Commit Graph

32374 Commits

Author SHA1 Message Date
Igor Mammedov
482f38b948 acpi: fix incorrect encoding for 0x{F-1}FFFF
Fix typo in build_append_int() which causes integer
truncation when it's in range 0x{F-1}FFFF by packing it
as WordConst instead of required DWordConst.

In partucular this fixes a regression: hotplug in slots 16,17,18 and 19
didn't work, since SSDT had code like this:

                If (And (Arg0, 0x0000))
                {
                    Notify (S80, Arg1)
                }

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
2014-04-14 15:13:27 +03:00
Peter Maydell
590e5dd98f configure: Make stack-protector test check both compile and link
Since we use the -fstack-protector argument at both compile and
link time in the build, we must check that it works with both
a compile and a link:
 * MacOSX only fails in the compile step, not linking
 * some gcc cross environments only fail at the link stage (if they
   require a libssp and it's not present for some reason)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1397232832-32301-1-git-send-email-peter.maydell@linaro.org
Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2014-04-14 12:11:18 +01:00
Dmitry Fleytman
f12d048a52 vmxnet3: validate queues configuration read on migration
CVE-2013-4544

Signed-off-by: Dmitry Fleytman <dmitry@daynix.com>
Reported-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-id: 1396604722-11902-5-git-send-email-dmitry@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14 11:50:56 +01:00
Dmitry Fleytman
3c99afc779 vmxnet3: validate interrupt indices read on migration
CVE-2013-4544

Signed-off-by: Dmitry Fleytman <dmitry@daynix.com>
Reported-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-id: 1396604722-11902-4-git-send-email-dmitry@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14 11:50:49 +01:00
Dmitry Fleytman
9878d173f5 vmxnet3: validate queues configuration coming from guest
CVE-2013-4544

Signed-off-by: Dmitry Fleytman <dmitry@daynix.com>
Reported-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-id: 1396604722-11902-3-git-send-email-dmitry@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14 11:50:22 +01:00
Dmitry Fleytman
8c6c047899 vmxnet3: validate interrupt indices coming from guest
CVE-2013-4544

Signed-off-by: Dmitry Fleytman <dmitry@daynix.com>
Reported-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-id: 1396604722-11902-2-git-send-email-dmitry@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14 11:33:18 +01:00
Cole Robinson
92b3eeadd9 qom: Fix crash with qom-list and link properties
Commit 9561fda8d9 changed the type of
'opaque' for link properties, but missed updating this call site.
Reproducer:

./x86_64-softmmu/qemu-system-x86_64 -qmp unix:./qmp.sock,server &
./scripts/qmp/qmp-shell ./qmp.sock
(QEMU) qom-list path=//machine/i440fx/pci.0/child[2]

Reported-by: Marcin Gibuła <m.gibula@beyond.pl>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
Message-id: 2f8f007ce2152ac3b65f0811199662799c509225.1397155389.git.crobinso@redhat.com
Acked-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-11 17:57:36 +01:00
Michael S. Tsirkin
edc2438512 virtio-net: fix guest-triggerable buffer overrun
When VM guest programs multicast addresses for
a virtio net card, it supplies a 32 bit
entries counter for the number of addresses.
These addresses are read into tail portion of
a fixed macs array which has size MAC_TABLE_ENTRIES,
at offset equal to in_use.

To avoid overflow of this array by guest, qemu attempts
to test the size as follows:
-    if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {

however, as mac_data.entries is uint32_t, this sum
can overflow, e.g. if in_use is 1 and mac_data.entries
is 0xffffffff then in_use + mac_data.entries will be 0.

Qemu will then read guest supplied buffer into this
memory, overflowing buffer on heap.

