Commit Graph

40407 Commits

Author SHA1 Message Date
Pavel Fedin
e6fbcbc4e5 Introduce gic_class_name() instead of repeating condition
This small inline returns correct GIC class name depending on whether we
use KVM acceleration or not. Avoids duplicating the condition everywhere.

Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 4f26901be9b844b563673ce3ad08eeedbb7a7132.1438758065.git.p.fedin@samsung.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:21 +01:00
Pavel Fedin
7926c210ab hw/arm/gic: Kill code duplication
Extracted duplicated initialization code from SW-emulated and KVM GIC
implementations and put into gic_init_irqs_and_mmio()

Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
Message-id: 8ea5b2781ef39cb5989420987fc73c70e377687d.1438758065.git.p.fedin@samsung.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:21 +01:00
Pavel Fedin
6d6d2abf2c Merge memory_region_init_reservation() into memory_region_init_io()
Just specifying ops = NULL in some cases can be more convenient than having
two functions.

Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 78a379ab1b6b30ab497db7971ad336dad1dbee76.1438758065.git.p.fedin@samsung.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:21 +01:00
Jean-Christophe Dubois
68b85290c7 i.MX: Fix Coding style for GPT emulator
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: cc7d1589e774e87c346b75a6c25e07957f436ced.1437080501.git.jcd@tribudubois.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:21 +01:00
Jean-Christophe Dubois
d647b26dc6 i.MX: Split GPT emulator in a header file and a source file
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: e32fba56b9dae3cc7c83726550514b2d0c890ae0.1437080501.git.jcd@tribudubois.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:20 +01:00
Jean-Christophe Dubois
565328fcc3 i.MX: Fix Coding style for EPIT emulator
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: d8d70683c6a48ac318c1635595619cfb0eb31681.1437080501.git.jcd@tribudubois.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:20 +01:00
Jean-Christophe Dubois
951cd00e92 i.MX: Split EPIT emulator in a header file and a source file
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 948927cab0c85da9a753c5f6d5501323d5604c8e.1437080501.git.jcd@tribudubois.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:20 +01:00
Jean-Christophe Dubois
c14875b2e1 i.MX: Fix Coding style for CCM emulator
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: ff0b6720b1c55204e663f07be47c0203f6871084.1437080501.git.jcd@tribudubois.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:20 +01:00
Jean-Christophe Dubois
282e74c83f i.MX: Split CCM emulator in a header file and a source file
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: b1d6f990229b2608bbaba24f4ff359571c0b07da.1437080501.git.jcd@tribudubois.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:20 +01:00
Jean-Christophe Dubois
dbeedce78e i.MX: Fix Coding style for AVIC emulator.
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: 01e1d9026220992405819f25640ebd5bb843fc93.1437080501.git.jcd@tribudubois.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:20 +01:00
Jean-Christophe Dubois
f250c6a751 i.MX: Split AVIC emulator in a header file and a source file
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 06829257e845d693be05c7d491134313c1615d1a.1437080501.git.jcd@tribudubois.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:19 +01:00
Jean-Christophe Dubois
fa2650a37e i.MX:Fix Coding style for UART emulator.
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: 23ab872b7cd30b1399384fb26a2ebb75e9761d7b.1437080501.git.jcd@tribudubois.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:19 +01:00
Jean-Christophe Dubois
f6c64000f9 i.MX: Move serial initialization to init/realize of DeviceClass.
Move constructor to DeviceClass methods
 * imx_serial_init
 * imx_serial_realize

imx32_serial_properties is renamed to imx_serial_properties.

