Statistics
| Branch: | Revision:

root / hw @ 721589dd

# Date Author Comment
721589dd 06/05/2012 04:05 am Anthony Liguori

Revert "Revert "rtl8139: do the network/host communication only in normal operating mode""

This reverts commit 9c92bf7f6c3f675e60b8ba8a5287bb88ea1eac36.

Per Jason's request.

Signed-off-by: Anthony Liguori <>

9c92bf7f 06/04/2012 07:58 am Jason Wang

Revert "rtl8139: do the network/host communication only in normal operating mode"

This reverts commit ff71f2e8cacefae99179993204172bc65e4303df. This is because
the linux 8139cp driver would leave the card in "Config Register Write Enable"
mode after the eeprom were read or write ( which is unexpected in the spec...

74f4d227 06/03/2012 02:56 am Anthony Liguori

Merge remote-tracking branch 'qemu-kvm/uq/master' into staging

  • qemu-kvm/uq/master:
    virtio/vhost: Add support for KVM in-kernel MSI injection
    msix: Add msix_nr_vectors_allocated
    kvm: Enable use of kvm_irqchip_in_kernel in hwlib code
    kvm: Introduce kvm_irqchip_add/remove_irqfd...
4bb9c939 05/30/2012 03:51 pm Daniel Verkamp

ahci: SATA FIS is 20 bytes, not 0x20

As in the SATA and AHCI specifications, a FIS is 5 Dwords of 4 bytes
each, which comes to 20 bytes (decimal), not 0x20.

Signed-off-by: Daniel Verkamp <>
Signed-off-by: Kevin Wolf <>

136be99e 05/30/2012 03:51 pm Christian Borntraeger

virtio-blk: Fix geometry sector calculation

Currently the sector value for the geometry is masked, even if the
user usesa command line parameter that explicitely gives a number.
This breaks dasd devices on s390. A dasd device can have
a physical block size of 4096 (== same for logical block size)...

47ce9ef7 05/30/2012 10:49 am Stefan Weil

virtio: Fix compiler warning for non Linux hosts

The local variables ret, i are only used if linux is defined.

Signed-off-by: Stefan Weil <>
Signed-off-by: Kevin Wolf <>

8294a64d 05/30/2012 04:19 am Avi Kivity

vga: fix vram double-mapping with -vga std and -M pc-0.12

With pc-0.12, we map the video RAM both through the PCI BAR (the guest does
this) and through a fixed mapping at 0xe0000000. The memory API doesn't allow
this double map, and aborts.

Fix by using an alias....

9c3a596a 05/30/2012 04:19 am Scott Moser

fix multiboot loading if load_end_addr == 0

The previous multiboot load code did not treat the case where
load_end_addr was 0 specially. The multiboot specification says the
following: * load_end_addr
Contains the physical address of the end of the data segment....

a6de8ed8 05/30/2012 04:19 am Amos Kong

pci: call object_unparent() before free_qdev()

Start VM with 8 multiple-function block devs, hot-removing
those block devs by 'device_del ...' would cause qemu abort.

| (qemu) device_del virti0-0-0 | (qemu) ** |ERROR:qom/object.c:389:object_delete: assertion failed: (obj->ref == 0)...

dd86df75 05/29/2012 12:32 pm Anthony Liguori

Merge remote-tracking branch 'sstabellini/for_1.1_rc3' into staging

  • sstabellini/for_1.1_rc3:
    Call xc_domain_shutdown with the reboot flag when the guest requests a reboot.
    xen: Fix PV-on-HVM
    xen_disk: properly update stats in ioreq_release()
    xen_disk: use bdrv_aio_flush instead of bdrv_flush...
30676153 05/29/2012 12:30 pm Anthony Liguori

Merge remote-tracking branch 'kwolf/for-anthony' into staging

  • kwolf/for-anthony:
    fdc-test: introduced qtest no_media_on_start and cmos qtest for floppy
    fdc: fix media detection
    fdc: floppy drive should be visible after start without media
    qemu-iotests: mark 035 qcow2-only...
cfb08fba 05/25/2012 07:21 pm Pavel Hrdina

fdc: fix media detection

We have to set up 'media_changed' after guest start so floppy driver
could detect that there is no media in drive. For this purpose we call
'fdctrl_change_cb' instead of 'fd_revalidate' in 'fdctrl_connect_drives'.
'fd_revalidate' is called inside 'fdctrl_change_cb'....

