aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2015-06-03hw/pxb: add map_irq funcMarcel Apfelbaum
The bios does not index the pxb slot number when it computes the IRQ because it resides on bus 0 and not on the current bus. However Qemu routes the irq through bus 0 and adds the pxb slot to the IRQ computation of the PXB device. Synchronize between bios and Qemu by canceling pxb's effect. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03hw/pci: inform bios if the system has extra pci root busesMarcel Apfelbaum
The bios looks for 'etc/extra-pci-roots' to decide if is going to scan further buses after bus 0 tree. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03hw/pci: introduce PCI Expander Bridge (PXB)Marcel Apfelbaum
PXB is a "light-weight" host bridge whose purpose is to enable the main host bridge to support multiple PCI root buses for pc machines. As oposed to PCI-2-PCI bridge's secondary bus, PXB's bus is a primary bus and can be associated with a NUMA node (different from the main host bridge) allowing the guest OS to recognize the proximity of a pass-through device to other resources as RAM and CPUs. The PXB is composed from: - A primary PCI bus (can be associated with a NUMA node) Acts like a normal pci bus and from the functionality point of view is an "expansion" of the bus behind the main host bridge. - A pci-2-pci bridge behind the primary PCI bus where the actual devices will be attached. - A host-bridge PCI device Situated on the bus behind the main host bridge, allows the BIOS to configure the bus number and IO/mem resources. It does not have its own config/data register for configuration cycles, this being handled by the main host bridge. - A host-bridge sysbus to comply with QEMU current design. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03hw/pci: removed 'rootbus nr is 0' assumption from qmp_pci_queryMarcel Apfelbaum
Use the newer pci_bus_num to correctly get the root bus number. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03hw/acpi: remove from root bus 0 the crs resources used by other buses.Marcel Apfelbaum
If multiple root buses are used, root bus 0 cannot use all the pci holes ranges. Remove the IO/mem ranges used by the other primary buses. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03hw/acpi: add _CRS method for extra root bussesMarcel Apfelbaum
Save the IO/mem/bus numbers ranges assigned to the extra root busses to be removed from the root bus 0 range. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03hw/apci: add _PRT method for extra PCI root bussesMarcel Apfelbaum
Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03hw/acpi: add support for i440fx 'snooping' root bussesMarcel Apfelbaum
If the machine has extra root busses that are snooping to the i440fx host bridge, we need to add them to acpi in order to be properly detected by guests. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03hw/pci: extend PCI config access to support devices behind PXBMarcel Apfelbaum
PXB buses are assumed to be children of bus 0. Look for them while scanning the buses. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03hw/i386: query only for q35/pc when looking for pci host bridgeMarcel Apfelbaum
Because of the PXB hosts we cannot simply query TYPE_PCI_HOST_BRIDGE anymore. On i386 arch we only have two pci hosts, so we can look only for them. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03hw/pci: made pci_bus_num a PCIBusClass methodMarcel Apfelbaum
Refactoring it as a method of PCIBusClass will allow different implementations for subclasses. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03hw/pci: made pci_bus_is_root a PCIBusClass methodMarcel Apfelbaum
Refactoring it as a method of PCIBusClass will allow different implementations for subclasses. Removed the assumption that the root bus does not have a parent device because is specific only to the default class implementation. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03acpi: add implementation of aml_while() termMarcel Apfelbaum
Commit 68e6b0af7 (acpi: add aml_while() term) added the definition of aml_while without the actual implementation. Implement the term. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03acpi: add acpi_send_gpe_event() to rise sci for hotplugZhu Guihua
Add a new API named acpi_send_gpe_event() to send hotplug SCI. This API can be used by pci, cpu and memory hotplug. This patch is rebased on master. Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2015-06-03virtio: 64bit features fixups.Gerd Hoffmann
