summaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2015-09-19Revert use of DEFINE_MACHINE() for registrations of multiple machinesAndreas Färber
The script used for converting from QEMUMachine had used one DEFINE_MACHINE() per machine registered. In cases where multiple machines are registered from one source file, avoid the excessive generation of module init functions by reverting this unrolling. Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19Use DEFINE_MACHINE() to register all machinesEduardo Habkost
Convert all machines to use DEFINE_MACHINE() instead of QEMUMachine automatically using a script. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> [AF: Style cleanups, convert imx25_pdk machine] Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19mac_world: Break long lineEduardo Habkost
Coding style change only. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19exynos4: Declare each QEMUMachine as a separate variableEduardo Habkost
This will make the code follow the same pattern used for other machines, and will make it easier to automatically convert the code to be QOM-based. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19exynos4: Use MachineClass instead of exynos4_machines arrayEduardo Habkost
We don't need a QEMUMachine array to query max_cpus, if we can get the corresponding MachineClass. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19exynos4: Use EXYNOS4210_NCPUS instead of max_cpus on error messageEduardo Habkost
The code is checking smp_cpus against EXYNOS4210_NCPUS, not against max_cpus, so use EXYNOS4210_NCPUS in the error message for consistency. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19machine: Set MachineClass::name automaticallyEduardo Habkost
Now all TYPE_MACHINE subclasses use MACHINE_TYPE_NAME to generate the class name. So instead of requiring each subclass to set MachineClass::name manually, we can now set it automatically at the TYPE_MACHINE class_base_init() function. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> [AF/ehabkost: Updated for s390-ccw machines] [AF: Cleanup of intermediate virt and vexpress name handling] Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19machine: Ensure all TYPE_MACHINE subclasses have the right suffixEduardo Habkost
Now that all non-abstract TYPE_MACHINE subclasses have the -machine suffix, add an assert to ensure this will be always true. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19mac99: Use MACHINE_TYPE_NAME to encode class nameEduardo Habkost
It will result in exactly the same class name, but it will make the code consistent with the other classes. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19s390: Rename s390-ccw-virtio-2.4 class name to use MACHINE_TYPE_NAMEEduardo Habkost
Machine class names should use the "-machine" suffix to allow class-name-based machine class lookup to work. Rename the s390-ccw-virtio-2.4 machine class using the MACHINE_TYPE_NAME macro. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> [AF/ehabkost: Updated for 2.5 machine] Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19s390-virtio: Rename machine class name to use MACHINE_TYPE_NAMEEduardo Habkost
Machine class names should use the "-machine" suffix to allow class-name-based machine class lookup to work. Rename the s390-virtio machine class using the MACHINE_TYPE_NAME macro. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19pseries: Rename machine class names to use MACHINE_TYPE_NAMEEduardo Habkost
Machine class names should use the "-machine" suffix to allow class-name-based machine class lookup to work. Rename the the pseries machine classes using the MACHINE_TYPE_NAME macro. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19arm: Rename virt machine class to use MACHINE_TYPE_NAMEEduardo Habkost
Machine class names should use the "-machine" suffix to allow class-name-based machine class lookup to work. Rename the arm virt machine class using the MACHINE_TYPE_NAME macro. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19vexpress: Rename machine classes to use MACHINE_TYPE_NAMEEduardo Habkost
Machine class names should use the "-machine" suffix to allow class-name-based machine class lookup to work. Rename the vexpress machine classes using the MACHINE_TYPE_NAME macro. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> [AF: Introduce VEXPRESS_*_MACHINE_NAME] Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19vexpress: Don't set name on abstract classEduardo Habkost
