The event idx in virtio is an effective way to reduce the number of
interrupts and exits of the guest. When the guest puts an request
into the virtio ring, it doesn't exit immediately to inform the
backend. Instead, the guest checks the "avail" event idx to determine
the notification.

In virtqueue_pop, when a request is poped, the current avail event
idx should be set to the number of vq->last_avail_idx.
Signed-off-by: NBin Wu <wu.wubin@huawei.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>

Hot-plugging a device that has a romfile (either supplied by user
or built-in) using rombar=0 option is a user error,
do not allow the device to be hot-plugged.
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NMarcel Apfelbaum <marcel.a@redhat.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Verify return code for pci_add_option_rom.
Signed-off-by: NMarcel Apfelbaum <marcel.a@redhat.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>

This is a pc & q35 only machine opt.

VMWare apparently doesn't like running under QEMU due to our
incomplete emulation of it's special IO Port.  This adds a
pc & q35 property to allow it to be turned off.
Signed-off-by: NDr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: NDon Slutz <dslutz@verizon.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NRichard W.M. Jones <rjones@redhat.com>

Introduce helper function acpi_set_cpu_present_bit() to simplify acpi_cpu_plug_cb
and acpi_cpu_hotplug_init, so that we can keep bit setting in one place.
Signed-off-by: NGu Zheng <guz.fnst@cn.fujitsu.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>

Rename:
AcpiCpuHotplug_init --> acpi_cpu_hotplug_init
AcpiCpuHotplug_ops --> acpi_cpu_hotplug_ops
for better readability, just cleanup.
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>
Signed-off-by: NGu Zheng <guz.fnst@cn.fujitsu.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>

Remove the unused CPU hot-plug notifier.
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>
Signed-off-by: NGu Zheng <guz.fnst@cn.fujitsu.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>

Update rtc_cmos in pc_cpu_plug() directly, instead of the notifier.
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>
Signed-off-by: NGu Zheng <guz.fnst@cn.fujitsu.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>

Add cpu hotplug handler to PC_MACHINE, which will perform the acpi
cpu hotplug callback via hotplug_handler API.
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>
Signed-off-by: NGu Zheng <guz.fnst@cn.fujitsu.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>

Convert notifier based hotplug to hotplug_handler API,
and remove the unused AcpiCpuHotplug_add().
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>
Signed-off-by: NGu Zheng <guz.fnst@cn.fujitsu.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>

Convert notifier based hotplug to hotplug_handler API.
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>
Signed-off-by: NGu Zheng <guz.fnst@cn.fujitsu.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>

Add cpu hotplug callback function (acpi_cpu_plug_cb) to match hotplug_handler API.
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>
Signed-off-by: NGu Zheng <guz.fnst@cn.fujitsu.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>

Create the TCPA log in a separate file rather than allocating
ACPI table memory for it.
Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

This is now called bios-tables-test.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

(((sid) >> 8) && 0xff)  makes no sense
(((sid) >> 8) & 0xff) seems to be what was meant.

https://bugs.launchpad.net/qemu/+bug/1382477Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Current support for bus master (clearing OK bit) together with the need to
support guests which do not enable PCI bus mastering, leads to extra state in
VIRTIO_PCI_FLAG_BUS_MASTER_BUG bit, which isn't robust in case of cross-version
migration for the case when guests use the device before setting DRIVER_OK.

Rip out this code, and replace it:
-   Modern QEMU doesn't need VIRTIO_PCI_FLAG_BUS_MASTER_BUG
    so just drop it for latest machine type.
-   For compat machine types, set PCI_COMMAND if DRIVER_OK
    is set.

As this is needed for 2.1 for both pc and ppc, move PC_COMPAT macros from pc.h
to a new common header.