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: 6854bd75e2b5af312e04e760587e249dbaff807f.1437080501.git.jcd@tribudubois.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:19 +01:00
Jean-Christophe Dubois
cd0bda2087 i.MX: Split UART emulator in a header file and a source file
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: a51ef50fa222a614169056d5389a6d3ed6a63b04.1437080501.git.jcd@tribudubois.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:19 +01:00
Edgar E. Iglesias
a5c6a584a7 hw/arm/virt: Connect the Hypervisor timer
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1436791864-4582-8-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:19 +01:00
Edgar E. Iglesias
0e3e858f6a hw/arm/virt: Replace magic IRQ constants with macros
Replace magic constants with macros from
hw/arm/virt.h and hw/intc/arm_gic_common.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1436791864-4582-7-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:18 +01:00
Edgar E. Iglesias
b0e66d95e4 target-arm: Add the Hypervisor timer
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1436791864-4582-6-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:18 +01:00
Edgar E. Iglesias
0e3eca4c26 target-arm: Pass timeridx as argument to various timer functions
Prepare for adding the Hypervisor timer, no functional change.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1436791864-4582-5-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:18 +01:00
Edgar E. Iglesias
d57b9ee84f target-arm: Rename and move gt_cnt_reset
Rename gt_cnt_reset to gt_timer_reset as the function really
resets the timers and not the counters. Move the registration
from counter regs to timer regs.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1436791864-4582-4-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:18 +01:00
Edgar E. Iglesias
0b6440afb8 target-arm: Add CNTHCTL_EL2
Adds control for trapping selected timer and counter accesses to EL2.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1436791864-4582-3-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:18 +01:00
Edgar E. Iglesias
edac4d8a16 target-arm: Add CNTVOFF_EL2
Adds support for the virtual timer offset controlled by EL2.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1436791864-4582-2-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-13 11:26:17 +01:00
Peter Maydell
ca0e5d8b0d Open 2.5 development tree
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-11 23:15:55 +01:00
Peter Maydell
5c79ae3615 Update version for v2.4.0 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-11 15:30:34 +01:00
Peter Maydell
2d697366a1 Update version for v2.4.0-rc4 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-05 17:02:58 +01:00
Peter Maydell
0175409df4 virtio fix for 2.4
Fixes migration in virtio 1 mode.
 We still have a known bug with memory hotplug, it doesn't
 look like we can fix that in time for 2.4.
 
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJVwiRjAAoJECgfDbjSjVRpps8H/0Qh6JlHLeju9gEgqmreJTuT
 xihAdocwe7tFJkvkn6Lg404DtofIhBhS+hoMtnyXRgtGqrJ/qCk/J5fgTFhxk0Bo
 SUi45eTaR0W/g1L8Fwy4cwh8oc+vaD/Eaa6PXUYLlXdx0m9GkYRN+/QyVhXUJhhG
 90qx59eXfRLI1P0gm1/u+q9aYIwJ3N2dZm4tochVk2FQP9B9ZXKjCC/ux9OTyhmF
 APTrGa519CYheICWEdrimNbLa6+gaMnga+JUaLBypGXB6hE3RbLNzfxMmm2jy4i+
 qR2Nm6gDJ9Dw+OQJ0qw2BDIcQJo7PLrGgDE13IhqXBFliLTjLwxfLaAE9OaAv5s=
 =xygJ
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

virtio fix for 2.4

Fixes migration in virtio 1 mode.
We still have a known bug with memory hotplug, it doesn't
look like we can fix that in time for 2.4.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

# gpg: Signature made Wed 05 Aug 2015 15:57:39 BST using RSA key ID D28D5469
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

* remotes/mst/tags/for_upstream:
  virtio: fix 1.0 virtqueue migration

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-05 16:02:00 +01:00
Sascha Silbe
e94867ed5f block: don't register quorum driver if SHA256 support is unavailable
Commit 488981a4 [block: convert quorum blockdrv to use crypto APIs]
broke qemu-iotest 041 on hosts with GnuTLS < 2.10.0. It converted a
compile-time check to a run-time check at device open time. The result
is that we now advertise a feature (the quorum block driver) that will
never work (on those hosts). There's no way (short of parsing
human-readable error messages) for qemu-iotests or any other API
consumer to recognise that the quorum block driver isn't _actually_
available and shouldn't be used or tested.

