Commit Graph

32250 Commits

Author SHA1 Message Date
Kevin Wolf
e3737b820b bochs: Check catalog_size header field (CVE-2014-0143)
It should neither become negative nor allow unbounded memory
allocations. This fixes aborts in g_malloc() and an s->catalog_bitmap
buffer overflow on big endian hosts.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:59:47 +02:00
Kevin Wolf
246f65838d bochs: Use unsigned variables for offsets and sizes (CVE-2014-0147)
Gets us rid of integer overflows resulting in negative sizes which
aren't correctly checked.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:59:47 +02:00
Kevin Wolf
3dd8a6763b bochs: Unify header structs and make them QEMU_PACKED
This is an on-disk structure, so offsets must be accurate.

Before this patch, sizeof(bochs) != sizeof(header_v1), which makes the
memcpy() between both invalid. We're lucky enough that the destination
buffer happened to be the larger one, and the memcpy size to be taken
from the smaller one, so we didn't get a buffer overflow in practice.

This patch unifies the both structures, eliminating the need to do a
memcpy in the first place. The common fields are extracted to the top
level of the struct and the actually differing part gets a union of the
two versions.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:59:47 +02:00
Kevin Wolf
24f3078a04 qemu-iotests: Support for bochs format
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:59:47 +02:00
Stefan Hajnoczi
42d43d35d9 block/cloop: fix offsets[] size off-by-one
cloop stores the number of compressed blocks in the n_blocks header
field.  The file actually contains n_blocks + 1 offsets, where the extra
offset is the end-of-file offset.

The following line in cloop_read_block() results in an out-of-bounds
offsets[] access:

    uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num];

This patch allocates and loads the extra offset so that
cloop_read_block() works correctly when the last block is accessed.

Notice that we must free s->offsets[] unconditionally now since there is
always an end-of-file offset.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:59:47 +02:00
Stefan Hajnoczi
f56b9bc3ae block/cloop: refuse images with bogus offsets (CVE-2014-0144)
The offsets[] array allows efficient seeking and tells us the maximum
compressed data size.  If the offsets are bogus the maximum compressed
data size will be unrealistic.

This could cause g_malloc() to abort and bogus offsets mean the image is
broken anyway.  Therefore we should refuse such images.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:59:47 +02:00
Stefan Hajnoczi
7b103b36d6 block/cloop: refuse images with huge offsets arrays (CVE-2014-0144)
Limit offsets_size to 512 MB so that:

1. g_malloc() does not abort due to an unreasonable size argument.

2. offsets_size does not overflow the bdrv_pread() int size argument.

This limit imposes a maximum image size of 16 TB at 256 KB block size.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:59:47 +02:00
Stefan Hajnoczi
509a41bab5 block/cloop: prevent offsets_size integer overflow (CVE-2014-0143)
The following integer overflow in offsets_size can lead to out-of-bounds
memory stores when n_blocks has a huge value:

    uint32_t n_blocks, offsets_size;
    [...]
    ret = bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4);
    [...]
    s->n_blocks = be32_to_cpu(s->n_blocks);

    /* read offsets */
    offsets_size = s->n_blocks * sizeof(uint64_t);
    s->offsets = g_malloc(offsets_size);

    [...]

    for(i=0;i<s->n_blocks;i++) {
        s->offsets[i] = be64_to_cpu(s->offsets[i]);

offsets_size can be smaller than n_blocks due to integer overflow.
Therefore s->offsets[] is too small when the for loop byteswaps offsets.

This patch refuses to open files if offsets_size would overflow.

Note that changing the type of offsets_size is not a fix since 32-bit
hosts still only have 32-bit size_t.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:59:47 +02:00
Stefan Hajnoczi
d65f97a82c block/cloop: validate block_size header field (CVE-2014-0144)
Avoid unbounded s->uncompressed_block memory allocation by checking that
the block_size header field has a reasonable value.  Also enforce the
assumption that the value is a non-zero multiple of 512.