9ecd3947 05/25/2012 07:18 pm Pavel Hrdina

fdc: floppy drive should be visible after start without media

If you start guest with floppy drive but without media inserted, guest
still should see floppy drive pressent.

Signed-off-by: Pavel Hrdina <>
Signed-off-by: Kevin Wolf <>

12badfc2 05/25/2012 02:00 pm Jim Meyering

scsi: declare vmstate_info_scsi_requests to be static

Signed-off-by: Jim Meyering <>

f8687bab 05/24/2012 01:03 am Stefan Weil

es1370: Fix debug code

When DEBUG_ES1370 is defined, the compiler shows these warnings:

hw/es1370.c: In function ?es1370_update_voices?:
hw/es1370.c:414: warning: format ?%d? expects type ?int?, but argument 3 has type ?size_t?
hw/es1370.c: In function ?es1370_writel?:...

a3400466 05/21/2012 11:40 pm dunrong huang

qdev: Fix memory leak

The str allocated in visit_type_str was not freed.

The visit_type_str function is an input visitor(<QMP/String/etc>-to-native)
here, it will allocate memory for caller, so the caller is responsible for
freeing the memory.

Reviewed-by: Stefan Weil <>...

4accd107 05/21/2012 11:40 pm Anthony PERARD

xen: Fix PV-on-HVM

In the context of PV-on-HVM under Xen, the emulated nics are supposed to be
unplug before the guest drivers are initialized, when the guest write to a
specific IO port.

Without this patch, the guest end up with two nics with the same MAC, the...

80a2ba3d 05/21/2012 11:40 pm Mark Langsdorf

use an uint64_t for the max_sz parameter in load_image_targphys

Allow load_image_targphys to load files on systems with more than 2G of
emulated memory by changing the max_sz parameter from an int to an
uint64_t.

Reviewed-by: Andreas F=E4rber <>...

f34e73cd 05/21/2012 11:40 pm Paolo Bonzini

virtio-blk: report non-zero status when failing SG_IO requests

Linux really looks only at scsi->errors for SG_IO requests; it does
not look at the virtio request status at all. Because of this, when
a SG_IO request is failed early with virtio_blk_req_complete(req,...

0e47931b 05/21/2012 11:40 pm Paolo Bonzini

virtio-blk: blockdev_mark_auto_del is transport-independent

Move it from virtio_blk_exit_pci to virtio_blk_exit.

This is included here because the next patch removes proxy->block.

Signed-off-by: Paolo Bonzini <>
Signed-off-by: Anthony Liguori <>

12c5674b 05/21/2012 11:40 pm Paolo Bonzini

virtio-blk: define VirtIOBlkConf

We will have to add another field to the virtio-blk configuration in
the next patch. Avoid a proliferation of arguments to virtio_blk_init.

Signed-off-by: Paolo Bonzini <>
Signed-off-by: Anthony Liguori <>

a6c5c84a 05/21/2012 11:40 pm Paolo Bonzini

virtio-blk: always enable VIRTIO_BLK_F_SCSI

VIRTIO_BLK_F_SCSI is supposed to mean whether the host can parse
SCSI requests, not execute them. You could run QEMU with scsi=on
and a file-backed disk, and QEMU would fail all SCSI requests even
though it advertises VIRTIO_BLK_F_SCSI....

2a633c46 05/21/2012 11:40 pm Orit Wassermann

virtio: check virtio_load return code

Otherwise we crash on error.

Signed-off-by: Ulrich Obergfell <>
Signed-off-by: Orit Wassermann <>
Signed-off-by: Paolo Bonzini <>
Signed-off-by: Anthony Liguori <>

cb697aaa 05/21/2012 07:22 pm Jan Kiszka

msix: Add msix_nr_vectors_allocated

Analogously to msi_nr_vectors_allocated, add a service for MSI-X. Will
be used by the virtio-pci layer.

