aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2015-12-10virtio-9p-device: add minimal unrealize handlerGreg Kurz1-0/+12
Since commit 4652f1640e029e1f2433fa77ba6af285 "virtio-9p: add savevm handlers", if the user hot-unplugs a quiescent 9p device and live migrates, the source QEMU crashes before migration completetion... This happens because virtio-9p devices have a realize handler which calls virtio_init() and register_savevm(). Both calls store pointers to the device internals, that get dereferenced during migration even if the device got unplugged. This patch simply adds an unrealize handler to perform minimal cleanup and avoid the crash. Hot unplug of non-quiescent 9p devices is still not supported in QEMU, and not supported by linux guests either. Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20151208155457.27775.69441.stgit@bahia.huguette.org [PMM: rewrapped long lines in commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-12-07sd: Mark brittle abuse of blk_attach_dev() FIXMEMarkus Armbruster1-0/+1
blk_attach_dev() fails here only when we're working for device "sdhci-pci" (which already attached the backend), and then we don't want to attach a second time. If we ever create another failure mode, we're setting up ourselves to using the same backend from multiple frontends, which is likely to end in tears. Can't clean this up this close to the release, so mark it FIXME. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1449503710-3707-3-git-send-email-armbru@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-12-07sdhci: Sanitize "sdhci-pci" properties for future qomificationMarkus Armbruster1-2/+7
We currently fuse controller and card into a single device model, but we intend qomify things properly and separate the two. The properties that really belong to the card would then have to somehow pass-through to the card's properties. To avoid that complication, either mark them experimental or drop them. Properties "capareg", "maxcurr" and the usual PCI device properties belong to the controller. Property "drive" belongs to the card; rename it to "x-drive". Properties "logical_block_size", "physical_block_size", "min_io_size", "opt_io_size", "discard_granularity" belong to the card, but have no effect; drop them. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1449503710-3707-2-git-send-email-armbru@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-12-07virtio-blk: Drop x-data-plane optionFam Zheng2-14/+2
The official way of enabling dataplane is through the "iothread" property that references an iothread object created by "-object iothread". Since the old "x-data-plane=on" way now even crashes, it's probably easier to just drop it: $ qemu-system-x86_64 -drive file=null-co://,id=d0,if=none \ -device virtio-blk-pci,drive=d0,x-data-plane=on ERROR:/home/fam/work/qemu/qom/object.c:1515: object_get_canonical_path_component: assertion failed: (obj->parent != NULL) Aborted Signed-off-by: Fam Zheng <famz@redhat.com> Message-id: 1449485967-19240-1-git-send-email-famz@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-12-07Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell4-11/+29
staging # gpg: Signature made Mon 07 Dec 2015 14:06:07 GMT using RSA key ID 398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: lan9118: log and ignore access to invalid registers, rather than aborting lan9118: fix emulation of MAC address loaded bit in E2P_CMD register vmxnet3: silence warning pcnet: fix rx buffer overflow(CVE-2015-7512) net: pcnet: add check to validate receive data size(CVE-2015-7504) e1000: fix hang of win2k12 shutdown with flood ping Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-12-07lan9118: log and ignore access to invalid registers, rather than abortingAndrew Baumann1-4/+8
With this change, access to invalid/unimplemented device registers are logged as a "guest error" rather than aborting qemu with hw_error. This enables drivers for similar devices (e.g. SMSC 9221), by simply ignoring the unimplemented writes. It's also closer to what real hardware does. Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2015-12-07lan9118: fix emulation of MAC address loaded bit in E2P_CMD registerAndrew Baumann1-3/+5
There appears to have been a longstanding typo in the implementation of the "MAC address loaded" bit in the E2P_CMD (EEPROM command) register. The code was using 0x10, but the controller spec says it should be bit 8 (0x100). Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2015-12-07vmxnet3: silence warningMichael S. Tsirkin1-1/+0