Commit "019a3ed virtio: make features 64bit wide" missed a few changes, as I've noticed while trying to rebase the virtio-1 branch to latest master. This patch adds them. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-06-03virtio-pci: don't try to mask or unmask vqs without notifiersJason Wang
We should validate the vq index against nvqs_with_notifiers. Otherwise we may try to mask or unmask vector for vqs without notifiers (e.g control vq). This will lead qemu abort on kvm_irqchip_commit_routes() when trying to boot win8.1 guest. Fixes 851c2a75a6e80c8aa5e713864d98cfb512e7229b ("virtio-pci: speedup MSI-X masking and unmasking") Reported-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-06-03hw/q35: fix floppy controller definition in ich9Marcel Apfelbaum
In DSDT FDC0 declares the IO region as IO(Decode16, 0x03F2, 0x03F2, 0x00, 0x04). Use the same in lpc_ich9 initialization code. Now the floppy drive is detected correctly on Windows. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-06-03acpi: add missing ssdtMichael S. Tsirkin
commit 5cb18b3d7bff2a83275ee98af2a14eb9e21c93ab TPM2 ACPI table support was missing a file, so build with iasl fails (build without iasl works since it uses the generated hex files). Reported-by: "Daniel P. Berrange" <berrange@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-06-03virtio-ccw/migration: Migrate config vector for virtio devicesJason J. Herne
virtio_ccw_{save|load}_config are missing code to save and restore a vdev's config_vector value. This causes some virtio devices to become disabled following a migration. This patch fixes a bug whereby the qmp/hmp balloon command (virsh setmem) silently fails to update the guest's available memory because the device was not properly migrated. This will break compatibility, but vmstate_s390_cpu was bumped from version 2 to version 4 between v2.3.0 and v2.4.0 without a compat handler. Furthermore, there is no production environment yet so migration is fenced anyway between any relevant version of 2.3 and 2.4. Signed-off-by: Jason J. Herne <jjherne@linux.vnet.ibm.com> Message-Id: <1433343843-803-1-git-send-email-jjherne@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2015-06-03virtio-ccw: add support for 9pfsPierre Morel
This patch adds 9pfs support for virtio-ccw by registering the virtio_ccw_9p_info type and adding associated callbacks. Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2015-06-03cadence_gem: Fix Rx buffer size field maskSai Pavan Boddu
This patch corrects the Rx buffer size field mask to mask bits 23 to 16 to match Xilinx UG585 documentation. Signed-off-by: Sai Pavan Boddu <saipava@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/display/tc6393xb.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/arm/nseries.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/alpha/typhoon.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/unicore32/puv3.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/lm32/milkymist.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/lm32/lm32_boards.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/ppc/prep.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/sparc/sun4m.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/timer/arm_timer.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/isa/i82378.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/isa/lpc_ich9.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Since ich9_lpc_pm_init only requests one irq, so let it just call qemu_allocate_irq. Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/i386/pc: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Since pc_allocate_cpu_irq only requests one irq, so let it just call qemu_allocate_irq. Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/intc/exynos4210_gic.c: Fix memory leak by adjusting orderShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/arm/omap_sx1.c: Fix memory leak spotted by valgrindShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/ppc/e500.c: Fix memory leakShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/alpha/dp264.c: Fix memory leak spotted by valgrindShannon Zhao
valgrind complains about: ==7055== 58 bytes in 1 blocks are definitely lost in loss record 1,471 of 2,192 ==7055== at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==7055== by 0x24410F: malloc_and_trace (vl.c:2556) ==7055== by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3) ==7055== by 0x64DEFD7: g_strndup (in /usr/lib64/libglib-2.0.so.0.3600.3) ==7055== by 0x650181A: g_vasprintf (in /usr/lib64/libglib-2.0.so.0.3600.3) ==7055== by 0x64DF0CC: g_strdup_vprintf (in /usr/lib64/libglib-2.0.so.0.3600.3) ==7055== by 0x64DF188: g_strdup_printf (in /usr/lib64/libglib-2.0.so.0.3600.3) ==7055== by 0x242F81: qemu_find_file (vl.c:2121) ==7055== by 0x217A32: clipper_init (dp264.c:105) ==7055== by 0x2484DA: main (vl.c:4249) Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/i386/acpi-build: decref after useShannon Zhao