The MachineClass::name field won't be ever be used on TYPE_VEXPRESS, as it is an abstract class and the machine class lookup code explicitly skips abstract classes. We can remove it to make the code simpler. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19qdev: Do not use slow [*] expansion for GPIO creationPavel Fedin
Expansion of [*] suffix is very slow because index expansion is done using trial and error strategy, starting every time from zero and retrying with the next index until insertion succeeds. With large number of already added properties this process takes huge amount of time (O(n^2) complexity). Some architectures (like ARM) use very large amount of IRQ pins in interrupt controller models. This flaw makes machine startup extremely slow (~20 seconds for ARM64 with 32 CPUs). This patch decreases this time down to ~10 seconds. Also in qdev_init_gpio_out_named() memset() is now called only once for the whole array instead of per-cell cleaning Signed-off-by: Pavel Fedin <p.fedin@samsung.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-18Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into stagingPeter Maydell
# gpg: Signature made Fri 18 Sep 2015 15:59:02 BST using RSA key ID AAFC390E # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" * remotes/jnsnow/tags/ide-pull-request: ahci: clean up initial d2h semantics ahci: remove cmd_fis argument from write_fis_d2h ahci: fix signature generation ahci: remove dead reset code atapi: abort transfers with 0 byte limits ide: fix ATAPI command permissions ide-test: add cdrom dma test ide-test: add cdrom pio test qtest/ahci: export generate_pattern qtest/ahci: use generate_pattern everywhere ide: unify io_buffer_offset increments Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-18ahci: clean up initial d2h semanticsJohn Snow
with write_fis_d2h and signature generation tidied up, let's adjust the initial d2h semantics to make more sense. The initial d2h is considered delivered if there is guest memory to save it to. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1441140641-17631-5-git-send-email-jsnow@redhat.com
2015-09-18ahci: remove cmd_fis argument from write_fis_d2hJohn Snow
It's no longer used. We used to generate a D2H FIS based upon the command FIS that prompted the update, but in reality, the D2H FIS is generated purely from register state. cmd_fis is vestigial, so get rid of it. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1441140641-17631-4-git-send-email-jsnow@redhat.com
2015-09-18ahci: fix signature generationJohn Snow
The initial register device-to-host FIS no longer needs to specially set certain fields, as these can be handled generically by setting those fields explicitly with the signatures we want at port reset time. (1) Signatures are decomposed into their four component registers and set upon (AHCI) port reset. (2) the signature cache register is no longer set manually per-each device type, but instead just once during ahci_init_d2h. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1441140641-17631-3-git-send-email-jsnow@redhat.com
2015-09-18ahci: remove dead reset codeJohn Snow
This check is dead due to an earlier conditional. AHCI does not currently support hotplugging, so checks to see if devices are present or not are useless. Remove it. Reported-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1441140641-17631-2-git-send-email-jsnow@redhat.com
2015-09-18atapi: abort transfers with 0 byte limitsJohn Snow
We're supposed to abort on transfers like this, unless we fill Word 125 of our IDENTIFY data with a default transfer size, which we don't currently do. This is an ATA error, not a SCSI/ATAPI one. See ATA8-ACS3 sections 7.17.6.49 or 7.21.5. If we don't do this, QEMU will loop forever trying to transfer zero bytes, which isn't particularly useful. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 1442253685-23349-2-git-send-email-jsnow@redhat.com
2015-09-18ide: fix ATAPI command permissionsJohn Snow
We're a little too lenient with what we'll let an ATAPI drive handle. Clamp down on the IDE command execution table to remove CD_OK permissions from commands that are not and have never been ATAPI commands. For ATAPI command validity, please see: - ATA4 Section 6.5 ("PACKET Command feature set") - ATA8/ACS Section 4.3 ("The PACKET feature set") - ACS3 Section 4.3 ("The PACKET feature set") ACS3 has a historical command validity table in Table B.4 ("Historical Command Assignments") that can be referenced to find when a command was introduced, deprecated, obsoleted, etc. The only reference for ATAPI command validity is by checking that version's PACKET feature set section. ATAPI was introduced by T13 into ATA4, all commands retired prior to ATA4 therefore are assumed to have never been ATAPI commands. Mandatory commands, as listed in ATA8-ACS3, are: - DEVICE RESET - EXECUTE DEVICE DIAGNOSTIC - IDENTIFY DEVICE - IDENTIFY PACKET DEVICE - NOP - PACKET - READ SECTOR(S) - SET FEATURES Optional commands as listed in ATA8-ACS3, are: - FLUSH CACHE - READ LOG DMA EXT - READ LOG EXT - WRITE LOG DMA EXT - WRITE LOG EXT All other commands are illegal to send to an ATAPI device and should be rejected by the device. CD_OK removal justifications: 0x06 WIN_DSM Defined in ACS2. Not valid for ATAPI. 