aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2016-05-29hw/char: QOM'ify lm32_uart.cxiaoqiang zhao3-13/+35
* Drop the old SysBus init function and use instance_init * Call qemu_chr_add_handlers in the realize callback * Use qdev chardev prop instead of qemu_char_get_next_serial * Add lm32_uart_create function to create lm32 uart device Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Message-Id: <1464158344-12266-5-git-send-email-zxq_yx_007@163.com> Tested-by: Michael Walle <michael@walle.cc> Acked-by: Michael Walle <michael@walle.cc> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-29hw/char: QOM'ify lm32_juart.cxiaoqiang zhao4-13/+14
* Drop the old SysBus init function * Call qemu_chr_add_handlers in the realize callback * Use qdev chardev prop instead of qemu_char_get_next_serial Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Message-Id: <1464158344-12266-4-git-send-email-zxq_yx_007@163.com> Tested-by: Michael Walle <michael@walle.cc> Acked-by: Michael Walle <michael@walle.cc> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-29hw/char: QOM'ify etraxfs_ser.cxiaoqiang zhao2-12/+19
* Drop the old SysBus init function and use instance_init * Call qemu_chr_add_handlers in the realize callback * Use qdev chardev prop instead of qemu_char_get_next_serial * Add etraxfs_ser_create function to create etraxfs serial device Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Message-Id: <1464158344-12266-3-git-send-email-zxq_yx_007@163.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-29hw/char: QOM'ify escc.cxiaoqiang zhao1-11/+19
* Drop the old SysBus init function and use instance_init * Call qemu_chr_add_handlers in the realize callback Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Message-Id: <1464158344-12266-2-git-send-email-zxq_yx_007@163.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-27spapr_iommu: Move table allocation to helpersAlexey Kardashevskiy1-19/+39
At the moment presence of vfio-pci devices on a bus affect the way the guest view table is allocated. If there is no vfio-pci on a PHB and the host kernel supports KVM acceleration of H_PUT_TCE, a table is allocated in KVM. However, if there is vfio-pci and we do yet not KVM acceleration for these, the table has to be allocated by the userspace. At the moment the table is allocated once at boot time but next patches will reallocate it. This moves kvmppc_create_spapr_tce/g_malloc0 and their counterparts to helpers. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-05-27spapr_pci: Use correct DMA LIOBN when composing the device treeAlexey Kardashevskiy1-1/+1
The user could have picked LIOBN via the CLI but the device tree rendering code would still use the value derived from the PHB index (which is the default fallback if LIOBN is not set in the CLI). This replaces SPAPR_PCI_LIOBN() with the actual DMA LIOBN value. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-05-27spapr: ensure device trees are always associated with DRCJianjun Duan2-17/+11
There are possible racing situations involving hotplug events and guest migration. For cases where a hotplug event is migrated, or the guest is in the process of fetching device tree at the time of migration, we need to ensure the device tree is created and associated with the corresponding DRC for devices that were hotplugged on the source, but 'coldplugged' on the target. Signed-off-by: Jianjun Duan <duanj@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-05-27Added negative check for get_image_size()Zhou Jie1-0/+4
This patch adds check for negative return value from get_image_size(), where it is missing. It avoids unnecessary two function calls. Signed-off-by: Zhou Jie <zhoujie2011@cn.fujitsu.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-05-27hw/net/spapr_llan: Provide counter with dropped rx frames to the guestThomas Huth1-0/+17
The last 8 bytes of the receive buffer list page (that has been supplied by the guest with the H_REGISTER_LOGICAL_LAN call) contain a counter for frames that have been dropped because there was no suitable receive buffer available. This patch introduces code to use this field to provide the information about dropped rx packets to the guest. There it can be queried with "ethtool -S eth0 | grep rx_no_buffer". Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-05-27hw/net/spapr_llan: Delay flushing of the RX queue while adding new RX buffersThomas Huth1-3/+25
