aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2016-05-12block: Switch blk_read_unthrottled() to byte interfaceEric Blake
Sector-based blk_read() should die; convert the one-off variant blk_read_unthrottled(). Signed-off-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-05-12block: Allow BDRV_REQ_FUA through blk_pwrite()Eric Blake
We have several block drivers that understand BDRV_REQ_FUA, and emulate it in the block layer for the rest by a full flush. But without a way to actually request BDRV_REQ_FUA during a pass-through blk_pwrite(), FUA-aware block drivers like NBD are forced to repeat the emulation logic of a full flush regardless of whether the backend they are writing to could do it more efficiently. This patch just wires up a flags argument; followup patches will actually make use of it in the NBD driver and in qemu-io. Signed-off-by: Eric Blake <eblake@redhat.com> Acked-by: Denis V. Lunev <den@openvz.org> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-05-12block: Rename bdrv_co_do_preadv/writev to bdrv_co_preadv/writevKevin Wolf
It used to be an internal helper function just for implementing bdrv_co_do_readv/writev(), but now that it's a public interface, it deserves a name without "do" in it. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com>
2016-05-12hw/arm: QOM'ify versatilepb.cxiaoqiang.zhao
Drop the use of old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/arm: QOM'ify strongarm.cxiaoqiang.zhao
Drop the use of old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/arm: QOM'ify stellaris.cxiaoqiang.zhao
* Drop the use of old SysBus init function and use instance_init * Use DeviceClass::vmsd instead of 'vmstate_register' function Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/arm: QOM'ify spitz.cxiaoqiang zhao
Drop the use of old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/arm: QOM'ify pxa2xx_pic.cxiaoqiang.zhao
Remove the empty 'pxa2xx_pic_initfn' and it's setup code in the 'pxa2xx_pic_class_init' Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/arm: QOM'ify pxa2xx.cxiaoqiang.zhao
Drop the use of old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/arm: QOM'ify integratorcp.cxiaoqiang.zhao
* Drop the use of old SysBus init function and use instance_init * Remove the empty 'icp_pic_class_init' from Typeinfo Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/arm: QOM'ify highbank.cxiaoqiang.zhao
Drop the use of old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/arm: QOM'ify armv7m.cxiaoqiang.zhao
Drop the use of old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/display/blizzard: Remove blizzard_template.hPeter Maydell
We no longer need to do the "multiply include this header" trick with blizzard_template.h, and it is only used in a single .c file, so just put its contents inline in blizzard.c. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1462371352-21498-3-git-send-email-peter.maydell@linaro.org
2016-05-12hw/display/blizzard: Expand out macrosPeter Maydell
Now that we can assume that only depth 32 is possible, there's no need for the COPY_PIXEL1 and PIXEL_TYPE macros, and the SKIP_PIXEL, COPY_PIXEL and SWAP_WORDS macros aren't used at all. Expand out COPY_PIXEL1 and PIXEL_TYPE where they are used, delete the unused macro definitions, and expand out the uses of glue(name_prefix, DEPTH). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1462371352-21498-2-git-send-email-peter.maydell@linaro.org
2016-05-12i.MX: Add sabrelite i.MX6 emulation.Jean-Christophe DUBOIS
The sabrelite supports one SPI FLASH memory on SPI1 Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12i.MX: Add i.MX6 SOC implementation.Jean-Christophe DUBOIS
For now we only support the following devices: * up to 4 Cortex A9 cores * A9 MPCORE (SCU, GIC, TWD) * 5 i.MX UARTs * 2 EPIT timers * 1 GPT timer * 3 I2C controllers * 7 GPIO controllers * 6 SDHC controllers * 5 SPI controllers * 1 CCM device * 1 SRC device * various ROM/RAM areas. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12i.MX: Add the Freescale SPI ControllerJean-Christophe DUBOIS
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12i.MX: Add i.MX6 System Reset Controller device.Jean-Christophe DUBOIS
This controller is also present in i.MX5X devices but they are not yet emulated by QEMU. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12ACPI: Virt: Generate SRAT tableShannon Zhao
To support NUMA, it needs to generate SRAT ACPI table. Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Message-id: 1461667229-9216-6-git-send-email-zhaoshenglong@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12ACPI: move acpi_build_srat_memory to common placeShannon Zhao
Move acpi_build_srat_memory to common place so that it could be reused by ARM. Rename it to build_srat_memory. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Message-id: 1461667229-9216-5-git-send-email-zhaoshenglong@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12ACPI: Fix the definition of proximity in AcpiSratMemoryAffinityShannon Zhao
ACPI spec says that Proximity Domain is an "Integer that represents the proximity domain to which the processor belongs". So define it as a uint32_t. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Message-id: 1461667229-9216-4-git-send-email-zhaoshenglong@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12ACPI: Add GICC Affinity StructureShannon Zhao
Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Message-id: 1461667229-9216-3-git-send-email-zhaoshenglong@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12ARM: Virt: Set numa-node-id for cpu and memory nodesShannon Zhao
Generate memory nodes according to NUMA topology. Set numa-node-id property for cpu and memory nodes. Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Message-id: 1461667229-9216-2-git-send-email-zhaoshenglong@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/display: QOM'ify exynos4210_fimd.cxiaoqiang zhao
* Drop the old SysBus init function and use instance_init * Move graphic_console_init into realize stage Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Message-id: 1462417489-28603-2-git-send-email-zxq_yx_007@163.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/arm/nseries: Allocating Large sized arrays to heapZhou Jie
n8x0_init has a huge stack usage of 65536 bytes approx. Moving large arrays to heap to reduce stack usage. Signed-off-by: Zhou Jie <zhoujie2011@cn.fujitsu.com> Message-id: 1461651308-894-1-git-send-email-zhoujie2011@cn.fujitsu.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12bcm2835_property: use cached values when querying framebufferSylvain Garrigues
As the framebuffer settings are copied into the result message before it is reconfigured, inconsistent behavior can happen when, for instance, you set with a single message the width, height, and depth, and ask at the same time to allocate the buffer and get the pitch and the size. In this case, the reported pitch and size would be incorrect as they were computed with the initial values of width, height and depth, not the ones the client requested. Signed-off-by: Sylvain Garrigues <sylvain@sylvaingarrigues.com> Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Message-id: 1461325343-24995-1-git-send-email-sylvain@sylvaingarrigues.com [PMM: folded a couple of long lines] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/intc: QOM'ify omap_intc.cxiaoqiang zhao
* Split the old SysBus init into an instance_init and a DeviceClass::realize function * Drop the old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/intc: QOM'ify grlib_irqmp.cxiaoqiang.zhao
* Split the old SysBus init into an instance_init and a DeviceClass::realize function * Drop the old SysBus init function Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: corrected "can not" to "cannot" in error message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/intc: QOM'ify slavio_intctl.cxiaoqiang.zhao
Drop the old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/intc: QOM'ify pl190.cxiaoqiang.zhao
Drop the old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/intc: QOM'ify imx_avic.cxiaoqiang.zhao
Drop the old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/intc: QOM'ify exynos4210_gic.cxiaoqiang.zhao
* Drop the old SysBus init function and use instance_init * Split the exynos4210_irq_gate_init into an instance_init and a DeviceClass::realize function Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/intc: QOM'ify exynos4210_combiner.cxiaoqiang.zhao
Drop the old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12hw/intc: QOM'ify etraxfs_pic.cxiaoqiang.zhao
Drop the old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12omap_lcdc: Remove support for DEPTH != 32Pooja Dhannawat
surface_bits_per_pixel() always returns 32 so, removing other dead code which is based on DEPTH !== 32 Signed-off-by: Pooja Dhannawat <dhannawatpooja1@gmail.com> Message-id: 1459260142-9144-1-git-send-email-dhannawatpooja1@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12blizzard: Remove support for DEPTH != 32Pooja Dhannawat
Removing support for DEPTH != 32 from blizzard template header and file that includes it, as macro DEPTH == 32 only used. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Pooja Dhannawat <dhannawatpooja1@gmail.com> Message-id: 1458971873-2768-1-git-send-email-dhannawatpooja1@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12qapi: Simplify semantics of visit_next_list()Eric Blake
The semantics of the list visit are somewhat baroque, with the following pseudocode when FooList is used: start() for (prev = head; cur = next(prev); prev = &cur) { visit(&cur->value) } Note that these semantics (advance before visit) requires that the first call to next() return the list head, while all other calls return the next element of the list; that is, every visitor implementation is required to track extra state to decide whether to return the input as-is, or to advance. It also requires an argument of 'GenericList **' to next(), solely because the first iteration might need to modify the caller's GenericList head, so that all other calls have to do a layer of dereferencing. Thankfully, we only have two uses of list visits in the entire code base: one in spapr_drc (which completely avoids visit_next_list(), feeding in integers from a different source than uint8List), and one in qapi-visit.py. That is, all other list visitors are generated in qapi-visit.c, and share the same paradigm based on a qapi FooList type, so we can refactor how lists are laid out with minimal churn among clients. We can greatly simplify things by hoisting the special case into the start() routine, and flipping the order in the loop to visit before advance: start(head) for (tail = *head; tail; tail = next(tail)) { visit(&tail->value) } With