valgrind complains about: ==16447== 48 bytes in 2 blocks are definitely lost in loss record 2,033 of 3,310 ==16447== at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==16447== by 0x2E4FD7: malloc_and_trace (vl.c:2546) ==16447== by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3) ==16447== by 0x53EC3F: qint_from_int (qint.c:33) ==16447== by 0x53B426: qmp_output_type_int (qmp-output-visitor.c:162) ==16447== by 0x539257: visit_type_uint32 (qapi-visit-core.c:147) ==16447== by 0x471D07: property_get_uint32_ptr (object.c:1651) ==16447== by 0x47000C: object_property_get (object.c:822) ==16447== by 0x472428: object_property_get_qobject (qom-qobject.c:37) ==16447== by 0x25701A: build_append_pci_bus_devices (acpi-build.c:520) ==16447== by 0x25902E: build_ssdt (acpi-build.c:1004) ==16447== by 0x25A0A8: acpi_build (acpi-build.c:1420) Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/ide/pci: Fix memory leakShannon Zhao
valgrind complains about: ==16447== 16 bytes in 2 blocks are definitely lost in loss record 1,304 of 3,310 ==16447== at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==16447== by 0x2E4FD7: malloc_and_trace (vl.c:2546) ==16447== by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3) ==16447== by 0x36FB47: qemu_extend_irqs (irq.c:55) ==16447== by 0x36FBD3: qemu_allocate_irqs (irq.c:64) ==16447== by 0x3B4B44: bmdma_init (pci.c:464) ==16447== by 0x3B547B: pci_piix_init_ports (piix.c:144) ==16447== by 0x3B55D2: pci_piix_ide_realize (piix.c:164) ==16447== by 0x3EAEC6: pci_qdev_realize (pci.c:1790) ==16447== by 0x36C685: device_set_realized (qdev.c:1058) ==16447== by 0x47179E: property_set_bool (object.c:1514) ==16447== by 0x470098: object_property_set (object.c:837) Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/i386/pc_piix: Fix memory leakShannon Zhao
valgrind complains about: ==16447== 8 bytes in 1 blocks are definitely lost in loss record 552 of 3,310 ==16447== at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==16447== by 0x2E4FD7: malloc_and_trace (vl.c:2546) ==16447== by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3) ==16447== by 0x36FB47: qemu_extend_irqs (irq.c:55) ==16447== by 0x36FBD3: qemu_allocate_irqs (irq.c:64) ==16447== by 0x24E622: pc_init1 (pc_piix.c:287) ==16447== by 0x24E76A: pc_init_pci (pc_piix.c:310) ==16447== by 0x2E9360: main (vl.c:4226) ==16447== 128 bytes in 1 blocks are definitely lost in loss record 2,569 of 3,310 ==16447== at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==16447== by 0x2E4FD7: malloc_and_trace (vl.c:2546) ==16447== by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3) ==16447== by 0x36FB47: qemu_extend_irqs (irq.c:55) ==16447== by 0x36FBD3: qemu_allocate_irqs (irq.c:64) ==16447== by 0x25BEB2: kvm_i8259_init (i8259.c:133) ==16447== by 0x24E1F1: pc_init1 (pc_piix.c:219) ==16447== by 0x24E76A: pc_init_pci (pc_piix.c:310) ==16447== by 0x2E9360: main (vl.c:4226) Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-02apic: convert ->busdev.qdev casts to C castsZhu Guihua
Use C casts to avoid accessing ICCDevice's qdev field directly. Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Acked-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2015-06-02pc: Ensure non-zero CPU ref count after attaching to ICC busAndreas Färber
Setting the parent bus of a device increases its ref count, which we ultimately want to level out. However it is only safe to do so after the last reference to the device in local code, as qom-set or similar operations might decrease the ref count. Therefore move the object_unref() from pc_new_cpu() into its callers. The APIC operations on the last CPU in pc_cpus_init() are still potentially insecure, but that is beyond the scope of this code movement. Signed-off-by: Andreas Färber <afaerber@suse.de> Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2015-06-02fdc: Fix MSR.RQM flagKevin Wolf
