]> Git Repo - qemu.git/log
qemu.git
9 years agoMerge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150813' into...
Peter Maydell [Thu, 13 Aug 2015 11:04:24 +0000 (12:04 +0100)]
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150813' into staging

target-arm queue:
 * i.MX code cleanup/refactorings
 * i.MX UART fix to work with uninitialized chardev
 * minor GIC code refactorings
 * implement the ARM Secure physical timer
 * implement the ARM Hypervisor timer

# gpg: Signature made Thu 13 Aug 2015 11:40:56 BST using RSA key ID 14360CDE
# gpg: Good signature from "Peter Maydell <[email protected]>"

* remotes/pmaydell/tags/pull-target-arm-20150813: (27 commits)
  i.MX: Fix UART driver to work with unitialized "chardev" device
  hw/cpu/a15mpcore: Wire up hyp and secure physical timer interrupts
  hw/arm/virt: Wire up secure timer interrupt
  target-arm: Add AArch32 banked register access to secure physical timer
  target-arm: Add the AArch64 view of the Secure physical timer
  target-arm: Add debug check for mismatched cpreg resets
  Introduce gic_class_name() instead of repeating condition
  hw/arm/gic: Kill code duplication
  Merge memory_region_init_reservation() into memory_region_init_io()
  i.MX: Fix Coding style for GPT emulator
  i.MX: Split GPT emulator in a header file and a source file
  i.MX: Fix Coding style for EPIT emulator
  i.MX: Split EPIT emulator in a header file and a source file
  i.MX: Fix Coding style for CCM emulator
  i.MX: Split CCM emulator in a header file and a source file
  i.MX: Fix Coding style for AVIC emulator.
  i.MX: Split AVIC emulator in a header file and a source file
  i.MX:Fix Coding style for UART emulator.
  i.MX: Move serial initialization to init/realize of DeviceClass.
  i.MX: Split UART emulator in a header file and a source file
  ...

Signed-off-by: Peter Maydell <[email protected]>
9 years agoi.MX: Fix UART driver to work with unitialized "chardev" device
Jean-Christophe Dubois [Thu, 13 Aug 2015 10:26:22 +0000 (11:26 +0100)]
i.MX: Fix UART driver to work with unitialized "chardev" device

The "chardev" property initialization might have failed (for example because
there are not enough chardevs provided by QEMU).

The serial device emulator needs to be able to work with an uninitialized
(NULL) chardev device pointer.

This patch adds some missing tests on the chr pointer value before
using it.

Signed-off-by: Jean-Christophe Dubois <[email protected]>
Reviewed-by: Peter Crosthwaite <[email protected]>
Message-id: 1438342461[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agohw/cpu/a15mpcore: Wire up hyp and secure physical timer interrupts
Peter Maydell [Thu, 13 Aug 2015 10:26:22 +0000 (11:26 +0100)]
hw/cpu/a15mpcore: Wire up hyp and secure physical timer interrupts

Since we now support both the hypervisor and the secure physical timer, wire
their interrupt lines up in the a15mpcore wrapper object.

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 1437047249[email protected]
Reviewed-by: Edgar E. Iglesias <[email protected]>
9 years agohw/arm/virt: Wire up secure timer interrupt
Peter Maydell [Thu, 13 Aug 2015 10:26:22 +0000 (11:26 +0100)]
hw/arm/virt: Wire up secure timer interrupt

Wire up the secure timer interrupt. Since we've defined
that the plain old physical timer is the NS timer, we can
drop the now-out-of-date comment about QEMU not having TZ.

Use a data-driven loop to wire up the timer interrupts, since
we now have four of them and the code is the same for each.

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 1437047249[email protected]
Reviewed-by: Edgar E. Iglesias <[email protected]>
9 years agotarget-arm: Add AArch32 banked register access to secure physical timer
Peter Maydell [Thu, 13 Aug 2015 10:26:22 +0000 (11:26 +0100)]
target-arm: Add AArch32 banked register access to secure physical timer

If EL3 is AArch32, then the secure physical timer is accessed via
banking of the registers used for the non-secure physical timer.
Implement this banking.

Note that the access controls for the AArch32 banked registers
remain the same as the physical-timer checks; they are not the
same as the controls on the AArch64 secure timer registers.

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 1437047249[email protected]
Reviewed-by: Edgar E. Iglesias <[email protected]>
9 years agotarget-arm: Add the AArch64 view of the Secure physical timer
Peter Maydell [Thu, 13 Aug 2015 10:26:22 +0000 (11:26 +0100)]
target-arm: Add the AArch64 view of the Secure physical timer

On CPUs with EL3, there are two physical timers, one for Secure and one
for Non-secure. Implement this extra timer and the AArch64 registers
which access it.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Message-id: 1437047249[email protected]

9 years agotarget-arm: Add debug check for mismatched cpreg resets
Peter Maydell [Thu, 13 Aug 2015 10:26:21 +0000 (11:26 +0100)]
target-arm: Add debug check for mismatched cpreg resets

It's easy to accidentally define two cpregs which both try
to reset the same underlying state field (for instance a
clash between an AArch64 EL3 definition and an AArch32
banked register definition). if the two definitions disagree
about the reset value then the result is dependent on which
one happened to be reached last in the hashtable enumeration.

Add a consistency check to detect and assert in these cases:
after reset, we run a second pass where we check that the
reset operation doesn't change the value of the register.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Message-id: 1436797559[email protected]

9 years agoIntroduce gic_class_name() instead of repeating condition
Pavel Fedin [Thu, 13 Aug 2015 10:26:21 +0000 (11:26 +0100)]
Introduce gic_class_name() instead of repeating condition

This small inline returns correct GIC class name depending on whether we
use KVM acceleration or not. Avoids duplicating the condition everywhere.

Signed-off-by: Pavel Fedin <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Message-id: 4f26901be9b844b563673ce3ad08eeedbb7a7132.1438758065[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agohw/arm/gic: Kill code duplication
Pavel Fedin [Thu, 13 Aug 2015 10:26:21 +0000 (11:26 +0100)]
hw/arm/gic: Kill code duplication

Extracted duplicated initialization code from SW-emulated and KVM GIC
implementations and put into gic_init_irqs_and_mmio()

Signed-off-by: Pavel Fedin <[email protected]>
Message-id: 8ea5b2781ef39cb5989420987fc73c70e377687d.1438758065[email protected]
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
9 years agoMerge memory_region_init_reservation() into memory_region_init_io()
Pavel Fedin [Thu, 13 Aug 2015 10:26:21 +0000 (11:26 +0100)]
Merge memory_region_init_reservation() into memory_region_init_io()

Just specifying ops = NULL in some cases can be more convenient than having
two functions.

