aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2012-02-01Merge branch 'ppc-1.0' of git://repo.or.cz/qemu/agrafJustin M. Forbes
2012-01-23e1000: bounds packet size against buffer sizeAnthony Liguori
Otherwise we can write beyond the buffer and corrupt memory. This is tracked as CVE-2012-0029. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-12pseries: Populate "/chosen/linux,stdout-path" in the FDTDavid Gibson
There is a device tree property "/chosen/linux,stdout-path" which indicates which device should be used as stdout - ie. "the console". Currently we don't specify anything, which means both firmware and Linux choose something arbitrarily. Use the routine we added in the last patch to pick a default vty and specify it as stdout. Currently SLOF doesn't use the property, but we are hoping to update it to do so. Signed-off-by: Michael Ellerman <michael@ellerman.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit 68f3a94c64bbaaf8c7f2daa70de1b5d87a432f86)
2012-01-12pseries: Add a routine to find a stable "default" vty and use itDavid Gibson
In vty_lookup() we have a special case for supporting early debug in the kernel. This accepts reg == 0 as a special case to mean "any vty". We implement this by searching the vtys on the bus and returning the first we find. This means that the vty we chose depends on the order the vtys are specified on the QEMU command line - because that determines the order of the vtys on the bus. We'd rather the command line order was irrelevant, so instead return the vty with the lowest reg value. This is still a guess as to what the user really means, but it is at least stable WRT command line ordering. Signed-off-by: Michael Ellerman <michael@ellerman.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de> [agraf] fix braces (cherry picked from commit 98331f8ad6a3e2cfbb402d72e6be47eac7706251)
2012-01-12pseries: Emit device tree nodes in reg orderDavid Gibson
Although in theory the device tree has no inherent ordering, in practice the order of nodes in the device tree does effect the order that devices are detected by software. Currently the ordering is determined by the order the devices appear on the QEMU command line. Although that does give the user control over the ordering, it is fragile, especially when the user does not generate the command line manually - eg. when using libvirt etc. So order the device tree based on the reg value, ie. the address of on the VIO bus of the devices. This gives us a sane and stable ordering. Signed-off-by: Michael Ellerman <michael@ellerman.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de> [agraf] add braces (cherry picked from commit 05c194384f836240ea4c2da5fa3be43a54bff021)
2012-01-12kvm-ppc: halt secondary cpus when guest resetLiu Yu-B13201
When guest reset, we need to halt secondary cpus until guest kick them. This already works for tcg. The patch add the support for kvm. Signed-off-by: Liu Yu <yu.liu@freescale.com> Signed-off-by: Alexander Graf <agraf@suse.de> [agraf: remove in-kernel irqchip code] (cherry picked from commit 157feeadbaec09fe4dca539a24f6f6d327d6eeb6)
2012-01-12pseries: Fix array overrun bug in PCI codeDavid Gibson
spapr_populate_pci_devices() containd a loop with PCI_NUM_REGIONS (7) iterations. However this overruns the 'bars' global array, which only has 6 elements. In fact we only want to run this loop for things listed in the bars array, so this patch corrects the loop bounds to reflect that. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit 135712de61dfa22368e98914d65b8b0860ec8505)
2012-01-10usb-ohci: td.cbp incorrectly updated near page endAndriy Gapon
The current code that updates the cbp value after a transfer looks like this: td.cbp += ret; if ((td.cbp & 0xfff) + ret > 0xfff) { <handle page overflow> because the 'ret' value is effectively added twice the check may fire too early when the overflow hasn't happened yet. Below is one of the possible changes that correct the behavior: Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-01-10usb-storage: cancel I/O on resetGerd Hoffmann
When resetting the usb-storage device we'll have to carefully cancel and clear any requests which might be in flight, otherwise we'll confuse the state machine. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-01-10pc: fix event_idx compatibility for virtio devicesAnthony Liguori
event_idx was introduced in 0.15 and must be disabled for all virtio-pci devices (including virtio-balloon-pci). Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-10pc: add pc-0.15Anthony Liguori
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-10hw/9pfs: Use the correct signed type for different variablesAneesh Kumar K.V
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
2012-01-10hw/9pfs: replace iovec manipulation with QEMUIOVectorStefan Hajnoczi
The v9fs_read() and v9fs_write() functions rely on iovec[] manipulation code should be replaced with QEMUIOVector to avoid duplicating code. In the future it may be possible to make the code even more concise by using QEMUIOVector consistently across virtio and 9pfs. The "v" format specifier for pdu_marshal() and pdu_unmarshal() is dropped since it does not actually pack/unpack anything. The specifier was also not implemented to update the offset variable and could only be used at the end of a format string, another sign that this shouldn't really be a format specifier. Instead, see the new v9fs_init_qiov_from_pdu() function. This change avoids a possible iovec[] buffer overflow when indirect vrings are used since the number of vectors is now limited by the underlying VirtQueueElement and cannot be out-of-bounds. Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
