summaryrefslogtreecommitdiffstats
path: root/hw
Commit message (Collapse)AuthorAgeFilesLines
* Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2015-07-248-53/+158
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * qemu-char fixes * SCSI fixes (including CVE-2015-5158) * RCU fixes * Framebuffer logic to set DIRTY_MEMORY_VGA * Fix compiler warning for --disable-vnc * qemu-doc fixes * x86 TCG pasto fix # gpg: Signature made Fri Jul 24 12:57:52 2015 BST using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: target-i386/FPU: a misprint in helper_fistll_ST0 qemu-doc: fix typos framebuffer: set DIRTY_MEMORY_VGA on RAM that is used for the framebuffer memory: count number of active VGA logging clients vl: Fix compiler warning for builds without VNC scsi: Handle no media case for scsi_get_configuration rcu: actually register threads that have RCU read-side critical sections scsi: fix buffer overflow in scsi_req_parse_cdb (CVE-2015-5158) vnc: fix memory leak qemu-char: Fix missed data on unix socket qemu-char: handle EINTR for TCP character devices exec.c: Use atomic_rcu_read() to access dispatch in memory_region_section_get_iotlb() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * framebuffer: set DIRTY_MEMORY_VGA on RAM that is used for the framebufferPaolo Bonzini2015-07-246-51/+137
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The MemoryRegionSection contains enough information to access the RAM region underlying the framebuffer, and can be cached inside the display device. By doing this, the new framebuffer_update_memory_section function can enable dirty memory logging on the relevant RAM region. The function must be called whenever the stride or base of the framebuffer changes; a simple way to cover these cases is to call it on every full frame invalidation, which is a rare case. framebuffer_update_display now works entirely on a MemoryRegionSection, without going through cpu_physical_memory_map/unmap. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * scsi: Handle no media case for scsi_get_configurationMatthew Rosato2015-07-241-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, scsi_get_configuration always returns a current profile (DVD or CD), even when there is actually no media present. By comparison, ide/atapi uses a default profile of 0 (MMC_PROFILE_NONE) for this case and checks for tray_open, so let's do the same for scsi. This fixes a problem I'm seeing with Fedora 22 guests where systemd cdrom_id fails to unmount after a QEMU-initiated eject against a scsi cdrom device because it believes the media is still present (but unreadable). Signed-off-by: Matthew Rosato <mjrosato@linux.vnet.ibm.com> Message-Id: <1436986352-10695-1-git-send-email-mjrosato@linux.vnet.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * scsi: fix buffer overflow in scsi_req_parse_cdb (CVE-2015-5158)Paolo Bonzini2015-07-241-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a guest-triggerable buffer overflow present in QEMU 2.2.0 and newer. scsi_cdb_length returns -1 as an error value, but the caller does not check it. Luckily, the massive overflow means that QEMU will just SIGSEGV, making the impact much smaller. Reported-by: Zhu Donghai (朱东海) <donghai.zdh@alibaba-inc.com> Fixes: 1894df02811f6b79ea3ffbf1084599d96f316173 Reviewed-by: Fam Zheng <famz@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | vfio/pci: Fix bootindexAlex Williamson2015-07-221-1/+0
| | | | | | | | | | | | | | | | bootindex was incorrectly changed to a device Property during the platform code split, resulting in it no longer working. Remove it. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Cc: qemu-stable@nongnu.org # v2.3+
* | vfio/pci: Fix RTL8168 NIC quirksAlex Williamson2015-07-221-7/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The RTL8168 quirk correctly describes using bit 31 as a signal to mark a latch/completion, but the code mistakenly uses bit 28. This causes the Realtek driver to spin on this register for quite a while, 20k cycles on Windows 7 v7.092 driver. Then it gets frustrated and tries to set the bit itself and spins for another 20k cycles. For some this still results in a working driver, for others not. About the only thing the code really does in its current form is protect the guest from sneaking in writes to the real hardware MSI-X table. The fix is obviously to use bit 31 as we document that we should. The other problem doesn't seem to affect current drivers as nobody seems to use these window registers for writes to the MSI-X table, but we need to use the stored data when a write is triggered, not the value of the current write, which only provides the offset. Note that only the Windows drivers from Realtek seem to use these registers, the Microsoft drivers provided with Windows 8.1 do not access them, nor do Linux in-kernel drivers. Link: https://bugs.launchpad.net/qemu/+bug/1384892 Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Cc: qemu-stable@nongnu.org # v2.1+
* | qxl: Fix new function name for spice-server libraryFrediano Ziglio2015-07-221-2/+1