Signed-off-by: Jan Kiszka <>
Signed-off-by: Avi Kivity <>

7d37d351 05/21/2012 07:22 pm Jan Kiszka

virtio/vhost: Add support for KVM in-kernel MSI injection

Make use of the new vector notifier to track changes of the MSI-X
configuration of virtio PCI devices. On enabling events, we establish
the required virtual IRQ to MSI-X message route and link the signaling...

bc4caf49 05/21/2012 07:22 pm Jan Kiszka

msix: Factor out msix_get_message

This helper will also be used by the upcoming config notifier.

Signed-off-by: Jan Kiszka <>
Signed-off-by: Avi Kivity <>

5b5f1330 05/21/2012 07:22 pm Jan Kiszka

msix: Invoke msix_handle_mask_update on msix_mask_all

In preparation of firing vector notifiers on mask changes, call
msix_handle_mask_update also from msix_mask_all. So far, this will have
no real effect.

Signed-off-by: Jan Kiszka <>...

2cdfe53c 05/21/2012 07:22 pm Jan Kiszka

msix: Introduce vector notifiers

Vector notifiers shall be triggered by the MSI/MSI-X core whenever a
relevant configuration change is programmed by the guest. In case of
MSI-X, changes are reported when the effective mask (global &&
per-vector) alters its state. On unmask, the current vector...

1df186df 05/21/2012 07:22 pm Jan Kiszka

kvm: Rename kvm_irqchip_add_route to kvm_irqchip_add_irq_route

We will add kvm_irqchip_add_msi_route, so let's make the difference
clearer.

Signed-off-by: Jan Kiszka <>
Signed-off-by: Avi Kivity <>

e7b20308 05/21/2012 07:22 pm Jan Kiszka

kvm: Make kvm_irqchip_commit_routes an internal service

Automatically commit route changes after kvm_add_routing_entry and
kvm_irqchip_release_virq. There is no performance relevant use case for
which collecting multiple route changes is beneficial. This makes...

4636b9d1 05/19/2012 06:41 pm Blue Swirl

virtio-pci: add missing 'static'

There are no outside references to virtio_portio.
Add missing 'static' specifier.

Reviewed-by: Stefan Weil <>
Signed-off-by: Blue Swirl <>

5f2bf0fe 05/19/2012 06:39 pm Blue Swirl

sparc64: fix initrd loading

Initrd load address is too low, it conflicts with kernel load
address:
rom: requested regions overlap (rom phdr #0: /tmp/vmlinux-debian-6.0.4-sparc64. free=0x0000000000742519, addr=0x0000000000400000)
rom loading failed

Fix by making the initrd address variable, load initrd after kernel...

180640ea 05/17/2012 01:52 pm John V. Baboval

Call xc_domain_shutdown with the reboot flag when the guest requests a reboot.

Signed-off-by: John V. Baboval <>
Signed-off-by: Tom Goetz <>
Signed-off-by: Anthony PERARD <>...

a4f1a758 05/17/2012 01:52 pm Anthony PERARD

xen: Fix PV-on-HVM

In the context of PV-on-HVM under Xen, the emulated nics are supposed to be
unplug before the guest drivers are initialized, when the guest write to a
specific IO port.

Without this patch, the guest end up with two nics with the same MAC, the...

ba1dffed 05/17/2012 01:43 pm Stefano Stabellini

xen_disk: remove syncwrite option

This patch removes a dead option.

The same can be achieved removing BDRV_O_NOCACHE and BDRV_O_CACHE_WB
from the flags passed to bdrv_open.

Signed-off-by: Stefano Stabellini <>

c6961b7d 05/17/2012 01:43 pm Stefano Stabellini

xen_disk: use bdrv_aio_flush instead of bdrv_flush

Use bdrv_aio_flush instead of bdrv_flush.