Move the run-time check to bdrv_quorum_init() to avoid registering the
quorum block driver if we know it cannot work. This way API consumers
can recognise it's unavailable.

Fixes: 488981a4af
Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-id: 1438699705-21761-1-git-send-email-silbe@linux.vnet.ibm.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-05 15:19:32 +01:00
Jason Wang
74aae7b22b virtio: fix 1.0 virtqueue migration
1.0 does not requires physically-contiguous pages layout for a
virtqueue. So we could not infer avail and used from desc. This means
we need to migrate vring.avail and vring.used when host support virtio
1.0. This fixes malfunction of virtio 1.0 device after migration.

Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-08-05 16:56:34 +03:00
Peter Maydell
2be4f242b5 X86 queue, 2015-08-04
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJVwN8WAAoJECgHk2+YTcWmPi4P/ikCbJimzKm7PXf1nMyhXpq7
 JLJcOxEPMKR+I2tBzPWnO0q5FS2juVjHx1vcFBcfDHcZiHj+poeyFwZWV2bQx56f
 mr9fmD0077lJElPDRDeSjRsjK82EEZLlFGrTDgfH1UImN63/Gqvjq0GMKQSrT4qL
 cJLBYAPYZuWcye8lkU/J4RyUD+pA3BYuFammz5S2kc9UAWMcQ4nzrGnKr2wv3MgY
 VASHZ5/9i+yAg0PvnDCCN0ifMocYzOY5aCdn6P0yX6lHCX4X/q7iLe+OV9nbyzWC
 nfbNglxJycytaD2/uHTi9bhZdE7WK1RXjCSoJWHiQKD0fTJIXYrn+MbOUNK8yOMm
 /Hh+XnOOaPWQG9TeUYu8oOdtJYYae+xlqgqO3y9m/hmBdz3rhlo9mEwbvjn++E8U
 oSHKr4PAOgrZmRYYTUSkOpsPAq7LDBXcDw1Xqvj/WZoSkjOLPDFm8MF2fuozJsd6
 TsJYPoP/u4ey41Xu1td9JspoS+zzzybnfyIwWVFp4c39A4eTmcymLE0Am8nZA+0V
 Fh+eyY9csVAdlach0Yzli7wU36XEFjxVB1rEz/tR+5aszBiOVT+0DBJfrHeoGwYU
 ud4pNkh9OCp/BA8wNN6Im3LqEUOIwSsdMOoMAqAA6QU5RWeMaAXMt0DcQq/MYKoJ
 CoVMsFEg0wXw7EyvLfGu
 =ttw0
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

X86 queue, 2015-08-04

# gpg: Signature made Tue 04 Aug 2015 16:49:42 BST using RSA key ID 984DC5A6
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* remotes/ehabkost/tags/x86-pull-request:
  target-i386: fix IvyBridge xlevel in PC_COMPAT_2_3

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-04 16:51:24 +01:00
Radim Krčmář
27751aabd1 target-i386: fix IvyBridge xlevel in PC_COMPAT_2_3
Previous patch changed xlevel and missed the compatibility code.

Fixes: 3046bb5deb ("target-i386: emulate CPUID level of real hardware")
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2015-08-04 12:49:32 -03:00
Peter Maydell
426d0e7b7e MIPS patches 2015-08-04
Changes:
 * fix semihosting for microMIPS R6
 * fix an abort when booting mips64 kernel with --enable-tcg-debug
 -----BEGIN PGP SIGNATURE-----
 