These constraints conform to cloop 2.639's code so we accept existing
image files.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:59:47 +02:00
Stefan Hajnoczi
05560fcebb qemu-iotests: add cloop input validation tests
Add a cloop format-specific test case.  Later patches add tests for
input validation to the script.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:59:46 +02:00
Stefan Hajnoczi
47f73da0a7 qemu-iotests: add ./check -cloop support
Add the cloop block driver to qemu-iotests.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:59:46 +02:00
Prasad Joshi
c5a33ee9ee qcow2: fix two memory leaks in qcow2_open error code path
Signed-off-by: Prasad Joshi <prasadjoshi.linux@gmail.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:49:53 +02:00
Markus Armbruster
4c7096607d vvfat: Fix :floppy: option to suppress partition table
Regressed in commit 7ad9be6, v1.5.0.

Reported-by: Kiyokazu SUTO <suto@ks-and-ks.ne.jp>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:49:53 +02:00
Prasad Joshi
bdf866fe6c qemu-img: Release reference to BlockDriverState
Signed-off-by: Prasad Joshi <prasadjoshi.linux@gmail.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:49:53 +02:00
Gerd Hoffmann
bdcc3a28b7 input: add sanity check
Check we've actually found a input handler before trying to call it.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-04-01 10:17:45 +02:00
Hani Benhabiles
0419f78fae input: mouse_set should check input device type.
Otherwise, the index of an input device like a usb-kbd is silently accepted.

(qemu) info mice
  Mouse #2: QEMU PS/2 Mouse
* Mouse #3: QEMU HID Mouse
(qemu) mouse_set 1
(qemu) info mice
  Mouse #2: QEMU PS/2 Mouse
* Mouse #3: QEMU HID Mouse

Also replace monitor_printf() call in do_mouse_set() with error_report() and
adjust error message.

Signed-off-by: Hani Benhabiles <hani@linux.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-04-01 10:17:45 +02:00
Gerd Hoffmann
e82597f6f8 input: fix input_event_key_number trace event
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-04-01 10:17:45 +02:00
Petar Jovanovic
d25295d4ef linux-user: pass correct host flags to accept4()
Flags NONBLOCK and CLOEXEC can have different values on the host and the
guest, so set correct host values before calling accept4().

This fixes several issues with accept4 system call and user-mode of QEMU.

Signed-off-by: Petar Jovanovic <petar.jovanovic@imgtec.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
2014-04-01 09:17:19 +03:00
Peter Maydell
95224e87a7 QOM/QTest infrastructure fixes
* Revised QTest SIGABRT fix
 * Test cleanups for non-POSIX hosts
 * QTest test cases for NVMe, virtio-9p, pvpanic, i82801b11
 * QTest API addition for reading events
 * TMP105 fix and regression test
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTOdk6AAoJEPou0S0+fgE/adoQAJmM47CgbB3K2nOcRn+G7c/N
 9JX8qZDJCLj5QTm8NDGofjRkhYfvTulHocHMFNE7IfYIdEZGs+27UyZKJQ2Ti8SQ
 WLq9nzix4iV+QMCAkgX0VJ7MOIakVcWhKAMWZpRwQV00uv+OuxxI9eoW5wS/CTyP
 XVLpXznPwA/Nx8nDDceTuD/iDaHpTYBUXbxdLKgjE8T/K1Y6oR1xhCxpOHFLmOo+
 pPD0THD/XV4HH5TJ6hVVZwFEEvYYdRenYoG8U8E4u2R+dJTjIAeNhUCiGiIztHit
 pW5mlNL+jBSh/x1QnQuBu7YyvVM48zcNW9mZucrl8sC5ICq6FgBJv8af+IZullJ+
 KzPnERplMlFxieJAgiaWBURbWN7Zrgb8btZpX8QOu75C/zQbChDFbnQdsQglbNxU
 D5Z/wZeNM1v47O8VI+1Bel6/S2XM23LAJPyA3BkKQAS5ngUPe5epqkbW6X7REkFH
 dJ5XLqAQbUWIXWfje+2lgxzl3EOLYjiDekkCCxSPmeSE5AtvMEwdMGXuZCrvewQX
 NA4rqqGHwlCY/V7az/S1QHg23psXqf6euJgxHk8MwD+JNZJS7lca8x9PYfC/Enth
 6L1ThveVRxlDAzpzPrnlPtr7b2/SIvaSxPzVPdXN+b39Bkz2o28l27KmoBaLeh2Y
 nRZ7DgZcdCDH9ROW/Lhg
 =monR
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-2.0' into staging