Signed-off-by: Pavel Fedin <[email protected]>
Acked-by: Paolo Bonzini <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Message-id: 78a379ab1b6b30ab497db7971ad336dad1dbee76.1438758065[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoi.MX: Fix Coding style for GPT emulator
Jean-Christophe Dubois [Thu, 13 Aug 2015 10:26:21 +0000 (11:26 +0100)]
i.MX: Fix Coding style for GPT emulator

Signed-off-by: Jean-Christophe Dubois <[email protected]>
Reviewed-by: Peter Crosthwaite <[email protected]>
Message-id: cc7d1589e774e87c346b75a6c25e07957f436ced.1437080501[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoi.MX: Split GPT emulator in a header file and a source file
Jean-Christophe Dubois [Thu, 13 Aug 2015 10:26:20 +0000 (11:26 +0100)]
i.MX: Split GPT emulator in a header file and a source file

Signed-off-by: Jean-Christophe Dubois <[email protected]>
Reviewed-by: Peter Crosthwaite <[email protected]>
Message-id: e32fba56b9dae3cc7c83726550514b2d0c890ae0.1437080501[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoi.MX: Fix Coding style for EPIT emulator
Jean-Christophe Dubois [Thu, 13 Aug 2015 10:26:20 +0000 (11:26 +0100)]
i.MX: Fix Coding style for EPIT emulator

Signed-off-by: Jean-Christophe Dubois <[email protected]>
Reviewed-by: Peter Crosthwaite <[email protected]>
Message-id: d8d70683c6a48ac318c1635595619cfb0eb31681.1437080501[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoi.MX: Split EPIT emulator in a header file and a source file
Jean-Christophe Dubois [Thu, 13 Aug 2015 10:26:20 +0000 (11:26 +0100)]
i.MX: Split EPIT emulator in a header file and a source file

Signed-off-by: Jean-Christophe Dubois <[email protected]>
Reviewed-by: Peter Crosthwaite <[email protected]>
Message-id: 948927cab0c85da9a753c5f6d5501323d5604c8e.1437080501[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoi.MX: Fix Coding style for CCM emulator
Jean-Christophe Dubois [Thu, 13 Aug 2015 10:26:20 +0000 (11:26 +0100)]
i.MX: Fix Coding style for CCM emulator

Signed-off-by: Jean-Christophe Dubois <[email protected]>
Reviewed-by: Peter Crosthwaite <[email protected]>
Message-id: ff0b6720b1c55204e663f07be47c0203f6871084.1437080501[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoi.MX: Split CCM emulator in a header file and a source file
Jean-Christophe Dubois [Thu, 13 Aug 2015 10:26:20 +0000 (11:26 +0100)]
i.MX: Split CCM emulator in a header file and a source file

Signed-off-by: Jean-Christophe Dubois <[email protected]>
Reviewed-by: Peter Crosthwaite <[email protected]>
Message-id: b1d6f990229b2608bbaba24f4ff359571c0b07da.1437080501[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoi.MX: Fix Coding style for AVIC emulator.
Jean-Christophe Dubois [Thu, 13 Aug 2015 10:26:20 +0000 (11:26 +0100)]
i.MX: Fix Coding style for AVIC emulator.

Signed-off-by: Jean-Christophe Dubois <[email protected]>
Reviewed-by: Peter Crosthwaite <[email protected]>
Message-id: 01e1d9026220992405819f25640ebd5bb843fc93.1437080501[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoi.MX: Split AVIC emulator in a header file and a source file
Jean-Christophe Dubois [Thu, 13 Aug 2015 10:26:19 +0000 (11:26 +0100)]
i.MX: Split AVIC emulator in a header file and a source file

Signed-off-by: Jean-Christophe Dubois <[email protected]>
Reviewed-by: Peter Crosthwaite <[email protected]>
Message-id: 06829257e845d693be05c7d491134313c1615d1a.1437080501[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoi.MX:Fix Coding style for UART emulator.
Jean-Christophe Dubois [Thu, 13 Aug 2015 10:26:19 +0000 (11:26 +0100)]
i.MX:Fix Coding style for UART emulator.

Signed-off-by: Jean-Christophe Dubois <[email protected]>
Reviewed-by: Peter Crosthwaite <[email protected]>
Message-id: 23ab872b7cd30b1399384fb26a2ebb75e9761d7b.1437080501[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoi.MX: Move serial initialization to init/realize of DeviceClass.
Jean-Christophe Dubois [Thu, 13 Aug 2015 10:26:19 +0000 (11:26 +0100)]
i.MX: Move serial initialization to init/realize of DeviceClass.

Move constructor to DeviceClass methods
 * imx_serial_init
 * imx_serial_realize

imx32_serial_properties is renamed to imx_serial_properties.

Signed-off-by: Jean-Christophe Dubois <[email protected]>
Reviewed-by: Peter Crosthwaite <[email protected]>
Message-id: 6854bd75e2b5af312e04e760587e249dbaff807f.1437080501[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoi.MX: Split UART emulator in a header file and a source file
Jean-Christophe Dubois [Thu, 13 Aug 2015 10:26:19 +0000 (11:26 +0100)]
i.MX: Split UART emulator in a header file and a source file

Signed-off-by: Jean-Christophe Dubois <[email protected]>
Reviewed-by: Peter Crosthwaite <[email protected]>
Message-id: a51ef50fa222a614169056d5389a6d3ed6a63b04.1437080501[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agohw/arm/virt: Connect the Hypervisor timer
Edgar E. Iglesias [Thu, 13 Aug 2015 10:26:19 +0000 (11:26 +0100)]
hw/arm/virt: Connect the Hypervisor timer

Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Edgar E. Iglesias <[email protected]>
Message-id: 1436791864[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agohw/arm/virt: Replace magic IRQ constants with macros
Edgar E. Iglesias [Thu, 13 Aug 2015 10:26:18 +0000 (11:26 +0100)]
hw/arm/virt: Replace magic IRQ constants with macros

Replace magic constants with macros from
hw/arm/virt.h and hw/intc/arm_gic_common.h.

Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Edgar E. Iglesias <[email protected]>
Message-id: 1436791864[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agotarget-arm: Add the Hypervisor timer
Edgar E. Iglesias [Thu, 13 Aug 2015 10:26:18 +0000 (11:26 +0100)]
target-arm: Add the Hypervisor timer

Signed-off-by: Edgar E. Iglesias <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Message-id: 1436791864[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agotarget-arm: Pass timeridx as argument to various timer functions
Edgar E. Iglesias [Thu, 13 Aug 2015 10:26:18 +0000 (11:26 +0100)]
target-arm: Pass timeridx as argument to various timer functions

Prepare for adding the Hypervisor timer, no functional change.

Signed-off-by: Edgar E. Iglesias <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Message-id: 1436791864[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agotarget-arm: Rename and move gt_cnt_reset
Edgar E. Iglesias [Thu, 13 Aug 2015 10:26:18 +0000 (11:26 +0100)]
target-arm: Rename and move gt_cnt_reset

Rename gt_cnt_reset to gt_timer_reset as the function really
resets the timers and not the counters. Move the registration
from counter regs to timer regs.

Signed-off-by: Edgar E. Iglesias <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Message-id: 1436791864[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agotarget-arm: Add CNTHCTL_EL2
Edgar E. Iglesias [Thu, 13 Aug 2015 10:26:18 +0000 (11:26 +0100)]
target-arm: Add CNTHCTL_EL2

Adds control for trapping selected timer and counter accesses to EL2.

Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Edgar E. Iglesias <[email protected]>
Message-id: 1436791864[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agotarget-arm: Add CNTVOFF_EL2
Edgar E. Iglesias [Thu, 13 Aug 2015 10:26:17 +0000 (11:26 +0100)]
target-arm: Add CNTVOFF_EL2

Adds support for the virtual timer offset controlled by EL2.

Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Edgar E. Iglesias <[email protected]>
Message-id: 1436791864[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoOpen 2.5 development tree
Peter Maydell [Tue, 11 Aug 2015 22:15:55 +0000 (23:15 +0100)]
Open 2.5 development tree

Signed-off-by: Peter Maydell <[email protected]>
9 years agoUpdate version for v2.4.0 release
Peter Maydell [Tue, 11 Aug 2015 14:30:34 +0000 (15:30 +0100)]
Update version for v2.4.0 release

Signed-off-by: Peter Maydell <[email protected]>
9 years agoUpdate version for v2.4.0-rc4 release
Peter Maydell [Wed, 5 Aug 2015 16:02:58 +0000 (17:02 +0100)]
Update version for v2.4.0-rc4 release

Signed-off-by: Peter Maydell <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging
Peter Maydell [Wed, 5 Aug 2015 15:02:00 +0000 (16:02 +0100)]
Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

virtio fix for 2.4

Fixes migration in virtio 1 mode.
We still have a known bug with memory hotplug, it doesn't
look like we can fix that in time for 2.4.

Signed-off-by: Michael S. Tsirkin <[email protected]>
# gpg: Signature made Wed 05 Aug 2015 15:57:39 BST using RSA key ID D28D5469
# gpg: Good signature from "Michael S. Tsirkin <[email protected]>"
# gpg:                 aka "Michael S. Tsirkin <[email protected]>"

* remotes/mst/tags/for_upstream:
  virtio: fix 1.0 virtqueue migration

Signed-off-by: Peter Maydell <[email protected]>
9 years agoblock: don't register quorum driver if SHA256 support is unavailable
Sascha Silbe [Tue, 4 Aug 2015 14:48:25 +0000 (16:48 +0200)]
block: don't register quorum driver if SHA256 support is unavailable

Commit 488981a4 [block: convert quorum blockdrv to use crypto APIs]
broke qemu-iotest 041 on hosts with GnuTLS < 2.10.0. It converted a
compile-time check to a run-time check at device open time. The result
is that we now advertise a feature (the quorum block driver) that will
never work (on those hosts). There's no way (short of parsing
human-readable error messages) for qemu-iotests or any other API
consumer to recognise that the quorum block driver isn't _actually_
available and shouldn't be used or tested.

Move the run-time check to bdrv_quorum_init() to avoid registering the
quorum block driver if we know it cannot work. This way API consumers
can recognise it's unavailable.

Fixes: 488981a4af396551a3178d032cc2b41d9553ada2
Signed-off-by: Sascha Silbe <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Reviewed-by: Daniel P. Berrange <[email protected]>
Reviewed-by: Alberto Garcia <[email protected]>
Message-id: 1438699705[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agovirtio: fix 1.0 virtqueue migration
Jason Wang [Wed, 5 Aug 2015 09:50:07 +0000 (17:50 +0800)]
virtio: fix 1.0 virtqueue migration

1.0 does not requires physically-contiguous pages layout for a
virtqueue. So we could not infer avail and used from desc. This means
we need to migrate vring.avail and vring.used when host support virtio
1.0. This fixes malfunction of virtio 1.0 device after migration.

Cc: Michael S. Tsirkin <[email protected]>
Cc: Cornelia Huck <[email protected]>
Cc: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Jason Wang <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging
Peter Maydell [Tue, 4 Aug 2015 15:51:24 +0000 (16:51 +0100)]
Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

X86 queue, 2015-08-04

# gpg: Signature made Tue 04 Aug 2015 16:49:42 BST using RSA key ID 984DC5A6
# gpg: Good signature from "Eduardo Habkost <[email protected]>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* remotes/ehabkost/tags/x86-pull-request:
  target-i386: fix IvyBridge xlevel in PC_COMPAT_2_3

Signed-off-by: Peter Maydell <[email protected]>
9 years agotarget-i386: fix IvyBridge xlevel in PC_COMPAT_2_3
Radim Krčmář [Tue, 4 Aug 2015 14:17:21 +0000 (16:17 +0200)]
target-i386: fix IvyBridge xlevel in PC_COMPAT_2_3

Previous patch changed xlevel and missed the compatibility code.

Fixes: 3046bb5debc8 ("target-i386: emulate CPUID level of real hardware")
Signed-off-by: Radim Krčmář <[email protected]>
Reviewed-by: Andreas Färber <[email protected]>
Reviewed-by: Eduardo Habkost <[email protected]>
Acked-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/lalrae/tags/mips-20150804' into staging
Peter Maydell [Tue, 4 Aug 2015 11:57:06 +0000 (12:57 +0100)]
Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150804' into staging

MIPS patches 2015-08-04

Changes:
* fix semihosting for microMIPS R6
* fix an abort when booting mips64 kernel with --enable-tcg-debug

# gpg: Signature made Tue 04 Aug 2015 12:32:17 BST using RSA key ID 0B29DA6B
# gpg: Good signature from "Leon Alrae <[email protected]>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

* remotes/lalrae/tags/mips-20150804:
  target-mips: Copy restrictions from ext/ins to dext/dins
  target-mips: fix semihosting for microMIPS R6

Signed-off-by: Peter Maydell <[email protected]>
9 years agotarget-mips: Copy restrictions from ext/ins to dext/dins
Richard Henderson [Mon, 3 Aug 2015 19:35:53 +0000 (12:35 -0700)]
target-mips: Copy restrictions from ext/ins to dext/dins

The checks in dins is required to avoid triggering an assertion
in tcg_gen_deposit_tl.  The check in dext is just for completeness.
Fold the other D cases in via fallthru.

In this case the errant dins appears to be data, not code, as
translation failed to stop after a break insn.

Signed-off-by: Richard Henderson <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Reviewed-by: Leon Alrae <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>
9 years agotarget-mips: fix semihosting for microMIPS R6
Leon Alrae [Mon, 3 Aug 2015 12:01:19 +0000 (13:01 +0100)]
target-mips: fix semihosting for microMIPS R6

In semihosting mode the SDBBP 1 instructions should trigger UHI syscall,
but in QEMU this does not happen for recently added microMIPS R6.
Consequently bare metal microMIPS R6 programs supporting UHI will not run.

Signed-off-by: Leon Alrae <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/sstabellini/tags/cve-2015-5166-tag' into staging
Peter Maydell [Mon, 3 Aug 2015 17:52:55 +0000 (18:52 +0100)]
Merge remote-tracking branch 'remotes/sstabellini/tags/cve-2015-5166-tag' into staging

cve-2015-5166

# gpg: Signature made Mon 03 Aug 2015 15:27:44 BST using RSA key ID 70E1AE90
# gpg: Good signature from "Stefano Stabellini <[email protected]>"

* remotes/sstabellini/tags/cve-2015-5166-tag:
  Fix release_drive on unplugged devices (pci_piix3_xen_ide_unplug)

Signed-off-by: Peter Maydell <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/sstabellini/tags/xen-migration-2.4-tag' into...
Peter Maydell [Mon, 3 Aug 2015 16:33:35 +0000 (17:33 +0100)]
Merge remote-tracking branch 'remotes/sstabellini/tags/xen-migration-2.4-tag' into staging

xen-migration-2.4

# gpg: Signature made Mon 03 Aug 2015 17:18:36 BST using RSA key ID 70E1AE90
# gpg: Good signature from "Stefano Stabellini <[email protected]>"

* remotes/sstabellini/tags/xen-migration-2.4-tag:
  migration: Fix regression for xenfv and pc,accel=xen machine.
  migration: Fix global state with Xen.

Signed-off-by: Peter Maydell <[email protected]>
9 years agomigration: Fix regression for xenfv and pc,accel=xen machine.
Anthony PERARD [Mon, 3 Aug 2015 14:29:21 +0000 (15:29 +0100)]
migration: Fix regression for xenfv and pc,accel=xen machine.