|/ | | | | | | | | | | | | The new spice-server function to limit the number of monitors (0.12.6) changed while development from spice_qxl_set_monitors_config_limit to spice_qxl_max_monitors (accepted upstream). By mistake I post patch with former name. This patch fix the function name. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com> Acked-by: Martin Kletzander <mkletzan@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
* Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into stagingPeter Maydell2015-07-211-2/+7
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # gpg: Signature made Mon Jul 20 19:27:04 2015 BST using RSA key ID AAFC390E # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: FAEB 9711 A12C F475 812F 18F2 88A9 064D 1835 61EB # Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76 CBD0 7DEF 8106 AAFC 390E * remotes/jnsnow/tags/ide-pull-request: tests: Fix broken targets check-report-qtest-* ahci: Force ICC bits in PxCMD to zero qtest/ide: add another short PRDT test flavor Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ahci: Force ICC bits in PxCMD to zeroStefan Fritsch2015-07-201-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The AHCI spec requires that the HBA sets the ICC bits to zero after the ICC change is done. Since we don't do any ICC change, force the bits to zero all the time. This fixes delays with some OSs (e.g. OpenBSD) waiting for the ICC bits to change to 0. Signed-off-by: Stefan Fritsch <sf@sfritsch.de> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: E1ZFpg7-00027N-HW@eru.sfritsch.de Signed-off-by: John Snow <jsnow@redhat.com>
* | Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into ↵Peter Maydell2015-07-206-21/+79
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging # gpg: Signature made Mon Jul 20 18:25:14 2015 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/net-pull-request: net: Flush queued packets when guest resumes lan9118: Drop lan9118_can_receive etraxfs_eth: Drop eth_can_receive musicpal: Drop eth_can_receive net/vmxnet3: Fix RX TCP/UDP checksum on partially summed packets net/vmxnet3: Refactor 'vmxnet_rx_pkt_attach_data' socket: pass correct size in net_socket_send() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | lan9118: Drop lan9118_can_receiveFam Zheng2015-07-201-6/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | True is the default. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Message-id: 1435734647-8371-4-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * | etraxfs_eth: Drop eth_can_receiveFam Zheng2015-07-201-6/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | True is the default. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Message-id: 1435734647-8371-3-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * | musicpal: Drop eth_can_receiveFam Zheng2015-07-201-6/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | True is the default. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Message-id: 1435734647-8371-2-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * | net/vmxnet3: Fix RX TCP/UDP checksum on partially summed packetsDana Rubin2015-07-201-0/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Convert partially summed packets to be fully checksummed. In case csum offloaded packet, vmxnet3 implementation always passes an RxCompDesc with the "Checksum calculated and found correct" notification to the OS. This emulates the observed ESXi behavior. Therefore, if packet has the NEEDS_CSUM bit set, we must calculate and place a fully computed checksum into the tcp/udp header. Otherwise, the OS driver will receive a checksum-correct indication but with the actual tcp/udp checksum field having just the pseudo header csum value. If host OS performs forwarding, it will forward an incorrectly checksummed packet. Signed-off-by: Dana Rubin <dana.rubin@ravellosystems.com> Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com> Message-id: 1436864116-19154-3-git-send-email-shmulik.ladkani@ravellosystems.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * | net/vmxnet3: Refactor 'vmxnet_rx_pkt_attach_data'Shmulik Ladkani2015-07-203-3/+21
| |/ | | | | | | | | | | | | | | Separate RX packet protocol parsing out of 'vmxnet_rx_pkt_attach_data'. Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com> Message-id: 1436864116-19154-2-git-send-email-shmulik.ladkani@ravellosystems.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* | timer: rename NSEC_PER_SEC due to Mac OS X header clashStefan Hajnoczi2015-07-204-15/+18
|/ | | | | | | | | | | | | | | Commit e0cf11f31c24cfb17f44ed46c254d84c78e7f6e9 ("timer: Use a single definition of NSEC_PER_SEC for the whole codebase") renamed NANOSECONDS_PER_SECOND to NSEC_PER_SEC. On Mac OS X there is a <dispatch/time.h> system header which also defines NSEC_PER_SEC. This causes compiler warnings. Let's use the old name instead. It's longer but it doesn't clash. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1436364609-7929-1-git-send-email-stefanha@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell2015-07-205-53/+113