CVE-2014-0150

Cc: qemu-stable@nongnu.org
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1397218574-25058-1-git-send-email-mst@redhat.com
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-11 16:02:23 +01:00
Peter Maydell
21e2db7260 Block patches for 2.0.0-rc3
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTR+IOAAoJEH8JsnLIjy/WL8UP/ic9ato2QBnk0ojbUQD/fEdN
 LHMvofO7XvY2qOu6vpED25OxgeQcUJ5yrPaVjt0Nno597wHl9WM9Vrfx13Rd14yn
 DqYPptYduwvHlvUiI9tjk3SfQ8M3AbCII6v+wRueEuoJGupcHJ35usjHETGnV15S
 XH3PijFz56qwktbvawDtNDoFfjzG9Mtspwx8pO2ofU39awmC9/MS64DRvHjemV0c
 dszxf37cnWl6hN3gMdBIcNkVbPDxU2sOspG2wLaKVpxSg5nkd9i4ixgEwJNVc9n2
 aIhq7WZfX2hYWsfgUbvTnLTm0powXm9UMqUb6UQrBGdAEbI1Xof/TXPYTSy4BRJ/
 Eb/sBolbNe+7YsMZaPD2zo+ZDly4kH/GwpBwiwPp399Co6TkeqlEBrtBw5ps3zpC
 sZk14bltcVV5DUBZCnSiQuZb8j7RcSyye18gVsKe25RLLqB+iuYRsWCD01XjRPFf
 6TNsyNDlrjg2qyTZwgei+wCoOSik8ooxo9yYZDgicsqpa8/f90zZbeK/M3v7sLZ+
 49ZDwFDOHa6WED3Abt3RppROY1MJzHfSr3qpBjZFaMrocmnlpIG5NTBbK5X71Iw0
 eF8As3IIL+egsl2TZsDTHX30ENny3H6qfaJZ3vno2KNq3ooojvAaxGYqn1j8+HPU
 xomBdrvS4fevFmIfVSYv
 =Cz5J
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block patches for 2.0.0-rc3

# gpg: Signature made Fri 11 Apr 2014 13:37:34 BST using RSA key ID C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

* remotes/kevin/tags/for-upstream:
  block-commit: speed is an optional parameter
  iscsi: Remember to set ret for iscsi_open in error case
  bochs: Fix catalog size check
  bochs: Fix memory leak in bochs_open() error path

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-11 14:07:24 +01:00
Peter Maydell
80fc7b1755 sdl2 relative mouse mode fixes.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTR8W+AAoJEEy22O7T6HE4HIcP/34b4OIyEed1ijyg733YGHDf
 CTWOEX58MSbh0YoWjmU0sVhyTSOmpVznKS0mjxGiH87fksrkEpUkfUdHhhSFY/gJ
 +E6JEKafyWn0PSaAOA9aHB5WCQE1W59crNU2oFdO8CRe276Dody4uMyIEv5xy4PO
 N2qw7NgqyymPEXKi811ew9YO9zSYkfH62sLBmu57sCo9daOx5dExQ4cRMoZhG45v
 +TEWRy+DMQVJOBC4Exuk849Em1F25q95soAFqcWvE+HVeQ/i0twI4+Wyw0396IXb
 heWMfcE00bxrHxfwDTLMELwRN1s9KFko87h6O8ehyJUqW91ecJFHTS65OOFPFAXp
 RjWCdYWveazsfPPQaaTZ6/eh2Nhjh8u2FCXWyhkpl2m4LpT/AOuK2khVA0Bdv9Y2
 hqCqQ65DzCSPWc9tzPqxSKlfDGmq8SCECikHMpk4bhzkIvPQTXP9p8tZubHYlW9Q
 GyU6l3sY8rqYS3SOa9/96FDIxuZF7DWGmt6zEhrD4yDFibNBBoFtj3KtnEdB/ohF
 dQlCNGXXb8r3d6KFwa1uP8dGH73Yhd+npOxZ7xMdvInDdYVB+8WZKQT0rWRne8fR
 5R7VUk/ugKzIiHitKIpe0F2cVDpq71hN3aZBmkV+jN+cShUir1wPjm+DWw0uxMG7
 kpBpjDsVV/ymKOjyH7kz
 =DPcI
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kraxel/tags/pull-sdl-1' into staging

sdl2 relative mouse mode fixes.

# gpg: Signature made Fri 11 Apr 2014 11:36:46 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-sdl-1:
  input: sdl2: Fix relative mode to match SDL1 behavior
  input: sdl2: Fix guest_cursor logic

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-11 13:51:16 +01:00
Max Reitz
5450466394 block-commit: speed is an optional parameter
As speed is an optional parameter for the QMP block-commit command, it
should be set to 0 if not given (as it is undefined if has_speed is
false), that is, the speed should not be limited.

Cc: qemu-stable@nongnu.org
Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-04-11 13:59:49 +02:00
Fam Zheng
cd82b6fb4d iscsi: Remember to set ret for iscsi_open in error case
Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-04-11 13:59:49 +02:00
Kevin Wolf
715c3f60ef bochs: Fix catalog size check
The old check was off by a factor of 512 and didn't consider cases where
we don't get an exact division. This could lead to an out-of-bounds
array access in seek_to_sector().