vmxnet3 always produces a warning under qtest. This is not a user error, don't warn. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2015-12-07pcnet: fix rx buffer overflow(CVE-2015-7512)Jason Wang1-0/+6
Backends could provide a packet whose length is greater than buffer size. Check for this and truncate the packet to avoid rx buffer overflow in this case. Cc: Prasad J Pandit <pjp@fedoraproject.org> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2015-12-07net: pcnet: add check to validate receive data size(CVE-2015-7504)Prasad J Pandit1-3/+5
In loopback mode, pcnet_receive routine appends CRC code to the receive buffer. If the data size given is same as the buffer size, the appended CRC code overwrites 4 bytes after s->buffer. Added a check to avoid that. Reported by: Qinghao Tang <luodalongde@gmail.com> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2015-12-07e1000: fix hang of win2k12 shutdown with flood pingDenis V. Lunev1-0/+5
e1000 driver in Win2k12 is really well rotten. It 100% hangs on shutdown of UP VM under flood ping. The guest checks card state and reinjects itself interrupt in a loop. This is fatal for UP machine. There is no good way to fix this misbehavior but to kludge it. The emulation has interrupt throttling register aka ITR which limits interrupt rate and allows the guest to proceed this phase. There is no problem with this kludge for Linux guests - it adjust the value of it itself. On the other hand according to the initial research in commit e9845f0985f088dd01790f4821026df0afba5795 Author: Vincenzo Maffione <v.maffione@gmail.com> Date: Fri Aug 2 18:30:52 2013 +0200 e1000: add interrupt mitigation support ... Interrupt mitigation boosts performance when the guest suffers from an high interrupt rate (i.e. receiving short UDP packets at high packet rate). For some numerical results see the following link http://info.iet.unipi.it/~luigi/papers/20130520-rizzo-vm.pdf this should also boost performance a bit. See https://bugzilla.redhat.com/show_bug.cgi?id=874406 for additional details. Signed-off-by: Denis V. Lunev <den@openvz.org> CC: Vincenzo Maffione <v.maffione@gmail.com> CC: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2015-12-04Merge remote-tracking branch ↵Peter Maydell2-2/+3
'remotes/mjt/tags/pull-trivial-patches-2015-12-04' into staging trivial patches for 2015-12-04 # gpg: Signature made Fri 04 Dec 2015 06:40:23 GMT using RSA key ID A4C3D7DB # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" * remotes/mjt/tags/pull-trivial-patches-2015-12-04: bt: check struct sizes typedefs: Put them back into alphabetical order scsi: remove scsi_req_free prototype gt64xxx: fix decoding of ISD register configure: use appropriate code fragment for -fstack-protector checks crypto: avoid two coverity false positive error reports configure: Diagnose broken linkers directly bt: avoid unintended sign extension util/id: fully allocate names table Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-12-04gt64xxx: fix decoding of ISD registerPaolo Bonzini1-1/+2
The GT64xxx's internal registers can be placed above the first 4 GiB in the address space, but not above the first 64 GiB. Correctly cast the register to a 64-bit integer, and mask away bits above bit 35. Datasheet at http://pdf.datasheetarchive.com/datasheetsmain/Datasheets-33/DSA-655889.pdf (bug reported by Coverity). Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-12-04bt: avoid unintended sign extensionPaolo Bonzini1-1/+1
In the case of a 4-byte length, shifting a value by 24 may cause an unintended sign extension when converting from int to size_t. Use a uint32_t variable instead. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-12-04spapr_drc: Change value of property "fdt" from null back to {}Markus Armbruster1-0/+5
prop_get_fdt() misuses the visitor API: when fdt is null, it doesn't visit anything. object_property_get_qobject() happily object_property_get_qobject(). Amazingly, the latter survives the misuse. Turns out we've papered over it long before prop_get_fdt() existed, in commit 1d10b44. However, commit 6c2f9a1 changed how we paper over it, and as a side effect changed qom-get's value from {} to null. Change it right back by fixing the visitor misuse. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2015-12-04spapr_drc: Make device "spapr-dr-connector" unavailable with -deviceMarkus Armbruster1-0/+4
It should only be created via spapr_dr_connector_new(). Attempting to create it with -device crashes. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2015-12-04spapr_drc: Handle visitor errors properlyMarkus Armbruster1-6/+26