2012-01-10hw/9pfs: Use the correct file descriptor in Fsdriver CallbackAneesh Kumar K.V
Fsdriver callback that operate on file descriptor need to differentiate between directory fd and file fd. Based on the original patch from Sassan Panahinejad <sassan@sassan.me.uk> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
2012-01-10hw/9pfs: Add qdev.reset callback for virtio-9p-pci deviceAneesh Kumar K.V
Add the device reset callback Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
2012-01-10hw/9pfs: Reset server state during TVERSIONDeepak C Shetty
As per the 9p rfc, during TVERSION its necessary to clean all the active fids, so that we start the session from a clean state. Its also needed in scenarios where the guest is booting off 9p, and boot fails, and client restarts, without any knowledge of the past, it will issue a TVERSION again so this ensures that we always start from a clean state. Signed-off-by: Deepak C Shetty <deepakcs@linux.vnet.ibm.com> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
2012-01-10hw/9pfs: use migration blockers to prevent live migration when virtfs export ↵Aneesh Kumar K.V
path is mounted Now when you try to migrate with VirtFS export path mounted, you get a proper QMP error: (qemu) migrate tcp:localhost:4444 Migration is disabled when VirtFS export path '/tmp/' is mounted in the guest using mount_tag 'v_tmp' (qemu) Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
2012-01-10hw/9pfs: Improve portability to older systemsAneesh Kumar K.V
handle fs driver require a set of newly added syscalls. Don't Compile handle FS driver if those syscalls are not available. Instead of adding #ifdef for all those syscalls we check for open by handle syscall. If that is available then rest of the syscalls used by the driver should be available. Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
2012-01-08malta: Fix regression (i8259 interrupts did not work)Stefan Weil
Commit 5632ae46d5bda798e971dae48ebb318ac2c3686a passes the address of i8259 to qemu_irq_proxy. i8259 is an auto variable with undefined value outside of mips_malta_init. This made the interrupt proxy unusable: either QEMU crashes, or the interrupt handler was not called. Ethernet for example no longer worked with MIPS Malta. v2: While v1 used a static variable for i8259, this patch introduces a qdev for the malta machine. i8259 is now part of the device status. This is a minimal qdev implementation to keep the patch small. Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit e9b40fd34ceb23461083d505a444a389c094455b)
2011-11-28ccid: Fix buffer overrun in handling of VSC_ATR messageMarkus Armbruster
ATR size exceeding the limit is diagnosed, but then we merrily use it anyway, overrunning card->atr[]. The message is read from a character device. Obvious security implications unless the other end of the character device is trusted. Spotted by Coverity. CVE-2011-4111. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-11-289pfs: improve portability to older systemsAneesh Kumar K.V
I guess we can also make sure we don't call local_ioc_getversion at all. Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-11-28eepro100: Fix alignment requirement for statistical countersStefan Weil
According to Intel's Open Source Software Developer Manual, the dump counters address must be Dword aligned. The new code enforces this alignment, so s->statsaddr may now be used with stw_le_pci_dma() and stl_le_pci_dma(). Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-11-28virtio: add and use virtio_set_featuresPaolo Bonzini
vdev->guest_features is not masking features that are not supported by the guest. Fix this by introducing a common wrapper to be used by all virtio bus implementations. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-11-289pfs: improve portability to older systemsPaolo Bonzini
Small requirements on "new" features have percolated to virtio-9p-local.c. In particular, the utimensat wrapper actually only supports dirfd = AT_FDCWD and flags = AT_SYMLINK_NOFOLLOW in the fallback code. Remove the arguments so that virtio-9p-local.c will not use AT_* constants. At the same time, fail local_ioc_getversion if the ioctl is not supported by the host. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-11-28Merge remote-tracking branch 'kwolf/block-stable' into stagingAnthony Liguori
2011-11-28Merge remote-tracking branch 'kraxel/usb.32' into stagingAnthony Liguori
2011-11-23usb-ehci: add register namesGerd Hoffmann
The mmio register name list only had the names for four port status registers. We emulate a EHCI adapter with six ports though, the last two ones are listed as "unknown" in traces. Fix it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2011-11-23usb-ehci: codestyle fixupsGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2011-11-23usb-hub: implement resetGerd Hoffmann
based on a patch from hkran@linux.vnet.ibm.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2011-11-23rtl8139: Fix invalid IO access alignmentJulian Pidancet