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2014-04-11 13:59:49 +02:00
Kevin Wolf
28ec11bc88 bochs: Fix memory leak in bochs_open() error path
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2014-04-11 13:59:49 +02:00
Cole Robinson
2d968ffbae input: sdl2: Fix relative mode to match SDL1 behavior
Right now relative mode accelerates too fast, and has the 'invisible wall'
problem. SDL2 added an explicit API to handle this use case, so let's use
it.

Signed-off-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-04-11 12:19:16 +02:00
Cole Robinson
afbc0dd649 input: sdl2: Fix guest_cursor logic
Unbreaks relative mouse mode with sdl2, just like was done with sdl.c
in c3aa84b6.

Signed-off-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-04-11 12:19:16 +02:00
Peter Maydell
f516a5cc05 acpi: DSDT update
Two fixes here:
 - Test fix to avoid warning with make check.
 - Hex file update so people building QEMU
   without installing iasl get exactly the same ACPI
   as with.
 
 Both should help avoid user confusion.
 
 As it's very easy to check that the produced ACPI
 binary didn't change, I think these are very low risk.
 
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJTRsJHAAoJECgfDbjSjVRpt/kIAKHgP38TOkPLCNtC2puhXcJR
 tN6AzKYh5eZ4v+PK6mZfsryicoHMnKo9yzukCPkjDbZfiv0Iho6aJC/WmKR81whd
 yr06VDxxEhPUMsCRZpC3970rCTM/9iUnTk2KJOgv+P63/vxIiuRzLT3VyHnIuWou
 bkzJ459mQ33O3ZzkASKQfHD1agHN1z3SaPQRDuQRtx43FZYxc7ojRs52bl0oqc7m
 oTmoM1LISVmVsdh6uN7A5sRjpvjTb/cZTT2G4qHnxETNooRGaHNh/HWj9iqQOKiA
 xBoJJL7ePGbH3FmPGUE1tiUgx8Qu9Lr/qePfMcibzumbf8h8pG3Bqt0NDIBh/xY=
 =TQ9N
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

acpi: DSDT update

Two fixes here:
- Test fix to avoid warning with make check.
- Hex file update so people building QEMU
  without installing iasl get exactly the same ACPI
  as with.

Both should help avoid user confusion.

As it's very easy to check that the produced ACPI
binary didn't change, I think these are very low risk.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

# gpg: Signature made Thu 10 Apr 2014 17:09:43 BST using RSA key ID D28D5469
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

* remotes/mst/tags/for_upstream:
  acpi: update generated hex files
  tests/acpi: update expected DSDT files

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-10 23:07:56 +01:00
Peter Maydell
0a9077ea14 configure: use do_cc when checking for -fstack-protector support
MacOSX clang silently swallows unrecognized -f options when doing a link
with '-framework' also on the command line, so to detect support for
the various -fstack-protector options we must do a plain .c to .o compile,
not a complete compile-and-link.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1397041487-28477-1-git-send-email-peter.maydell@linaro.org
2014-04-10 22:17:47 +01:00
Michael S. Tsirkin
775478418a acpi: update generated hex files
commit f2ccc311df
    dsdt: tweak ACPI ID for hotplug resource device
changes the DSDT, update hex files to match

Otherwise the fix is only effective if QEMU is built
with iasl.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-04-10 19:03:18 +03:00
Michael S. Tsirkin
50329d3418 tests/acpi: update expected DSDT files
commit f2ccc311df
    dsdt: tweak ACPI ID for hotplug resource device
changes the DSDT, update test expected files to match

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reported-by: Igor Mammedov <imammedo@redhat.com>
2014-04-09 17:52:08 +03:00
Peter Maydell
efcc87d9ae Update version for v2.0.0-rc2 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-08 18:52:06 +01:00
Peter Maydell
7dc176bce4 hw/pci-host/prep: Don't reverse IO accesses on bigendian hosts
The raven_io_read() and raven_io_write() functions pass and
return values in little-endian format (since the IO op struct
is marked DEVICE_LITTLE_ENDIAN); however they were storing the
values in the buffer to pass to address_space_read/write()
in host-endian order, which meant that on big-endian hosts
the values were inadvertently reversed. Use the *_le_p()
accessors instead so that we are consistent regardless of
host endianness.

Strictly speaking the byte order of the buffer for
address_space_rw() is target byte order (which for PPC
will be BE) but it doesn't actually matter as long as we
are consistent about the marking on the IO op struct and
which stl_*_p().