Make sure to call bdrv_aio_writev/readv after the presync bdrv_aio_flush is fully
completed and make sure to call the postsync bdrv_aio_flush after
bdrv_aio_writev/readv is fully completed....

ed547766 05/17/2012 01:43 pm Jan Beulich

xen_disk: properly update stats in ioreq_release()

While for the "normal" case (called from blk_send_response_all())
decrementing requests_finished is correct, doing so in the parse error
case is wrong; requests_inflight needs to be decremented instead.
...

c2d8d311 05/17/2012 01:43 pm Stefano Stabellini

xen: do not initialize the interval timer and PCSPK emulator

PIT and PCSPK are emulated by the hypervisor so we don't need to emulate
them in Qemu: this patch prevents Qemu from waking up needlessly at
PIT_FREQ on Xen.

Signed-off-by: Stefano Stabellini <>

ffb8d429 05/17/2012 12:04 am Jan Kiszka

kvm: x86: Wire up MSI support for in-kernel irqchip

Catch writes to the MSI MMIO region in the KVM APIC and forward them to
the kernel. Provide the kernel support GSI routing, this allows to
enable MSI support also for in-kernel irqchip mode.

Signed-off-by: Jan Kiszka <>...

14de9bab 05/17/2012 12:04 am Jan Kiszka

Introduce MSIMessage structure

Will be used for generating and distributing MSI messages, both in
emulation mode and under KVM.

Signed-off-by: Jan Kiszka <>
Signed-off-by: Marcelo Tosatti <>

08a82ac0 05/17/2012 12:04 am Jan Kiszka

pc: Enable MSI support at APIC level

Push msi_supported enabling to the APIC implementations where we can
encapsulate the decision more cleanly, hiding the details from the
generic code.

Acked-by: Stefano Stabellini <>
Signed-off-by: Jan Kiszka <>...

8592d525 05/14/2012 06:15 pm Anthony Liguori

Merge remote-tracking branch 'afaerber-or/qom-1.1' into staging

  • afaerber-or/qom-1.1:
    mips_fulong2e: Don't register "cpu" VMState twice
    pc: Add back PCI.rombar compat property
    qdev: Fix adding of ptr properties
    qdev: Use object_property_print() in info qtree...
7a85d1cf 05/14/2012 06:07 pm Anthony Liguori

Merge remote-tracking branch 'kraxel/usb.50' into staging

  • kraxel/usb.50:
    usb-host: handle guest-issued clear halt
caa3d6d3 05/14/2012 06:07 pm Anthony Liguori

Merge remote-tracking branch 'spice/spice.v55' into staging

  • spice/spice.v55:
    qxl: set size of PCI IO BAR correctly (16) for revision 2
82ac96a7 05/14/2012 06:06 pm Anthony Liguori

Merge remote-tracking branch 'sweil/for-1.1' into staging

  • sweil/for-1.1:
    qemu-doc: Use QEMU instead of qemu for product name
    qemu-doc: Fix executable name in examples
    qemu-doc: Add missing parameter in description of -D option
    configure: Use QEMU instead of Qemu...
90ca64a9 05/14/2012 06:06 pm Paolo Bonzini

qdev: fix -device foo,?

Since most property types do not have a parse property now, this was
broken. Fix it by looking at the setter instead.

Reviewed-by: Anthony Liguori <>
Acked-by: Andreas F=E4rber <>
Signed-off-by: Paolo Bonzini <>...

a2498f76 05/14/2012 11:22 am Gerd Hoffmann

usb-host: handle guest-issued clear halt

Most important here is to update our internal endpoint state so we know
the endpoint isn't in halted state any more. Without this usb-host
tries to clear halt again with the next data transfer submitted. Doing
this twice is (a) not correct and (b) confuses some usb devices,...

3f6297b9 05/14/2012 11:22 am Uri Lublin

qxl: set size of PCI IO BAR correctly (16) for revision 2

Also move it up into switch(qxl->revision) block

Signed-off-by: Uri Lublin <>
Signed-off-by: Gerd Hoffmann <>

a31f0531 05/14/2012 08:27 am Jim Meyering

fix some common typos

These were identified using: http://github.com/lyda/misspell-check
and run like this to create a bourne shell script using GNU sed's
-i option:

git ls-files|grep -vF .bin | misspellings -f - |grep -v '^ERROR:' |perl \
-pe 's/^(.*?)\[(\d+)\]: (\w+) -> "(.*?)"$/sed -i '\''${2}s!$3!$4!'\'' $1/'...