Since prop_get_fdt() is only used with QmpOutputVisitor, errors shouldn't actually happen, so this is only a latent bug. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2015-12-02virtio-pci: Set the QEMU_PCI_CAP_EXPRESS capability early in its DeviceClass ↵Shmulik Ladkani2-5/+26
realize method In 1811e64 'hw/virtio: Add PCIe capability to virtio devices', the QEMU_PCI_CAP_EXPRESS capability was added to virtio's pci_dev, within 'virtio_pci_realize' - the pci device object realization method. This occurs to late, as 'pci_qdev_realize' (DeviceClass.realize of TYPE_PCI_DEVICE) has already been called, without knowing that the device instance is indeed an "express" instance, thus allocating insufficient pci config space. As a result, device may crash upon attempt to write to the PCIE config space. Fix, by arming the QEMU_PCI_CAP_EXPRESS capability early in virtio-pci's own DeviceClass realize method. This also makes code cleaner, as 'virtio_pci_realize' may now access the 'pci_is_express' predicate when needed. Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Tested-by: Marcel Apfelbaum <marcel@redhat.com>
2015-12-02virtio: handle non-virtio-1-capable backend for ccwCornelia Huck2-0/+15
If you run a qemu advertising VERSION_1 with an old kernel where vhost did not yet support VERSION_1, you'll end up with a device that is {modern pci|ccw revision 1} but does not advertise VERSION_1. This is not a sensible configuration and is rejected by the Linux guest drivers. To fix this, add a ->post_plugged() callback invoked after features have been queried that can handle the VERSION_1 bit being withdrawn and change ccw to fall back to revision 0 if VERSION_1 is gone. Note that pci is _not_ fixed; we'll need to rethink the approach for the next release but at least for pci it's not a regression. Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-12-01Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20151201' into stagingPeter Maydell4-8/+36
Last round of s390x fixes for 2.5: - The bios should be built for the first z machine, so that newer instructions don't creep in. - Silence annoying message when running make check. - Fix a problem with the pci iommu exposed by recent changes. # gpg: Signature made Tue 01 Dec 2015 08:59:42 GMT using RSA key ID C6F02FAF # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" * remotes/cohuck/tags/s390x-20151201: s390x/pci: fix up IOMMU size s390x: no deprecation warning while testing pc-bios/s390-ccw: rebuild image pc-bios/s390-ccw: build for z900 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-12-01s390x/pci: fix up IOMMU sizeYi Min Zhao3-5/+30
Present code uses @size==UINT64_MAX to initialize IOMMU. It infers that it can map any 64-bit IOVA whatsoever. But in fact, the largest DMA range for each PCI Device on s390x is from ZPCI_SDMA_ADDR to ZPCI_EDMA_ADDR. The largest value is returned from hardware, which is to indicate the largest range hardware can support. But the real IOMMU size for specific PCI Device is obtained once qemu intercepts mpcifc instruction that guest is requesting a DMA range for that PCI Device. Therefore, before intercepting mpcifc instruction, qemu cannot be aware of the size of IOMMU region that guest will use. Moreover, iommu replay during device initialization for the whole region in 4k steps takes a very long time. In conclusion, this patch intializes IOMMU region for each PCI Device when intercept mpcifc instruction which is to register DMA range for the PCI Device. And then, destroy IOMMU region when guest wants to deregister IOAT. Signed-off-by: Yi Min Zhao <zyimin@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2015-12-01s390x: no deprecation warning while testingCornelia Huck1-3/+6
'make check' tries to start all available machines; the deprecation message for the s390-virtio machine is both useless and annoying there. Silence it while testing. Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Acked-by: Michael S. Tsirkin <mst@redhat.com>
2015-11-30Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell3-68/+15
Two fixes for virtfs/9p from Paolo. # gpg: Signature made Mon 30 Nov 2015 14:10:47 GMT using DSA key ID 0101DBC2 # gpg: Good signature from "Greg Kurz <gkurz@fr.ibm.com>" # gpg: aka "Greg Kurz <groug@free.fr>" # gpg: aka "Greg Kurz <gkurz@linux.vnet.ibm.com>" # gpg: aka "Gregory Kurz (Groug) <groug@free.fr>" # gpg: aka "Gregory Kurz (Cimai Technology) <gkurz@cimai.com>" # gpg: aka "Gregory Kurz (Meiosys Technology) <gkurz@meiosys.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2BD4 3B44 535E C0A7 9894 DBA2 02FC 3AEB 0101 DBC2 * remotes/gkurz/tags/for-upstream: virtio-9p: use QEMU thread pool fsdev-proxy-helper: avoid TOC/TOU race Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-11-30virtio-9p: use QEMU thread poolPaolo Bonzini3-68/+15