0x21 WIN_READ_ONCE Retired in ATA5. Not ATAPI in ATA4. 0x94 WIN_STANDBYNOW2 Retired in ATA4. Did not coexist with ATAPI. 0x95 WIN_IDLEIMMEDIATE2 Retired in ATA4. Did not coexist with ATAPI. 0x96 WIN_STANDBY2 Retired in ATA4. Did not coexist with ATAPI. 0x97 WIN_SETIDLE2 Retired in ATA4. Did not coexist with ATAPI. 0x98 WIN_CHECKPOWERMODE2 Retired in ATA4. Did not coexist with ATAPI. 0x99 WIN_SLEEPNOW2 Retired in ATA4. Did not coexist with ATAPI. 0xE0 WIN_STANDBYNOW1 Not part of ATAPI in ATA4, ACS or ACS3. 0xE1 WIN_IDLEIMMDIATE Not part of ATAPI in ATA4, ACS or ACS3. 0xE2 WIN_STANDBY Not part of ATAPI in ATA4, ACS or ACS3. 0xE3 WIN_SETIDLE1 Not part of ATAPI in ATA4, ACS or ACS3. 0xE4 WIN_CHECKPOWERMODE1 Not part of ATAPI in ATA4, ACS or ACS3. 0xE5 WIN_SLEEPNOW1 Not part of ATAPI in ATA4, ACS or ACS3. 0xF8 WIN_READ_NATIVE_MAX Obsoleted in ACS3. Not ATAPI in ATA4 or ACS. This patch fixes a divide by zero fault that can be caused by sending the WIN_READ_NATIVE_MAX command to an ATAPI drive, which causes it to attempt to use zeroed CHS values to perform sector arithmetic. Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 1441816082-21031-1-git-send-email-jsnow@redhat.com CC: qemu-stable@nongnu.org
2015-09-18Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2015-09-18' ↵Peter Maydell
into staging Error reporting patches # gpg: Signature made Fri 18 Sep 2015 13:42:49 BST using RSA key ID EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" * remotes/armbru/tags/pull-error-2015-09-18: memory: Fix bad error handling in memory_region_init_ram_ptr() loader: Fix memory_region_init_resizeable_ram() error handling Fix bad error handling after memory_region_init_ram() error: New error_fatal MAINTAINERS: Add "Error reporting" entry error: Copy location information in error_copy() hmp: Allow for error message hints on HMP error: only prepend timestamp on stderr Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-18loader: Fix memory_region_init_resizeable_ram() error handlingMarkus Armbruster
Commit ef701d7 screwed up handling of out-of-memory conditions. Before the commit, we report the error and exit(1), in one place. The commit lifts the error handling up the call chain some, to three places. Fine. Except it uses &error_abort in these places, changing the behavior from exit(1) to abort(), and thus undoing the work of commit 3922825 "exec: Don't abort when we can't allocate guest memory". The previous commit fixed up uses of memory_region_init_ram(). One of them was replaced by memory_region_init_resizeable_ram() [sic!] in commit a166614, so Coccinelle missed it. Fix it up. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1441983105-26376-4-git-send-email-armbru@redhat.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
2015-09-18Fix bad error handling after memory_region_init_ram()Markus Armbruster
Symptom: $ qemu-system-x86_64 -m 10000000 Unexpected error in ram_block_add() at /work/armbru/qemu/exec.c:1456: upstream-qemu: cannot set up guest memory 'pc.ram': Cannot allocate memory Aborted (core dumped) Root cause: commit ef701d7 screwed up handling of out-of-memory conditions. Before the commit, we report the error and exit(1), in one place, ram_block_add(). The commit lifts the error handling up the call chain some, to three places. Fine. Except it uses &error_abort in these places, changing the behavior from exit(1) to abort(), and thus undoing the work of commit 3922825 "exec: Don't abort when we can't allocate guest memory". The three places are: * memory_region_init_ram() Commit 4994653 (right after commit ef701d7) lifted the error handling further, through memory_region_init_ram(), multiplying the incorrect use of &error_abort. Later on, imitation of existing (bad) code may have created more. * memory_region_init_ram_ptr() The &error_abort is still there. * memory_region_init_rom_device() Doesn't need fixing, because commit 33e0eb5 (soon after commit ef701d7) lifted the error handling further, and in the process changed it from &error_abort to passing it up the call chain. Correct, because the callers are realize() methods. Fix the error handling after