aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-01-12ui: fix VNC client throttling when audio capture is activeDaniel P. Berrange
The VNC server must throttle data sent to the client to prevent the 'output' buffer size growing without bound, if the client stops reading data off the socket (either maliciously or due to stalled/slow network connection). The current throttling is very crude because it simply checks whether the output buffer offset is zero. This check must be disabled if audio capture is enabled, because when streaming audio the output buffer offset will rarely be zero due to queued audio data, and so this would starve framebuffer updates. As a result, the VNC client can cause QEMU to allocate arbitrary amounts of RAM. They can first start something in the guest that triggers lots of framebuffer updates eg play a youtube video. Then enable audio capture, and simply never read data back from the server. This can easily make QEMU's VNC server send buffer consume 100MB of RAM per second, until the OOM killer starts reaping processes (hopefully the rogue QEMU process, but it might pick others...). To address this we make the throttling more intelligent, so we can throttle when audio capture is active too. To determine how to throttle incremental updates or audio data, we calculate a size threshold. Normally the threshold is the approximate number of bytes associated with a single complete framebuffer update. ie width * height * bytes per pixel. We'll send incremental updates until we hit this threshold, at which point we'll stop sending updates until data has been written to the wire, causing the output buffer offset to fall back below the threshold. If audio capture is enabled, we increase the size of the threshold to also allow for upto 1 seconds worth of audio data samples. ie nchannels * bytes per sample * frequency. This allows the output buffer to have a mixture of incremental framebuffer updates and audio data queued, but once the threshold is exceeded, audio data will be dropped and incremental updates will be throttled. This unbounded memory growth affects all VNC server configurations supported by QEMU, with no workaround possible. The mitigating factor is that it can only be triggered by a client that has authenticated with the VNC server, and who is able to trigger a large quantity of framebuffer updates or audio samples from the guest OS. Mostly they'll just succeed in getting the OOM killer to kill their own QEMU process, but its possible other processes can get taken out as collateral damage. This is a more general variant of the similar unbounded memory usage flaw in the websockets server, that was previously assigned CVE-2017-15268, and fixed in 2.11 by: commit a7b20a8efa28e5f22c26c06cd06c2f12bc863493 Author: Daniel P. Berrange <berrange@redhat.com> Date: Mon Oct 9 14:43:42 2017 +0100 io: monitor encoutput buffer size from websocket GSource This new general memory usage flaw has been assigned CVE-2017-15124, and is partially fixed by this patch. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20171218191228.31018-10-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-12ui: refactor code for determining if an update should be sent to the clientDaniel P. Berrange
The logic for determining if it is possible to send an update to the client will become more complicated shortly, so pull it out into a separate method for easier extension later. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20171218191228.31018-9-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-12ui: correctly reset framebuffer update state after processing dirty regionsDaniel P. Berrange
According to the RFB protocol, a client sends one or more framebuffer update requests to the server. The server can reply with a single framebuffer update response, that covers all previously received requests. Once the client has read this update from the server, it may send further framebuffer update requests to monitor future changes. The client is free to delay sending the framebuffer update request if it needs to throttle the amount of data it is reading from the server. The QEMU VNC server, however, has never correctly handled the framebuffer update requests. Once QEMU has received an update request, it will continue to send client updates forever, even if the client hasn't asked for further updates. This prevents the client from throttling back data it gets from the server. This change fixes the flawed logic such that after a set of updates are sent out, QEMU waits for a further update request before sending more data. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20171218191228.31018-8-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-12ui: introduce enum to track VNC client framebuffer update request stateDaniel P. Berrange
Currently the VNC servers tracks whether a client has requested an incremental or forced update with two boolean flags. There are only really 3 distinct states to track, so create an enum to more accurately reflect permitted states. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20171218191228.31018-7-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-12ui: track how much decoded data we consumed when doing SASL encodingDaniel P. Berrange