0c9dfe46 05/13/2012 08:58 pm Juan Quintela

mips_fulong2e: Don't register "cpu" VMState twice

We have the following simplified callgraph in mips_fulong2e_init():

cpu_init() => cpu_mips_init()
object_new()
mips_cpu_initfn()
cpu_exec_init()
register_savevm(NULL, "cpu", cpu_index, CPU_SAVE_VERSION,...
c115cd65 05/13/2012 07:55 pm Paolo Bonzini

pc: Add back PCI.rombar compat property

This was erroneously dropped in d6c730086cbf24382eb8cff25551798769edfd84
(pc: reduce duplication in compat machine types).

Signed-off-by: Paolo Bonzini <>
Signed-off-by: Andreas Färber <>...

f3be016d 05/12/2012 03:19 pm Anthony Liguori

qdev: Fix adding of ptr properties

ptr properties have neither a get/set or a print/parse which means that when
they're added they aren't treated as static or legacy properties.

Just assume properties like this are legacy properties and treat them as such....

8185bfc1 05/12/2012 03:17 pm Paolo Bonzini

qdev: Use object_property_print() in info qtree

Otherwise, non-string properties without a legacy counterpart are missed.
Also fix error propagation in object_property_print() itself.

Signed-off-by: Paolo Bonzini <>
Reviewed-by: Anthony Liguori <>...

94d19914 05/12/2012 12:49 pm Artyom Tarasenko

sun4u: implement interrupt clearing registers

Implement registers for clearing OBIO and PCI interrupts

Signed-off-by: Artyom Tarasenko <>
Signed-off-by: Blue Swirl <>

d1d80055 05/12/2012 12:49 pm Artyom Tarasenko

sun4u: initialize OBIO interrupt mappings

Similarly to PCI interrupt mappings, the OBIO ones have to be initialized.

Signed-off-by: Artyom Tarasenko <>
Signed-off-by: Blue Swirl <>

4f08129e 05/08/2012 05:41 pm Anthony Liguori

Merge remote-tracking branch 'mst/tags/for_anthony' into staging

  • mst/tags/for_anthony:
    rtl8139: fix regression in TxStatus/TxAddr read
7c652c1e 05/08/2012 05:38 pm Anthony Liguori

Merge remote-tracking branch 'kwolf/for-anthony' into staging

  • kwolf/for-anthony:
    fdc: simplify media change handling
    qcow2: lock on prealloc
    block: make bdrv_create adopt coroutine
    qcow2: Limit COW to where it's needed
    sheepdog: switch to writethrough mode if cluster doesn't support flush
e45bca68 05/08/2012 05:37 pm Anthony Liguori

Merge remote-tracking branch 'bonzini/scsi-next' into staging

  • bonzini/scsi-next:
    scsi: Add assertion for use-after-free errors
    scsi: remove useless debug messages
    scsi: set VALID bit to 0 in fixed format sense data
    scsi: do not require a minimum allocation length for REQUEST SENSE...
acde8376 05/08/2012 05:36 pm Anthony Liguori

Merge remote-tracking branch 'spice/spice.v54' into staging

  • spice/spice.v54:
    qxl: don't assert on guest create_guest_primary
    qxl: ioport_write: remove guest trigerrable abort
    qxl: qxl_add_memslot: remove guest trigerrable panics
    qxl: interface_notify_update: remove guest trigerrable abort...
4b5463bf 05/08/2012 05:36 pm Anthony Liguori

Merge remote-tracking branch 'sweil/fixes' into staging

  • sweil/fixes:
    qemu-timer: Fix limits for w32 mmtimer
    qom: Fix memory leak in function container_get
    hw/pc_sysfw: Fix memory leak
    qdev: Fix memory leak in function set_pci_devfn
    arm-semi: Rename SYS_XXX macros to TARGET_SYS_XXX (fixes compiler warning)...
bdc62e62 05/08/2012 05:09 pm Avi Kivity

rtl8139: fix regression in TxStatus/TxAddr read

Commit afe0a595356192 added byte reads for TxStatus/TxAddr, but
broke 32-bit reads; the mask generation

(1 << (8 * size)) - 1

is unspecified in C for size >= sizeof(int), and in fact returns 0
on x86.
...