Currently, the spapr-vlan device is trying to flush the RX queue after each RX buffer that has been added by the guest via the H_ADD_LOGICAL_LAN_BUFFER hypercall. In case the receive buffer pool was empty before, we only pass single packets to the guest this way. This can cause very bad performance if a sender is trying to stream fragmented UDP packets to the guest. For example when using the UDP_STREAM test from netperf with UDP packets that are much bigger than the MTU size, almost all UDP packets are dropped in the guest since the chances are quite high that at least one of the fragments got lost on the way. When flushing the receive queue, it's much better if we'd have a bunch of receive buffers available already, so that fragmented packets can be passed to the guest in one go. To do this, the spapr_vlan_receive() function should return 0 instead of -1 if there are no more receive buffers available, so that receive_disabled = 1 gets temporarily set for the receive queue, and we have to delay the queue flushing at the end of h_add_logical_lan_buffer() a little bit by using a timer, so that the guest gets a chance to add multiple RX buffers before we flush the queue again. This improves the UDP_STREAM test with the spapr-vlan device a lot: Running netserver -p 44444 -L <guestip> -f -D -4 in the guest, and netperf -p 44444 -L <hostip> -H <guestip> -t UDP_STREAM -l 60 -- -m 16384 in the host, I get the following values _without_ this patch: Socket Message Elapsed Messages Size Size Time Okay Errors Throughput bytes bytes secs # # 10^6bits/sec 229376 16384 60.00 1738970 0 3798.83 229376 60.00 23 0.05 That "0.05" means that almost all UDP packets got lost/discarded at the receiving side. With this patch applied, the value look much better: Socket Message Elapsed Messages Size Size Time Okay Errors Throughput bytes bytes secs # # 10^6bits/sec 229376 16384 60.00 1789104 0 3908.35 229376 60.00 22818 49.85 Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-05-26Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20160526.1' ↵Peter Maydell5-73/+871
into staging VFIO updates 2016-05-26 - Infrastructure and quirks to support IGD assignment (Alex Williamson) - Fixes to 128bit handling, IOMMU replay, IOMMU translation sanity checking (Alexey Kardashevskiy) # gpg: Signature made Thu 26 May 2016 18:50:29 BST using RSA key ID 3BB08B22 # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" # gpg: aka "Alex Williamson <alex@shazbot.org>" # gpg: aka "Alex Williamson <alwillia@redhat.com>" # gpg: aka "Alex Williamson <alex.l.williamson@gmail.com>" * remotes/awilliam/tags/vfio-update-20160526.1: vfio: Check that IOMMU MR translates to system address space memory: Fix IOMMU replay base address vfio: Fix 128 bit handling when deleting region vfio/pci: Add IGD documentation vfio/pci: Add a separate option for IGD OpRegion support vfio/pci: Intel graphics legacy mode assignment vfio/pci: Setup BAR quirks after capabilities probing vfio/pci: Consolidate VGA setup vfio/pci: Fix return of vfio_populate_vga() vfio: Create device specific region info helper vfio: Enable sparse mmap capability Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-26vfio: Check that IOMMU MR translates to system address spaceAlexey Kardashevskiy1-0/+6
At the moment IOMMU MR only translate to the system memory. However if some new code changes this, we will need clear indication why it is not working so here is the check. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2016-05-26memory: Fix IOMMU replay base addressAlexey Kardashevskiy2-7/+9
Since a788f227 "memory: Allow replay of IOMMU mapping notifications" when new VFIO listener is added, all existing IOMMU mappings are replayed. However there is a problem that the base address of an IOMMU memory region (IOMMU MR) is ignored which is not a problem for the existing user (which is pseries) with its default 32bit DMA window starting at 0 but it is if there is another DMA window. This stores the IOMMU's offset_within_address_space and adjusts the IOVA before calling vfio_dma_map/vfio_dma_unmap. As the IOMMU notifier expects IOVA offset rather than the absolute address, this also adjusts IOVA in sPAPR H_PUT_TCE handler before calling notifier(s). Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2016-05-26vfio: Fix 128 bit handling when deleting regionAlexey Kardashevskiy1-6/+11