memory_region_init_ram() with a Coccinelle semantic patch: @r@ expression mr, owner, name, size, err; position p; @@ memory_region_init_ram(mr, owner, name, size, ( - &error_abort + &error_fatal | err@p ) ); @script:python@ p << r.p; @@ print "%s:%s:%s" % (p[0].file, p[0].line, p[0].column) When the last argument is &error_abort, it gets replaced by &error_fatal. This is the fix. If the last argument is anything else, its position is reported. This lets us check the fix is complete. Four positions get reported: * ram_backend_memory_alloc() Error is passed up the call chain, ultimately through user_creatable_complete(). As far as I can tell, it's callers all handle the error sanely. * fsl_imx25_realize(), fsl_imx31_realize(), dp8393x_realize() DeviceClass.realize() methods, errors handled sanely further up the call chain. We're good. Test case again behaves: $ qemu-system-x86_64 -m 10000000 qemu-system-x86_64: cannot set up guest memory 'pc.ram': Cannot allocate memory [Exit 1 ] The next commits will repair the rest of commit ef701d7's damage. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1441983105-26376-3-git-send-email-armbru@redhat.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
2015-09-18target-mips: fix corner case in TLBWR causing QEMU to hangLeon Alrae
cpu_mips_get_random() function is used to generate a random index from CP0.Wired to TLBSize-1 range. Current implementation avoids generating the same as before value, hence the while loop. If the guest sets CP0.Wired to TLBSize-1 (which actually does not sound to be very practical) QEMU will get stuck in the loop infinitely as we always generate the same index. Signed-off-by: Leon Alrae <leon.alrae@imgtec.com> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
2015-09-18pic32: use LCG algorithm for generated random index of TLBWR instructionSerge Vakulenko
The LFSR algorithm, used for generating random TLB indexes for TLBWR instruction, was inclined to produce a degenerate sequence in some cases. For example, for 16-entry TLB size and Wired=1, it gives: 15, 6, 7, 2, 7, 2, 7, 2, 7, 2, 7, 2, 7, 2, 7, 2, 7, 2, 7, 2, 7, 2, 7, 2, 7, 2, 7, 2... When replaced with LCG algorithm from ISO/IEC 9899 standard, the sequence looks much better, with about the same computational effort needed. Signed-off-by: Serge Vakulenko <serge.vakulenko@gmail.com> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Leon Alrae <leon.alrae@imgtec.com> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
2015-09-17ide: unify io_buffer_offset incrementsJohn Snow
IDEState's io_buffer_offset was originally added to keep track of offsets in AHCI rather exclusively, but it was added to IDEState instead of an AHCI-specific structure. AHCI fakes all PIO transfers using DMA and a scatter-gather list. When the core or atapi layers invoke HBA-specific mechanisms for transfers, they do not always know that it is being backed by DMA or a sglist, so this offset is not always updated by the HBA code everywhere. If we modify it in dma_buf_commit, however, any HBA that needs to use this offset to manage operating on only part of a sglist will have access to it. This will fix ATAPI PIO transfers performed through the AHCI HBA, which were previously not modifying this value appropriately. This will fix ATAPI PIO transfers larger than one sector. Reported-by: Hannes Reinecke <hare@suse.de> Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Message-id: 1440546331-29087-2-git-send-email-jsnow@redhat.com CC: qemu-stable@nongnu.org
2015-09-17Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into ↵Peter Maydell
staging # gpg: Signature made Thu 17 Sep 2015 12:43:56 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/net-pull-request: net: smc91c111: flush packets on RCR register changes net: smc91c111: gate can_receive() on rx FIFO having a slot net: smc91c111: guard flush_queued_packets() on can_rx() MAINTAINERS: Stefan will not maintain net subsystem Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-17net: smc91c111: flush packets on RCR register changesPeter Crosthwaite
The SOFT_RST or RXEN in the control register can be used as a condition to unblock the net layer via can_receive(). So check for possible flushes on RCR changes. This will drop all pending packets on soft reset or disable which is the functional intent of the can_receive() logic. Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Reviewed-by: Fam Zheng <famz@redhat.com> Tested-by: Richard Purdie <richard.purdie@linuxfoundation.org> Message-id: b114d4c96f4afbdaa15f1361d9c07e3021755915.1441873621.git.crosthwaite.peter@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-09-17net: smc91c111: gate can_receive() on rx FIFO having a slotPeter Crosthwaite