This fix migration from the same QEMU version and from previous QEMU
version.

>From the global state section, we don't need runstate with Xen. Right now,
the way the Xen toolstack knows when QEMU is ready is when QEMU reach
"running" runstate.

The configuration section and the section footers are not going to be
present in previous version of QEMU with xenfv machine, so we skip them.

The Xen toolstack libxenlight does not specify a particular version of the
'pc' machine, so migration from older version of QEMU used by Xen to newer
one would break due to missing "configuration" section and section footers.

Signed-off-by: Anthony PERARD <[email protected]>
Signed-off-by: Stefano Stabellini <[email protected]>
9 years agomigration: Fix global state with Xen.
Anthony PERARD [Mon, 3 Aug 2015 14:29:19 +0000 (15:29 +0100)]
migration: Fix global state with Xen.

When doing migration via the QMP command xen_save_devices_state, the
current runstate is not store into the global state section. Also the
current runstate is not the one we want on the receiver side.

During migration, the Xen toolstack paused QEMU before save the devices
state. Also, the toolstack expect QEMU to autostart when the migration is
finished.
So this patch store "running" as it's current runstate.

Signed-off-by: Anthony PERARD <[email protected]>
Signed-off-by: Stefano Stabellini <[email protected]>
9 years agoconfigure: Drop vnc-ws feature from help text
Andreas Färber [Fri, 24 Jul 2015 14:47:37 +0000 (16:47 +0200)]
configure: Drop vnc-ws feature from help text

Commit 8e9b0d2 (ui: convert VNC websockets to use crypto APIs) dropped
the --enable-vnc-ws option but forgot to update the help text. Fix this.

Cc: Daniel P. Berrange <[email protected]>
Cc: Paolo Bonzini <[email protected]>
Signed-off-by: Andreas Färber <[email protected]>
Reviewed-by: Daniel P. Berrange <[email protected]>
Message-id: 1437749257[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoFix release_drive on unplugged devices (pci_piix3_xen_ide_unplug)
Stefano Stabellini [Mon, 3 Aug 2015 13:56:57 +0000 (13:56 +0000)]
Fix release_drive on unplugged devices (pci_piix3_xen_ide_unplug)

pci_piix3_xen_ide_unplug should completely unhook the unplugged
IDEDevice from the corresponding BlockBackend, otherwise the next call
to release_drive will try to detach the drive again.

Suggested-by: Kevin Wolf <[email protected]>
Signed-off-by: Stefano Stabellini <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/stefanha/tags/rtl8139-cplus-tx-input-validation...
Peter Maydell [Mon, 3 Aug 2015 12:09:10 +0000 (13:09 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/rtl8139-cplus-tx-input-validation-pull-request' into staging

Pull request

# gpg: Signature made Mon Aug  3 13:08:25 2015 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <[email protected]>"
# gpg:                 aka "Stefan Hajnoczi <[email protected]>"

* remotes/stefanha/tags/rtl8139-cplus-tx-input-validation-pull-request:
  rtl8139: check TCP Data Offset field (CVE-2015-5165)
  rtl8139: skip offload on short TCP header (CVE-2015-5165)
  rtl8139: check IP Total Length field (CVE-2015-5165)
  rtl8139: check IP Header Length field (CVE-2015-5165)
  rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)
  rtl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165)
  rtl8139: avoid nested ifs in IP header parsing (CVE-2015-5165)

Signed-off-by: Peter Maydell <[email protected]>
9 years agortl8139: check TCP Data Offset field (CVE-2015-5165)
Stefan Hajnoczi [Wed, 15 Jul 2015 16:39:29 +0000 (17:39 +0100)]
rtl8139: check TCP Data Offset field (CVE-2015-5165)

The TCP Data Offset field contains the length of the header.  Make sure
it is valid and does not exceed the IP data length.

Reported-by: 朱东海(启路) <[email protected]>
Reviewed-by: Jason Wang <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
9 years agortl8139: skip offload on short TCP header (CVE-2015-5165)
Stefan Hajnoczi [Wed, 15 Jul 2015 16:36:15 +0000 (17:36 +0100)]
rtl8139: skip offload on short TCP header (CVE-2015-5165)

TCP Large Segment Offload accesses the TCP header in the packet.  If the
packet is too short we must not attempt to access header fields:

  tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen);
  int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);

Reported-by: 朱东海(启路) <[email protected]>
Reviewed-by: Jason Wang <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
9 years agortl8139: check IP Total Length field (CVE-2015-5165)
Stefan Hajnoczi [Wed, 15 Jul 2015 16:34:40 +0000 (17:34 +0100)]
rtl8139: check IP Total Length field (CVE-2015-5165)

The IP Total Length field includes the IP header and data.  Make sure it
is valid and does not exceed the Ethernet payload size.

Reported-by: 朱东海(启路) <[email protected]>
Reviewed-by: Jason Wang <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
9 years agortl8139: check IP Header Length field (CVE-2015-5165)
Stefan Hajnoczi [Wed, 15 Jul 2015 16:32:32 +0000 (17:32 +0100)]
rtl8139: check IP Header Length field (CVE-2015-5165)

The IP Header Length field was only checked in the IP checksum case, but
is used in other cases too.

Reported-by: 朱东海(启路) <[email protected]>
Reviewed-by: Jason Wang <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
9 years agortl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)
Stefan Hajnoczi [Wed, 15 Jul 2015 13:30:37 +0000 (14:30 +0100)]
rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)

Transmit offload features access Ethernet and IP headers the packet.  If
the packet is too short we must not attempt to access header fields:

  int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
  ...
  eth_payload_data = saved_buffer + ETH_HLEN;
  ...
  ip = (ip_header*)eth_payload_data;
  if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {

Reported-by: 朱东海(启路) <[email protected]>
Reviewed-by: Jason Wang <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
9 years agortl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165)
Stefan Hajnoczi [Wed, 15 Jul 2015 16:17:28 +0000 (17:17 +0100)]
rtl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165)

The previous patch stopped using the ip pointer as an indicator that the
IP header is present.  When we reach the if (ip) {...} statement we know
ip is always non-NULL.

Remove the if statement to reduce nesting.

Reported-by: 朱东海(启路) <[email protected]>
Reviewed-by: Jason Wang <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
9 years agortl8139: avoid nested ifs in IP header parsing (CVE-2015-5165)
Stefan Hajnoczi [Wed, 15 Jul 2015 16:13:32 +0000 (17:13 +0100)]
rtl8139: avoid nested ifs in IP header parsing (CVE-2015-5165)

Transmit offload needs to parse packet headers.  If header fields have
unexpected values the offload processing is skipped.

The code currently uses nested ifs because there is relatively little
input validation.  The next patches will add missing input validation
and a goto label is more appropriate to avoid deep if statement nesting.

Reported-by: 朱东海(启路) <[email protected]>
Reviewed-by: Jason Wang <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/aurel/tags/pull-tcg-mips-s390-20150803' into...
Peter Maydell [Mon, 3 Aug 2015 10:44:07 +0000 (11:44 +0100)]
Merge remote-tracking branch 'remotes/aurel/tags/pull-tcg-mips-s390-20150803' into staging

TCG MIPS and S390 fixes for 2.4.