7532d3cbf "vfio: Fix 128 bit handling" added support for 64bit IOMMU memory regions when those are added to VFIO address space; however removing code cannot cope with these as int128_get64() will fail on 1<<64. This copies 128bit handling from region_add() to region_del(). Since the only machine type which is actually going to use 64bit IOMMU is pseries and it never really removes them (instead it will dynamically add/remove subregions), this should cause no behavioral change. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2016-05-26vfio/pci: Add a separate option for IGD OpRegion supportAlex Williamson3-2/+39
The IGD OpRegion is enabled automatically when running in legacy mode, but it can sometimes be useful in universal passthrough mode as well. Without an OpRegion, output spigots don't work, and even though Intel doesn't officially support physical outputs in UPT mode, it's a useful feature. Note that if an OpRegion is enabled but a monitor is not connected, some graphics features will be disabled in the guest versus a headless system without an OpRegion, where they would work. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-26vfio/pci: Intel graphics legacy mode assignmentAlex Williamson3-1/+652
Enable quirks to support SandyBridge and newer IGD devices as primary VM graphics. This requires new vfio-pci device specific regions added in kernel v4.6 to expose the IGD OpRegion, the shadow ROM, and config space access to the PCI host bridge and LPC/ISA bridge. VM firmware support, SeaBIOS only so far, is also required for reserving memory regions for IGD specific use. In order to enable this mode, IGD must be assigned to the VM at PCI bus address 00:02.0, it must have a ROM, it must be able to enable VGA, it must have or be able to create on its own an LPC/ISA bridge of the proper type at PCI bus address 00:1f.0 (sorry, not compatible with Q35 yet), and it must have the above noted vfio-pci kernel features and BIOS. The intention is that to enable this mode, a user simply needs to assign 00:02.0 from the host to 00:02.0 in the VM: -device vfio-pci,host=0000:00:02.0,bus=pci.0,addr=02.0 and everything either happens automatically or it doesn't. In the case that it doesn't, we leave error reports, but assume the device will operate in universal passthrough mode (UPT), which doesn't require any of this, but has a much more narrow window of supported devices, supported use cases, and supported guest drivers. When using IGD in this mode, the VM firmware is required to reserve some VM RAM for the OpRegion (on the order or several 4k pages) and stolen memory for the GTT (up to 8MB for the latest GPUs). An additional option, x-igd-gms allows the user to specify some amount of additional memory (value is number of 32MB chunks up to 512MB) that is pre-allocated for graphics use. TBH, I don't know of anything that requires this or makes use of this memory, which is why we don't allocate any by default, but the specification suggests this is not actually a valid combination, so the option exists as a workaround. Please report if it's actually necessary in some environment. See code comments for further discussion about the actual operation of the quirks necessary to assign these devices. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-26vfio/pci: Setup BAR quirks after capabilities probingAlex Williamson1-3/+5
Capability probing modifies wmask, which quirks may be interested in changing themselves. Apply our BAR quirks after the capability scan to make this possible. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-26vfio/pci: Consolidate VGA setupAlex Williamson1-23/+26
Combine VGA discovery and registration. Quirks can have dependencies on BARs, so the quirks push out until after we've scanned the BARs. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-26vfio/pci: Fix return of vfio_populate_vga()Alex Williamson1-29/+26
This function returns success if either we setup the VGA region or the host vfio doesn't return enough regions to support the VGA index. This latter case doesn't make any sense. If we're asked to populate VGA, fail if it doesn't exist and let the caller decide if that's important. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-26vfio: Create device specific region info helperAlex Williamson1-0/+36
Given a device specific region type and sub-type, find it. Also cleanup return point on error in vfio_get_region_info() so that we always return 0 with a valid pointer or -errno and NULL. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-26vfio: Enable sparse mmap capabilityAlex Williamson1-4/+63