the simpler semantics, visitors have less state to track, the argument to next() is reduced to 'GenericList *', and it also becomes obvious whether an input visitor is allocating a FooList during visit_start_list() (rather than the old way of not knowing if an allocation happened until the first visit_next_list()). As a minor drawback, we now allocate in two functions instead of one, and have to pass the size to both functions (unless we were to tweak the input visitors to cache the size to start_list for reuse during next_list, but that defeats the goal of less visitor state). The signature of visit_start_list() is chosen to match visit_start_struct(), with the new parameters after 'name'. The spapr_drc case is a virtual visit, done by passing NULL for list, similarly to how NULL is passed to visit_start_struct() when a qapi type is not used in those visits. It was easy to provide these semantics for qmp-output and dealloc visitors, and a bit harder for qmp-input (several prerequisite patches refactored things to make this patch straightforward). But it turned out that the string and opts visitors munge enough other state during visit_next_list() to make it easier to just document and require a GenericList visit for now; an assertion will remind us to adjust things if we need the semantics in the future. Several pre-requisite cleanup patches made the reshuffling of the various visitors easier; particularly the qmp input visitor. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1461879932-9020-24-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-05-12qapi: Split visit_end_struct() into piecesEric Blake
As mentioned in previous patches, we want to call visit_end_struct() functions unconditionally, so that visitors can release resources tied up since the matching visit_start_struct() without also having to worry about error priority if more than one error occurs. Even though error_propagate() can be safely used to ignore a second error during cleanup caused by a first error, it is simpler if the cleanup cannot set an error. So, split out the error checking portion (basically, input visitors checking for unvisited keys) into a new function visit_check_struct(), which can be safely skipped if any earlier errors are encountered, and leave the cleanup portion (which never fails, but must be called unconditionally if visit_start_struct() succeeded) in visit_end_struct(). Generated code in qapi-visit.c has diffs resembling: |@@ -59,10 +59,12 @@ void visit_type_ACPIOSTInfo(Visitor *v, | goto out_obj; | } | visit_type_ACPIOSTInfo_members(v, obj, &err); |- error_propagate(errp, err); |- err = NULL; |+ if (err) { |+ goto out_obj; |+ } |+ visit_check_struct(v, &err); | out_obj: |- visit_end_struct(v, &err); |+ visit_end_struct(v); | out: and in qapi-event.c: @@ -47,7 +47,10 @@ void qapi_event_send_acpi_device_ost(ACP | goto out; | } | visit_type_q_obj_ACPI_DEVICE_OST_arg_members(v, &param, &err); |- visit_end_struct(v, err ? NULL : &err); |+ if (!err) { |+ visit_check_struct(v, &err); |+ } |+ visit_end_struct(v); | if (err) { | goto out; Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1461879932-9020-20-git-send-email-eblake@redhat.com> [Conflict with a doc fixup resolved] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-05-12spapr_drc: Expose 'null' in qom-get when there is no fdtEric Blake
Now that the QMP output visitor supports an explicit null output, we should utilize it to make it easier to diagnose the difference between a missing fdt ('null') vs. a present-but-empty one ('{}'). (Note that this reverts the behavior of commit ab8bf1d, taking us back to the behavior of commit 6c2f9a1 [which in turn stemmed from a crash fix in 1d10b44]; but that this time, the change is intentional and not an accidental side-effect.) Signed-off-by: Eric Blake <eblake@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <1461879932-9020-17-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-05-11usb: Support compilation without poll.hStefan Weil
This is a hack to support compilation with Mingw-w64 which provides a libusb-1.0 package, but no poll.h. Signed-off-by: Stefan Weil <sw@weilnetz.de> Message-id: 1458630800-10088-1-git-send-email-sw@weilnetz.de Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-11usb-mtp: fix usb_mtp_get_device_info so that libmtp on the guest doesn't ↵Isaac Lozano
complain If an application uses libmtp on the guest system, it will complain with the warning message: LIBMTP WARNING: VendorExtensionID: ffffffff LIBMTP WARNING: VendorExtensionDesc: (null) LIBMTP WARNING: this typically means the device is PTP (i.e. a camera) but not a MTP device at all. Trying to continue anyway. This is because libmtp expects a MTP Vendor Extension ID of 0x00000006 and a MTP Version of 0x0064. These numbers are taken from Microsoft's MTP Vendor Extension Identification Message page and are what most physical devices show. Signed-off-by: Isaac Lozano <109lozanoi@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1460892593-5908-1-git-send-email-109lozanoi@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-11usb:xhci: no DMA on HC resetRoman Kagan