21fcf360 05/07/2012 08:33 pm Hervé Poussineau

fdc: simplify media change handling

This also (partly) fixes IBM OS/2 Warp 4.0 floppy installation, where
not all floppies have the same format (2x80x18 for the first ones,
2x80x23 for the next ones).

Signed-off-by: Hervé Poussineau <>...

d044be37 05/07/2012 03:31 pm Hans de Goede

hw/ac97: Make a bunch of mixer registers read only

The Linux ac97 driver tries to see if optional things like video input
volume control are available in 2 ways:
1) See if the mute bit is set after reset, if it is no further tests are done
2) If the mute bit is not set it does a write/read test of the mute bit...

f94e9b9b 05/07/2012 03:31 pm Hans de Goede

hw/ac97: Use AC97_Record_Gain_Mute not AC97_Line_In_Volume_Mute

After commit 19677a380a70348134ed7650b294522617eb03fc:
"hw/ac97: add support for volume control"

We are (correctly) using AC97_Record_Gain_Mute and not AC97_Line_In_Volume_Mute
for recording volume, but various places in hw/ac97 were still assumimg that...

7873bfb8 05/07/2012 03:31 pm Hans de Goede

hw/ac97: Mask out unused bits of volume controls

The Linux ac97 drivers does a number of register read/write tests to
see how much resolution a volume control actually has.

This patch takes this into account by masking out any bits written to
a volume control reg which should not be there according to the spec....

847c25d0 05/07/2012 03:31 pm Hans de Goede

hw/ac97: Mask out the EAPD bit on Powerdown Ctrl/Stat writes

The Linux AC97 driver tests this bit to decide wether or not to show
an External amplifier toggle control.

This patch was also tested with a Windows XP guest without any issues.

Signed-off-by: Hans de Goede <>...

a4e652eb 05/07/2012 03:31 pm Hans de Goede

hw/ac97: Fix log message in mixer_load

Fix a small copy and paste error in logging.

Signed-off-by: Hans de Goede <>
Signed-off-by: malc <>

065c2599 05/07/2012 09:44 am Paolo Bonzini

scsi: parse 16-byte tape CDBs

The transfer length for these commands is different from the transfer
length of the corresponding disk commands, so parse it specially.

Signed-off-by: Paolo Bonzini <>

3c3d8a95 05/07/2012 09:44 am Paolo Bonzini

scsi: do not require a minimum allocation length for INQUIRY

The requirements on the INQUIRY buffer size are not in my copy of SPC
(SPC-4 r27) and not observed by LIO. Rip them out.

Signed-off-by: Paolo Bonzini <>

e5f38ff6 05/07/2012 09:44 am Paolo Bonzini

scsi: do not require a minimum allocation length for REQUEST SENSE

The requirements on the REQUEST SENSE buffer size are not in my copy of SPC
(SPC-4 r27) and not observed by LIO. Rip them out.

Signed-off-by: Paolo Bonzini <>

77e4743c 05/07/2012 09:44 am Paolo Bonzini

scsi: set VALID bit to 0 in fixed format sense data

The INFORMATION field (bytes 3..6) is never set by QEMU, so the VALID
bit must be 0.

Signed-off-by: Paolo Bonzini <>

2a92fbff 05/07/2012 09:44 am Paolo Bonzini

scsi: remove useless debug messages

Optional inquiry information is declared obsolete in the latest versions
of the standard; invalid CDBs or unsupported VPD pages are supported
can be diagnosed with trace_scsi_inquiry.