# gpg: Signature made Mon Aug  3 09:09:59 2015 BST using RSA key ID 1DDD8C9B
# gpg: Good signature from "Aurelien Jarno <[email protected]>"
# gpg:                 aka "Aurelien Jarno <[email protected]>"
# gpg:                 aka "Aurelien Jarno <[email protected]>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 7746 2642 A9EF 94FD 0F77  196D BA9C 7806 1DDD 8C9B

* remotes/aurel/tags/pull-tcg-mips-s390-20150803:
  tcg/mips: fix add2
  tcg/s390x: Mask TCGMemOp appropriately for indexing
  tcg/mips: Mask TCGMemOp appropriately for indexing
  tcg/mips: fix TLB loading for BE host with 32-bit guests

Signed-off-by: Peter Maydell <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging
Peter Maydell [Mon, 3 Aug 2015 09:44:23 +0000 (10:44 +0100)]
Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

# gpg: Signature made Fri Jul 31 23:24:06 2015 BST using RSA key ID AAFC390E
# gpg: Good signature from "John Snow (John Huston) <[email protected]>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
#      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

* remotes/jnsnow/tags/ide-pull-request:
  ahci: fix ICC mask definition
  macio: re-add TRIM support

Signed-off-by: Peter Maydell <[email protected]>
9 years agotcg/mips: fix add2
Aurelien Jarno [Fri, 31 Jul 2015 14:38:25 +0000 (16:38 +0200)]
tcg/mips: fix add2

The add2 code in the tcg_out_addsub2 function doesn't take into account
the case where rl == al == bl. In that case we can't compute the carry
after the addition. As it corresponds to a multiplication by 2, the
carry bit is the bit 31.

While this is a corner case, this prevents x86-64 guests to boot on a
MIPS host.

Cc: [email protected]
Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
9 years agotcg/s390x: Mask TCGMemOp appropriately for indexing
Aurelien Jarno [Thu, 30 Jul 2015 20:13:26 +0000 (22:13 +0200)]
tcg/s390x: Mask TCGMemOp appropriately for indexing

Commit 2b7ec66f fixed TCGMemOp masking following the MO_AMASK addition,
but two cases were forgotten in the TCG S390 backend.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
9 years agotcg/mips: Mask TCGMemOp appropriately for indexing
Aurelien Jarno [Thu, 30 Jul 2015 20:11:51 +0000 (22:11 +0200)]
tcg/mips: Mask TCGMemOp appropriately for indexing

Commit 2b7ec66f fixed TCGMemOp masking following the MO_AMASK addition,
but two cases were forgotten in the TCG MIPS backend.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
9 years agotcg/mips: fix TLB loading for BE host with 32-bit guests
Aurelien Jarno [Thu, 30 Jul 2015 21:39:34 +0000 (23:39 +0200)]
tcg/mips: fix TLB loading for BE host with 32-bit guests

For 32-bit guest, we load a 32-bit address from the TLB, so there is no
need to compensate for the low or high part. This fixes 32-bit guests on
big-endian hosts.

Cc: [email protected]
Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
9 years agoahci: fix ICC mask definition
John Snow [Tue, 21 Jul 2015 18:02:01 +0000 (14:02 -0400)]
ahci: fix ICC mask definition

There are likely others that could be updated, but we'll
go with a light touch for 2.4 for now.

Without the Unsigned specifier, this shifts bits into the
signed bit, which makes clang unhappy and could cause
unwanted behavior.

Reported-by: Peter Maydell <[email protected]>
Signed-off-by: John Snow <[email protected]>
Message-id: 1437501721[email protected]

9 years agomacio: re-add TRIM support
Aurelien Jarno [Wed, 29 Jul 2015 19:27:48 +0000 (21:27 +0200)]
macio: re-add TRIM support

Commit bd4214fc dropped TRIM support by mistake. Given it is still
advertised to the host when using a drive with discard=on, this cause
the IDE bus to hang when the host issues a TRIM command.

This patch fixes that by re-adding the TRIM code, ported to the new
new DMA implementation.

Cc: Mark Cave-Ayland <[email protected]>
Cc: John Snow <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-id: 1438198068[email protected]
Signed-off-by: John Snow <[email protected]>
9 years agobsd-user: Fix operand to cpu_x86_exec
Richard Henderson [Wed, 29 Jul 2015 18:40:52 +0000 (11:40 -0700)]
bsd-user: Fix operand to cpu_x86_exec

Signed-off-by: Richard Henderson <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Message-id: 1438195252[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoUpdate version for v2.4.0-rc3 release
Peter Maydell [Wed, 29 Jul 2015 17:50:11 +0000 (18:50 +0100)]
Update version for v2.4.0-rc3 release

Signed-off-by: Peter Maydell <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
Peter Maydell [Wed, 29 Jul 2015 16:08:38 +0000 (17:08 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

Pull request

These fixes make dataplane work again after the notify_me optimization was
added.  They also solve QEMUBH memory leaks and fix a bug in dataplane's
cleanup code.

# gpg: Signature made Wed Jul 29 14:50:26 2015 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <[email protected]>"
# gpg:                 aka "Stefan Hajnoczi <[email protected]>"

* remotes/stefanha/tags/block-pull-request:
  AioContext: force event loop iteration using BH
  AioContext: avoid leaking BHs on cleanup
  virtio-blk-dataplane: delete bottom half before the AioContext is freed

Signed-off-by: Peter Maydell <[email protected]>
9 years agoAioContext: force event loop iteration using BH
Stefan Hajnoczi [Tue, 28 Jul 2015 16:34:09 +0000 (18:34 +0200)]
AioContext: force event loop iteration using BH

The notify_me optimization introduced in commit eabc97797310
("AioContext: fix broken ctx->dispatching optimization") skips
event_notifier_set() calls when the event loop thread is not blocked in
ppoll(2).

This optimization causes a deadlock if two aio_context_acquire() calls
race.  notify_me = 0 during the race so the winning thread can enter
ppoll(2) unaware that the other thread is waiting its turn to acquire
the AioContext.

This patch forces ppoll(2) to return by scheduling a BH instead of
calling aio_notify().

The following deadlock with virtio-blk dataplane is fixed:

  qemu ... -object iothread,id=iothread0 \
           -drive if=none,id=drive0,file=test.img,... \
           -device virtio-blk-pci,iothread=iothread0,drive=drive0

This command-line results in a hang early on without this patch.

Thanks to Paolo Bonzini <[email protected]> for investigating this bug
with me.

Cc: Christian Borntraeger <[email protected]>
Cc: Cornelia Huck <[email protected]>
Cc: Paolo Bonzini <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
Message-id: 1438101249[email protected]
Message-Id: <1438014819[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
9 years agoAioContext: avoid leaking BHs on cleanup
Stefan Hajnoczi [Tue, 28 Jul 2015 16:34:08 +0000 (18:34 +0200)]
AioContext: avoid leaking BHs on cleanup

BHs are freed during aio_bh_poll().  This leads to memory leaks if there
is no aio_bh_poll() between qemu_bh_delete() and aio_ctx_finalize().