This bug was probably introduced due to confusion caused by
the two different versions of ldl_p() and friends:
 bswap.h defines versions meaning "host endianness access"
 cpu-all.h defines versions meaning "target endianness access"
As a target-independent source file prep.c gets the bswap.h
versions; the very similar looking code in ioport.c is
compiled per-target and gets the cpu-all.h versions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1396972271-22660-1-git-send-email-peter.maydell@linaro.org
Reviewed-by: Richard Henderson <rth@twiddle.net>
2014-04-08 18:37:45 +01:00
Peter Maydell
9bc1a1d817 acpi bug fix
Here is a single last minute fix for 2.0
 
 This changes the HID of the container used to claim
 resources for CPU hotplug.
 As a result, windows XP SP3 no longer brings up
 an annoying "found new hardware" wizard on boot.
 
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJTQ+pCAAoJECgfDbjSjVRpEM0H/24/MYnycc4XLJnhaByc9Tlp
 ftcshToM34f+RxXm/hMLq/at/7Bu1S/rDXJEfm8WZ6Fm6Lr1DA9xQPuhIfEj3xqF
 aVz98GQhT6cAN2PzlkAhdR4vpb3qTLIS1rSeS92z0bRgsZyLW4kO1aGEpxr4/vYu
 VoSVl11ShdHQZodm0ukXLgAlgQPNMpwY1sIa/rYNzL+tnjN9UqqwazmL9t2SkZJc
 OlwuLfV5KA1RfVHeZNYCJWExPAmBGbPBt4Pw04f0D0hhkLem9Oiv1bQnbsiLO7jq
 RscOW4GjA5CZEHeuTZSdmHBTMjejMsrLWvmoxjzzut8l33aXHEKJtwBpN+JihGs=
 =Zm7h
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

acpi bug fix

Here is a single last minute fix for 2.0

This changes the HID of the container used to claim
resources for CPU hotplug.
As a result, windows XP SP3 no longer brings up
an annoying "found new hardware" wizard on boot.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

# gpg: Signature made Tue 08 Apr 2014 13:23:30 BST using RSA key ID D28D5469
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

* remotes/mst/tags/for_upstream:
  dsdt: tweak ACPI ID for hotplug resource device

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-08 13:59:28 +01:00
Michael S. Tsirkin
f2ccc311df dsdt: tweak ACPI ID for hotplug resource device
ACPI0004 seems too new:
Windows XP complains about an unrecognized device.
This is a regression since 1.7.
Use PNP0A06 instead - Generic Container Device.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-By: Igor Mammedov <imammedo@redhat.com>
2014-04-08 15:22:59 +03:00
Peter Maydell
093de72b9c gtk: Implement grab-on-click behavior in relative mode
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTQ+R5AAoJEEy22O7T6HE42wEP/R8bnGPEOphI7LykjFbK9aSo
 x4RKcYoaOe3r5TjlVmBG8xYnWL+7fCHc70WGQvtkWy7Ytqru6SUMR5siKJuZ2DMS
 wRwQFir6n8L8Oaaa+MVbueld8Q6zsWQCS1XND7aHUn/IA+vrGPzseyLFjcd04CVI
 Q0/7jMcPR9dEfA/T2ZsjXPsHU4b1/sPqHFO/nB34mzNXsFHSoDLhk4/AeQTifOE9
 zZ/TFUajd5YjG1TadrYBXpyahNbjSUFBz+BM2Fas4GXhHNoAe1fY9vo0LIQmp+/a
 nVLl0t+EkpV7gvOmmBb+8nL9UQ8KfCO9mQDm3xEvBaVjfWldauXOB6SE1RJz3hBt
 YT7ZCZcjQ8vxpbp+3275wqD+weyzLluG3jijE8Vy0q9oGPgOBFo6u5iDzmcTDFyi
 ULI1X24KtH1oliPuP3sINsTz1jgtD1ZNZgzeqZvxWPjG6DGjQAVX5smUXENLqpKz
 kJ6tBryGjrm2cShtxOaRJn4AcfNbLw7Rd7ETdcfhXwFMLdi2ov+McpdsrDz3ES12
 tew3U0M0vooGOMI9KHEAznPA7D1je2GaxI7D1UWg5AjVBqdUl8Lv9zqGzU5xxT6E
 uxSnIfGWGgJw68kOQpc1BioKO2CtZHGF2n2sIjsHoWsjkx7gg/LtcuKxeCsZ1WoA
 CkmbK40wfOInRzBk5Cri
 =xK+3
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-5' into staging

gtk: Implement grab-on-click behavior in relative mode

# gpg: Signature made Tue 08 Apr 2014 12:58:49 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-gtk-5:
  gtk: Implement grab-on-click behavior in relative mode