 iQEcBAABAgAGBQJVwKLBAAoJEFIRjjwLKdprdfEH/RVxNZyYkh7/mO6azHnZRJe3
 6ZyKi77Bw7xhBB6AkQD6/f7xDPPTfS7NZBTq9MftNCPnUvKk0nCJYVZFB3sla2mS
 XxeFdMi4dXBL1Dz8+04ZNsWUfO/SoGgKJUc2sFIn0ssvOS5IuzjjPIYu/+SgcVe7
 lAkIyOCfhWAIw6CQNhPrIGCmpfGklvns17HC9rcCNzgvECo8DTL5415DuC+7nJG9
 yVMo/gxpjgpGrvGW1I07QfPo6H9gcKwIuxNSlsEq/q6Tkh+aqDl22xscPPBZTOF0
 p3xo8cA1dcbZj+sw+DY+2pK3OpFHbM5MdW4W5/S23Un3gpVBLeJDoyLRpxLTdg8=
 =DhD7
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150804' into staging

MIPS patches 2015-08-04

Changes:
* fix semihosting for microMIPS R6
* fix an abort when booting mips64 kernel with --enable-tcg-debug

# gpg: Signature made Tue 04 Aug 2015 12:32:17 BST using RSA key ID 0B29DA6B
# gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

* remotes/lalrae/tags/mips-20150804:
  target-mips: Copy restrictions from ext/ins to dext/dins
  target-mips: fix semihosting for microMIPS R6

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-04 12:57:06 +01:00
Richard Henderson
b7f26e5239 target-mips: Copy restrictions from ext/ins to dext/dins
The checks in dins is required to avoid triggering an assertion
in tcg_gen_deposit_tl.  The check in dext is just for completeness.
Fold the other D cases in via fallthru.

In this case the errant dins appears to be data, not code, as
translation failed to stop after a break insn.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
2015-08-04 11:53:15 +01:00
Leon Alrae
060ebfef1a target-mips: fix semihosting for microMIPS R6
In semihosting mode the SDBBP 1 instructions should trigger UHI syscall,
but in QEMU this does not happen for recently added microMIPS R6.
Consequently bare metal microMIPS R6 programs supporting UHI will not run.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
2015-08-04 11:10:20 +01:00
Peter Maydell
260425ab40 cve-2015-5166
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJVv3pgAAoJEIlPj0hw4a6QGKUP/2za5f0iiPUERQuCW1ollKSe
 p1JdyHAJrzuHYiubHj4Zo878IhYzG2tvG1UNm2reaYV+gDAML/suUwH2Uh4FSRdp
 vjg/qIZJ+UPwVS220En/XRoyXHv6J9AC2oVDhFSUm7QBK6QJ9Pzr0qVLIyNj0UPi
 Ec9V+/pQn+mTveJ/ytu8/YxSmFZP8xyDtJb7jsUpcSQAcGPOLObIYamNdT+0ArVg
 ex+5VoZdOGjVuG18c9IAO6O0Ymy4Ll/MB2pe0KRfbpBMJtO8t7EH1honuQHR1w+z
 g4j34bTiNMT6U48Gh7gUcU8HgJxpLyN6GB63RkspuGyiJar5106n21sC1DtpfeKf
 CC34qb4cw+32GE7QqCAbx4yLD/w+MrtD99FYfpCtcxNGqkgxIaE+hT6/o/Qt+8TS
 8itcTvw1YCk0JSwb4P4nf6jOQtetAl3pMYRPh2TEsmCyuMqxPr6seMIJ3pK+zMd6
 CtT5jvNGSaYNPPonJ+AOlCShuWPPIfjMSOgOiUbrEBLN4A0JmZx5i3bYFgPXK3Ad
 v/Ny83rygmzqmtxKMnzHC0KdBlmmbhmeH7b8Iubfpl0amefqA1DZOEDc8PZJcz+2
 iErFILfJHmQDXhut3+LEUzxOX18GstKoLYdM3kOutae41Rga+cKQSUszkRaRWq5k
 lVT2zlk9TsAu5ccU5Y6l
 =rvso
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/sstabellini/tags/cve-2015-5166-tag' into staging

cve-2015-5166

# gpg: Signature made Mon 03 Aug 2015 15:27:44 BST using RSA key ID 70E1AE90
# gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>"