Suggested-by: Paolo Bonzini <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
Message-id: 1438101249[email protected]
Message-Id: <1438014819[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
9 years agovirtio-blk-dataplane: delete bottom half before the AioContext is freed
Paolo Bonzini [Tue, 28 Jul 2015 16:34:07 +0000 (18:34 +0200)]
virtio-blk-dataplane: delete bottom half before the AioContext is freed

Other uses of aio_bh_new are safe as long as all scheduled bottom
halves are run before an iothread is destroyed, which bdrv_drain will
ensure:

- archipelago_finish_aiocb: BH deletes itself

- inject_error: BH deletes itself

- blkverify_aio_bh: BH deletes itself

- abort_aio_request: BH deletes itself

- curl_aio_readv: BH deletes itself

- gluster_finish_aiocb: BH deletes itself

- bdrv_aio_rw_vector: BH deletes itself

- bdrv_co_maybe_schedule_bh: BH deletes itself

- iscsi_schedule_bh, iscsi_co_generic_cb: BH deletes itself

- laio_attach_aio_context: deleted in laio_detach_aio_context,
called through bdrv_detach_aio_context before deleting the iothread

- nfs_co_generic_cb: BH deletes itself

- null_aio_common: BH deletes itself

- qed_aio_complete: BH deletes itself

- rbd_finish_aiocb: BH deletes itself

- dma_blk_cb: BH deletes itself

- virtio_blk_dma_restart_cb: BH deletes itself

- qemu_bh_new: main loop AioContext is never destroyed

- test-aio.c: bh_delete_cb deletes itself, otherwise deleted in
the same function that calls aio_bh_new

Reported-by: Cornelia Huck <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
Message-id: 1438101249[email protected]
Message-Id: <1438086628[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging
Peter Maydell [Tue, 28 Jul 2015 18:02:04 +0000 (19:02 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

Pull request

These two .can_receive() are now reviewed.  The net subsystem queue for 2.4 is now empty.

# gpg: Signature made Tue Jul 28 13:26:03 2015 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <[email protected]>"
# gpg:                 aka "Stefan Hajnoczi <[email protected]>"

* remotes/stefanha/tags/net-pull-request:
  xen: Drop net_rx_ok
  hw/net: handle flow control in mcf_fec driver receiver

Signed-off-by: Peter Maydell <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging
Peter Maydell [Tue, 28 Jul 2015 16:09:56 +0000 (17:09 +0100)]
Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

virtio fixes for 2.4

Mostly virtio 1 spec compliance fixes.
We are unlikely to make it perfectly compliant in
the first release, but it seems worth it to try.

Signed-off-by: Michael S. Tsirkin <[email protected]>
# gpg: Signature made Mon Jul 27 21:55:48 2015 BST using RSA key ID D28D5469
# gpg: Good signature from "Michael S. Tsirkin <[email protected]>"
# gpg:                 aka "Michael S. Tsirkin <[email protected]>"

* remotes/mst/tags/for_upstream:
  virtio: minor cleanup
  acpi: fix pvpanic device is not shown in ui
  virtio-blk: only clear VIRTIO_F_ANY_LAYOUT for legacy device
  virtio-blk: fail get_features when both scsi and 1.0 were set
  virtio: get_features() can fail
  virtio-pci: fix memory MR cleanup for modern
  virtio: set any_layout in virtio core
  virtio-9p: fix any_layout
  virtio-serial: fix ANY_LAYOUT
  virtio: hide legacy features from modern guests

Signed-off-by: Peter Maydell <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/lalrae/tags/mips-20150728' into staging
Peter Maydell [Tue, 28 Jul 2015 14:25:24 +0000 (15:25 +0100)]
Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150728' into staging

MIPS patches 2015-07-28

Changes:
* net/dp8393x fixes
* Vectored Interrupts bug fix
* fix for a bug in machine.c which was provoking a warning on FreeBSD

# gpg: Signature made Tue Jul 28 10:47:19 2015 BST using RSA key ID 0B29DA6B
# gpg: Good signature from "Leon Alrae <[email protected]>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

* remotes/lalrae/tags/mips-20150728:
  net/dp8393x: do not use memory_region_init_rom_device with NULL
  net/dp8393x: remove check of runt packets
  net/dp8393x: disable user creation
  target-mips: fix offset calculation for Interrupts
  target-mips: fix passing incompatible pointer type in machine.c

Signed-off-by: Peter Maydell <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging
Peter Maydell [Tue, 28 Jul 2015 13:19:16 +0000 (14:19 +0100)]
Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

* crypto fixes
* megasas SIGSEGV fix
* memory refcount change to fix virtio hot-unplug

# gpg: Signature made Tue Jul 28 08:29:07 2015 BST using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <[email protected]>"
# gpg:                 aka "Paolo Bonzini <[email protected]>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream:
  memory: do not add a reference to the owner of aliased regions
  megasas: Add write function to handle write access to PCI BAR 3
  crypto: extend unit tests to cover decryption too
  crypto: fix built-in AES decrypt function

Signed-off-by: Peter Maydell <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/cody/tags/jtc-for-upstream-pull-request' into...
Peter Maydell [Tue, 28 Jul 2015 12:22:57 +0000 (13:22 +0100)]
Merge remote-tracking branch 'remotes/cody/tags/jtc-for-upstream-pull-request' into staging

# gpg: Signature made Tue Jul 28 05:22:29 2015 BST using RSA key ID C0DE3057
# gpg: Good signature from "Jeffrey Cody <[email protected]>"
# gpg:                 aka "Jeffrey Cody <[email protected]>"
# gpg:                 aka "Jeffrey Cody <[email protected]>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 9957 4B4D 3474 90E7 9D98  D624 BDBE 7B27 C0DE 3057

* remotes/cody/tags/jtc-for-upstream-pull-request:
  block/ssh: Avoid segfault if inet_connect doesn't set errno.
  sheepdog: serialize requests to overwrapping area

Signed-off-by: Peter Maydell <[email protected]>
9 years agoxen: Drop net_rx_ok
Fam Zheng [Tue, 28 Jul 2015 09:52:56 +0000 (17:52 +0800)]
xen: Drop net_rx_ok

Let net_rx_packet() (which checks the same conditions) drops the packet
if the device is not ready. Drop net_xen_info.can_receive and update the
return value for the buffer full case.

We rely on the qemu_flush_queued_packets() in net_event() to wake up
the peer when the buffer becomes available again.

Signed-off-by: Fam Zheng <[email protected]>
Message-id: 1438077176[email protected]
Signed-off-by: Stefan Hajnoczi <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-07-27' into...
Peter Maydell [Tue, 28 Jul 2015 10:28:44 +0000 (11:28 +0100)]
Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-07-27' into staging

trivial patches for 2015-07-27

# gpg: Signature made Mon Jul 27 20:50:14 2015 BST using RSA key ID A4C3D7DB
# gpg: Good signature from "Michael Tokarev <[email protected]>"
# gpg:                 aka "Michael Tokarev <[email protected]>"
# gpg:                 aka "Michael Tokarev <[email protected]>"

* remotes/mjt/tags/pull-trivial-patches-2015-07-27:
  gdbstub: Set current CPU on interruptions
  qapi: add missing @
  Fix Cortex-A9 global timer
  gitignore: Ignore shader generated files
  vmstate: remove unused declaration
  make: Clean build messages
  qemu-common.h: Document cutils.c string functions
  device_tree: Fix a typo
  hw/acpi/ich9: clean up stale comment about KVM not supporting SMM
  hw/acpi/ich9: clear smi_en on reset

Signed-off-by: Peter Maydell <[email protected]>
9 years agohw/net: handle flow control in mcf_fec driver receiver
Greg Ungerer [Tue, 28 Jul 2015 01:02:54 +0000 (11:02 +1000)]
hw/net: handle flow control in mcf_fec driver receiver

The network mcf_fec driver emulated receive side method is not dealing
with network queue flow control properly.