QOM/QTest infrastructure fixes

* Revised QTest SIGABRT fix
* Test cleanups for non-POSIX hosts
* QTest test cases for NVMe, virtio-9p, pvpanic, i82801b11
* QTest API addition for reading events
* TMP105 fix and regression test

# gpg: Signature made Mon 31 Mar 2014 22:08:10 BST using RSA key ID 3E7E013F
# gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
# gpg:                 aka "Andreas Färber <afaerber@suse.com>"

* remotes/afaerber/tags/qom-devices-for-2.0:
  tmp105-test: Test QOM property and precision
  tmp105-test: Add a second sensor and test that one
  tmp105-test: Wrap simple building blocks for testing
  tmp105: Read temperature in milli-celsius
  tests: Add i82801b11 qtest
  pvpanic-test: Assert pause event
  qtest: Factor out qtest_qmp_receive()
  tests: Add pvpanic qtest
  tests: Add virtio-9p qtest
  tests: Add nvme qtest
  nvme: Permit zero-length block devices
  tests: Correctly skip qtest on non-POSIX hosts
  tests: Skip POSIX-only tests on Windows
  tests: Remove unsupported tests for MinGW
  qtest: Keep list of qtest instances for SIGABRT handler
  Revert "qtest: Fix crash if SIGABRT during qtest_init()"

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-31 22:11:30 +01:00
Paolo Bonzini
7373fc7693 tmp105-test: Test QOM property and precision
This adds a regression test for commit
efdf6a56a7 (tmp105: Read temperature in
milli-celsius).

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 23:03:14 +02:00
Paolo Bonzini
a4ec5bb718 tmp105-test: Add a second sensor and test that one
This will make it easier to reach the device under test via QOM.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:57:35 +02:00
Paolo Bonzini
cebac61498 tmp105-test: Wrap simple building blocks for testing
The next patches will add more reads and writes.  Add a simple testing
API for this.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:53:45 +02:00
Paolo Bonzini
efdf6a56a7 tmp105: Read temperature in milli-celsius
Right now, the temperature property must be written in milli-celsius,
but it reads back the value in 8.8 fixed point.  Fix this by letting the
property read back the original value (possibly rounded).  Also simplify
the code that does the conversion.

Before:

    (QEMU) qom-set path=/machine/peripheral/sensor property=temperature value=20000
    {u'return': {}}
    (QEMU) qom-get path=sensor property=temperature
    {u'return': 5120}

After:

    (QEMU) qom-set path=/machine/peripheral/sensor property=temperature value=20000
    {u'return': {}}
    (QEMU) qom-get path=sensor property=temperature
    {u'return': 20000}

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:49:40 +02:00
Andreas Färber
e683eb9ecc tests: Add i82801b11 qtest
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:36:17 +02:00
Andreas Färber
627b1a17ce pvpanic-test: Assert pause event
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:36:17 +02:00
Andreas Färber
66e0c7b187 qtest: Factor out qtest_qmp_receive()
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:36:16 +02:00
Andreas Färber
abc53733f3 tests: Add pvpanic qtest
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:36:16 +02:00
Andreas Färber
2d888c099c tests: Add virtio-9p qtest
Make it conditional to 9p availability.
Create a temporary directory to share.

Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:35:50 +02:00
Andreas Färber
fc9677915c tests: Add nvme qtest
Acked-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:35:03 +02:00
Andreas Färber
592408b8ca nvme: Permit zero-length block devices
It may not be sensible for normal use cases, but it allows to use
/dev/null in QTest.

Acked-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:35:03 +02:00
Stefan Hajnoczi
5c4e24c151 tests: Correctly skip qtest on non-POSIX hosts
qtest test cases only work on POSIX hosts.  The following line only
defines dependencies for qtest binaries on POSIX hosts:

  check-qtest-$(CONFIG_POSIX)=$(foreach TARGET,$(TARGETS),$(check-qtest-$(TARGET)-y))

But the QTEST_TARGETS definition earlier in the Makefile fails to check
CONFIG_POSIX.  This causes make targets to be generated for qtest test
cases even though we don't know how to build the binaries.