* remotes/sstabellini/tags/cve-2015-5166-tag:
  Fix release_drive on unplugged devices (pci_piix3_xen_ide_unplug)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-03 18:52:55 +01:00
Peter Maydell
e95edefbd0 xen-migration-2.4
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJVv5RcAAoJEIlPj0hw4a6QNHUP/iQTq0aGox9MzAY4eQ8QvyQe
 Qz+vXRHOZ61+Ipn9Aw7XrKXKfFklX1jrxdl1G87/YDD2/Or6W8wuRWKgoVa8OzJX
 ZTtT0b07+E0E20dBaFT/g/vgsecdciTvEzbBc0Y+wRw4PGFwHMCtmUmzU46+xBDR
 EEBscgP5eUuGad6K72DX6O2xy/qxXhJAc5oa/TBullKlnHXOgjoBtSjJZ6HrO0j/
 zl71zLoU9okFu4p71m9VcD9+6U3rSlhUZ+XMThftik1dYR6uinsQFnzhxVLpEPWW
 +Zvd8hfS6STKfguyWyWv+d4Io0VBBiENgG8jjw4m4HrARuvcEYRtFKis6rg0eqby
 nxOkhAYniosJwNukFuJwLwvvRbqFBr1BZ4Vmk52B1Qfm/rgSIK21JN3eFvRsI/Pn
 W3NgNtlNij3NuKCzLOYyjmK2ayOn3MuKluyz//dAdBXKITeIOsf+WJEGS+u4kmI2
 jVLlgfLa5NDbw81HjushSgz95EKwzqIcKdTwyHGDPhXuLuhf/oGfr89S8n+P/wg/
 DHBBIfou2kkDwqE7kAv3Me/rO+8Y+U8uB10q9mBmvgauUh7FZYZ9s+sTx7vv9dGK
 bcB14sciUcjfiFHV6x7NQuUcBFB3eER1d7E3Bbk3Q6vk4CD2Peahq4F+dKtxu08C
 s5GrknrXi0WomodR85jg
 =khJG
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/sstabellini/tags/xen-migration-2.4-tag' into staging

xen-migration-2.4

# gpg: Signature made Mon 03 Aug 2015 17:18:36 BST using RSA key ID 70E1AE90
# gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>"

* remotes/sstabellini/tags/xen-migration-2.4-tag:
  migration: Fix regression for xenfv and pc,accel=xen machine.
  migration: Fix global state with Xen.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-03 17:33:35 +01:00
Anthony PERARD
8c6dc68f4c migration: Fix regression for xenfv and pc,accel=xen machine.
This fix migration from the same QEMU version and from previous QEMU
version.

>From the global state section, we don't need runstate with Xen. Right now,
the way the Xen toolstack knows when QEMU is ready is when QEMU reach
"running" runstate.

The configuration section and the section footers are not going to be
present in previous version of QEMU with xenfv machine, so we skip them.

The Xen toolstack libxenlight does not specify a particular version of the
'pc' machine, so migration from older version of QEMU used by Xen to newer
one would break due to missing "configuration" section and section footers.

Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2015-08-03 16:13:40 +00:00
Anthony PERARD
c69adea462 migration: Fix global state with Xen.
When doing migration via the QMP command xen_save_devices_state, the
current runstate is not store into the global state section. Also the
current runstate is not the one we want on the receiver side.

During migration, the Xen toolstack paused QEMU before save the devices
state. Also, the toolstack expect QEMU to autostart when the migration is
finished.
So this patch store "running" as it's current runstate.

Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2015-08-03 16:13:23 +00:00
Andreas Färber
f60c87154a configure: Drop vnc-ws feature from help text
Commit 8e9b0d2 (ui: convert VNC websockets to use crypto APIs) dropped
the --enable-vnc-ws option but forgot to update the help text. Fix this.