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-08 13:05:25 +01:00
Takashi Iwai
800b0e814b gtk: Implement grab-on-click behavior in relative mode
This patch changes the behavior in the relative mode to be compatible
with other UIs, namely, grabbing the input at the first left click.
It improves the usability a lot; otherwise you have to press ctl-alt-G
or select from menu at each time you want to move the pointer.  Also,
the input grab is cleared when the current mode is switched to the
absolute mode.

The automatic reset of the implicit grabbing is needed since the
switching to the absolute mode happens always after the click even on
Gtk.  That is, we cannot check whether the absolute mode is already
available at the first click time even though it should have been
switched in X11 input driver side.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-04-08 13:57:34 +02:00
Peter Maydell
9a4fb6aa19 Patch queue for ppc - 2014-04-08
This is the final queue for 2.0! It fixes a lot of bugs people have
 seen during testing:
 
   - Fix e500 SMP
   - Fix book3s_64 DEC
   - Fix VSX (new feature in 2.0) for LE hosts
   - Fix PR KVM on top of pHyp (SLOF update)
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.19 (GNU/Linux)
 
 iQIcBAABAgAGBQJTQ8BCAAoJECszeR4D/txgX98QAI9ccJung8AY7KT5X6gaKZqH
 rC2bBuB6Cg/Lkm8sUIEhsYJKpT4F2LTwQvWpi/L9JbXR2L39o5Gt9LD3a00VG4gC
 eKIm9utZN7GJw61w6GzGIEjQX3eQh0GJUqP+U3KEh8Vzdl+Vr3sEpeuVQzwucO1Z
 dYPKXK9ZVXLcTgCDbCO/D6R4129mnbZvyTiJIJLPewVXcBB0fKWHdu5x+VexaVXz
 tuwa1UfMVqUBFcBxDvqRmvTCLwCwa0Gn2kVSl0sNb/cw/MRatb0uomJCr6OQCgXX
 Fu6pEur+Tvsq/8twuqnTz/7Hs+EruYr6+4kB63ZZwRabJ1UmRmGUrIh+BvMJvgii
 lGLV4F4VCqxakDLuFqvS98Ww+HhgBUqjnRPkKP+Epyg6JFV4yh+CWXIWY0ck27E9
 aVSgeEgmNISIQs5vJ7JTNcGmF8KXvHc74HCtNQyenC89EoVaGHxI/ssJIk3u4dVA
 TxYgb7tttG+qXAEeaxXziwptd5Tb4mWxx1j6Pz/Es9kqURWCnIBAfuoihDXIsKwc
 +D6pv1GQ5vkTIyLbWjZ7LSkFNfJBFQzzbxXVBxzK1gOoklQBjJXNOylcuyOYLUD2
 HjDDkVdolRv6xMWYQltUc2UlMos5rGC3rNvtJ4K9CeoIo7hZiSRnM9gnbIf/TwBo
 55n53ZvZhIksFQXArmfH
 =U2m0
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging

Patch queue for ppc - 2014-04-08

This is the final queue for 2.0! It fixes a lot of bugs people have
seen during testing:

  - Fix e500 SMP
  - Fix book3s_64 DEC
  - Fix VSX (new feature in 2.0) for LE hosts
  - Fix PR KVM on top of pHyp (SLOF update)

# gpg: Signature made Tue 08 Apr 2014 10:24:18 BST using RSA key ID 03FEDC60
# gpg: Can't check signature: public key not found

* remotes/agraf/tags/signed-ppc-for-upstream:
  PPC: Add l1 cache sizes for 970 and above systems
  ppce500_spin: Initialize struct properly
  PPC: Only enter MSR_POW when no interrupts pending
  PPC: Clean up DECR implementation
  target-ppc: Correct VSX Integer to FP Conversion
  target-ppc: Correct VSX FP to Integer Conversion
  target-ppc: Correct VSX FP to FP Conversions
  target-ppc: Correct VSX Scalar Compares
  target-ppc: Correct Simple VSR LE Host Inversions
  target-ppc: Correct LE Host Inversion of Lower VSRs
  target-ppc: Define Endian-Correct Accessors for VSR Field Access
  target-ppc: Bug: VSX Convert to Integer Should Truncate
  softfloat: Introduce float32_to_uint64_round_to_zero
  pseries: Update SLOF firmware image to qemu-slof-20140404
  PPC: E500: Set PIR default reset value rather than SPR value