Cc: Greg Kurz <gkurz@linux.vnet.ibm.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NAlexander Graf <agraf@suse.de>

This comment applies to all functions below it.
It is not appropriate that called capability allocation
functions, change it into capability list management functions.
Signed-off-by: NGonglei <arei.gonglei@huawei.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Add a 16-bytes buffer to allow storing a 128-bit UUID value in an
ACPI table.
Signed-off-by: NGal Hammer <ghammer@redhat.com>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

We used to be able to address both the QEMU and the KVM APIC via "apic".
This doesn't work anymore. So we need to use their parent class to turn
off the vapic on machines that should not expose them.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

With this patch applied, the output of -M \? is

> Supported machines are:
> pc                   Standard PC (i440FX + PIIX, 1996) (alias of pc-i440fx-2.2)
> pc-i440fx-2.2        Standard PC (i440FX + PIIX, 1996) (default)
> pc-i440fx-2.1        Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-2.0        Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-1.7        Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-1.6        Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-1.5        Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-1.4        Standard PC (i440FX + PIIX, 1996)
> pc-1.3               Standard PC (i440FX + PIIX, 1996)
> pc-1.2               Standard PC (i440FX + PIIX, 1996)
> pc-1.1               Standard PC (i440FX + PIIX, 1996)
> pc-1.0               Standard PC (i440FX + PIIX, 1996)
> pc-0.15              Standard PC (i440FX + PIIX, 1996)
> pc-0.14              Standard PC (i440FX + PIIX, 1996)
> pc-0.13              Standard PC (i440FX + PIIX, 1996)
> pc-0.12              Standard PC (i440FX + PIIX, 1996)
> pc-0.11              Standard PC (i440FX + PIIX, 1996)
> pc-0.10              Standard PC (i440FX + PIIX, 1996)
> q35                  Standard PC (Q35 + ICH9, 2009) (alias of pc-q35-2.2)
> pc-q35-2.2           Standard PC (Q35 + ICH9, 2009)
> pc-q35-2.1           Standard PC (Q35 + ICH9, 2009)
> pc-q35-2.0           Standard PC (Q35 + ICH9, 2009)
> pc-q35-1.7           Standard PC (Q35 + ICH9, 2009)
> pc-q35-1.6           Standard PC (Q35 + ICH9, 2009)
> pc-q35-1.5           Standard PC (Q35 + ICH9, 2009)
> pc-q35-1.4           Standard PC (Q35 + ICH9, 2009)
> isapc                ISA-only PC
> none                 empty machine

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1145042Signed-off-by: NLaszlo Ersek <lersek@redhat.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: NMarcel Apfelbaum <marcel.a@redhat.com>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>

Commit 261747f1 ("vl: Use MachineClass instead of global QEMUMachine
list") broke the ordering of the machine types in the user-visible output
of

  qemu-system-XXXX -M \?

This occurred because registration was rebased from a manually maintained
linked list to GLib hash tables:

  qemu_register_machine()
    type_register()
      type_register_internal()
        type_table_add()
          g_hash_table_insert()

and because the listing was rebased accordingly, from the traversal of the
list to the traversal of the hash table (rendered as an ad-hoc list):

  machine_parse()
    object_class_get_list(TYPE_MACHINE)
      object_class_foreach()
        g_hash_table_foreach()

The current order is a "random" one, for practical purposes, which is
annoying for users.

Introduce new members QEMUMachine.family and MachineClass.family, allowing
machine types to be "clustered". Introduce a comparator function that
establishes a total ordering between machine types, ordering machine types
in the same family next to each other. In machine_parse(), list the
supported machine types sorted with the comparator function.

The comparator function:
- sorts whole families before standalone machine types,
- sorts whole families between each other in alphabetically increasing
  order,
- sorts machine types inside the same family in alphabetically decreasing
  order,
- sorts standalone machine types between each other in alphabetically
  increasing order.

After this patch, all machine types are considered standalone, and
accordingly, the output is alphabetically ascending. This will be refined
in the following patches.

Effects on the x86_64 output:

Before:

> Supported machines are:
> pc-0.13              Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-2.0        Standard PC (i440FX + PIIX, 1996)
> pc-1.0               Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-2.1        Standard PC (i440FX + PIIX, 1996)
> pc-q35-1.7           Standard PC (Q35 + ICH9, 2009)
> pc-1.1               Standard PC (i440FX + PIIX, 1996)
> pc-0.14              Standard PC (i440FX + PIIX, 1996)
> pc-q35-2.0           Standard PC (Q35 + ICH9, 2009)
> pc-i440fx-1.4        Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-1.5        Standard PC (i440FX + PIIX, 1996)
> pc-0.15              Standard PC (i440FX + PIIX, 1996)
> pc-q35-1.4           Standard PC (Q35 + ICH9, 2009)
> isapc                ISA-only PC
> pc                   Standard PC (i440FX + PIIX, 1996) (alias of pc-i440fx-2.2)
> pc-i440fx-2.2        Standard PC (i440FX + PIIX, 1996) (default)
> pc-1.2               Standard PC (i440FX + PIIX, 1996)
> pc-0.10              Standard PC (i440FX + PIIX, 1996)
> pc-0.11              Standard PC (i440FX + PIIX, 1996)
> pc-q35-2.1           Standard PC (Q35 + ICH9, 2009)
> q35                  Standard PC (Q35 + ICH9, 2009) (alias of pc-q35-2.2)
> pc-q35-2.2           Standard PC (Q35 + ICH9, 2009)
> pc-i440fx-1.6        Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-1.7        Standard PC (i440FX + PIIX, 1996)
> none                 empty machine
> pc-q35-1.5           Standard PC (Q35 + ICH9, 2009)
> pc-q35-1.6           Standard PC (Q35 + ICH9, 2009)
> pc-0.12              Standard PC (i440FX + PIIX, 1996)
> pc-1.3               Standard PC (i440FX + PIIX, 1996)

After:

> Supported machines are:
> isapc                ISA-only PC
> none                 empty machine
> pc-0.10              Standard PC (i440FX + PIIX, 1996)
> pc-0.11              Standard PC (i440FX + PIIX, 1996)
> pc-0.12              Standard PC (i440FX + PIIX, 1996)
> pc-0.13              Standard PC (i440FX + PIIX, 1996)
> pc-0.14              Standard PC (i440FX + PIIX, 1996)
> pc-0.15              Standard PC (i440FX + PIIX, 1996)
> pc-1.0               Standard PC (i440FX + PIIX, 1996)
> pc-1.1               Standard PC (i440FX + PIIX, 1996)
> pc-1.2               Standard PC (i440FX + PIIX, 1996)
> pc-1.3               Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-1.4        Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-1.5        Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-1.6        Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-1.7        Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-2.0        Standard PC (i440FX + PIIX, 1996)
> pc-i440fx-2.1        Standard PC (i440FX + PIIX, 1996)
> pc                   Standard PC (i440FX + PIIX, 1996) (alias of pc-i440fx-2.2)
> pc-i440fx-2.2        Standard PC (i440FX + PIIX, 1996) (default)
> pc-q35-1.4           Standard PC (Q35 + ICH9, 2009)
> pc-q35-1.5           Standard PC (Q35 + ICH9, 2009)
> pc-q35-1.6           Standard PC (Q35 + ICH9, 2009)
> pc-q35-1.7           Standard PC (Q35 + ICH9, 2009)
> pc-q35-2.0           Standard PC (Q35 + ICH9, 2009)
> pc-q35-2.1           Standard PC (Q35 + ICH9, 2009)
> q35                  Standard PC (Q35 + ICH9, 2009) (alias of pc-q35-2.2)
> pc-q35-2.2           Standard PC (Q35 + ICH9, 2009)

Effects on the aarch64 output:

Before:

> Supported machines are:
> lm3s811evb           Stellaris LM3S811EVB
> canon-a1100          Canon PowerShot A1100 IS
> vexpress-a15         ARM Versatile Express for Cortex-A15
> vexpress-a9          ARM Versatile Express for Cortex-A9
> xilinx-zynq-a9       Xilinx Zynq Platform Baseboard for Cortex-A9
> connex               Gumstix Connex (PXA255)
> n800                 Nokia N800 tablet aka. RX-34 (OMAP2420)
> lm3s6965evb          Stellaris LM3S6965EVB
> versatileab          ARM Versatile/AB (ARM926EJ-S)
> borzoi               Borzoi PDA (PXA270)
> tosa                 Tosa PDA (PXA255)
> cheetah              Palm Tungsten|E aka. Cheetah PDA (OMAP310)
> midway               Calxeda Midway (ECX-2000)
> mainstone            Mainstone II (PXA27x)
> n810                 Nokia N810 tablet aka. RX-44 (OMAP2420)
> terrier              Terrier PDA (PXA270)
> highbank             Calxeda Highbank (ECX-1000)
> cubieboard           cubietech cubieboard
> sx1-v1               Siemens SX1 (OMAP310) V1
> sx1                  Siemens SX1 (OMAP310) V2
> realview-eb-mpcore   ARM RealView Emulation Baseboard (ARM11MPCore)
> kzm                  ARM KZM Emulation Baseboard (ARM1136)
> akita                Akita PDA (PXA270)
> z2                   Zipit Z2 (PXA27x)
> musicpal             Marvell 88w8618 / MusicPal (ARM926EJ-S)
> realview-pb-a8       ARM RealView Platform Baseboard for Cortex-A8
> versatilepb          ARM Versatile/PB (ARM926EJ-S)
> realview-eb          ARM RealView Emulation Baseboard (ARM926EJ-S)
> realview-pbx-a9      ARM RealView Platform Baseboard Explore for Cortex-A9
> spitz                Spitz PDA (PXA270)
> none                 empty machine
> virt                 ARM Virtual Machine
> collie               Collie PDA (SA-1110)
> smdkc210             Samsung SMDKC210 board (Exynos4210)
> verdex               Gumstix Verdex (PXA270)
> nuri                 Samsung NURI board (Exynos4210)
> integratorcp         ARM Integrator/CP (ARM926EJ-S)