Cc: Daniel P. Berrange <berrange@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 1437749257-3313-1-git-send-email-afaerber@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-03 15:32:17 +01:00
Stefano Stabellini
6cd387833d Fix release_drive on unplugged devices (pci_piix3_xen_ide_unplug)
pci_piix3_xen_ide_unplug should completely unhook the unplugged
IDEDevice from the corresponding BlockBackend, otherwise the next call
to release_drive will try to detach the drive again.

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2015-08-03 14:27:12 +00:00
Peter Maydell
2a3612ccc1 Pull request
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJVv1m5AAoJEJykq7OBq3PIO+QIAMbPSu/ZqfdANX+H4bgshudw
 9CMYsgEqlmjOSeFP1Pp7lYbuceInsvY4Ks+GtWsPkV/mhEl4+g1h9uWKMSWg0jsU
 14hfi7ibJomFngRPkEhcDemu6JSLAGsqedLPyrFZZyGzVZnY/TmpwG3s9CiSUSU0
 h7knQLxt8QemsPU+rlH6xE/QkSdyWpERsUCTpcKufIGwIZJDeUfW1/9UxDp6M0QK
 LZj+8ZJzF2g/s51xHCTmAyvFZxROceEgUbGyWYNh1Aj55LMT7k+t4TTEYkizqTYj
 n0AUDzV65Pm67OWRf22siqb74BPt72gf/048LmhqE7o4NZvLqJ7Kff6pFDYOF0Q=
 =9hkg
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/stefanha/tags/rtl8139-cplus-tx-input-validation-pull-request' into staging

Pull request

# gpg: Signature made Mon Aug  3 13:08:25 2015 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/rtl8139-cplus-tx-input-validation-pull-request:
  rtl8139: check TCP Data Offset field (CVE-2015-5165)
  rtl8139: skip offload on short TCP header (CVE-2015-5165)
  rtl8139: check IP Total Length field (CVE-2015-5165)
  rtl8139: check IP Header Length field (CVE-2015-5165)
  rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)
  rtl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165)
  rtl8139: avoid nested ifs in IP header parsing (CVE-2015-5165)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-03 13:09:10 +01:00
Stefan Hajnoczi
8357946b15 rtl8139: check TCP Data Offset field (CVE-2015-5165)
The TCP Data Offset field contains the length of the header.  Make sure
it is valid and does not exceed the IP data length.

Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03 13:08:10 +01:00
Stefan Hajnoczi
4240be4563 rtl8139: skip offload on short TCP header (CVE-2015-5165)
TCP Large Segment Offload accesses the TCP header in the packet.  If the
packet is too short we must not attempt to access header fields:

  tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen);
  int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);

Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03 13:08:07 +01:00
Stefan Hajnoczi
c6296ea88d rtl8139: check IP Total Length field (CVE-2015-5165)
The IP Total Length field includes the IP header and data.  Make sure it
is valid and does not exceed the Ethernet payload size.

Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03 13:08:06 +01:00
Stefan Hajnoczi
03247d43c5 rtl8139: check IP Header Length field (CVE-2015-5165)
The IP Header Length field was only checked in the IP checksum case, but
is used in other cases too.

Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03 13:08:03 +01:00
Stefan Hajnoczi
e1c120a9c5 rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)
Transmit offload features access Ethernet and IP headers the packet.  If
the packet is too short we must not attempt to access header fields:

  int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
  ...
  eth_payload_data = saved_buffer + ETH_HLEN;
  ...
  ip = (ip_header*)eth_payload_data;
  if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {

Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03 13:08:00 +01:00
Stefan Hajnoczi
d6812d60e7 rtl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165)
The previous patch stopped using the ip pointer as an indicator that the
IP header is present.  When we reach the if (ip) {...} statement we know
ip is always non-NULL.

Remove the if statement to reduce nesting.

Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03 13:07:54 +01:00
Stefan Hajnoczi
39b8e7dcaf rtl8139: avoid nested ifs in IP header parsing (CVE-2015-5165)
Transmit offload needs to parse packet headers.  If header fields have
unexpected values the offload processing is skipped.