Signed-off-by: Paolo Bonzini <>

68bd348a 05/07/2012 09:44 am Stefan Weil

scsi: Add assertion for use-after-free errors

The QEMU emulation which is currently used with Raspberry PI images
(qemu-system-arm -M versatilepb ...) accesses memory which was freed.

Valgrind output (extract):

17857 Invalid write of size 4
17857 at 0x24EB06: scsi_req_unref (scsi-bus.c:1273)...
f62d0594 05/07/2012 09:44 am Paolo Bonzini

scsi: do not report bogus overruns for commands in the 0x00-0x1F range

Interpreting cdb4 == 0 as a request to transfer 256 blocks is only
needed for READ_6 and WRITE_6. No other command in that range needs
that special-casing, and the resulting overrun breaks scsi-testsuite's...

da8365db 05/07/2012 09:44 am Paolo Bonzini

scsi-disk: add dpofua property

Linux expects REQ_FUA to be advertised only if WRITE+FUA is faster than
WRITE+SYNCHRONIZE CACHE, so we should not set the DPOFUA bit. However,
it is useful to have it for testing purposes, so add a qdev property to
set it....

bfe3d7ac 05/07/2012 09:43 am Paolo Bonzini

scsi: change "removable" field to host many features

It is pointless to add a uint32_t field for every new feature.
Since we will need a new feature soon, convert accesses to "removable"
to look at bit 0 only.

Signed-off-by: Paolo Bonzini <>

31e8fd86 05/04/2012 11:39 am Paolo Bonzini

scsi: fix refcounting for reads

Recently introduced FUA support also gave us a use-after-free
of the BlockAcctCookie within a SCSIDiskReq, due to unbalanced
reference counting.

The patch fixes this by making scsi_do_read look like a combination
of scsi_*_complete + scsi_*_data. It does both a ref (like...

a5ee9085 05/04/2012 11:39 am Paolo Bonzini

scsi: fix WRITE SAME transfer length and direction

Signed-off-by: Paolo Bonzini <>

381b634c 05/04/2012 11:39 am Ronnie Sahlberg

scsi: Specify the xfer direction for UNMAP and ATA_PASSTHROUGH commands

scsi_cmd_xfer_mode() is used to specify the xfer direction for SCSI
commands that come in from the guest. If the direction is set incorrectly
this will eventually cause QEMU to kernel-panic the guest....

12a08998 05/04/2012 11:39 am Paolo Bonzini

scsi: prevent data transfer overflow

Avoid sending more than 2GB of data, as that can cause overflows
in int32_t variables.