When we encode data for writing with SASL, we encode the entire pending output buffer. The subsequent write, however, may not be able to send the full encoded data in one go though, particularly with a slow network. So we delay setting the output buffer offset back to zero until all the SASL encoded data is sent. Between encoding the data and completing sending of the SASL encoded data, however, more data might have been placed on the pending output buffer. So it is not valid to set offset back to zero. Instead we must keep track of how much data we consumed during encoding and subtract only that amount. With the current bug we would be throwing away some pending data without having sent it at all. By sheer luck this did not previously cause any serious problem because appending data to the send buffer is always an atomic action, so we only ever throw away complete RFB protocol messages. In the case of frame buffer updates we'd catch up fairly quickly, so no obvious problem was visible. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20171218191228.31018-6-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-12ui: avoid pointless VNC updates if framebuffer isn't dirtyDaniel P. Berrange
The vnc_update_client() method checks the 'has_dirty' flag to see if there are dirty regions that are pending to send to the client. Regardless of this flag, if a forced update is requested, updates must be sent. For unknown reasons though, the code also tries to sent updates if audio capture is enabled. This makes no sense as audio capture state does not impact framebuffer contents, so this check is removed. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20171218191228.31018-5-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-12ui: remove redundant indentation in vnc_client_updateDaniel P. Berrange
Now that previous dead / unreachable code has been removed, we can simplify the indentation in the vnc_client_update method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20171218191228.31018-4-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-12ui: remove unreachable code in vnc_update_clientDaniel P. Berrange
A previous commit: commit 5a8be0f73d6f60ff08746377eb09ca459f39deab Author: Gerd Hoffmann <kraxel@redhat.com> Date: Wed Jul 13 12:21:20 2016 +0200 vnc: make sure we finish disconnect Added a check for vs->disconnecting at the very start of the vnc_update_client method. This means that the very next "if" statement check for !vs->disconnecting always evaluates true, and is thus redundant. This in turn means the vs->disconnecting check at the very end of the method never evaluates true, and is thus unreachable code. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20171218191228.31018-3-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-12ui: remove 'sync' parameter from vnc_update_clientDaniel P. Berrange
There is only one caller of vnc_update_client and that always passes false for the 'sync' parameter. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20171218191228.31018-2-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-12vnc: fix debug spellingMarc-André Lureau
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20171220140618.12701-1-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-11Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20180111' into staging target-arm queue: * add aarch64_be linux-user target * Virt: ACPI: fix qemu assert due to re-assigned table data address * imx_fec: various bug fixes and cleanups * hw/timer/pxa2xx_timer: replace hw_error() -> qemu_log_mask() * hw/sd/pxa2xx_mmci: add read/write() trace events * linux-user/arm/nwfpe: Check coprocessor number for FPA emulation * target/arm: Make disas_thumb2_insn() generate its own UNDEF exceptions * hw/intc/arm_gicv3: Make reserved register addresses RAZ/WI * hw/intc/arm_gic: reserved register addresses are RAZ/WI # gpg: Signature made Thu 11 Jan 2018 13:37:25 GMT # gpg: using RSA key 0x3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20180111: (26 commits) hw/intc/arm_gic: reserved register addresses are RAZ/WI hw/intc/arm_gicv3: Make reserved register addresses RAZ/WI target/arm: Make disas_thumb2_insn() generate its own UNDEF exceptions linux-user/arm/nwfpe: Check coprocessor number for FPA emulation hw/sd/pxa2xx_mmci: add read/write() trace events hw/timer/pxa2xx_timer: replace hw_error() -> qemu_log_mask() imx_fec: Reserve full FSL_IMX25_FEC_SIZE page for the register file imx_fec: Fix a typo in imx_enet_receive() imx_fec: Use correct length for packet size imx_fec: Add support for multiple Tx DMA rings imx_fec: Emulate SHIFT16 in ENETx_RACC imx_fec: Use MIN instead of explicit ternary operator imx_fec: Use ENET_FTRL to determine truncation length imx_fec: Move Tx frame buffer away from the stack imx_fec: Change queue flushing heuristics imx_fec: Refactor imx_eth_enable_rx() imx_fec: Do not link to netdev Virt: ACPI: fix qemu assert due to re-assigned table data address target/arm: Fix stlxp for aarch64_be linux-user: Activate armeb handler registration ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11hw/intc/arm_gic: reserved register addresses are RAZ/WIPeter Maydell