This patch is a rough fix to a memory corruption we are observing when running VMs with xhci USB controller and OVMF firmware. Specifically, on the following call chain xhci_reset xhci_disable_slot xhci_disable_ep xhci_set_ep_state QEMU overwrites guest memory using stale guest addresses. This doesn't happen when the guest (firmware) driver sets up xhci for the first time as there are no slots configured yet. However when the firmware hands over the control to the OS some slots and endpoints are already set up with their context in the guest RAM. Now the OS' driver resets the controller again and xhci_set_ep_state then reads and writes that memory which is now owned by the OS. As a quick fix, skip calling xhci_set_ep_state in xhci_disable_ep if the device context base address array pointer is zero (indicating we're in the HC reset and no DMA is possible). Cc: qemu-stable@nongnu.org Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Message-id: 1462384435-1034-1-git-send-email-rkagan@virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-09Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20160509-1' into ↵Peter Maydell
staging vga security fixes (CVE-2016-3710, CVE-2016-3712) # gpg: Signature made Mon 09 May 2016 13:39:30 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-vga-20160509-1: vga: make sure vga register setup for vbe stays intact (CVE-2016-3712). vga: update vga register setup on vbe changes vga: factor out vga register setup vga: add vbe_enabled() helper vga: fix banked access bounds checking (CVE-2016-3710) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-02Revert "acpi: mark PMTIMER as unlocked"Gerd Hoffmann
This reverts commit 7070e085d490c396f9237c8f10bf8b6e69cd0066. Commit message claims locking is not needed, but that appears to not be true, seabios ehci driver runs into timekeeping problems with this, see https://bugzilla.redhat.com/show_bug.cgi?id=1322713 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1460702609-25971-1-git-send-email-kraxel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-02vga: make sure vga register setup for vbe stays intact (CVE-2016-3712).Gerd Hoffmann
Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT registers, to make sure the vga registers will always have the values needed by vbe mode. This makes sure the sanity checks applied by vbe_fixup_regs() are effective. Without this guests can muck with shift_control, can turn on planar vga modes or text mode emulation while VBE is active, making qemu take code paths meant for CGA compatibility, but with the very large display widths and heigts settable using VBE registers. Which is good for one or another buffer overflow. Not that critical as they typically read overflows happening somewhere in the display code. So guests can DoS by crashing qemu with a segfault, but it is probably not possible to break out of the VM. Fixes: CVE-2016-3712 Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com> Reported-by: P J P <ppandit@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-02vga: update vga register setup on vbe changesGerd Hoffmann
Call the new vbe_update_vgaregs() function on vbe configuration changes, to make sure vga registers are up-to-date. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-02vga: factor out vga register setupGerd Hoffmann
When enabling vbe mode qemu will setup a bunch of vga registers to make sure the vga emulation operates in correct mode for a linear framebuffer. Move that code to a separate function so we can call it from other places too. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-02vga: add vbe_enabled() helperGerd Hoffmann
Makes code a bit easier to read. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-02vga: fix banked access bounds checking (CVE-2016-3710)Gerd Hoffmann
vga allows banked access to video memory using the window at 0xa00000 and it supports a different access modes with different address calculations. The VBE bochs extentions support banked access too, using the VBE_DISPI_INDEX_BANK register. The code tries to take the different address calculations into account and applies different limits to VBE_DISPI_INDEX_BANK depending on the current access mode. Which is probably effective in stopping misprogramming by accident. But from a security point of view completely useless as an attacker can easily change access modes after setting the bank register. Drop the bogus check, add range checks to vga_mem_{readb,writeb} instead. Fixes: CVE-2016-3710 Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-01acpi: fix bios linker loadder COMMAND_ALLOCATE on bigendian hostIgor Mammedov
'make check' fails with: ERROR:tests/bios-tables-test.c:493:load_expected_aml: assertion failed: (g_file_test(aml_file, G_FILE_TEST_EXISTS)) since commit: caf50c7166a6ed96c462ab5db4b495e1234e4cc6 tests: pc: acpi: drop not needed 'expected SSDT' blobs Assert happens because qemu-system-x86_64 generates SSDT table and test looks for a corresponding expected table to compare with. However there is no expected SSDT blob anymore, since QEMU souldn't generate one. As it happens BIOS is not able to read ACPI tables from QEMU and fallbacks to embeded legacy ACPI codepath, which generates SSDT. That happens due to wrongly sized endiannes conversion which makes uint8_t BiosLinkerLoaderEntry.alloc.zone end up with 0 due to truncation of 32 bit integer which on host is 1 or 2. Fix it by dropping invalid cpu_to_le32() as uint8_t doesn't require any conversion. RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1330174 Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>