Modify the receive side to check if we have enough space in the
descriptors to store the current packet. If not we process none of it
and return 0. When the guest frees up some buffers through its descriptors
we signal the qemu net layer to send more packets.

[Fixed coding style: 4-space indent and curly braces on if statement.
--Stefan]

Signed-off-by: Greg Ungerer <[email protected]>
Message-id: 1438045374[email protected]
Signed-off-by: Stefan Hajnoczi <[email protected]>
9 years agonet/dp8393x: do not use memory_region_init_rom_device with NULL
Hervé Poussineau [Sun, 26 Jul 2015 20:32:55 +0000 (22:32 +0200)]
net/dp8393x: do not use memory_region_init_rom_device with NULL

Replace memory_region_init_rom_device() with memory_region_init_ram() and
memory_region_set_readonly().
This fixes a guest-triggerable QEMU crash when guest tries to write to PROM.

Signed-off-by: Hervé Poussineau <[email protected]>
[[email protected]: shorten subject length]
Signed-off-by: Leon Alrae <[email protected]>
9 years agonet/dp8393x: remove check of runt packets
Hervé Poussineau [Fri, 24 Jul 2015 18:42:23 +0000 (20:42 +0200)]
net/dp8393x: remove check of runt packets

Ethernet requires that messages are at least 64 bytes on the wire. This
limitation does not exist on emulation (no wire message), so remove the
check. Netcard is now able to receive small network packets.

Signed-off-by: Hervé Poussineau <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>
9 years agonet/dp8393x: disable user creation
Hervé Poussineau [Fri, 24 Jul 2015 18:42:21 +0000 (20:42 +0200)]
net/dp8393x: disable user creation

Netcard needs an address space to write data to, which can't be specified
on command line.
This fixes a crash when user starts QEMU with "-device dp8393x"

Signed-off-by: Hervé Poussineau <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Peter Maydell [Tue, 28 Jul 2015 08:11:48 +0000 (09:11 +0100)]
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches for 2.4.0-rc3

# gpg: Signature made Mon Jul 27 16:19:17 2015 BST using RSA key ID C88F2FD6
# gpg: Good signature from "Kevin Wolf <[email protected]>"

* remotes/kevin/tags/for-upstream:
  block: qemu-iotests - add check for multiplication overflow in vpc
  block: vpc - prevent overflow if max_table_entries >= 0x40000000

Signed-off-by: Peter Maydell <[email protected]>
9 years agotarget-mips: fix offset calculation for Interrupts
Yongbok Kim [Fri, 10 Jul 2015 11:10:02 +0000 (12:10 +0100)]
target-mips: fix offset calculation for Interrupts

Correct computation of vector offsets for EXCP_EXT_INTERRUPT.
For instance, if Cause.IV is 0 the vector offset should be 0x180.

Simplify the finding vector number logic for the Vectored Interrupts.

Signed-off-by: Yongbok Kim <[email protected]>
Reviewed-by: Leon Alrae <[email protected]>
[[email protected]: cosmetic changes]
Signed-off-by: Leon Alrae <[email protected]>
9 years agotarget-mips: fix passing incompatible pointer type in machine.c
Leon Alrae [Wed, 22 Jul 2015 13:59:23 +0000 (14:59 +0100)]
target-mips: fix passing incompatible pointer type in machine.c

Reported-by: Peter Maydell <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>
9 years agoblock/ssh: Avoid segfault if inet_connect doesn't set errno.
Richard W.M. Jones [Wed, 22 Jul 2015 13:27:47 +0000 (14:27 +0100)]
block/ssh: Avoid segfault if inet_connect doesn't set errno.

On some (but not all) systems:

  $ qemu-img create -f qcow2 overlay -b ssh://xen/
  Segmentation fault

It turns out this happens when inet_connect returns -1 in the
following code, but errno == 0.

  s->sock = inet_connect(s->hostport, errp);
  if (s->sock < 0) {
      ret = -errno;
      goto err;
  }

In the test case above, no host called "xen" exists, so getaddrinfo fails.

On Fedora 22, getaddrinfo happens to set errno = ENOENT (although it
is *not* documented to do that), so it doesn't segfault.

On RHEL 7, errno is not set by the failing getaddrinfo, so ret =
-errno = 0, so the caller doesn't know there was an error and
continues with a half-initialized BDRVSSHState struct, and everything
goes south from there, eventually resulting in a segfault.

Fix this by setting ret to -EIO (same as block/nbd.c and
block/sheepdog.c).  The real error is saved in the Error** errp
struct, so it is printed correctly:

  $ ./qemu-img create -f qcow2 overlay -b ssh://xen/
  qemu-img: overlay: address resolution failed for xen:22: No address associated with hostname

Signed-off-by: Richard W.M. Jones <[email protected]>
Reported-by: Jun Li
BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1147343
Signed-off-by: Jeff Cody <[email protected]>
9 years agosheepdog: serialize requests to overwrapping area
Hitoshi Mitake [Fri, 17 Jul 2015 16:44:24 +0000 (01:44 +0900)]
sheepdog: serialize requests to overwrapping area

Current sheepdog driver only serializes create requests in oid
unit. This mechanism isn't enough for handling requests to
overwrapping area spanning multiple oids, so it can result bugs like
below:
https://bugs.launchpad.net/sheepdog-project/+bug/1456421

This patch adds a new serialization mechanism for the problem. The
difference from the old one is:
1. serialize entire aiocb if their targetting areas overwrap
2. serialize all requests (read, write, and discard), not only creates

This patch also removes the old mechanism because the new one can be
an alternative.

Cc: Kevin Wolf <[email protected]>
Cc: Stefan Hajnoczi <[email protected]>
Cc: Teruaki Ishizaki <[email protected]>
Cc: Vasiliy Tolstov <[email protected]>
Signed-off-by: Hitoshi Mitake <[email protected]>
Tested-by: Vasiliy Tolstov <[email protected]>
Signed-off-by: Jeff Cody <[email protected]>
9 years agomemory: do not add a reference to the owner of aliased regions
Paolo Bonzini [Mon, 27 Jul 2015 14:29:56 +0000 (16:29 +0200)]
memory: do not add a reference to the owner of aliased regions

Very often the owner of the aliased region is the same as the owner of the alias
region itself.  When this happens, the reference count can never go back to 0 and
the owner is leaked.  This is for example breaking hot-unplug of virtio-pci
devices (the device cannot be plugged back again with the same id).

Another common use for alias is to transform the system I/O address space
into an MMIO regions; in this case the aliased region never dies, so there
is no problem.  Otherwise the owner is always the same for aliasing
and aliased region.

I checked all calls to memory_region_init_alias introduced after commit
dfde4e6 (memory: add ref/unref calls, 2013-05-06) and they do not need the
reference in order to keep the owner of the aliased region alive.

Reported-by: Michael S. Tsirkin <[email protected]>
Tested-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
9 years agomegasas: Add write function to handle write access to PCI BAR 3
Salva Peiró [Mon, 27 Jul 2015 08:51:52 +0000 (10:51 +0200)]
megasas: Add write function to handle write access to PCI BAR 3

This patch fixes a QEMU SEGFAULT when a write operation is performed on
the memory region of the PCI BAR 3 (base address space).
When a writeb(0xe0000000) is performed the .write function is invoked to
handle the write access, however, since the .write is not initialised,
the call to 0, causes QEMU to SEGFAULT.