The GICv2 specification says that reserved register addresses must RAZ/WI; now that we implement external abort handling for Arm CPUs this means we must return MEMTX_OK rather than MEMTX_ERROR, to avoid generating a spurious guest data abort. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1513183941-24300-3-git-send-email-peter.maydell@linaro.org Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
2018-01-11hw/intc/arm_gicv3: Make reserved register addresses RAZ/WIPeter Maydell
The GICv3 specification says that reserved register addresses should RAZ/WI. This means we need to return MEMTX_OK, not MEMTX_ERROR, because now that we support generating external aborts the latter will cause an abort on new board models. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1513183941-24300-2-git-send-email-peter.maydell@linaro.org Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
2018-01-11target/arm: Make disas_thumb2_insn() generate its own UNDEF exceptionsPeter Maydell
Refactor disas_thumb2_insn() so that it generates the code for raising an UNDEF exception for invalid insns, rather than returning a flag which the caller must check to see if it needs to generate the UNDEF code. This brings the function in to line with the behaviour of disas_thumb_insn() and disas_arm_insn(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1513080506-17703-1-git-send-email-peter.maydell@linaro.org
2018-01-11linux-user/arm/nwfpe: Check coprocessor number for FPA emulationPeter Maydell
Our copy of the nwfpe code for emulating of the old FPA11 floating point unit doesn't check the coprocessor number in the instruction when it emulates it. This means that we might treat some instructions which should really UNDEF as being FPA11 instructions by accident. The kernel's copy of the nwfpe code doesn't make this error; I suspect the bug was noticed and fixed as part of the process of mainlining the nwfpe code more than a decade ago. Add a check that the coprocessor number (which is always in bits [11:8] of the instruction) is either 1 or 2, which is where the FPA11 lives. Reported-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11hw/sd/pxa2xx_mmci: add read/write() trace eventsPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 20180104000156.30932-1-f4bug@amsat.org [PMM: add missing include] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11hw/timer/pxa2xx_timer: replace hw_error() -> qemu_log_mask()Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 20180103224208.30291-2-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11imx_fec: Reserve full FSL_IMX25_FEC_SIZE page for the register fileAndrey Smirnov
Some i.MX SoCs (e.g. i.MX7) have FEC registers going as far as offset 0x614, so to avoid getting aborts when accessing those on QEMU, extend the register file to cover FSL_IMX25_FEC_SIZE(16K) of address space instead of just 1K. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Jason Wang <jasowang@redhat.com> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: qemu-devel@nongnu.org Cc: qemu-arm@nongnu.org Cc: yurovsky@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11imx_fec: Fix a typo in imx_enet_receive()Andrey Smirnov
Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Jason Wang <jasowang@redhat.com> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: qemu-devel@nongnu.org Cc: qemu-arm@nongnu.org Cc: yurovsky@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11imx_fec: Use correct length for packet sizeAndrey Smirnov
Use 'frame_size' instead of 'len' when calling qemu_send_packet(), failing to do so results in malformed packets send in case when that packed is fragmented into multiple DMA transactions. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Jason Wang <jasowang@redhat.com> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: qemu-devel@nongnu.org Cc: qemu-arm@nongnu.org Cc: yurovsky@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11imx_fec: Add support for multiple Tx DMA ringsAndrey Smirnov
More recent version of the IP block support more than one Tx DMA ring, so add the code implementing that feature. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Jason Wang <jasowang@redhat.com> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: qemu-devel@nongnu.org Cc: qemu-arm@nongnu.org Cc: yurovsky@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11imx_fec: Emulate SHIFT16 in ENETx_RACCAndrey Smirnov
Needed to support latest Linux kernel driver which relies on that functionality. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Jason Wang <jasowang@redhat.com> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: qemu-devel@nongnu.org Cc: qemu-arm@nongnu.org Cc: yurovsky@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11imx_fec: Use MIN instead of explicit ternary operatorAndrey Smirnov
Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Jason Wang <jasowang@redhat.com> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: qemu-devel@nongnu.org Cc: qemu-arm@nongnu.org Cc: yurovsky@gmail.com Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11imx_fec: Use ENET_FTRL to determine truncation lengthAndrey Smirnov