The following error message is printed when trying to run gtester on a
binary that was never built:

  GLib-WARNING **: Failed to execute test binary: tests/endianness-test.exe: Failed to execute child process "tests/endianness-test.exe" (No such file or directory)

This patch makes QTEST_TARGETS empty on non-POSIX hosts.  This prevents
the targets from being generated.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:35:03 +02:00
Stefan Hajnoczi
d597a32a6d tests: Skip POSIX-only tests on Windows
test-rfifolock and test-vmstate only build on POSIX hosts.  Exclude them
if building for Windows.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:35:02 +02:00
Stefan Weil
0875709429 tests: Remove unsupported tests for MinGW
test_timer_schedule and test_source_timer_schedule don't compile for MinGW
because some functions are not implemented for MinGW (qemu_pipe,
aio_set_fd_handler).

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:35:02 +02:00
Stefan Hajnoczi
d766825190 qtest: Keep list of qtest instances for SIGABRT handler
Keep track of active qtest instances so we can kill them when the test
aborts.  This ensures no QEMU processes are left running after test
failure.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Marcel Apfelbaum <marcel.a@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:20:04 +02:00
Stefan Hajnoczi
96b8ca47f8 Revert "qtest: Fix crash if SIGABRT during qtest_init()"
It turns out there are test cases that use multiple libqtest instances.
We cannot use a global qtest instance in the SIGABRT handler.

This reverts commit cb201b4872.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Marcel Apfelbaum <marcel.a@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 22:20:04 +02:00
Steven Noonan
63678e17cf configure: add option to disable -fstack-protector flags
The -fstack-protector flag family is useful for ensuring safety and for
debugging, but has a performance impact. Here are some boot time comparisons of
the various versions of -fstack-protector using qemu-system-arm on an x86_64
host:

    # -fstack-protector-all
    Startup finished in 1.810s (kernel) + 12.331s (initrd) + 49.016s (userspace) = 1min 3.159s
    Startup finished in 1.801s (kernel) + 12.287s (initrd) + 47.925s (userspace) = 1min 2.013s
    Startup finished in 1.812s (kernel) + 12.302s (initrd) + 47.995s (userspace) = 1min 2.111s

    # -fstack-protector-strong
    Startup finished in 1.744s (kernel) + 11.223s (initrd) + 44.688s (userspace) = 57.657s
    Startup finished in 1.721s (kernel) + 11.222s (initrd) + 44.194s (userspace) = 57.138s
    Startup finished in 1.693s (kernel) + 11.250s (initrd) + 44.426s (userspace) = 57.370s

    # -fstack-protector
    Startup finished in 1.705s (kernel) + 11.409s (initrd) + 43.563s (userspace) = 56.677s
    Startup finished in 1.877s (kernel) + 11.137s (initrd) + 43.719s (userspace) = 56.734s
    Startup finished in 1.708s (kernel) + 11.141s (initrd) + 43.628s (userspace) = 56.478s

    # no stack protector
    Startup finished in 1.743s (kernel) + 11.190s (initrd) + 43.709s (userspace) = 56.643s
    Startup finished in 1.763s (kernel) + 11.216s (initrd) + 43.767s (userspace) = 56.747s
    Startup finished in 1.711s (kernel) + 11.283s (initrd) + 43.878s (userspace) = 56.873s

This patch introduces a configure option to disable the stack protector
entirely, and conditional stack protector flag selection (in order,
based on availability): -fstack-protector-strong, -fstack-protector-all,
no stack protector.

Signed-off-by: Steven Noonan <snoonan@amazon.com>
Cc: Anthony Liguori <aliguori@amazon.com>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
[Prefer -fstack-protector-all to -fstack-protector, suggested by
 Laurent Desnogues. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-31 20:16:02 +01:00
Cole Robinson
58b590148c pci: Fix clearing IRQs on reset
irq_state is cleared before calling pci_device_deassert_intx, but the
latter misbehaves if the former isn't accurate. In this case, any raised
IRQs are not cleared, which hits an assertion in pcibus_reset:

qemu-system-x86_64: hw/pci/pci.c:250: pcibus_reset: Assertion
`bus->irq_count[i] == 0' failed.

pci_device_deassert_intx should clear irq_state anyways, so add
an assert.

