pc-i440fx-1.7. It will help to maintain size of SSDT static regardless of number of PCI bridges on startup for pc-i440fx-1.7 machine type. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-28pc: hack for migration compatibility from QEMU 2.0Paolo Bonzini3-4/+77
Changing the ACPI table size causes migration to break, and the memory hotplug work opened our eyes on how horribly we were breaking things in 2.0 already. The ACPI table size is rounded to the next 4k, which one would think gives some headroom. In practice this is not the case, because the user can control the ACPI table size (each CPU adds 97 bytes to the SSDT and 8 to the MADT) and so some "-smp" values will break the 4k boundary and fail to migrate. Similarly, PCI bridges add ~1870 bytes to the SSDT. This patch concerns itself with fixing migration from QEMU 2.0. It computes the payload size of QEMU 2.0 and always uses that one. The previous patch shrunk the ACPI tables enough that the QEMU 2.0 size should always be enough; non-AML tables can change depending on the configuration (especially MADT, SRAT, HPET) but they remain the same between QEMU 2.0 and 2.1, so we only compute our padding based on the sizes of the SSDT and DSDT. Migration from QEMU 1.7 should work for guests that have a number of CPUs other than 12, 13, 14, 54, 55, 56, 97, 98, 139, 140. It was already broken from QEMU 1.7 to QEMU 2.0 in the same way, though. Even with this patch, QEMU 1.7 and 2.0 have two different ideas of "-M pc-i440fx-2.0" when there are PCI bridges. Igor sent a patch to adopt the QEMU 1.7 definition. I think distributions should apply it if they move directly from QEMU 1.7 to 2.1+ without ever packaging version 2.0. Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-28acpi-dsdt: procedurally generate _PRTPaolo Bonzini2-1832/+128
This replaces the _PRT constant with a method that computes it. The problem is that the DSDT+SSDT have grown from 2.0 to 2.1, enough to cross the 8k barrier (we align the ACPI tables to 4k before putting them in fw_cfg). This causes problems with migration and the pc-i440fx-2.0 machine type. The solution to the problem is to hardcode 64k as the limit, but this doesn't solve the bug with pc-i440fx-2.0. The fix will be for QEMU 2.1 to use exactly the same size as QEMU 2.0 for the ACPI tables. First, however, we must make the actual AML equal or smaller; to do this, rewrite _PRT in a way that saves over 1k of bytecode. Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-23usb: mtp: tag root property as experimentalGerd Hoffmann1-1/+1
Reason: we don't want commit to that interface yet. Possibly the implementation will be switched over to use fsdev. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-22hw/misc/imx_ccm.c: Add missing VMState list terminatorPeter Maydell1-0/+1
The VMStateDescription for the imx_ccm device was missing its terminator. Found by static search of the codebase using a regex based on one suggested by Ian Jackson: pcregrep -rMi '(?s)VMStateField(?:(?!END_OF_LIST).)*?;' $(git grep -l 'VMStateField\[\]') Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org
2014-07-22vmstate_xhci_event: fix unterminated field listLaszlo Ersek1-0/+1
"vmstate_xhci_event" was introduced in commit 37352df3 ("xhci: add live migration support"), and first released in v1.6.0. The field list in this VMSD is not terminated with the VMSTATE_END_OF_LIST() macro. During normal use (ie. migration), the issue is practically invisible, because the "vmstate_xhci_event" object (with the unterminated field list) is only ever referenced -- via "vmstate_xhci_intr" -- if xhci_er_full() returns true, for the "ev_buffer" test. Since that field_exists() check (apparently) almost always returns false, we almost never traverse "vmstate_xhci_event" during migration, which hides the bug. However, Amit's vmstate checker forces recursion into this VMSD as well, and the lack of VMSTATE_END_OF_LIST() breaks the field list terminator check (field->name != NULL) in dump_vmstate_vmsd(). The result is undefined behavior, which in my case translates to infinite recursion (because the loop happens to overflow into "vmstate_xhci_intr", which then links back to "vmstate_xhci_event"). Add the missing terminator. Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-18 18:53:33 +0000