The QEMU thread pool already has a mechanism to invoke callbacks in the main thread. It does not need an EventNotifier and it is more efficient too. Use it instead of GAsyncQueue + GThreadPool + glue. As a side effect, it silences Coverity's complaint about an unchecked return value for event_notifier_init. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Greg Kurz <gkurz@linux.vnet.ibm.com> (removed no more needed #include <glib.h> from virtio-9p-coth.h) Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
2015-11-30hw/ppc/ppc405_boards: Fix infinite recursion by converting taihu_cpld from ↵Peter Maydell1-44/+8
old_mmio The taihu_cpld_writel() function had an obvious typo that meant that if it was ever called it would go into an infinite recursion. Newer versions of clang will detect and warn about this: hw/ppc/ppc405_boards.c:481:1: warning: all paths through this function will call itself [-Winfinite-recursion] Fix this by converting taihu_cpld from the legacy old_mmio accessors to new-style ones, with an impl {} declaration to cause the core memory code to do the splitting of 16 bit and 32 bit accesses into multiple 8-bit accesses. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2015-11-30hw/ppc/spapr: Remove duplicated "pseries" aliasThomas Huth1-2/+0
The "pseries" alias is currently set twice, one time for the pseries-2.4 machine and one time for the "pseries-2.5" machine. To avoid confusion with the alias, let's remove the one from the older machine class. And while we're at it, also remove the "is_default = 0" there since the is_default variable should be set to zero by default already. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2015-11-30mac_dbdma: always initialize channel field in DBDMA_channelHervé Poussineau1-1/+1
dbdma_from_ch() uses channel field to return the right DBDMA object. Previous code was working if guest OS was only using registered DMA channels. However, it lead to QEMU crashes if guest OS was using unregistered DMA channels. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2015-11-27eepro100: Prevent two endless loopsStefan Weil1-0/+16
http://lists.nongnu.org/archive/html/qemu-devel/2015-11/msg04592.html shows an example how an endless loop in function action_command can be achieved. During my code review, I noticed a 2nd case which can result in an endless loop. Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Jason Wang <jasowang@redhat.com>
2015-11-26Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell5-11/+2
vhost, pc: fixes for 2.5 Minor vhost fixes. HW version tweak for PC. Documentation and test updates. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Thu 26 Nov 2015 16:40:25 GMT using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: vhost-user-test: fix migration overlap test Fix memory leak on error Revert "vhost: send SET_VRING_ENABLE at start/stop" tests/vhost-user-bridge: read command line arguments tests/vhost-user-bridge: propose GUEST_ANNOUNCE feature vhost-user: clarify start and enable vhost-user: set link down when the char device is closed pc: Don't set hw_version on pc-*-2.5 osdep: Change default value of qemu_hw_version() to "2.5+" Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-11-26Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell1-1/+1
Small patches, without the one that introduces -fwrapv. # gpg: Signature made Thu 26 Nov 2015 15:48:53 GMT using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" * remotes/bonzini/tags/for-upstream: target-i386: kvm: Print warning when clearing mcg_cap bits target-i386: kvm: Use env->mcg_cap when setting up MCE target-i386: kvm: Abort if MCE bank count is not supported by host virtio-scsi: don't crash without a valid device target-sparc: fix 32-bit truncation in fpackfix exec: remove warning about mempath and hugetlbfs Revert "exec: silence hugetlbfs warning under qtest" call bdrv_drain_all() even if the vm is stopped MAINTAINERS: Update TCG CPU cores section Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-11-26virtio-scsi: don't crash without a valid deviceEugene (jno) Dvurechenski1-1/+1