Frame truncation length, TRUNC_FL, is determined by the contents of ENET_FTRL register, so convert the code to use it instead of a hardcoded constant. To avoid the case where TRUNC_FL is greater that ENET_MAX_FRAME_SIZE, increase the value of the latter to its theoretical maximum of 16K. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Jason Wang <jasowang@redhat.com> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: qemu-devel@nongnu.org Cc: qemu-arm@nongnu.org Cc: yurovsky@gmail.com Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11imx_fec: Move Tx frame buffer away from the stackAndrey Smirnov
Make Tx frame assembly buffer to be a paort of IMXFECState structure to avoid a concern about having large data buffer on the stack. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Jason Wang <jasowang@redhat.com> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: qemu-devel@nongnu.org Cc: qemu-arm@nongnu.org Cc: yurovsky@gmail.com Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11imx_fec: Change queue flushing heuristicsAndrey Smirnov
In current implementation, packet queue flushing logic seem to suffer from a deadlock like scenario if a packet is received by the interface before before Rx ring is initialized by Guest's driver. Consider the following sequence of events: 1. A QEMU instance is started against a TAP device on Linux host, running Linux guest, e. g., something to the effect of: qemu-system-arm \ -net nic,model=imx.fec,netdev=lan0 \ netdev tap,id=lan0,ifname=tap0,script=no,downscript=no \ ... rest of the arguments ... 2. Once QEMU starts, but before guest reaches the point where FEC deriver is done initializing the HW, Guest, via TAP interface, receives a number of multicast MDNS packets from Host (not necessarily true for every OS, but it happens at least on Fedora 25) 3. Recieving a packet in such a state results in imx_eth_can_receive() returning '0', which in turn causes tap_send() to disable corresponding event (tap.c:203) 4. Once Guest's driver reaches the point where it is ready to recieve packets it prepares Rx ring descriptors and writes ENET_RDAR_RDAR to ENET_RDAR register to indicate to HW that more descriptors are ready. And at this points emulation layer does this: s->regs[index] = ENET_RDAR_RDAR; imx_eth_enable_rx(s); which, combined with: if (!s->regs[ENET_RDAR]) { qemu_flush_queued_packets(qemu_get_queue(s->nic)); } results in Rx queue never being flushed and corresponding I/O event beign disabled. To prevent the problem, change the code to always flush packet queue when ENET_RDAR transitions 0 -> ENET_RDAR_RDAR. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Jason Wang <jasowang@redhat.com> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: qemu-devel@nongnu.org Cc: qemu-arm@nongnu.org Cc: yurovsky@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11imx_fec: Refactor imx_eth_enable_rx()Andrey Smirnov
Refactor imx_eth_enable_rx() to have more meaningfull variable name than 'tmp' and to reduce number of logical negations done. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Jason Wang <jasowang@redhat.com> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: qemu-devel@nongnu.org Cc: qemu-arm@nongnu.org Cc: yurovsky@gmail.com Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11imx_fec: Do not link to netdevAndrey Smirnov
Binding to a particular netdev doesn't seem to belong to this layer and should probably be done as a part of board or SoC specific code. Convert all of the users of this IP block to use qdev_set_nic_properties() instead. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Jason Wang <jasowang@redhat.com> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: qemu-devel@nongnu.org Cc: qemu-arm@nongnu.org Cc: yurovsky@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11Virt: ACPI: fix qemu assert due to re-assigned table data addressZhaoshenglong
acpi_data_push uses g_array_set_size to resize the memory size. If there is no enough contiguous memory, the address will be changed. If we use the old value, it will assert. qemu-kvm: hw/acpi/bios-linker-loader.c:214: bios_linker_loader_add_checksum: Assertion `start_offset < file->blob->len' failed.` This issue only happens in building SRAT table now but here we unify the pattern for other tables as well to avoid possible issues in the future. Signed-off-by: Zhaoshenglong <zhaoshenglong@huawei.com> Reviewed-by: Andrew Jones <drjones@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11target/arm: Fix stlxp for aarch64_beMichael Weiser
ldxp loads two consecutive doublewords from memory regardless of CPU endianness. On store, stlxp currently assumes to work with a 128bit value and consequently switches order in big-endian mode. With this change it packs the doublewords in reverse order in anticipation of the 128bit big-endian store operation interposing them so they end up in memory in the right order. This makes it work for both MTTCG and !MTTCG. It effectively implements the ARM ARM STLXP operation pseudo-code: data = if BigEndian() then el1:el2 else el2:el1; With this change an aarch64_be Linux 4.14.4 kernel succeeds to boot up in system emulation mode. Signed-off-by: Michael Weiser <michael.weiser@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11linux-user: Activate armeb handler registrationMichael Weiser