The sparse mmap capability in a vfio region info allows vfio to tell us which sub-areas of a region may be mmap'd. Thus rather than assuming a single mmap covers the entire region and later frobbing it ourselves for things like the PCI MSI-X vector table, we can read that directly from vfio. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-26Merge remote-tracking branch 'remotes/amit-migration/tags/migration-2.7-2' ↵Peter Maydell1-12/+14
into staging migration: add TLS support to the migration data channel This is a big refactoring of the migration backend code - moving away from QEMUFile to the new QIOChannel framework introduced here. This brings a good level of abstraction and reduction of many lines of code. This series also adds the ability for many backends (all except RDMA) to use TLS for encrypting the migration data between the endpoints. # gpg: Signature made Thu 26 May 2016 07:07:08 BST using RSA key ID 657EF670 # gpg: Good signature from "Amit Shah <amit@amitshah.net>" # gpg: aka "Amit Shah <amit@kernel.org>" # gpg: aka "Amit Shah <amitshah@gmx.net>" * remotes/amit-migration/tags/migration-2.7-2: (28 commits) migration: remove qemu_get_fd method from QEMUFile migration: remove support for non-iovec based write handlers migration: add support for encrypting data with TLS migration: define 'tls-creds' and 'tls-hostname' migration parameters migration: don't use an array for storing migrate parameters migration: move definition of struct QEMUFile back into qemu-file.c migration: delete QEMUFile stdio implementation migration: delete QEMUFile sockets implementation migration: delete QEMUSizedBuffer struct migration: delete QEMUFile buffer implementation migration: convert savevm to use QIOChannel for writing to files migration: convert RDMA to use QIOChannel interface migration: convert exec socket protocol to use QIOChannel migration: convert fd socket protocol to use QIOChannel migration: convert tcp socket protocol to use QIOChannel migration: rename unix.c to socket.c migration: convert unix socket protocol to use QIOChannel migration: convert post-copy to use QIOChannelBuffer migration: add reporting of errors for outgoing migration migration: add helpers for creating QEMUFile from a QIOChannel ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-26Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell6-20/+28
Block layer patches # gpg: Signature made Wed 25 May 2016 18:32:40 BST using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: (31 commits) blockjob: Remove BlockJob.bs commit: Use BlockBackend for I/O backup: Use BlockBackend for I/O backup: Remove bs parameter from backup_do_cow() backup: Pack Notifier within BackupBlockJob backup: Don't leak BackupBlockJob in error path mirror: Use BlockBackend for I/O mirror: Allow target that already has a BlockBackend stream: Use BlockBackend for I/O block: Make blk_co_preadv/pwritev() public block: Convert block job core to BlockBackend block: Default to enabled write cache in blk_new() block: Cancel jobs first in bdrv_close_all() block: keep a list of block jobs block: Rename blk_write_zeroes() dma-helpers: change BlockBackend to opaque value in DMAIOFunc dma-helpers: change interface to byte-based block: Propagate .drained_begin/end callbacks block: Fix reconfiguring graph with drained nodes block: Make bdrv_drain() use bdrv_drained_begin/end() ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-26qdev: Start disentangling bus from deviceAndreas Färber3-222/+252
Move bus type and related APIs to a separate file bus.c. This is a first step in breaking up qdev.c into more manageable chunks. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [AF: Rebased onto osdep.h] Signed-off-by: Andreas Färber <afaerber@suse.de> [PMM: added bus.o to link line for test-qdev-global-props] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-26s390: use FILE instead of QEMUFile for creating text fileDaniel P. Berrange1-12/+14
The s390 skeys monitor command needs to write out a plain text file. Currently it is using the QEMUFile class for this, but work is ongoing to refactor QEMUFile and eliminate much code related to it. The only feature qemu_fopen() gives over fopen() is support for QEMU FD passing, but this can be achieved with qemu_open() + fdopen() too. Switching to regular stdio FILE APIs avoids the need to sprintf via an intermedia buffer which slightly simplifies the code. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-Id: <1461751518-12128-2-git-send-email-berrange@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