Make sure that we actually have a device when checking the aio context. Otherwise guests could trigger QEMU crashes. Signed-off-by: "Eugene (jno) Dvurechenski" <jno@linux.vnet.ibm.com> Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Message-Id: <1448549135-6582-2-git-send-email-jno@linux.vnet.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-11-26Fix memory leak on errorStefano Dong (董兴水)2-0/+2
hw/ppc/spapr.c: Fix memory leak on error, it was introduced in bc09e0611 hw/acpi/memory_hotplug.c: Fix memory leak on error, it was introduced in 34f2af3d Signed-off-by: Stefano Dong (董兴水) <opensource.dxs@aliyun.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-11-26Revert "vhost: send SET_VRING_ENABLE at start/stop"Michael S. Tsirkin1-9/+0
This reverts commit 3a12f32229a046f4d4ab0a3a52fb01d2d5a1ab76. In case of live migration several queues can be enabled and not only the first one. So informing backend that only the first queue is enabled is wrong. Reported-by: Thibaut Collet <thibaut.collet@6wind.com> Cc: Yuanhan Liu <yuanhan.liu@linux.intel.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Yuanhan Liu <yuanhan.liu@linux.intel.com>
2015-11-26Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into stagingPeter Maydell1-3/+5
# gpg: Signature made Wed 25 Nov 2015 20:25:21 GMT using RSA key ID AAFC390E # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" * remotes/jnsnow/tags/ide-pull-request: ide-test: fix timeouts atapi: Fix code indentation atapi: Account for failed and invalid operations in cd_read_sector() ide-test: cdrom_pio_impl fixup Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-11-25Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell1-1/+1
Block layer patches # gpg: Signature made Wed 25 Nov 2015 13:33:14 GMT using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: qemu-iotests: Add -nographic when starting QEMU in 119 and 120 block/qapi: Plug memory leak on query-block error path raw-posix.c: Make GetBSDPath() handle caching options nand: fix flash erase when oob is in memory test-aio: Fix event notifier cleanup tests/Makefile: Add more dependencies for test-timed-average Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-11-25nand: fix flash erase when oob is in memoryRicard Wanderlof1-1/+1
For the "main area on file, oob in memory" case, fix the shifts so that we erase the correct number of pages. Signed-off-by: Ricard Wanderlöf <ricardw@axis.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2015-11-25Merge remote-tracking branch 'remotes/sstabellini/tags/xen-20151125' into ↵Peter Maydell2-9/+1
staging Xen 2015/11/25 # gpg: Signature made Wed 25 Nov 2015 11:19:26 GMT using RSA key ID 70E1AE90 # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>" * remotes/sstabellini/tags/xen-20151125: xen_disk: Remove ioreq.postsync xen: fix usage of xc_domain_create in domain builder Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-11-25pc: Don't set hw_version on pc-*-2.5Eduardo Habkost2-2/+0
Now that qemu_hw_version() returns a fixed "2.5+" string instead of QEMU_VERSION, we don't need to set hw_version on pc-*-2.5 explicitly. Suggested-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-11-25xen_disk: Remove ioreq.postsyncAlberto Garcia1-8/+0
This code has been dead for three years (since commit 7e7b7cba1). Signed-off-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2015-11-25ivshmem: Rename property memdev to x-memdev for 2.5Markus Armbruster1-5/+3
The device's guest interface and its QEMU user interface are flawed^Whotly debated. We'll resolve that in the next development cycle, probably by deprecating the device in favour of a cleaned up, but not quite compatible revision. To avoid adding more baggage to the soon-to-be-deprecated interface, mark property "memdev" as experimental, by renaming it to "x-memdev". It's the only recent user interface change. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1448384789-14830-6-git-send-email-armbru@redhat.com> [Update of qemu-doc.texi squashed in] Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2015-11-25ivshmem: Mark questionable socket type test FIXMEMarkus Armbruster1-0/+1
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2015-11-24atapi: Fix code indentationAlberto Garcia1-1/+1
This was accidentally changed by commit 5f81724d Signed-off-by: Alberto Garcia <berto@igalia.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 93fb43522e3b8dddb6c709d568919347d9a5ba3f.1448367341.git.berto@igalia.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-11-24atapi: Account for failed and invalid operations in cd_read_sector()Alberto Garcia1-2/+4