This fixes migration with usb2 + usb-tablet.

Signed-off-by: Cole Robinson <crobinso@redhat.com>
Message-id: 7da1ad94ce027183b4049c2de370cb191b0073c1.1396290569.git.crobinso@redhat.com
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-31 19:53:34 +01:00
Peter Maydell
7d4d7975e5 QOM CPUState refactorings / X86CPU
* X86CPU IA32e 1GB paging support
 * Performance quickfix for CPU() cast macro
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTOabnAAoJEPou0S0+fgE/ob4QAL2DBPLq+QPWYUg8JRe3+8DW
 czMcgxQ2G1vSr8mpMSTWePW0qwX1M/nsmxreOsZ4cWL38UzwZNKqGVHN3a/YXvrv
 4Aw7acLKK91FE2SLvtvM1KsIQlzbRlIUxaRCldfubIKbSgqKMYZooMOKlTnzpXkx
 rLa4Tx+nUxTIQXZ1PJ5XTXBk5KYnVJaVrUBp22MWsmt5crKoKnNYAxniqemx6S9M
 ImqQLrpmnj3tjhZzpF2+1fSbnTmrMLdO8CNUDFgCDZzHr+rs5oLRwdVvk3FPQbNW
 NO59TtBmEDZ1jyGpktI5D0/4GD5ctU1zsirehWai4VspN6qmBS7slW9Nk//KnvvW
 pf3zoQwzN7JUq0+ZkVPjnWsrUm7TWlkSQZjXdD4qtTAOR31EOt+oE0FdWqnYiPDr
 pwh8zl2jv+2wW1fewqSSvcRKFZJSsYjYu0fDxoFf0zSnj764Q5RYil7CWkpXxb4p
 cS4u40SBITe9D68BxgYrVlf8slmTIGVXSNWuNH9QFOu1B/0ZQFbp7CO0rHru9PJH
 8/63j4zpROGPuZvviiltKgv4iYhmBGhub0yr3GQvu7cDKbrNVMGCUFzcnQKcABn8
 ZHEzpz5YU9H6mpfQ/r9Pi4DiTvl6jBnu89/EmCKVLNIZYNKCSjtk7pS9XderesTE
 6qq3jG0uejLnDHfqYLUp
 =gmXa
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/afaerber/tags/qom-cpu-for-2.0' into staging

QOM CPUState refactorings / X86CPU

* X86CPU IA32e 1GB paging support
* Performance quickfix for CPU() cast macro

# gpg: Signature made Mon 31 Mar 2014 18:33:27 BST using RSA key ID 3E7E013F
# gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
# gpg:                 aka "Andreas Färber <afaerber@suse.com>"

* remotes/afaerber/tags/qom-cpu-for-2.0:
  cpu: Avoid QOM casts for CPU()
  target-i386: x86_cpu_get_phys_page_debug(): support 1GB page translation

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-31 18:47:14 +01:00
Andreas Färber
0d6d1ab499 cpu: Avoid QOM casts for CPU()
CPU address spaces touching load and store helpers as well as the
movement of (almost) all fields from CPU_COMMON to CPUState have led to
a noticeable increase of CPU() usage in "hot" paths for both TCG and KVM.

While CPU()'s OBJECT_CHECK() might help detect development errors, i.e.
in form of crashes due to QOM vs. non-QOM mismatches rather than QOM
type mismatches, it is not really needed at runtime since mostly used in
CPU-specific paths, coming from a target-specific CPU subtype. If that
pointer is damaged, other errors are highly likely to occur elsewhere
anyway.

Keep the CPU() macro for a consistent developer experience and for
flexibility to exchange its implementation, but turn it into a pure,
unchecked C cast for now.

Compare commit 6e42be7cd1.

Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 19:28:38 +02:00
Luiz Capitulino
c8c14bcb72 target-i386: x86_cpu_get_phys_page_debug(): support 1GB page translation
Linux guests, when using more than 4GB of RAM, may end up using 1GB pages
to store (kernel) data. When this happens, we're unable to debug a running
Linux kernel with GDB:

(gdb) p node_data[0]->node_id
Cannot access memory at address 0xffff88013fffd3a0
(gdb)

GDB returns this error because x86_cpu_get_phys_page_debug() doesn't support
translating 1GB pages in IA-32e paging mode and returns an error to GDB.

This commit adds support for 1GB page translation for IA32e paging.

Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31 19:06:48 +02:00
Andreas Färber
8648fcd52a make-release: Record SeaBIOS version
Before deleting .git, determine the version and save it in .version file.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
Message-id: 1395277315-7806-1-git-send-email-afaerber@suse.de
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-31 15:02:04 +01:00
Peter Maydell
b3706faf0d Merge remote-tracking branch 'remotes/rth/tcg-arm-unaligned' into staging
* remotes/rth/tcg-arm-unaligned:
  tcg-arm: Avoid ldrd/strd for user-only emulation

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-28 14:52:29 +00:00
Peter Maydell
3b6144bdbb acpi,pc,build bug fixes
Here are some bugfixes for 2.0.
 
 A bugfix for acpi for pci bridges, and a build fix for
 old systems without pthread_setname_np: both fix regressions
 so we definitely want to include them.
 HPET fix is not for a regression but looks very safe,
 fixes a nasty bug and has been on list for a while.
 
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJTNWRMAAoJECgfDbjSjVRp6CoH/A3iLi+jkV4EhQQzU8U6vOmi
 PIV71600rZd29u4hk6w5pyev6yyXSBwatmWk+vzHvINUIcc22KUue+773nXPW/fH
 3oIgTwjKndE98V5vTSeOgOdD7iFuWlcgHQHLXXMsgpY1hVMS/1kidZdb+36o8euI
 kdE+AxYGXS8Z3oBRFfROpT4v0UZ17qIaL4tqA4JJWMh/A3Qp3HY+ffU3ODAvKSQw
 KWVWmKvbh82I25HOvALoMwtu26x48jhzu586pHBuEsHgTJKKBrAUdWph+2f1eSC+
 xTgduKWEgK6Z9dCYDQwDaM8CqNzjqVzfgRu0RCSHtgTxCWaIN3dQbxEFi7WQ2Yo=
 =dfqJ
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

acpi,pc,build bug fixes

Here are some bugfixes for 2.0.

A bugfix for acpi for pci bridges, and a build fix for
old systems without pthread_setname_np: both fix regressions
so we definitely want to include them.
HPET fix is not for a regression but looks very safe,
fixes a nasty bug and has been on list for a while.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

# gpg: Signature made Fri 28 Mar 2014 12:00:12 GMT using RSA key ID D28D5469
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

* remotes/mst/tags/for_upstream:
  acpi: fix ACPI generation for pci bridges
  Don't enable a HPET timer if HPET is disabled
  Detect pthread_setname_np at configure time

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-28 13:46:29 +00:00
Marcel Apfelbaum
b89834f4d7 acpi: fix ACPI generation for pci bridges
Commit 8dcf525abc
    acpi-build: append description for non-hotplug
appended description for all occupied non hotpluggable PCI slots.
However the bridge devices are already added to SSDT,
adding them again will create an incorrect SSDT table.

Fixed by skipping the pci bridge devices, marking them as 'system'.

Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-03-28 13:59:48 +02:00
Richard Henderson
1a8e80d7e8 tcg-arm: Avoid ldrd/strd for user-only emulation
The arm ldrd/strd insns must cause alignment traps, whereas
at least for armv7 ldr/str must handle unaligned operations.