Signed-off-by: Salva Peiró <[email protected]>
Acked-by: Hannes Reinecke <[email protected]>
Message-Id: <1437987112[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
9 years agovirtio: minor cleanup
Michael S. Tsirkin [Mon, 27 Jul 2015 15:39:37 +0000 (18:39 +0300)]
virtio: minor cleanup

There's no need for blk to set ANY_LAYOUT, it's
done by virtio core as necessary.

Signed-off-by: Michael S. Tsirkin <[email protected]>
9 years agoacpi: fix pvpanic device is not shown in ui
Gal Hammer [Sun, 26 Jul 2015 08:00:51 +0000 (11:00 +0300)]
acpi: fix pvpanic device is not shown in ui

Commit 2332333c added a _STA method that hides the device. The fact
that the device is not shown in the gui make it harder to install its
Windows' device.

https://bugzilla.redhat.com/show_bug.cgi?id=1238141

Signed-off-by: Gal Hammer <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Reviewed-by: Igor Mammedov <[email protected]>
9 years agogdbstub: Set current CPU on interruptions
Jan Kiszka [Fri, 24 Jul 2015 16:52:31 +0000 (18:52 +0200)]
gdbstub: Set current CPU on interruptions

gdb expects that the thread ID for c and g-class operations is set to
the CPU we provide when reporting VM stop conditions. If the stub is
still tuned to a different CPU, the wrong information is delivered to
the gdb frontend.

Signed-off-by: Jan Kiszka <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>
9 years agoqapi: add missing @
Marc-André Lureau [Fri, 3 Jul 2015 09:51:01 +0000 (11:51 +0200)]
qapi: add missing @

Signed-off-by: Marc-André Lureau <[email protected]>
Reviewed-by: Markus Armbruster <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>
9 years agoFix Cortex-A9 global timer
Johannes Schlatow [Mon, 29 Jun 2015 15:45:41 +0000 (17:45 +0200)]
Fix Cortex-A9 global timer

The auto increment bit of the timer control register was wrongly
defined.

See Cortex-A9 MPcore Technical Reference Manual, Section 4.4.2.

Signed-off-by: Johannes Schlatow <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>
9 years agogitignore: Ignore shader generated files
Michal Privoznik [Tue, 23 Jun 2015 12:30:20 +0000 (14:30 +0200)]
gitignore: Ignore shader generated files

As of d98bc0b65 there are two files that are automatically generated:
ui/shader/texture-blit-frag.h and /ui/shader/texture-blit-vert.h. None
of them is wanted to be tracked by git. Put them into the ignore file
then.

Signed-off-by: Michal Privoznik <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>
9 years agovmstate: remove unused declaration
Marc-André Lureau [Tue, 23 Jun 2015 16:41:27 +0000 (18:41 +0200)]
vmstate: remove unused declaration

Since 38e0735e, register_device_unmigratable() has been removed

Signed-off-by: Marc-André Lureau <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>
9 years agomake: Clean build messages
Stefan Weil [Sat, 18 Jul 2015 14:54:32 +0000 (16:54 +0200)]
make: Clean build messages

We want to have uniform build messages, so fix some messages
which did not follow the standard pattern.

Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>
9 years agoqemu-common.h: Document cutils.c string functions
Peter Maydell [Sun, 19 Jul 2015 20:34:22 +0000 (21:34 +0100)]
qemu-common.h: Document cutils.c string functions

Add documentation comments for various utility string functions
which we have implemented in util/cutils.c:
 pstrcpy()
 strpadcpy()
 pstrcat()
 strstart()
 stristart()
 qemu_strnlen()
 qemu_strsep()

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>
9 years agodevice_tree: Fix a typo
Kamalesh Babulal [Fri, 24 Jul 2015 08:18:13 +0000 (13:48 +0530)]
device_tree: Fix a typo

Fix spelling of 'allocting' -> 'allocating'.

Signed-off-by: Kamalesh Babulal <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>
9 years agohw/acpi/ich9: clean up stale comment about KVM not supporting SMM
Laszlo Ersek [Fri, 24 Jul 2015 18:16:01 +0000 (20:16 +0200)]
hw/acpi/ich9: clean up stale comment about KVM not supporting SMM

Commit fba72476c6 ("ich9: add smm_enabled field and arguments") detached
SMM availability from kvm_enabled(). However, the comment in pm_reset()
was not updated; let's do it now.

Cc: "Michael S. Tsirkin" <[email protected]>
Cc: Igor Mammedov <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Cc: Paolo Bonzini <[email protected]>
Cc: [email protected]
Signed-off-by: Laszlo Ersek <[email protected]>
Reviewed-by: Igor Mammedov <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>
9 years agohw/acpi/ich9: clear smi_en on reset
Laszlo Ersek [Fri, 24 Jul 2015 18:16:00 +0000 (20:16 +0200)]
hw/acpi/ich9: clear smi_en on reset

Otherwise on reboot firmware might think (due to APMC_EN remaining set
from the previous boot) that SMI support is absent.

Cc: "Michael S. Tsirkin" <[email protected]>
Cc: Igor Mammedov <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Cc: Paolo Bonzini <[email protected]>
Cc: [email protected]
Signed-off-by: Laszlo Ersek <[email protected]>
Reviewed-by: Igor Mammedov <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>
9 years agoMerge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150727' into staging
Peter Maydell [Mon, 27 Jul 2015 18:37:09 +0000 (19:37 +0100)]
Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150727' into staging

Fix buglets for 2.4

# gpg: Signature made Mon Jul 27 15:26:48 2015 BST using RSA key ID 4DD0279B
# gpg: Good signature from "Richard Henderson <[email protected]>"
# gpg:                 aka "Richard Henderson <[email protected]>"
# gpg:                 aka "Richard Henderson <[email protected]>"

* remotes/rth/tags/pull-tcg-20150727:
  tcg: mark temps as mem_coherent = 0 for mov with a constant
  tcg: correctly mark dead inputs for mov with a constant

Signed-off-by: Peter Maydell <[email protected]>
9 years agomain-loop: fix qemu_notify_event for aio_notify optimization
Paolo Bonzini [Fri, 24 Jul 2015 11:42:55 +0000 (13:42 +0200)]
main-loop: fix qemu_notify_event for aio_notify optimization

aio_notify can be optimized away, and in fact almost always will.  However,
qemu_notify_event is used in places where this is incorrect---most notably,
when handling SIGTERM.  When aio_notify is optimized away, it is possible that
QEMU enters a blocking ppoll immediately afterwards and stays there, without
reaching main_loop_should_exit().

Fix this by using a bottom half.  The bottom half can be optimized too, but
scheduling it is enough for the ppoll not to block.  The hang is thus avoided.

Reported-by: Peter Maydell <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Message-id: 1437738175[email protected]
Signed-off-by: Peter Maydell <[email protected]>
9 years agoblock: qemu-iotests - add check for multiplication overflow in vpc
Jeff Cody [Fri, 24 Jul 2015 14:26:52 +0000 (10:26 -0400)]
block: qemu-iotests - add check for multiplication overflow in vpc

This checks that VPC is able to successfully fail (without segfault)
on an image file with a max_table_entries that exceeds 0x40000000.

This table entry is within the valid range for VPC (although too large
for this sample image).

Cc: [email protected]
Signed-off-by: Jeff Cody <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
This page took 0.091123 seconds and 4 git commands to generate.