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | virtio, vhost, pc fixes for 2.4 The only notable thing here is vhost-user multiqueue revert. We'll work on making it stable in 2.5, reverting now means we won't have to maintain bug for bug compability forever. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon Jul 20 12:24:00 2015 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: virtio-net: remove virtio queues if the guest doesn't support multiqueue virtio-net: Flush incoming queues when DRIVER_OK is being set pci_add_capability: remove duplicate comments virtio-net: unbreak any layout Revert "vhost-user: add multi queue support" ich9: fix skipped vmstate_memhp_state subsection Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * virtio-net: remove virtio queues if the guest doesn't support multiqueueWen Congyang2015-07-201-28/+82
| | | | | | | | | | | | | | | | | | | | | | commit da51a335 adds all queues in .realize(). But if the guest doesn't support multiqueue, we forget to remove them. And we cannot handle the ctrl vq corretly. The guest will hang. Signed-off-by: Wen Congyang <wency@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com>
| * virtio-net: Flush incoming queues when DRIVER_OK is being setFam Zheng2015-07-201-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes network hang after "stop" then "cont", while network packets keep arriving. Tested both manually (tap, host pinging guest) and with Jason's qtest series (plus his "[PATCH 2.4] socket: pass correct size in net_socket_send()" fix). As virtio_net_set_status is called when guest driver is setting status byte and when vm state is changing, it is a good opportunity to flush queued packets. This is necessary because during vm stop the backend (e.g. tap) would stop rx processing after .can_receive returns false, until the queue is explicitly flushed or purged. The other interesting condition in .can_receive, virtio_queue_ready(), is handled by virtio_net_handle_rx() when guest kicks; the 3rd condition is invalid queue index which doesn't need flushing. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pci_add_capability: remove duplicate commentsChen Hanxiao2015-07-201-4/+2
| | | | | | | | | | | | Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * virtio-net: unbreak any layoutJason Wang2015-07-201-5/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 032a74a1c0fcdd5fd1c69e56126b4c857ee36611 ("virtio-net: byteswap virtio-net header") breaks any layout by requiring out_sg[0].iov_len >= n->guest_hdr_len. Fixing this by copying header to temporary buffer if swap is needed, and then use this buffer as part of out_sg. Fixes 032a74a1c0fcdd5fd1c69e56126b4c857ee36611 ("virtio-net: byteswap virtio-net header") Cc: qemu-stable@nongnu.org Cc: clg@fr.ibm.com Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
| * Revert "vhost-user: add multi queue support"Michael S. Tsirkin2015-07-202-12/+2
| | | | | | | | | | | | | | | | | | This reverts commit 830d70db692e374b55555f4407f96a1ceefdcc97. The interface isn't fully backwards-compatible, which is bad. Let's redo this properly after 2.4. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * ich9: fix skipped vmstate_memhp_state subsectionPaulo Alcantara2015-07-201-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | By declaring another .subsections array for vmstate_tco_io_state made vmstate_memhp_state not registered anymore. There must be only one .subsections array for all subsections. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Amit Shah <amit.shah@redhat.com> Reported-by: Amit Shah <amit.shah@redhat.com> Signed-off-by: Paulo Alcantara <pcacjr@zytor.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Amit Shah <amit.shah@redhat.com>
* | virtio-rng: trigger timer only when guest requests for entropyPankaj Gupta2015-07-171-7/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch triggers timer only when guest requests for entropy. As soon as first request from guest for entropy comes we set the timer. Timer bumps up the quota value when it gets triggered. Signed-off-by: Pankaj Gupta <pagupta@redhat.com> Reviewed-by: Amit Shah <amit.shah@redhat.com> Message-Id: <1436962608-9961-2-git-send-email-pagupta@redhat.com> [Re-worded patch subject, removed extra whitespace -- Amit] Signed-off-by: Amit Shah <amit.shah@redhat.com>
* | Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150717-1' into ↵Peter Maydell2015-07-173-10/+16
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging usb: fixes for 2.4 (ccid, xhci and usb-host) # gpg: Signature made Fri Jul 17 12:21:42 2015 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-usb-20150717-1: Revert "xhci: set timer to retry xfers" usb-ccid: add missing wakeup calls usb-ccid: fix 61b4887b41b270bc837ead57bc502d904af023bb Re-attach usb device to kernel while usb_host_open fails Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | Revert "xhci: set timer to retry xfers"Gerd Hoffmann2015-07-171-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 4e8cfbe1143d8384387595b500212d7a7f11aeae. We should not poll via timer, and with ccid being fixed to properly notify us about pending transfers we don't have to. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | usb-ccid: add missing wakeup callsGerd Hoffmann2015-07-171-0/+5
| | | | | | | | | | | | | | | | | | | | | Properly notify the host adapter that we have data pending, so it doesn't has to poll us. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | usb-ccid: fix 61b4887b41b270bc837ead57bc502d904af023bbGerd Hoffmann2015-07-171-8/+8