This patch makes iPXE work with the rtl8139 emulation. The rtl8139 driver in iPXE issues a 16bit access on the ChipCmd register (offset 0x37) to check the status of the rx buffer. The offset of the ioport access was getting fixed up to 0x36 in qemu, causing the value read in iPXE to be invalid. This fixes an issue with iPXE reporting timeouts during TFTP transfers. Reposting this here because it is trivial enough and the original post on qemu-devel didn't attract much attention. Also, the inw() which was causing the issue has been replaced with an inb() in upstream iPXE: https://git.ipxe.org/ipxe.git/commit/91dd64ad25baa27954a7518e73df4fca8a2d0c93 Signed-off-by: Julian Pidancet <julian.pidancet@gmail.com> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
2011-11-22usb-hub: wakeup on detach too.Gerd Hoffmann
When detaching devices from the usb hub we must wakeup too, otherwise the host misses the detach event. Commit 4a33a9ea06f6fbb08d8311a7cfed72975344f9ab does the same for device attach. Found by hkran@linux.vnet.ibm.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2011-11-22usb: fix usb_qdev_init error handling.Gerd Hoffmann
qdev doesn't call the ->exit callback on ->init failures, so we have to take care ourself that we cleanup property on errors. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2011-11-22usb: make usb_create_simple catch and pass up errors.Gerd Hoffmann
Use qdev_init() instead of qdev_init_nofail(), usb device initialization can fail, most common case being port and device speed mismatch. Handle failures correctly and pass up NULL pointers then. Also fixup usb_create_simple() callers (only one was buggy) to properly check for NULL pointers before referncing the usb_create_simple() return value. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2011-11-22scsi-generic: add as boot devicePaolo Bonzini
There is no reason why a scsi-generic device cannot boot if it has the right type, and indeed it provides already a bootindex property. So register those devices too. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2011-11-22scsi: fix fw pathPaolo Bonzini
The pre-1.0 firmware path for SCSI devices already included the LUN using the suffix argument to add_boot_device_path. Avoid that it is included twice, and convert the colons to commas for consistency with other kinds of devices Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2011-11-22usb-msd: do not register twice in the boot orderPaolo Bonzini
USB mass storage devices are registered twice in the boot order. To avoid having to keep the two paths in sync, pass the bootindex property down to the scsi-disk device and let it register itself. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2011-11-22virtio-blk: fix cross-endian config spacePaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2011-11-21ivshmem: fix PCI BAR2 registration during initializationHongyong Zang
Ivshmem cannot work, and the command lspci cannot show ivshmem BAR2 in the guest. As for pci_register_bar(), parameter MemoryRegion should be s->bar instead of s->ivshmem. Reviewed-by: Avi Kivity <avi@redhat.com> Signed-off-by: Hongyong Zang <zanghongyong@huawei.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-11-21msix: avoid mask updates if mask is unchangedMichael S. Tsirkin
Check pending bit only if vector mask status changed. This is not really important for qemu.git but helps fix a bug in qemu-kvm.git. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-11-21msix: Prevent bogus mask updates on MMIO accessesMichael S. Tsirkin
>From: Jan Kiszka <jan.kiszka@siemens.com> Only accesses to the MSI-X table must trigger a call to msix_handle_mask_update, otherwise the vector value might be out of range. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-11-21msix: track function masked in pci device stateMichael S. Tsirkin
Only go over the table when function is masked. This is not really important for qemu.git but helps fix a bug in qemu-kvm.git. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-11-219p: pass dotl flags to the unlinkat methodPaolo Bonzini
AT_REMOVEDIR is not defined on all systems. Pass the raw flags from the 9p protocol, which are always there. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-11-219p: allow compiling the dummy virtio-9p-handle.c code on LinuxPaolo Bonzini
Avoid a conflict on the definition of struct file_handle by using a replacement name. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-11-21ivshmem: use migration blockers to prevent live migration in peer mode (v2)Anthony Liguori
Now when you try to migrate with ivshmem, you get a proper QMP error: (qemu) migrate tcp:localhost:1025 Migration is disabled when using feature 'peer mode' in device 'ivshmem' (qemu) Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-11-21Merge remote-tracking branch 'kraxel/usb.31' into stagingAnthony Liguori
2011-11-21Merge remote-tracking branch 'origin/master' into stagingAnthony Liguori
2011-11-21ehci: add assertGerd Hoffmann
Coverity thinks q could be NULL there and warns. I believe it can't be NULL there. Add assert to prove it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2011-11-21usb-storage: don't try to send the status early.Gerd Hoffmann
Until recently all scsi commands sent to scsi-disk did either transfer data or finished instantly. The correct implementation of SYNCRONIZE_CACHE changed the picture though, and usb-storage needs a fix to handle that case correctly.
2011-11-21usb-storage: drop result from device state.Gerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2011-11-21usb-storage: drop tag from device state.Gerd Hoffmann
scsi keeps track of the tag in SCSIRequest, no need to store a separate copy. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>