While this is hardly the only problem facing user-only emu,
this solves one problem for i386 on armv7 emulation.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reported-by: Huw Davies <huw@codeweavers.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-03-27 16:33:01 -04:00
Peter Maydell
9c5793c503 PowerPC queue for 2.0
* OpenPIC fix
 * MSR fixes for POWER7 upwards
 * TCG instruction set support fix for POWER8
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTNE3cAAoJEPou0S0+fgE/B9wQAI/V6tTBA73II45GluSuz9nI
 G2RBYJdj4JFgYeQ4BRKjQ8gS9fOhK53SunDaHpwYys8QedOjkF5ANnxmxL7MAMyB
 ORgTbjhW2hqV+MnQDtqlwhGJMqtnlS8gBmPPe9a+zO2k7xw4C6OQNG9fenJWNFSQ
 MjbZEH4lrIMnLO9DBDzjhzXXemIGcl9btqF6jPw9v2IjU3NS1CmO+gwzC0MR/HR7
 t7v4Nfjr1vUTfOR0Uj+wYPwMTcc9y2Odbwx4sqBJ+77OBXiu/AoB6AxhCr0CliRm
 NQBPymbE50PtwxBch/PB+z9/cz9D1m7He8iVu7IdMLGe+u/CRexSbrPWV/0AmwC3
 VrhqycZoq6PCdo5+6NZh5B3E9IbeIlOJMopFz+lH08pf0tjgCnnBvKaX2M+Xmqtu
 klQJi84er9/nQfLDntpSNZLWAYa+loPWEvmmTKBLXz+YNwhcdEhu3En2pjkMir6/
 Qb/8wed9wL8qadjerKAez7p2ZKpZAssrM68Ddb4yUZEtOwlnuGJvN9XRQfjxUDAM
 wWsG8nv1BcSKT0XpH5nFKZOVFKa6xzP3ZETb4gFZtIkZpVqMFmmZpX2LZr5+V3SO
 r+e3EBqbbvk7tXV+EwYoAy9U0a1/Ym1YhWVmOzm+MIkgvC7QQbagNcASoQZemV0i
 7qNCjM4kFYm9hOeLDdHe
 =uE84
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/afaerber/tags/ppc-for-2.0' into staging

PowerPC queue for 2.0

* OpenPIC fix
* MSR fixes for POWER7 upwards
* TCG instruction set support fix for POWER8

# gpg: Signature made Thu 27 Mar 2014 16:12:12 GMT using RSA key ID 3E7E013F
# gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
# gpg:                 aka "Andreas Färber <afaerber@suse.com>"

* remotes/afaerber/tags/ppc-for-2.0:
  target-ppc: MSR_POW not supported on POWER7/7+/8
  target-ppc: POWER7+ supports the MSR_VSX bit
  target-ppc: POWER8 supports isel
  target-ppc: POWER8 supports the MSR_LE bit
  intc/openpic_kvm: Fix MemListener delete region callback function

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-27 17:08:30 +00:00
Peter Maydell
c6c09ba995 trivial patches for 2014-03-27
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iJwEAAECAAYFAlM0QokACgkQUlPFrXTwyDg0MAP/aV+I1bH7nAIXEPxfFNUd4bBQ
 PsgaDTOd44G8SGjBqpO7EvgElBPfKnRfQjDmNV2LqYK6p+NMtlUh+ULDjxEBMBRU
 hDXOWMlhHUU1to3vdN6qsRhCHNMEQUFeJWpv5EVIaD/VZkcgpz90F4WF6ZE0Xs9R
 ZuUVbV/bapaow7bKoIk=
 =3iLr
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-03-27' into staging

trivial patches for 2014-03-27

# gpg: Signature made Thu 27 Mar 2014 15:23:53 GMT using RSA key ID 74F0C838
# gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
# gpg:                 aka "Michael Tokarev <mjt@debian.org>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D  4324 457C E0A0 8044 65C5
#      Subkey fingerprint: E190 8639 3B10 B51B AC2C  8B73 5253 C5AD 74F0 C838