2016-05-25block: Rename blk_write_zeroes()Eric Blake1-1/+1
Commit 983a1600 changed the semantics of blk_write_zeroes() to be byte-based rather than sector-based, but did not change the name, which is an open invitation for other code to misuse the function. Renaming to pwrite_zeroes() makes it more in line with other byte-based interfaces, and will help make it easier to track which remaining write_zeroes interfaces still need conversion. Reported-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2016-05-25dma-helpers: change BlockBackend to opaque value in DMAIOFuncPaolo Bonzini3-10/+12
Callers of dma_blk_io have no way to pass extra data to the DMAIOFunc, because the original callback and opaque are gone by the time DMAIOFunc is called. On the other hand, the BlockBackend is usually derived from those extra data that you could pass to the DMAIOFunc (in the next patch, that would be the SCSIRequest). So change DMAIOFunc's prototype, decoupling it from blk_aio_readv and blk_aio_writev's. The new prototype loses the BlockBackend and gains an extra opaque value which, in the case of dma_blk_readv and dma_blk_writev, is of course used for the BlockBackend. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-05-25dma-helpers: change interface to byte-basedPaolo Bonzini4-10/+16
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-05-24Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into ↵Peter Maydell1-0/+13
staging X86 queue, 2016-05-23 # gpg: Signature made Mon 23 May 2016 23:48:27 BST using RSA key ID 984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" * remotes/ehabkost/tags/x86-pull-request: target-i386: kvm: Eliminate kvm_msr_entry_set() target-i386: kvm: Simplify MSR setting functions target-i386: kvm: Simplify MSR array construction target-i386: kvm: Increase MSR_BUF_SIZE target-i386: kvm: Allocate kvm_msrs struct once per VCPU target-i386: Call cpu_exec_init() on realize target-i386: Move TCG initialization to realize time target-i386: Move TCG initialization check to tcg_x86_init() cpu: Eliminate cpudef_init(), cpudef_setup() target-i386: Set constant model_id for qemu64/qemu32/athlon pc: Set CPU model-id on compat_props for pc <= 2.4 osdep: Move default qemu_hw_version() value to a macro target-i386: kvm: Use X86XSaveArea struct for xsave save/load target-i386: Use xsave structs for ext_save_area target-i386: Define structs for layout of xsave area Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-23hw/net/opencores_eth: Allocating Large sized arrays to heapZhou Jie1-1/+10
open_eth_start_xmit has a huge stack usage of 65536 bytes approx. Moving large arrays to heap to reduce stack usage. Reduce size of a buffer allocated on stack to 0x600 bytes, which is the maximal frame length when HUGEN bit is not set in MODER, only allocate buffer on heap when that is too small. Thus heap is not used in typical use case. Signed-off-by: Zhou Jie <zhoujie2011@cn.fujitsu.com> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2016-05-23hw/net/opencores_eth: use mii.hMax Filippov1-17/+16
Drop local definitions of MII registers and use constants from mii.h for registers and register bits. No functional changes. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2016-05-23pc: Set CPU model-id on compat_props for pc <= 2.4Eduardo Habkost1-0/+13
Instead of relying on x86_cpudef_setup() calling qemu_hw_version(), just make old machines set model-id explicitly on compat_props for qemu64, qemu32, and athlon. This will allow us to eliminate x86_cpudef_setup() later. Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-05-23Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell6-31/+67