After:

> Supported machines are:
> akita                Akita PDA (PXA270)
> borzoi               Borzoi PDA (PXA270)
> canon-a1100          Canon PowerShot A1100 IS
> cheetah              Palm Tungsten|E aka. Cheetah PDA (OMAP310)
> collie               Collie PDA (SA-1110)
> connex               Gumstix Connex (PXA255)
> cubieboard           cubietech cubieboard
> highbank             Calxeda Highbank (ECX-1000)
> integratorcp         ARM Integrator/CP (ARM926EJ-S)
> kzm                  ARM KZM Emulation Baseboard (ARM1136)
> lm3s6965evb          Stellaris LM3S6965EVB
> lm3s811evb           Stellaris LM3S811EVB
> mainstone            Mainstone II (PXA27x)
> midway               Calxeda Midway (ECX-2000)
> musicpal             Marvell 88w8618 / MusicPal (ARM926EJ-S)
> n800                 Nokia N800 tablet aka. RX-34 (OMAP2420)
> n810                 Nokia N810 tablet aka. RX-44 (OMAP2420)
> none                 empty machine
> nuri                 Samsung NURI board (Exynos4210)
> realview-eb          ARM RealView Emulation Baseboard (ARM926EJ-S)
> realview-eb-mpcore   ARM RealView Emulation Baseboard (ARM11MPCore)
> realview-pb-a8       ARM RealView Platform Baseboard for Cortex-A8
> realview-pbx-a9      ARM RealView Platform Baseboard Explore for Cortex-A9
> smdkc210             Samsung SMDKC210 board (Exynos4210)
> spitz                Spitz PDA (PXA270)
> sx1                  Siemens SX1 (OMAP310) V2
> sx1-v1               Siemens SX1 (OMAP310) V1
> terrier              Terrier PDA (PXA270)
> tosa                 Tosa PDA (PXA255)
> verdex               Gumstix Verdex (PXA270)
> versatileab          ARM Versatile/AB (ARM926EJ-S)
> versatilepb          ARM Versatile/PB (ARM926EJ-S)
> vexpress-a15         ARM Versatile Express for Cortex-A15
> vexpress-a9          ARM Versatile Express for Cortex-A9
> virt                 ARM Virtual Machine
> xilinx-zynq-a9       Xilinx Zynq Platform Baseboard for Cortex-A9
> z2                   Zipit Z2 (PXA27x)

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1145042Signed-off-by: NLaszlo Ersek <lersek@redhat.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: NMarcel Apfelbaum <marcel.a@redhat.com>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>

QEMU currently allows the number of VCPUs to not be a multiple of the
number of threads per socket, but the smbios socket count calculation
introduced by commit c97294ec doesn't
take that into account, triggering an assertion. e.g.:

  $ ./x86_64-softmmu/qemu-system-x86_64 -smp 4,sockets=2,cores=6,threads=1
  qemu-system-x86_64: /home/ehabkost/rh/proj/virt/qemu/hw/i386/smbios.c:825: smbios_get_tables: Assertion `smbios_smp_sockets >= 1' failed.
  Aborted (core dumped)

Socket count calculation doesn't belong to smbios.c and should
eventually be moved to the main SMP topology configuration code. But
while we don't move the code, at least make it correct by rounding up
the division.