* remotes/mjt/tags/trivial-patches-2014-03-27: (23 commits)
  linux-user: remove duplicate statement
  hw/timer/grlib_gptimer: remove unnecessary assignment
  hw/pci-host/apb.c: Avoid shifting left into sign bit
  hw/intc/xilinx_intc: Avoid shifting left into sign bit
  hw/intc/slavio_intctl: Avoid shifting left into sign bit
  tests/libqos/pci-pc: Avoid shifting left into sign bit
  hw/ppc: Avoid shifting left into sign bit
  hw/intc/openpic: Avoid shifting left into sign bit
  hw/usb/hcd-ohci.c: Avoid shifting left into sign bit
  target-mips: Avoid shifting left into sign bit
  hw/i386/acpi_build.c: Avoid shifting left into sign bit
  hw/pci/pci_host.c: Avoid shifting left into sign bit
  hw/intc/apic.c: Use uint32_t for mask word in foreach_apic
  target-i386: Avoid shifting left into sign bit
  CODING_STYLE: Section about mixed declarations
  doc: update default PowerPC framebuffer settings
  doc: update sun4m documentation
  fix return check for KVM_GET_DIRTY_LOG ioctl
  target-i386: Add missing 'static' and 'const' attributes
  util: Add 'static' attribute to function implementation
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-27 16:38:58 +00:00
Matt Lupfer
c36ad13fe9 Don't enable a HPET timer if HPET is disabled
A HPET timer can be started when HPET is not yet
enabled. This will not generate an interrupt
to the guest, but causes problems when HPET is later
enabled.

A timer that is created and expires at least once before
HPET is enabled will have an initialized comparator based
on a hpet_offset of 0 (uninitialized). When HPET is
enabled, hpet_set_timer() is called a second time, which
modifies the timer expiry to a time based on the
difference between current ticks (measured with the
newly initialized hpet_offset) and the timer's
comparator (which was generated before hpet_offset was
initialized). This results in a long period of no HPET
timer ticks.

When this occurs with a CentOS 5.x guest, the guest
may not receive timer interrupts during its narrow
timer check window and panic on boot.

Signed-off-by: Matt Lupfer <mlupfer@ddn.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
2014-03-27 17:48:11 +02:00
Dr. David Alan Gilbert
5c31207941 Detect pthread_setname_np at configure time
Warn if no way of setting thread name is available.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-03-27 17:48:11 +02:00
Peter Maydell
6ff45f01c7 target-arm queue:
* Don't default to integratorcp board if no machine specified
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABCAAGBQJTNDEIAAoJEDwlJe0UNgzeKqwQAISsctPHa4VswH+E/13fw0gE
 QDXBjcAZzkrC4KP+iqm8ZrC3H7sOfqQgCJmrpupaGuOxTzHIbmZMpJFUbOOGf1MJ
 tpAjdIeGmsWkBIl12c+aPHKy+EjwOs0n6A3pJJgFvaUfxR1U9coj/xak39XICErw
 qD+fx1P3nvBm0FZHfybNJHdGWZeHixvODMq/oGhAY7h3T0NODL2r+aOThihkZe2I
 lYB0zPKtyUDN5SEN3by1Ydv+uw0gQbM3HC+nH/ybsNl13ZeN8lSoyQryrYiLRQGY
 CpoxzMGQV9/w3J1KkMrLvoPOoiuoE2/oOrOWgoP+qYa0QKrD6dDy3m7uk1Pgp2g0
 bZWGxj6MKnSaYBgtXA1tp/XijlIBOM0CSa1DaS8voHy74sDrKnzsJF7qun3eVvUu
 ptjbppxrJMrjHJ4/Qldcs+Xjfb+sXDdLt65nTmCEQ/IQpyvo2zVLET10B5g58Pyf
 m8Ob2eGKEDSouw2y5LfKsQtZyN9fRCsC5MN0BJqSjOB2gOzgn5hx2Nv71W8eudaR
 +65ZuF65IaDtMR1rTidzrE0SFZ21uYo/YLB77mOrsiIjL/XzGxvhffugt5Wpeuqq
 lmZ8fBVhBoja2POn8dTALslCxBv8DPI3w5uYtNFriCKJ4bWdeiAg0LM1GvVKuwBW
 oM4WyGLNdyZ7VJdvENmB
 =HPUl
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20140327' into staging

target-arm queue:
 * Don't default to integratorcp board if no machine specified

# gpg: Signature made Thu 27 Mar 2014 14:09:12 GMT using RSA key ID 14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

* remotes/pmaydell/tags/pull-target-arm-20140327:
  vl.c: Improve message when no default machine is found
  hw/arm: Stop specifying integratorcp as the default board

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-27 15:29:33 +00:00