The RQM bit in MSR should be set whenever the guest is supposed to access the FIFO, and it should be cleared in all other cases. This is important so the guest can't continue writing/reading the FIFO beyond the length that it's suppossed to access (see CVE-2015-3456). Commit e9077462 fixed the CVE by adding code that avoids the buffer overflow; however it doesn't correct the wrong behaviour of the floppy controller which should already have cleared RQM. Currently, RQM stays set all the time and during all phases while a command is being processed. This is error-prone because the command has to explicitly clear the flag if it doesn't need data (and indeed, the two buggy commands that are the culprits for the CVE just forgot to do that). This patch clears RQM immediately as soon as all bytes that are expected have been received. If the the FIFO is used in the next phase, the flag has to be set explicitly there. It also clear RQM after receiving all bytes even if the phase transition immediately sets it again. While it's technically not necessary at the moment because the state between clearing and setting RQM is not observable by the guest, this is more explicit and matches how real hardware works. It will actually become necessary in qemu once asynchronous code paths are introduced. This alone should have been enough to fix the CVE, but now we have two lines of defense - even better. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-8-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-06-02fdc: Disentangle phases in fdctrl_read_data()Kevin Wolf
This commit makes similar improvements as have already been made to the write function: Instead of relying on a flag in the MSR to distinguish controller phases, use the explicit phase that we store now. Assertions of the right MSR flags are added. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-7-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-06-02fdc: Code cleanup in fdctrl_write_data()Kevin Wolf
Factor out a few common lines of code, reformat, improve comments. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-6-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-06-02fdc: Use phase in fdctrl_write_data()Kevin Wolf
Instead of relying on a flag in the MSR to distinguish controller phases, use the explicit phase that we store now. Assertions of the right MSR flags are added. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-5-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-06-02fdc: Introduce fdctrl->phaseKevin Wolf
The floppy controller spec describes three different controller phases, which are currently not explicitly modelled in our emulation. Instead, each phase is represented by a combination of flags in registers. This patch makes explicit in which phase the controller currently is. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Acked-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-4-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-06-02fdc: Rename fdctrl_set_fifo() to fdctrl_to_result_phase()Kevin Wolf
What callers really do with this function is to switch from execution phase (including data transfers) to result phase where the guest can read out one or more status bytes from the FIFO (the number depends on the command). Rename the function accordingly. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-3-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-06-02fdc: Rename fdctrl_reset_fifo() to fdctrl_to_command_phase()Kevin Wolf
What all callers of fdctrl_reset_fifo() really want to do is to start the command phase, where writes to the data port initiate a new command. The function doesn't only clear the FIFO, but also sets up the state so that a new command can be received. Rename it to reflect this. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-2-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-06-02Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2015-06-02' ↵Peter Maydell
into staging Monitor patches # gpg: Signature made Tue Jun 2 09:16:07 2015 BST using RSA key ID EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" * remotes/armbru/tags/pull-monitor-2015-06-02: (21 commits) monitor: Change return type of monitor_cur_is_qmp() to bool monitor: Rename monitor_ctrl_mode() to monitor_is_qmp() monitor: Turn int command_mode into bool in_command_mode monitor: Drop do_qmp_capabilities()'s superfluous QMP check monitor: Unbox Monitor member mc and rename to qmp monitor: Rename monitor_control_read(), monitor_control_event() monitor: Rename handle_user_command() to handle_hmp_command() monitor: Limit QError use to command handlers monitor: Inline monitor_has_error() into its only caller monitor: Wean monitor_protocol_emitter() off mon->error monitor: Propagate errors through invalid_qmp_mode() monitor: Propagate errors through qmp_check_input_obj() monitor: Propagate errors through qmp_check_client_args() monitor: Drop unused "new" HMP command interface monitor: Use trad. command interface for HMP pcie_aer_inject_error monitor: Use traditional command interface for HMP device_add monitor: Use traditional command interface for HMP drive_del monitor: Convert client_migrate_info to QAPI monitor: Improve and document client_migrate_info protocol error monitor: Clean up after previous commit ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>