Commit 5f81724d made PIO read requests async but didn't add the relevant block_acct_failed() and block_acct_invalid() calls. Signed-off-by: Alberto Garcia <berto@igalia.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 9b87e09d61019c128139b6c999ed0c07f0674170.1448367341.git.berto@igalia.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-11-24xlnx-ep108: Fix minimum RAM checkAlistair Francis1-1/+1
The minimum RAM check logic for the Xiilnx EP108 was off by one, which caused a false positive. Correct the logic to only print warnings when the RAM is below 0x8000000. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: fba8112ca7b01efd72553332b8045ecf107b7662.1448021100.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-11-24virtio-blk: Move resetting of req->mr_next to virtio_blk_handle_rw_errorFam Zheng1-4/+3
"werror=report" would free the req in virtio_blk_handle_rw_error, we mustn't write to it in that case. Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Message-id: 1448239280-15025-1-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-11-19Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' ↵Peter Maydell1-1/+4
into staging QOM infrastructure fixes and device conversions * Fix for properties on objects > 4 GiB * Performance improvements for QOM property handling * Assertion cleanups * MAINTAINERS additions # gpg: Signature made Thu 19 Nov 2015 14:32:16 GMT using RSA key ID 3E7E013F # gpg: Good signature from "Andreas Färber <afaerber@suse.de>" # gpg: aka "Andreas Färber <afaerber@suse.com>" * remotes/afaerber/tags/qom-devices-for-peter: MAINTAINERS: Add check-qom-{interface,proplist} to QOM qom: Clean up assertions to display values on failure qom: Replace object property list with GHashTable qom: Add a test case for complex property finalization net: Convert net filter code to use object property iterators ppc: Convert spapr code to use object property iterators vl: Convert machine help code to use object property iterators qmp: Convert QMP code to use object property iterators qom: Introduce ObjectPropertyIterator struct for iteration qdev: Change Property::offset field to ptrdiff_t type Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-11-19Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell6-31/+28
vhost, pc: fixes for 2.5 Fixes all over the place. This also re-enables a test we disabled in 2.5 cycle now that there's a way not to get a warning from it. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Thu 19 Nov 2015 13:27:43 GMT using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: exec: silence hugetlbfs warning under qtest tests: re-enable vhost-user-test acpi: fix buffer overrun on migration vhost-user: fix log size vhost-user: ignore qemu-only features specs/vhost-user: fix spec to match reality tests/vhost-user-bridge: implement logging of dirty pages i440fx: print an error message if user tries to enable iommu q35: Check propery to determine if iommu is set vhost-user: start/stop all rings vhost-user: print original request on error vhost-user-test: support VHOST_USER_SET_VRING_ENABLE vhost-user: update spec description vhost: don't send RESET_OWNER at stop vhost: let SET_VRING_ENABLE message depends on protocol feature Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-11-19acpi: fix buffer overrun on migrationMichael S. Tsirkin1-2/+6
ich calls acpi_gpe_init with length ICH9_PMIO_GPE0_LEN so ICH9_PMIO_GPE0_LEN/2 bytes are allocated, but then the full ICH9_PMIO_GPE0_LEN bytes are migrated. As a quick work-around, allocate twice the memory. We'll probably want to tweak code to avoid migrating the extra ICH9_PMIO_GPE0_LEN/2 bytes, but that is a bit trickier to do without breaking migration compatibility. Tested-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-11-19hw/arm_gic: Correctly restore nested irq priorityFrançois Baldassari1-2/+2
Upon activating an interrupt, set the corresponding priority bit in the APR/NSAPR registers without touching the currently set bits. In the event of nested interrupts, the GIC will then have the information it needs to restore the priority of the pre-empted interrupt once the higher priority interrupt finishes execution. Signed-off-by: François Baldassari <francois@pebble.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-11-18ppc: Convert spapr code to use object property iteratorsDaniel P. Berrange1-1/+4
Stop directly accessing the Object::properties field data structure and instead use the formal object property iterator APIs. This insulates the code from future data structure changes in the Object struct. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Tested-by: Pavel Fedin <p.fedin@samsung.com> Signed-off-by: Andreas Färber <afaerber@suse.de>