| | | | | | | | | | | | | | | | | | QOMification dropped the parent device lookup, fix it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | Re-attach usb device to kernel while usb_host_open failsLin Ma2015-07-161-0/+3
| | | | | | | | | | | | | | | | | | Signed-off-by: Lin Ma <lma@suse.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | | Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150717-1' ↵Peter Maydell2015-07-173-4/+30
|\ \ \ | |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging input: fixes for 2.4 # gpg: Signature made Fri Jul 17 07:45:17 2015 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-input-20150717-1: hid: clarify hid_keyboard_process_keycode virtio-input: move sys/ioctl.h include virtio-input: fix segfault in virtio_input_hid_properties Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hid: clarify hid_keyboard_process_keycodePaolo Bonzini2015-07-171-4/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Coverity thinks the fallthroughs are smelly. They are correct, but everything else in this function is like "wut?". Refer explicitly to bits 8 and 9 of hs->kbd.modifiers instead of shifting right first and using (1 << 7). Document what the scancode is when hid_code is 0xe0. And add plenty of comments. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-input: move sys/ioctl.h includeGerd Hoffmann2015-07-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Drop from include/standard-headers/linux/input.h Add to hw/input/virtio-input-host.c instead. That allows to build virtio-input (except pass-through) on windows. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-input: fix segfault in virtio_input_hid_propertiesLin Ma2015-07-161-0/+1
| |/ | | | | | | | | | | | | commit 5cce173 introduced virtio-input segfault, This patch fixes it. Signed-off-by: Lin Ma <lma@suse.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2015-07-162-0/+3
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * MIPS-KVM fixes. * Coverity fixes. * Nettle function prototype fixes. * Memory API refcount fix. # gpg: Signature made Thu Jul 16 19:01:27 2015 BST using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: crypto: avoid undefined behavior in nettle calls crypto: fix build with nettle >= 3.0.0 memory: fix refcount leak in memory_region_present RDMA: Fix error exits arm/xlnx-zynqmp: fix memory leak ppc/spapr_drc: fix memory leak mips/kvm: Sign extend registers written to KVM mips/kvm: Fix Big endian 32-bit register access Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | arm/xlnx-zynqmp: fix memory leakGonglei2015-07-161-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | fix CID 1311372. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Message-Id: <1436489490-236-4-git-send-email-arei.gonglei@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | ppc/spapr_drc: fix memory leakGonglei2015-07-161-0/+1
| |/ | | | | | | | | | | | | | | fix CID 1311373. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Message-Id: <1436489490-236-3-git-send-email-arei.gonglei@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | qxl: allow to specify head limit to qxl driverFrediano Ziglio2015-07-162-5/+24
|/ | | | | | | | | | | | | This patch allow to limit number of heads using qxl driver. By default qxl driver is not limited on any kind on head use so can decide to use as much heads. libvirt has this as a video card parameter (actually set to 1 but not used). This parameter will allow to limit setting a use can do (which could be confusing). Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/arm/boot: Increase fdt alignmentAlexander Graf2015-07-151-6/+22
| | | | | | | | | | | | | | | | | | | | The Linux kernel on aarch64 creates a page table entry at early bootup that spans the 2MB range on memory spanning the fdt start address: [ ALIGN_DOWN(fdt, 2MB) ... ALIGN_DOWN(fdt, 2MB) + 2MB ] This means that when our current 4k alignment happens to fall at the end of the aligned region, Linux tries to access memory that is not mapped. The easy fix is to instead increase the alignment to 2MB, making Linux's logic always succeed. We leave the existing 4k alignment for 32bit kernels to not cause any regressions due to space constraints. Reported-by: Andreas Schwab <schwab@suse.de> Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150714' into stagingPeter Maydell2015-07-143-2/+14
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | s390x fixes for 2.4: - virtio migration regression - missing diag288 watchdog resets # gpg: Signature made Tue Jul 14 18:17:54 2015 BST using RSA key ID C6F02FAF # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" * remotes/cohuck/tags/s390x-20150714: s390/virtio-ccw: Fix migration watchdog/diag288: correctly register for system reset requests Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * s390/virtio-ccw: Fix migrationChristian Borntraeger2015-07-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 213941d73b ("virtio-ccw: migrate ->revision") broke migration: 2015-07-07T11:22:55.570968Z qemu-system-s390x: VQ 39 address 0x0 inconsistent with Host index 0x100 2015-07-07T11:22:55.571008Z qemu-system-s390x: error while loading state for instance 0x0 of If thinint support is active, the config_load function returns early. Make sure to load the revision all the time. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Fixes: 213941d73b ("virtio-ccw: migrate ->revision") Message-Id: <1436269643-66303-1-git-send-email-borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