* NMI cleanups (Bandan) * RAMBlock/Memory cleanups and fixes (Dominik, Gonglei, Fam, me) * first part of linuxboot support for fw_cfg DMA (Richard) * IOAPIC fix (Peter Xu) * iSCSI SG_IO fix (Vadim) * Various infrastructure bug fixes (Zhijian, Peter M., Stefan) * CVE fixes (Prasad) # gpg: Signature made Mon 23 May 2016 16:06:18 BST using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" * remotes/bonzini/tags/for-upstream: (24 commits) cpus: call the core nmi injection function nmi: remove x86 specific nmi handling target-i386: add a generic x86 nmi handler coccinelle: add g_assert_cmp* to macro file iscsi: pass SCSI status back for SG_IO esp: check dma length before reading scsi command(CVE-2016-4441) esp: check command buffer length before write(CVE-2016-4439) scripts/signrom.py: Check for magic in option ROMs. scripts/signrom.py: Allow option ROM checksum script to write the size header. Remove config-devices.mak on 'make clean' cpus.c: Use pthread_sigmask() rather than sigprocmask() memory: remove unnecessary masking of MemoryRegion ram_addr memory: Drop FlatRange.romd_mode memory: Remove code for mr->may_overlap exec: adjust rcu_read_lock requirement memory: drop find_ram_block() vl: change runstate only if new state is different from current state ioapic: clear remote irr bit for edge-triggered interrupts ioapic: keep RO bits for IOAPIC entry target-i386: key sfence availability on CPUID_SSE, not CPUID_SSE2 ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-23nmi: remove x86 specific nmi handlingBandan Das2-25/+1
nmi_monitor_handle is wired to call the x86 nmi handler. So, we can directly use it at call sites. Signed-off-by: Bandan Das <bsd@redhat.com> Message-Id: <1463761717-26558-3-git-send-email-bsd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-23target-i386: add a generic x86 nmi handlerBandan Das1-0/+20
Instead of having x86 ifdefs in core nmi code, this change adds a arch specific handler that the nmi common code can call. Signed-off-by: Bandan Das <bsd@redhat.com> Message-Id: <1463761717-26558-2-git-send-email-bsd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-23esp: check dma length before reading scsi command(CVE-2016-4441)Prasad J Pandit1-4/+7
The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte FIFO buffer. It is used to handle command and data transfer. Routine get_cmd() uses DMA to read scsi commands into this buffer. Add check to validate DMA length against buffer size to avoid any overrun. Fixes CVE-2016-4441. Reported-by: Li Qiang <liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1463654371-11169-3-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-23esp: check command buffer length before write(CVE-2016-4439)Prasad J Pandit1-1/+5
The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte FIFO buffer. It is used to handle command and data transfer. While writing to this command buffer 's->cmdbuf[TI_BUFSZ=16]', a check was missing to validate input length. Add check to avoid OOB write access. Fixes CVE-2016-4439. Reported-by: Li Qiang <liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1463654371-11169-2-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-23ioapic: clear remote irr bit for edge-triggered interruptsPeter Xu1-0/+29
This is to better emulate IOAPIC version 0x1X hardware. Linux kernel leveraged this "feature" to do explicit EOI since EOI register is still not introduced at that time. This will also fix the issue that level triggered interrupts failed to work when IR enabled (tested with Linux kernel version 4.5). Reviewed-by: Radim Krčmář <rkrcmar@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1462875682-1349-3-git-send-email-peterx@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-23ioapic: keep RO bits for IOAPIC entryPeter Xu1-0/+4
Currently IOAPIC RO bits can be written. To be better aligned with hardware, we should let them read-only. Reviewed-by: Radim Krčmář <rkrcmar@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1462875682-1349-2-git-send-email-peterx@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-23i386: kvmvapic: initialise imm32 variablePrasad J Pandit1-1/+1
When processing Task Priorty Register(TPR) access, it could leak automatic stack variable 'imm32' in patch_instruction(). Initialise the variable to avoid it. Reported by: Donghai Zdh <donghai.zdh@alibaba-inc.com> Cc: qemu-stable@nongnu.org Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1460013608-16670-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-23Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20160523-1' into ↵Peter Maydell6-50/+1198
staging usb: add xen pvUSB backend, add num-ports check to ohci. # gpg: Signature made Mon 23 May 2016 14:02:25 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-usb-20160523-1: usb/ohci: Fix crash with when specifying too many num-ports xen: add pvUSB backend xen: write information about supported backends xen: introduce dummy system device Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-23usb/ohci: Fix crash with when specifying too many num-portsThomas Huth1-0/+6