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-08 10:58:31 +01:00
Peter Maydell
e792933ce1 Merge remote-tracking branch 'remotes/mdroth/qga-pull-2014-4-7' into staging
* remotes/mdroth/qga-pull-2014-4-7:
  vss-win32: Fix build with mingw64-headers-3.1.0
  Makefile: add qga-vss-dll-obj-y to nested variables

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-08 10:41:30 +01:00
Alexander Graf
06f6e12491 PPC: Add l1 cache sizes for 970 and above systems
Book3s_64 guests expect the L1 cache size in device tree, so let's give
them proper values for all CPU types we support.

This fixes a "not compliant" warning with sles11 guests on -M pseries for me.

Signed-off-by: Alexander Graf <agraf@suse.de>
2014-04-08 11:20:06 +02:00
Alexander Graf
6a2b3d89fa ppce500_spin: Initialize struct properly
The spinning struct is in guest endianness, so we need to initialize
its variables in guest endianness too.

This fixes booting e500 guests with SMP on x86 for me.

Signed-off-by: Alexander Graf <agraf@suse.de>
2014-04-08 11:20:05 +02:00
Alexander Graf
05edc26c61 PPC: Only enter MSR_POW when no interrupts pending
We were entering the power saving state even when interrupts (like an
external interrupt or a decrementer interrupt) were still in flight.

In case we find a pending interrupt, don't enter power saving state.

Signed-off-by: Alexander Graf <agraf@suse.de>
Reviewed-by: Tom Musta <tmusta@gmail.com>
2014-04-08 11:20:05 +02:00
Alexander Graf
e81a982aa5 PPC: Clean up DECR implementation
There are 3 different variants of the decrementor for BookE and BookS.

The BookE variant sets TSR[DIS] to 1 when the DEC value becomes 1 or 0. TSR[DIS]
is then the indicator whether the decrementor interrupt line is asserted or not.

The old BookS variant treats DEC as an edge interrupt that gets triggered when
the DEC value's top bit turns 1 from 0.

The new BookS variant maintains the assertion bit inside DEC itself. Whenever
the DEC value becomes negative (top bit set) the DEC interrupt line is asserted.

So far we implemented mostly the old BookS variant. Let's do them all properly.

This fixes booting pseries ppc64 guest images in TCG mode for me.

Signed-off-by: Alexander Graf <agraf@suse.de>
2014-04-08 11:20:04 +02:00
Tom Musta
6cd7db3d92 target-ppc: Correct VSX Integer to FP Conversion
This patch corrects the VSX integer to floating point conversion instructions
by using the endian correct accessors.  The auxiliary "j" index used by the
existing macros is now obsolete and is removed.  The JOFFSET preprocessor
macro is also obsolete and removed.

Signed-off-by: Tom Musta <tommusta@gmail.com>
Tested-by: Tom Musta <tommusta@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-04-08 11:20:04 +02:00
Tom Musta
d1dec5ef55 target-ppc: Correct VSX FP to Integer Conversion
This patch corrects the VSX floating point to integer conversion
instructions by using the endian correct accessors.  The auxiliary
"j" index used by the existing macros is now obsolete and is removed.

Signed-off-by: Tom Musta <tommusta@gmail.com>
Tested-by: Tom Musta <tommusta@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-04-08 11:20:03 +02:00
Tom Musta
6bbad7a91e target-ppc: Correct VSX FP to FP Conversions
This change corrects the VSX double precision to single precision and
single precision to double precisions conversion routines.  The endian
correct accessors are now used.  The auxiliary "j" index is no longer
necessary and is eliminated.

Signed-off-by: Tom Musta <tommusta@gmail.com>
Tested-by: Tom Musta <tommusta@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-04-08 11:20:03 +02:00
Tom Musta
50fc89e7b1 target-ppc: Correct VSX Scalar Compares
This change fixes the VSX scalar compare instructions.  The existing usage of "x.f64[0]"
is changed to "x.VsrD(0)".

Signed-off-by: Tom Musta <tommusta@gmail.com>
Tested-by: Tom Musta <tommusta@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-04-08 11:20:03 +02:00
Tom Musta
bcb7652e8d target-ppc: Correct Simple VSR LE Host Inversions
A common pattern in the VSX helper code macros is the use of "x.fld[i]" where
"x" is a VSR and "fld" is an argument to a macro ("f64" or "f32" is passed).
This is not always correct on LE hosts.