Return false from can_receive() when the FIFO doesn't have a free RX slot. This fixes a bug in the current code where the allocated buffer is freed before the fifo pop, triggering a premature flush of queued RX packets. It also will handle a corner case, where the guest manually frees the allocated buffer before popping the rx FIFO (hence it is not enough to just delay the flush_queued_packets()). Reported-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Reviewed-by: Fam Zheng <famz@redhat.com> Tested-by: Richard Purdie <richard.purdie@linuxfoundation.org> Message-id: 97bfdfc5cbce0bd5e0cbbbff35ce7a1bf6f8603d.1441873621.git.crosthwaite.peter@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-09-17net: smc91c111: guard flush_queued_packets() on can_rx()Peter Crosthwaite
Check that the core can once again receive packets before asking the net layer to do a flush. This will make it more convenient to flush packets when adding new conditions to can_receive. Add missing if braces while moving the can_receive() core code. Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Reviewed-by: Fam Zheng <famz@redhat.com> Tested-by: Richard Purdie <richard.purdie@linuxfoundation.org> Message-id: 92e15e12a6964274f4bc0eb71b61a7d94326f6c6.1441873621.git.crosthwaite.peter@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-09-16Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* Linux header update and cleanup * Support for HyperV crash report * Cleanup of target-specific HMP commands * Multiarch batch * Checkpatch fix for Perl 5.22 * NBD fix * Revert incorrect commit 5243722376 # gpg: Signature made Wed 16 Sep 2015 16:39:01 BST using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" * remotes/bonzini/tags/for-upstream: (24 commits) nbd: release exp->blk after all clients are closed checkpatch: Escape left braces in regex monitor: uninclude cpu_ldst include/exec: Move cputlb exec.c defs out cputlb: Change tlb_set_dirty() arg to cpu cputlb: move CPU_LOOP() for tlb_reset() to exec.c translate: move real_host_page setting to -common tcg: Move tci_tb_ptr to -common tcg: split tcg_op_defs to -common translate-all: Move tcg_handle_interrupt() to -common cpu-exec: Migrate some generic fns to cpu-exec-common qemu-char: Use g_new() & friends where that makes obvious sense monitor: added generation of documentation for hmp-commands-info.hx hmp-commands.hx: fix end of table info monitor: remove target-specific code from monitor.c hmp-commands-info: move info_cmds content out of monitor.c i386/kvm: Hyper-v crash msrs set/get'ers and migration kvm: Add kvm system event crash handler cpu: Add crash_occurred flag into CPUState target-i386: move asm-x86/hyperv.h to standard-headers ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-16pci: remove Link Training error from AER error listPaolo Bonzini
The spec says: Undefined – The value read from this bit is undefined. In previous versions of this specification, this bit was used to indicate a Link Training Error. System software must ignore the value read from this bit. System software is permitted to write any value to this bit. Do not allow injecting it. Suggested-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-09-15net: avoid infinite loop when receiving packets(CVE-2015-5278)P J P
Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152) bytes to process network packets. While receiving packets via ne2000_receive() routine, a local 'index' variable could exceed the ring buffer size, leading to an infinite loop situation. Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: P J P <pjp@fedoraproject.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-09-15net: add checks to validate ring buffer pointers(CVE-2015-5279)P J P
Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152) bytes to process network packets. While receiving packets via ne2000_receive() routine, a local 'index' variable could exceed the ring buffer size, which could lead to a memory buffer overflow. Added other checks at initialisation. Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: P J P <pjp@fedoraproject.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-09-15e1000: Avoid infinite loop in processing transmit descriptor (CVE-2015-6815)P J P
While processing transmit descriptors, it could lead to an infinite loop if 'bytes' was to become zero; Add a check to avoid it. [The guest can force 'bytes' to 0 by setting the hdr_len and mss descriptor fields to 0. --Stefan] Signed-off-by: P J P <pjp@fedoraproject.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 1441383666-6590-1-git-send-email-stefanha@redhat.com