Cc: Gabriel Somlo <somlo@cmu.edu>
Cc: qemu-stable@nongnu.org
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-By: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

* remotes/sstabellini/xen-2014-10-30:
  fix off-by-one error in pci_piix3_xen_ide_unplug
  xen-hvm.c: Add support for Xen access to vmport
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

vmware-vga: add rectangle verification (CVE-2014-3689)

# gpg: Signature made Wed 29 Oct 2014 11:45:29 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-cve-2014-3689-20141029-1:
  vmware-vga: use vmsvga_verify_rect in vmsvga_fill_rect
  vmware-vga: use vmsvga_verify_rect in vmsvga_copy_rect
  vmware-vga: use vmsvga_verify_rect in vmsvga_update_rect
  vmware-vga: add vmsvga_verify_rect
  vmware-vga: CVE-2014-3689: turn off hw accel
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

vnc: return directly if no vnc client connected
vnc: sanitize bits_per_pixel from the client (CVE-2014-7815)

# gpg: Signature made Tue 28 Oct 2014 10:52:31 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-vnc-20141028-1:
  vnc: return directly if no vnc client connected
  vnc: sanitize bits_per_pixel from the client
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Fixes for libcacard (usb smartcard emulation), xhci and uhci.

# gpg: Signature made Tue 28 Oct 2014 10:39:52 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-usb-20141028-1:
  uhci: remove useless DEBUG
  xhci: add property to turn on/off streams support
  libcacard: don't free sign buffer while sign op is pending
  libcacard: Lock NSS cert db when selecting an applet on an emulated card
  libcacard: introduce new vcard_emul_logout
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

gtk: fix two warnings with gtk 3.14+

# gpg: Signature made Tue 28 Oct 2014 10:25:52 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-gtk-20141028-1:
  gtk: avoid gd_widget_reparent with gtk 3.14+
  gtk: drop gtk_widget_set_double_buffered call
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Fix off-by-one error when unplugging disks, which would otherwise leave the last ATA disk plugged, with obvious consequences. Also rewrite loop to be more readable.
Signed-off-by: NJames Harper <james.harper@ejbdigital.com.au>
Signed-off-by: NStefano Stabellini <stefano.stabellini@eu.citrix.com>

This adds synchronisation of the 6 vcpu registers (only 32bits of
them) that vmport.c needs between Xen and QEMU.

This is to avoid a 2nd and 3rd exchange between QEMU and Xen to
fetch and put these 6 vcpu registers used by the code in vmport.c
and vmmouse.c

The registers are passed in the new shared page provided by
HVM_PARAM_VMPORT_REGS_PFN.

Add new array to XenIOState that allows selection of current_cpu by
vcpu id.

Now pass XenIOState to handle_ioreq().

Add new routines regs_to_cpu(), regs_from_cpu(), and
handle_vmport_ioreq().
Signed-off-by: NDon Slutz <dslutz@verizon.com>
Reviewed-by: NPaul Durrant <paul.durrant@citrix.com>
Signed-off-by: NStefano Stabellini <stefano.stabellini@eu.citrix.com>

virtio-scsi fixes, the first part of dynamic sysbus devices,
MAINTAINERS updates, and AVX512 support.

# gpg: Signature made Mon 27 Oct 2014 15:12:13 GMT using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream: (28 commits)
  aio / timers: De-document -clock
  hw/scsi/virtio-scsi.c: fix the "type" use error in virtio_scsi_handle_ctrl
  virtio-scsi: sense in virtio_scsi_command_complete
  target-i386: add Intel AVX-512 support
  get_maintainer.pl: restrict cases where it falls back to --git
  get_maintainer.pl: move git loop under "if ($email) {"
  qtest: fix qtest log fd should be initialized before qtest chardev
  MAINTAINERS: avoid M entries that point to mailing lists
  MAINTAINERS: add some tests directories
  MAINTAINERS: Add more TCG files
  MAINTAINERS: add myself for X86
  MAINTAINERS: add Samuel Thibault as usb-serial.c and baum.c maintainer
  MAINTAINERS: grab more files from Anthony's pile
  target-i386: warns users when CPU threads>1 for non-Intel CPUs
  sysbus: Use TYPE_DEVICE GPIO functionality
  qdev: gpio: Define qdev_pass_gpios()
  qdev: gpio: Remove qdev_init_gpio_out x1 restriction
  qdev: gpio: delete NamedGPIOList::out
  irq: Remove qemu_irq_intercept_out
  qtest/irq: Rework IRQ interception
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The virtio-rng backend is currently linked twice, once in the proxy
device (e.g. virtio-rng-pci) and once in virtio-rng-device.  This causes
a double unref of the backend when the parent device is unplugged.