Signed-off-by: Paolo Bonzini <>

4b635c59 05/03/2012 11:45 am Alon Levy

hw/qxl.c: qxl_phys2virt: replace panics with guest_bug

Signed-off-by: Alon Levy <>
Signed-off-by: Gerd Hoffmann <>

fae2afb1 05/03/2012 11:45 am Alon Levy

qxl: check for NULL return from qxl_phys2virt

Signed-off-by: Alon Levy <>
Signed-off-by: Gerd Hoffmann <>

47eddfbf 05/03/2012 11:45 am Alon Levy

qxl: replace panic with guest bug in qxl_track_command

Signed-off-by: Alon Levy <>
Signed-off-by: Gerd Hoffmann <>

2fce7edf 05/03/2012 11:45 am Alon Levy

qxl: fix > 80 chars line

Signed-off-by: Alon Levy <>
Signed-off-by: Gerd Hoffmann <>

0b81c478 05/03/2012 11:45 am Alon Levy

qxl: don't abort on guest trigerrable ring indices mismatch

Signed-off-by: Alon Levy <>
Signed-off-by: Gerd Hoffmann <>

75fe0d7b 05/03/2012 11:45 am Alon Levy

qxl: cleanup s/__FUNCTION__/__func__/

Signed-off-by: Alon Levy <>
Signed-off-by: Gerd Hoffmann <>

baeae407 05/03/2012 11:45 am Alon Levy

qxl: interface_notify_update: remove guest trigerrable abort

Signed-off-by: Alon Levy <>
Signed-off-by: Gerd Hoffmann <>

e954ea28 05/03/2012 11:45 am Alon Levy

qxl: qxl_add_memslot: remove guest trigerrable panics

Signed-off-by: Alon Levy <>
Signed-off-by: Gerd Hoffmann <>

4763e2ca 05/03/2012 11:45 am Alon Levy

qxl: ioport_write: remove guest trigerrable abort

Signed-off-by: Alon Levy <>
Signed-off-by: Gerd Hoffmann <>

ddf9f4b7 05/03/2012 11:45 am Alon Levy

qxl: don't assert on guest create_guest_primary

Signed-off-by: Alon Levy <>
Signed-off-by: Gerd Hoffmann <>

5c878008 05/03/2012 08:04 am Stefan Weil

qdev: Fix memory leak in function set_pci_devfn

Valgrind reported this memory leak which occured very often.

Test scenario:

qemu-system-i386 (no arguments), only BIOS started, terminate with
monitor command (quit).

v2:
Use error_free instead of g_free (hint from Andreas Färber, thanks)....

9cf1f002 05/03/2012 08:04 am Stefan Weil

hw/pc_sysfw: Fix memory leak

Valgrind reported this memory leak which occured a few times.

Test scenario:

qemu-system-i386 (no arguments), only BIOS started, terminate with
monitor command (quit).

Signed-off-by: Stefan Weil <>
Reviewed-by: Andreas Färber <>

d5b406d9 05/02/2012 07:47 pm Alexander Graf

ATA: Allow WIN_SECURITY_FREEZE_LOCK as nop

When using Windows 8 with an AHCI disk drive, it issues a blue screen.
The reason is that WIN_SECURITY_FREEZE_LOCK / CFA_WEAR_LEVEL is not
supported by our ATA implementation, but Windows expects it to be there....

174210fe 05/02/2012 02:46 am Anthony Liguori

Merge remote-tracking branch 'agraf/s390-for-upstream' into staging

  • agraf/s390-for-upstream:
    s390: reset avail and used index on reboot
    S390: dont call system_shutdown on disabled wait
    S390: remove default cdrom, sd-card and floppy support
    S390: support reboot for kvm on s390...
5f2c23e6 05/01/2012 10:47 pm Stefan Weil

ppce500_spin: Replace assert by hw_error (fixes compiler warning)

The default case in function spin_read should never be reached,
therefore the old code used assert(0) to abort QEMU.

This does not work when QEMU is compiled with macro NDEBUG defined.
In this case (and also when the compiler does not know that assert...

58f90f21 05/01/2012 10:47 pm Bharat Bhushan

booke:Use MMU API for creating initial mapping for secondary cpus

Initial Mapping creation for secondary CPU in SMP was missing new MMU API.

Signed-off-by: Bharat Bhushan <>
Signed-off-by: Alexander Graf <>

d601fac4 05/01/2012 10:47 pm David Gibson

pseries: Implement automatic PAPR VIO address allocation

PAPR virtual IO (VIO) devices require a unique, but otherwise arbitrary,
"address" used as a token to the hypercalls which manipulate them.

Currently the pseries machine code does an ok job of allocating these...

7fb0bd34 05/01/2012 10:47 pm David Gibson

pseries: Use the same interrupt swizzling for host bridges as p2p bridges

Currently the pseries PCI code uses a somewhat strange scheme of PCI irq
allocation - one per slot up to a maximum that's greater than the usual 4.
This scheme more or less worked, because we were able to tell the guest the...

73f7821b 05/01/2012 10:47 pm Peter Portante

pseries: Fix use of global CPU state

Commit ed120055c7f9b26b5707d3ceabbe5a3f06aaf937 (Implement PAPR VPA
functions for pSeries shared processor partitions) introduced the
deregister_dtl() function and typo "emv" as name of its argument.
This went unnoticed because the code in that function can access the...

4170aea1 05/01/2012 10:04 pm Jens Freimann

s390: reset avail and used index on reboot

reset the guest vring avail/used idx fields, otherwise it's possible
that old values remain in memory which would cause a reboot to fail
with a "Guest moved used index" message

Signed-off-by: Jens Freimann <>...