armeb is missing from the target list in qemu-binfmt-conf.sh. Add it so the handler for those binaries gets registered by the script. Signed-off-by: Michael Weiser <michael.weiser@gmx.de> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-id: 20171220212308.12614-8-michael.weiser@gmx.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11linux-user: Separate binfmt arm CPU familiesMichael Weiser
Give big-endian arm and aarch64 CPUs their own family in qemu-binfmt-conf.sh to make sure we register qemu-user for binaries of the opposite endianness on arm and aarch64. Apart from the family assignments of the magic values, qemu_get_family() needs to be able to distinguish the two and recognise aarch64{,_be} as well. Signed-off-by: Michael Weiser <michael.weiser@gmx.de> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-id: 20171220212308.12614-7-michael.weiser@gmx.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11linux-user: Add aarch64_be magic numbers to qemu-binfmt-conf.shMichael Weiser
As we now have a linux-user aarch64_be target, we can add it to the list of supported targets in qemu-binfmt-conf.sh Signed-off-by: Michael Weiser <michael.weiser@gmx.de> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-id: 20171220212308.12614-6-michael.weiser@gmx.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11configure: Add aarch64_be-linux-user targetMichael Weiser
Add target aarch64_be-linux-user. This allows a qemu-aarch64_be binary to be built that will run big-endian aarch64 binaries. Signed-off-by: Michael Weiser <michael.weiser@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-id: 20171220212308.12614-5-michael.weiser@gmx.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11linux-user: Fix endianess of aarch64 signal trampolineMichael Weiser
Since for aarch64 the signal trampoline is synthesized directly into the signal frame we need to make sure the instructions end up little-endian. Otherwise the wrong endianness will cause a SIGILL upon return from the signal handler on big-endian targets. Signed-off-by: Michael Weiser <michael.weiser@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20171220212308.12614-4-michael.weiser@gmx.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11linux-user: Add separate aarch64_be unameMichael Weiser
Make big-endian aarch64 systems identify as aarch64_be as expected by big-endian userland and toolchains. Signed-off-by: Michael Weiser <michael.weiser@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-id: 20171220212308.12614-3-michael.weiser@gmx.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11linux-user: Add support for big-endian aarch64Michael Weiser
Enable big-endian mode for data accesses on aarch64 for big-endian linux user mode. Activate it for all exception levels as documented by ARM: Set the SCTLR EE bit for ELs 1 through 3. Additionally set bit E0E in EL1 to enable it in EL0 as well. Signed-off-by: Michael Weiser <michael.weiser@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20171220212308.12614-2-michael.weiser@gmx.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.12-20180111' ↵Peter Maydell
into staging ppc patch queue 2018-01-11 This pull request supersedes ppc-for-2.12-20180108 and several before it. The earlier pull request included a patch which exposed a bug in the ARM TCG backend. I've pulled that out and will repost once the ARM bug is fixed (a patch has been posted by Richard Henderson). Higlights from this series: * SLOF update * Several new devices for embedded platforms * Fix to correctly set compatiblity mode for hotplugged CPUs * dtc compile fix for older MacOS versions # gpg: Signature made Thu 11 Jan 2018 04:58:11 GMT # gpg: using RSA key 0x6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.12-20180111: spapr: Correct compatibility mode setting for hotplugged CPUs hw/ppc: Remove the deprecated spapr-pci-vfio-host-bridge device Update dtc to fix compilation problem on Mac OS 10.6 target/ppc: more use of the PPC_*() macros ppc/pnv: change powernv_ prefix to pnv_ for overall naming consistency hw/ide: Emulate SiI3112 SATA controller spapr_pci: use warn_report() ppc4xx_i2c: Implement basic I2C functions sm501: Add some more unimplemented registers sm501: Add panel hardware cursor registers also to read function pseries: Update SLOF firmware image to qemu-slof-20171214 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-01-10' into ↵Peter Maydell
staging nbd patches for 2018-01-10 - Vladimir Sementsov-Ogievskiy: nbd: rename nbd_option and nbd_opt_reply - Vladimir Sementsov-Ogievskiy: nbd/server: add additional assert to nbd_export_put # gpg: Signature made Wed 10 Jan 2018 22:53:49 GMT # gpg: using RSA key 0xA7A16B4A2527436A # gpg: Good signature from "Eric Blake <eblake@redhat.com>" # gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" # gpg: aka "[jpeg image of size 6874]" # Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A * remotes/ericb/tags/pull-nbd-2018-01-10: nbd: rename nbd_option and nbd_opt_reply nbd/server: add additional assert to nbd_export_put Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-signed' into ↵Peter Maydell