QEMU currently crashes when an OHCI controller is instantiated with too many ports, e.g. "-device pci-ohci,num-ports=100,masterbus=1". Thus add a proper check in usb_ohci_init() to make sure that we do not use more than OHCI_MAX_PORTS = 15 ports here. Ticket: https://bugs.launchpad.net/qemu/+bug/1581308 Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1463995387-11710-1-git-send-email-thuth@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-23vga: add sr_vbe register setGerd Hoffmann2-22/+29
Commit "fd3c136 vga: make sure vga register setup for vbe stays intact (CVE-2016-3712)." causes a regression. The win7 installer is unhappy because it can't freely modify vga registers any more while in vbe mode. This patch introduces a new sr_vbe register set. The vbe_update_vgaregs will fill sr_vbe[] instead of sr[]. Normal vga register reads and writes go to sr[]. Any sr register read access happens through a new sr() helper function which will read from sr_vbe[] with vbe active and from sr[] otherwise. This way we can allow guests update sr[] registers as they want, without allowing them disrupt vbe video modes that way. Cc: qemu-stable@nongnu.org Reported-by: Thomas Lamprecht <thomas@lamprecht.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1463475294-14119-1-git-send-email-kraxel@redhat.com
2016-05-23xen: add pvUSB backendJuergen Gross3-0/+1087
Add a backend for para-virtualized USB devices for xen domains. The backend is using host-libusb to forward USB requests from a domain via libusb to the real device(s) passed through. Signed-off-by: Juergen Gross <jgross@suse.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com> Message-id: 1463062421-613-4-git-send-email-jgross@suse.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-23virtio-gpu: fix ui idx checkMarc-André Lureau1-1/+1
Fix off-by-one value check (0 is the first scanout). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-7-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-23xen: write information about supported backendsJuergen Gross2-50/+65
Add a Xenstore directory for each supported pv backend. This will allow Xen tools to decide which backend type to use in case there are multiple possibilities. The information is added under /local/domain/<backend-domid>/device-model/<domid>/backends before the "running" state is written to Xenstore. Using a directory for each backend enables us to add parameters for specific backends in the future. This interface is documented in the Xen source repository in the file docs/misc/qemu-backends.txt In order to reuse the Xenstore directory creation already present in hw/xen/xen_devconfig.c move the related functions to hw/xen/xen_backend.c where they fit better. Signed-off-by: Juergen Gross <jgross@suse.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com> Reviewed-by: Wei Liu <wei.liu2@citrix.com> Message-id: 1463062421-613-3-git-send-email-jgross@suse.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-23virtio-gpu: use VIRTIO_GPU_MAX_SCANOUTSMarc-André Lureau1-2/+2
The value is defined in virtio_gpu.h already (changing from 4 to 16). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-6-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-23xen: introduce dummy system deviceJuergen Gross1-0/+40
Introduce a new dummy system device serving as parent for virtual buses. This will enable new pv backends to introduce virtual buses which are removable again opposed to system buses which are meant to stay once added. Signed-off-by: Juergen Gross <jgross@suse.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com> Reviewed-by: Wei Liu <wei.liu2@citrix.com> Message-id: 1463062421-613-2-git-send-email-jgross@suse.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-23virtio-gpu: check max_outputs onlyMarc-André Lureau2-5/+4
The scanout id should not be above the configured num_scanouts. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-5-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-23virtio-gpu: check max_outputs valueMarc-André Lureau1-0/+6
The value must be less than VIRTIO_GPU_MAX_SCANOUT. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-4-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.1 at 2024-08-21 22:03:40 +0000