2015-09-14Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* Support for jemalloc * qemu_mutex_lock_iothread "No such process" fix * cutils: qemu_strto* wrappers * iohandler.c simplification * Many other fixes and misc patches. And some MTTCG work (with Emilio's fixes squashed): * Signal-free TCG kick * Removing spinlock in favor of QemuMutex * User-mode emulation multi-threading fixes/docs # gpg: Signature made Thu 10 Sep 2015 09:03:07 BST using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" * remotes/bonzini/tags/for-upstream: (44 commits) cutils: work around platform differences in strto{l,ul,ll,ull} cpu-exec: fix lock hierarchy for user-mode emulation exec: make mmap_lock/mmap_unlock globally available tcg: comment on which functions have to be called with mmap_lock held tcg: add memory barriers in page_find_alloc accesses remove unused spinlock. replace spinlock by QemuMutex. cpus: remove tcg_halt_cond and tcg_cpu_thread globals cpus: protect work list with work_mutex scripts/dump-guest-memory.py: fix after RAMBlock change configure: Add support for jemalloc add macro file for coccinelle configure: factor out adding disas configure vhost-scsi: fix wrong vhost-scsi firmware path checkpatch: remove tests that are not relevant outside the kernel checkpatch: adapt some tests to QEMU CODING_STYLE: update mixed declaration rules qmp: Add example usage of strto*l() qemu wrapper cutils: Add qemu_strtoull() wrapper cutils: Add qemu_strtoll() wrapper ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-14hw/cpu/{a15mpcore, a9mpcore}: Handle missing has_el3 CPU props gracefullyEdgar E. Iglesias
Handle missing CPU support for EL3 gracefully. Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1442135278-25281-2-git-send-email-edgar.iglesias@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-14i.MX: Add GPIO devices to i.MX25 SOCJean-Christophe Dubois
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Message-id: 2eb129ba8713aedfe877eaa3d8de80061d880fbb.1441828793.git.jcd@tribudubois.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-14i.MX: Add GPIO devices to i.MX31 SOCJean-Christophe Dubois
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Message-id: 60b67c9a8b948159f4b4163ead86fbf701c011c6.1441828793.git.jcd@tribudubois.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-14i.MX: Add GPIO deviceJean-Christophe Dubois
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Message-id: 5ea3b0021e47cf7f7d883a7edbabee44980f3df7.1441828793.git.jcd@tribudubois.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-14xlnx-zynqmp: Remove unnecessary brackets around error messagesAlistair Francis
The errp and err variable have unnecessary brackets around them, so remove the brackets. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Message-id: 9900393572b63f2ec3d68785ca98193d81e0ac71.1441758563.git.alistair.francis@xilinx.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-14Merge remote-tracking branch 'remotes/aurel/tags/pull-sh4-next-20150913' ↵Peter Maydell
into staging sh4-next: - TCG optimizations - fix initramfs endianness issue # gpg: Signature made Sun 13 Sep 2015 22:16:12 BST using RSA key ID 1DDD8C9B # gpg: Good signature from "Aurelien Jarno <aurelien@aurel32.net>" # gpg: aka "Aurelien Jarno <aurelien@jarno.fr>" # gpg: aka "Aurelien Jarno <aurel32@debian.org>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 7746 2642 A9EF 94FD 0F77 196D BA9C 7806 1DDD 8C9B * remotes/aurel/tags/pull-sh4-next-20150913: sh4: Fix initramfs initialization for endiannes-mismatched targets target-sh4: improve shad instruction target-sh4: improve shld instruction target-sh4: improve cmp/str instruction target-sh4: use deposit in swap.b instruction target-sh4: add flags markups for FP helpers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-13sh4: Fix initramfs initialization for endiannes-mismatched targetsGuenter Roeck
If host and target endianness does not match, loding an initramfs does not work. Fix by writing boot parameters with appropriate endianness conversion. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2015-09-11hw/arm/spitz: Remove meaningless blank PropertyShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-09-11hw/gpio/zaurus: Remove meaningless blank PropertyShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-09-11hw/virtio/virtio-pci: Remove meaningless blank PropertyShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-09-11hw/s390x/s390-virtio-bus: Remove meaningless blank PropertyShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-14 19:32:34 +0000