staging qemu-sparc update # gpg: Signature made Tue 09 Jan 2018 22:12:22 GMT # gpg: using RSA key 0x5BC2C56FAE0F321F # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" # Primary key fingerprint: CC62 1AB9 8E82 200D 915C C9C4 5BC2 C56F AE0F 321F * remotes/mcayland/tags/qemu-sparc-signed: (25 commits) sun4u_iommu: add trace event for IOMMU translations sun4u_iommu: convert from IOMMU_DPRINTF to trace-events sun4u_iommu: update to reflect IOMMU is no longer part of the APB device sun4u: split IOMMU device out from apb.c to sun4u_iommu.c apb: QOMify IOMMU sun4m: remove include/hw/sparc/sun4m.h and all references to it sun4m: move IOMMU declarations from sun4m.h to sun4m_iommu.h sun4m: move sun4m_iommu.c from hw/dma to hw/sparc sun4u: switch from EBUS_DPRINTF() macro to trace-events sparc64: introduce trace-events for hw/sparc64 apb: replace OBIO interrupt numbers in pci_pbmA_map_irq() with constants ebus: wire up OBIO interrupts to APB pbm via qdev GPIOs apb: remove busA property from PBMPCIBridge state apb: split pci_pbm_map_irq() into separate functions for bus A and bus B apb: remove pci_apb_init() and instantiate APB device using qdev apb: move the two secondary PCI bridges objects into APBState apb: use gpios to wire up the apb device to the SPARC CPU IRQs apb: return APBState from pci_apb_init() rather than PCIBus apb: APB QOMify tidy-up sun4u: move initialisation of all ISABus devices into ebus_realize() ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-10nbd: rename nbd_option and nbd_opt_replyVladimir Sementsov-Ogievskiy
Rename nbd_option and nbd_opt_reply to NBDOption and NBDOptionReply to correspond to Qemu coding style and other structures here. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <20171122101958.17065-5-vsementsov@virtuozzo.com> Signed-off-by: Eric Blake <eblake@redhat.com>
2018-01-10spapr: Correct compatibility mode setting for hotplugged CPUsDavid Gibson
Currently the pseries machine sets the compatibility mode for the guest's cpus in two places: 1) at machine reset and 2) after CAS negotiation. This means that if we set or negotiate a compatiblity mode, then hotplug a cpu, the hotplugged cpu doesn't get the right mode set and will incorrectly have the full native features. To correct this, we set the compatibility mode on a cpu when it is brought online with the 'start-cpu' RTAS call. Given that we no longer need to set the compatibility mode on all CPUs at machine reset, so we change that to only set the mode for the boot cpu. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reported-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com> Tested-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2018-01-10hw/ppc: Remove the deprecated spapr-pci-vfio-host-bridge deviceThomas Huth
It's a deprecated dummy device since QEMU v2.6.0. That should have been enough time to allow the users to update their scripts in case they still use it, so let's remove this legacy code now. Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-10Update dtc to fix compilation problem on Mac OS 10.6John Arbuckle
Currently QEMU does not build on Mac OS 10.6 because of a missing patch in the dtc subproject. Updating dtc to make the patch available fixes this problem. Signed-off-by: John Arbuckle <programmingkidx@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-10target/ppc: more use of the PPC_*() macrosCédric Le Goater
Also introduce utilities to manipulate bitmasks (originaly from OPAL) which be will be used in the model of the XIVE interrupt controller. Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-10ppc/pnv: change powernv_ prefix to pnv_ for overall naming consistencyCédric Le Goater
The 'pnv' prefix is now used for all and the routines populating the device tree start with 'pnv_dt'. The handler of the PnvXScomInterface is also renamed to 'dt_xscom' which should reflect that it is populating the device tree under the 'xscom@' node of the chip. Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-10hw/ide: Emulate SiI3112 SATA controllerBALATON Zoltan
This is a common generic PCI SATA controller that is also used in PCs but more importantly guests running on the Sam460ex board prefer this card and have a driver for it (unlike for other SATA controllers already emulated). Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Acked-by: John Snow <jsnow@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-10spapr_pci: use warn_report()Greg Kurz
These two are definitely warnings. Let's use the appropriate API. Signed-off-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-10ppc4xx_i2c: Implement basic I2C functionsBALATON Zoltan
Enough to please U-Boot and make it able to detect SDRAM SPD EEPROMs Signed-off-by: François Revol <revol@free.fr> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-10sm501: Add some more unimplemented registersBALATON Zoltan
These are not really implemented (just return zero or default values) but add these so guests accessing them can run. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-28 16:33:24 +0000