To fix this, make the proxy device use an alias, similar to what is
already being done for the iothread link.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: NGonglei <arei.gonglei@huawei.com>
Message-id: 1414577839-18695-1-git-send-email-pbonzini@redhat.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Add verification to vmsvga_fill_rect, re-enable HW_FILL_ACCEL.

Cc: qemu-stable@nongnu.org
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NDon Koch <dkoch@verizon.com>

Add verification to vmsvga_copy_rect, re-enable HW_RECT_ACCEL.

Cc: qemu-stable@nongnu.org
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NDon Koch <dkoch@verizon.com>

graphic_hw_update and vnc_refresh_server_surface aren't
need to do when no vnc client connected. It can reduce
lock contention, because vnc_refresh will hold global big
lock two millisecond every three seconds.
Signed-off-by: NChenLiang <chenliang88@huawei.com>
Signed-off-by: NGonglei <arei.gonglei@huawei.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

bits_per_pixel that are less than 8 could result in accessing
non-initialized buffers later in the code due to the expectation
that bytes_per_pixel value that is used to initialize these buffers is
never zero.

To fix this check that bits_per_pixel from the client is one of the
values that the rfb protocol specification allows.

This is CVE-2014-7815.
Signed-off-by: NPetr Matousek <pmatouse@redhat.com>

[ kraxel: apply codestyle fix ]
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

commit 50dcc0f8 (uhci: tracing support) had removed
DPRINTF, the DEBUG marco is useless now, remove it.
Signed-off-by: NGonglei <arei.gonglei@huawei.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

streams support in usb-redir and usb-host works only with recent enough
versions of the support libraries (libusbredir and libusbx).  Failure
mode is rather unelegant:  Any stream usb transfers will throw stall
errors.  Turning off support for streams in the xhci host controller
will work better as the guest can figure beforehand that streams are
not going to work.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NHans de Goede <hdegoede@redhat.com>

commit 57f97834 cleaned up
the cac_applet_pki_process_apdu function to have a single
exit point. Unfortunately, that commit introduced a bug
where the sign buffer can get free'd and nullified while
it's still being used.

This commit corrects the bug by introducing a boolean to
track whether or not the sign buffer should be freed in
the function exit path.
Signed-off-by: NRay Strode <rstrode@redhat.com>
Reviewed-by: NAlon Levy <alon@pobox.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

When a process in a guest uses an emulated smartcard, libcacard running
on the host passes the PIN from the guest to the PK11_Authenticate NSS
function. The first time PK11_Authenticate is called the passed in PIN
is used to unlock the certificate database. Subsequent calls to
PK11_Authenticate will transparently succeed, regardless of the passed in
PIN. This is a convenience for applications provided by NSS.

Of course, the guest may have many applications using the one emulated
smart card all driven from the same host QEMU process.  That means if a
user enters the right PIN in one program in the guest, and then enters the
wrong PIN in another program in the guest, the wrong PIN will still
successfully unlock the virtual smartcard.

This commit forces the NSS certificate database to be locked anytime an
applet is selected on an emulated smartcard by calling vcard_emul_logout.
Signed-off-by: NRay Strode <rstrode@redhat.com>
Reviewed-By: NRobert Relyea <rrelyea@redhat.com>
Reviewed-By: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

vcard_emul_reset currently only logs NSS out, but there is a TODO
for potentially sending insertion/removal events when powering down
or powering up.

For clarity, this commit moves the current guts of vcard_emul_reset to
a new vcard_emul_logout function which will never send insertion/removal
events. The vcard_emul_reset function now just calls vcard_emul_logout,
but also retains its TODO for watching power state transitions and sending
insertion/removal events.
Signed-off-by: NRay Strode <rstrode@redhat.com>
Reviewed-By: NRobert Relyea <rrelyea@redhat.com>
Reviewed-By: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>