This change addresses all instances of this pattern to be "x.fld" where "fld" is:

  - "VsrD(0)" for scalar instructions accessing 64-bit numbers
  - "VsrD(i)" for vector instructions accessing 64-bit numbers
  - "VsrW(i)" for vector instructions accessing 32-bit numbers

Note that there are no instances of this pattern where a scalar instruction
accesses a 32-bit number.

Note also that it would be correct to use "VsrD(i)" for scalar instructions since
the loop index is only ever "0".  I have choosen to use "VsrD(0)" instead ... it
seems a little clearer.

Signed-off-by: Tom Musta <tommusta@gmail.com>
Tested-by: Tom Musta <tommusta@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-04-08 11:20:02 +02:00
Tom Musta
d359db00e6 target-ppc: Correct LE Host Inversion of Lower VSRs
This change properly orders the doublewords of the VSRs 0-31.  Because these
registers are constructed from separate doublewords, they must be inverted
on Little Endian hosts.  The inversion is performed both when the VSR is read
and when it is written.

Signed-off-by: Tom Musta <tommusta@gmail.com>
Tested-by: Tom Musta <tommusta@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-04-08 11:20:02 +02:00
Tom Musta
80189035de target-ppc: Define Endian-Correct Accessors for VSR Field Access
This change defines accessors for VSR doubleword and word fields that
are correct from a host Endian perspective.  This allows code to
use the Power ISA indexing numbers in code.

For example, the xscvdpsxws instruction has a target VSR that looks
like this:

  0           32       64                    127
  +-----------+--------+-----------+-----------+
  | undefined | SW     | undefined | undefined |
  +-----------+--------+-----------+-----------+

VSX helper code will use VsrW(1) to access this field.

Signed-off-by: Tom Musta <tommusta@gmail.com>
Tested-by: Tom Musta <tommusta@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-04-08 11:20:01 +02:00
Tom Musta
0453099b7d target-ppc: Bug: VSX Convert to Integer Should Truncate
The various VSX Convert to Integer instructions should truncate the
floating point number to an integer value, which is equivalent to
a round-to-zero rounding mode.  The existing VSX floating point to
integer conversion helpers are erroneously using the rounding mode set
int the PowerPC Floating Point Status and Control Register (FPSCR).
This change corrects this defect by using the appropriate
float*_to_*_round_to_zero() routines fro the softfloat library.

Signed-off-by: Tom Musta <tommusta@gmail.com>
Tested-by: Tom Musta <tommusta@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-04-08 11:20:01 +02:00
Tom Musta
a13d448968 softfloat: Introduce float32_to_uint64_round_to_zero
This change adds the float32_to_uint64_round_to_zero function to the softfloat
library.  This function fills out the complement of float32 to INT round-to-zero
conversion rountines, where INT is {int32_t, uint32_t, int64_t, uint64_t}.

This contribution can be licensed under either the softfloat-2a or -2b
license.

Signed-off-by: Tom Musta <tommusta@gmail.com>
Tested-by: Tom Musta <tommusta@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-04-08 11:20:00 +02:00
Alexey Kardashevskiy
3636226ae4 pseries: Update SLOF firmware image to qemu-slof-20140404
The change log is:
  > Isolate sc 1 detection logic
  > build: auto-detect ppc64 architecture
  > cas: increase hcall buffer size to accomodate 256 cpus
  > usb: change device tree naming
  > usb-core: adjust port numbers in set_address
  > virtio-scsi: correct srplun comment
  > Fix kernel loading
  > Workaround to make grub2 assign server ip from dhcp ack packet only
  > ELF: Enter LE binary in LE mode
  > ELF loading should fail for virt != phys

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-04-08 11:20:00 +02:00
Alexander Graf
6a450df9b8 PPC: E500: Set PIR default reset value rather than SPR value
We now reset SPRs to their reset values on CPU reset. So if we want
to have an SPR persistently changed, we need to change its default
reset value rather than the value itself manually.

Do this for SPR_BOOKE_PIR, fixing e500v2 SMP boot.

Reported-by: Frederic Konrad <fred.konrad@greensocs.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
Tested-by: KONRAD Frederic <fred.konrad@greensocs.com>
2014-04-08 11:19:59 +02:00
Tomoki Sekiyama
9854202b57 vss-win32: Fix build with mingw64-headers-3.1.0
In mingw64-headers-3.1.0, definition of _com_issue_error() is added, which
conflicts with definition in install.cpp. This adds version checking for
mingw headers to disable the definition when the headers>=3.1 is used.

Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-04-07 14:39:19 -05:00
Tomoki Sekiyama
577a67234d Makefile: add qga-vss-dll-obj-y to nested variables
The build rule for qga/vss-win32/qga-vss.dll is broken by commit
ba1183da9a, because it misses
qga-vss-dll-obj-y in the list of nested variables.
This fixes build of qga-vss.dll by adding qga-vss-dll-obj-y to the list.

Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-04-07 14:39:19 -05:00
Peter Maydell
55519a4b24 QOM/QTest infrastructure fixes
* Relicensing of FWPathProvider interface
 * Clean up all targets' qtests
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTQtitAAoJEPou0S0+fgE/YgAP/iQSMEu+Y/fIhtBOgIjuP/Qr
 6NxNkiwIhT8T2eZmFBQ3qsuo3IrBFOmD2kXuQcywAhtvlfjcb36OF11dwPYRt/vy
 dqJge7s9CighNI34YHLpNbnu4XfqrwiMw8qwIEziNQ5GeBhM8azFwamcOAoiV3uw
 KzyclrJOj8Mvmx2Zd7nMhY8KLbEaZUsqm5ycFaPOhTTtSw4tHLsBRblwz5cBZUe7
 YaM3Da0j6qn0pYai98oG4b0TzMgn4ZH0PH0Rv9QyG66TH65PbwLNbrbHOb1ZQx40
 Eemirlm7um4rPFFayW/WKl/iyGHjKgyflm/2LvuV6pUCny+vU/qOp5eKLzuLqp7w
 S5OhLWxlwPXjFwTJUmG0+QYWlWbZJuh6S4/0K7+6vIHDuJtoIrpMkEqlc+KW3825
 vBNpBtybwOK+mDezzXIylF+sEYV37tWH3+3tagG/CEaFFj150xxyDQRpFhiurIpX
 JsqOKciWK4xW60y2lhQ4s5i4t3POsE+OChuzasqZm3vExNNee1QNLcWdFUOlJiqd
 pD8YBd6FoJhLewZMOo/0hiPa39o7NAVllDS2HloUVIy86LmBePgaTt5Eqn2dD03L
 so4rAkW+kMRqO8MwIE+pQeKLl1Iab0/UojcPI4EQr9cbJkNNaVVcmWpKjVO2CbI7
 FM7PqgvCf8+F1iwmDZMU
 =1t/E
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-2.0' into staging

QOM/QTest infrastructure fixes

* Relicensing of FWPathProvider interface
* Clean up all targets' qtests

# gpg: Signature made Mon 07 Apr 2014 17:56:13 BST using RSA key ID 3E7E013F
# gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
# gpg:                 aka "Andreas Färber <afaerber@suse.com>"

* remotes/afaerber/tags/qom-devices-for-2.0:
  tests: Update check-clean rule
  fw-path-provider: Change GPL version to 2+

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-07 17:57:23 +01:00
Andreas Färber
f85e3457ce tests: Update check-clean rule
Only i386, x86_64, sparc and sparc64 qtests were cleaned up.
Make this more generic to not miss any newly tested targets.

Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-04-07 18:33:22 +02:00
Michael Tokarev
9c269f6d7b Makefile: remove bashism
When installing modules (when --enable-modules is specified for
./configure), Makefile uses the following construct to replace all
slashes with dashes in module name:

 ${s//\//-}

This is a bash-specific substitution mechanism.  POSIX does not
have it, and some operating systems (for example Debian) does not
implement this construct in default shell (for example dash).

Use more traditional way to perform the substitution: use `tr' tool.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-id: 1396707946-21351-1-git-send-email-mjt@msgid.tls.msk.ru
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-07 15:19:16 +01:00
Don Slutz
dffacd4654 char/serial: Fix emptyness handling
The commit 88c1ee73d3
char/serial: Fix emptyness check

Still causes extra NULL byte(s) to be sent.

So if the fifo is empty, do not send an extra NULL byte.

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Don Slutz <dslutz@verizon.com>
Message-id: 1395160174-16006-1-git-send-email-dslutz@verizon.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-07 14:51:32 +01:00
Alexey Kardashevskiy
20c50a955f fw-path-provider: Change GPL version to 2+
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-04-07 15:36:07 +02:00