| * watchdog/diag288: correctly register for system reset requestsXu Wang2015-07-142-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The diag288 watchdog is no sysbus device, therefore it doesn't get triggered on resets automatically using dc->reset. Let's register the reset handler manually, so we get correctly notified again when a system reset was requested. Also reset the watchdog on subsystem resets that don't trigger a full system reset. Signed-off-by: Xu Wang <gesaint@linux.vnet.ibm.com> Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Tested-by: Christian Borntraeger <borntraeger@de.ibm.com> Reviewed-by: Andreas Färber <afaerber@suse.de>
* | nvme: properly report volatile write cachesChristoph Hellwig2015-07-141-5/+14
| | | | | | | | | | | | | | | | | | | | Implement support in Identify and Get/Set Features to properly report and allow to change the Volatile Write Cache status reported by the virtual NVMe device. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Keith Busch <keith.busch@intel.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* | nvme: implement the Flush commandChristoph Hellwig2015-07-142-3/+17
|/ | | | | | | | | | Implement a real flush instead of faking it. This is especially important as Qemu assume Write back cashing by default and thus requires a working cache flush operation for data integrity. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Keith Busch <keith.busch@intel.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell2015-07-134-5/+6
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pc,virtio: fixes for 2.4 pc and virtio changes, bugfixes only. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon Jul 13 13:03:38 2015 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: pc: fix reuse of pc-i440fx-2.4 in pc-i440fx-2.3 Revert "virtio-net: enable virtio 1.0" virtio-pci: don't crash on illegal length qdev: fix 64 bit properties Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * pc: fix reuse of pc-i440fx-2.4 in pc-i440fx-2.3Eduardo Habkost2015-07-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit fddd179ab962f6f78a8493742e1068d6a620e059, "pc: Convert *_MACHINE_OPTIONS macros into functions" broke the chaining of *_machine_options() functions on pc-i440fx-2.3, at: -#define PC_I440FX_2_3_MACHINE_OPTIONS \ - PC_I440FX_2_4_MACHINE_OPTIONS, \ - .alias = NULL, \ - .is_default = 0 +static void pc_i440fx_2_3_machine_options(QEMUMachine *m) +{ + pc_i440fx_machine_options(m); + m->alias = NULL; + m->is_default = 0; +} I have replaced PC_I440FX_2_4_MACHINE_OPTIONS with a pc_i440fx_machine_options() call, instead of calling pc_i440fx_2_4_machine_options(). This broke the setting of default_machine_opts and default_display on pc-i440fx-{2.0,2,1,2.2,2.3}. Fix this by making pc_i440fx_2_3_machine_options() reuse pc_i440fx_2_4_machine_options(). Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
| * Revert "virtio-net: enable virtio 1.0"Jason Wang2015-07-131-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit df91055db5c9cee93d70ca8c08d72119a240b987. This is because: - vhost support virtio 1.0 now - transport code (e.g virtio-pci) set this feature when modern is enabled, setting this unconditionally will break disable-modern=on. Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * virtio-pci: don't crash on illegal lengthMichael S. Tsirkin2015-07-131-2/+4
| | | | | | | | | | | | | | | | Some guests seem to access cfg with an illegal length value. It's worth fixing them but debugging is easier if qemu does not crash. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * qdev: fix 64 bit propertiesCornelia Huck2015-07-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | 64 bit props used 32 bit callbacks in two places, leading to broken feature bits on virtio (example: got 0x31000000000006d4 which is obviously bogus). Fix this. Fixes: fdba6d96 ("qdev: add 64bit properties") Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Christian Borntraeger <borntraeger@de.ibm.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
* | microblaze: boot: Use cpu_set_pc()Peter Crosthwaite2015-07-091-2/+3
| | | | | | | | | | | | | | | | | | | | | | Use cpu_set_pc() for setting program counters when bootloading. This removes an instance of system level code having to reach into the CPU env. Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> [AF: Avoid duplicated CPU() casts through local variable] Signed-off-by: Andreas Färber <afaerber@suse.de>
* | hw/arm/boot: Use cpu_set_pc()Peter Crosthwaite2015-07-091-13/+11
| | | | | | | | | | | | | | | | | | | | | | | | Use cpu_set_pc() across the board for setting program counters. This removes instances of system level code having to reach into the CPU env. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> [AF: Avoid repeated casts with local variables] Signed-off-by: Andreas Färber <afaerber@suse.de>
OpenPOWER on IntegriCloud