The code currently uses nested ifs because there is relatively little
input validation.  The next patches will add missing input validation
and a goto label is more appropriate to avoid deep if statement nesting.

Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03 13:06:59 +01:00
Peter Maydell
bd80b5963f TCG MIPS and S390 fixes for 2.4.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJVvyHXAAoJELqceAYd3Yyb0ysP+wY3gvuZJ4FRY2zszQ7/0Z08
 I9TIWlE+Ty5KY23BdTqVTIcslbIohN6avYTZXnbVXtHiAlktegAGhc7SsJgzNvoi
 xfntyiQXqtWbR2s/BrNZvBU8Xjirdfz6uJhONBXpYUkDBkHab0ivSDG8D4jr/Kfv
 yDQalmwGqoI8hrodkoIbIwhlX4wT6OIKY80fYzwJcQEgVO9a31MuK9o+twNqMO7P
 D0awzky7xleizfuffEDkoMVLX+3zcb/pVYr4zSJws6yDDcm7fsK8BK66/NvQGEd0
 PAc1a8aVtqQW2jwXZRzXmdlhpu6EGuhxOkvZepD1lSAuXFBTSMHNy9A4gZzrXBJI
 F5f1ZcvHsGovudjvQBxnZOPAWpLFV+wmM8YKOLWmVQoudmwm/q7jMyjRIw6nR/Yf
 oOBWeUgIRZ9wzH+VKj3AjfYeVp6LtNph8hvu4c2/SmlZgYugIKliAwfMVrGmm5Ke
 YgkCqyR8gF5+9WI9hr8vZjUCqnCjRbkTYkNdpLOzgGOEbpVLLVePm2lTrcMMkjXn
 OZYC6mXKRsGYpwwkevoQpBQ0PCMVwFBsdHs4mmgS7SAeEv+KECHw+o8DT76qh/o3
 0eb0DJFv1T7IrR87uo0uTHzj5tjg1Z1Kxyocey0WW46dVDOiFgHAydSo59x2l6nY
 /IQSliSUgF/ULdlG1Lmx
 =3lEa
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/aurel/tags/pull-tcg-mips-s390-20150803' into staging

TCG MIPS and S390 fixes for 2.4.

# gpg: Signature made Mon Aug  3 09:09:59 2015 BST using RSA key ID 1DDD8C9B
# gpg: Good signature from "Aurelien Jarno <aurelien@aurel32.net>"
# gpg:                 aka "Aurelien Jarno <aurelien@jarno.fr>"
# gpg:                 aka "Aurelien Jarno <aurel32@debian.org>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 7746 2642 A9EF 94FD 0F77  196D BA9C 7806 1DDD 8C9B

* remotes/aurel/tags/pull-tcg-mips-s390-20150803:
  tcg/mips: fix add2
  tcg/s390x: Mask TCGMemOp appropriately for indexing
  tcg/mips: Mask TCGMemOp appropriately for indexing
  tcg/mips: fix TLB loading for BE host with 32-bit guests

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-03 11:44:07 +01:00
Peter Maydell
ff90f84e74 -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
 
 iQIcBAABAgAGBQJVu/WGAAoJEH3vgQaq/DkOWCcP/AnTuFcatf30pvHeniLxokLa
 t+6dLGo+KC6qPz4TpYcjQ9sA7pwZhk0/KSUTUnbZGQ8P0+uoxQ66OcL0UGvjZck1
 0da261meUWWyNzVhZK1JHZggfpn/H/EaXBM0OQojnhe0xmtrVR4RJqaqW1ZjNFL/
 jsw4HcA6BENokU8+wwYnX4HodX5ej2mh4GZpaPKh8gk7ryyeB1SermLcL7kvFvyZ
 1DFVPcmsxBXm93gVIaOP0u4lhAWFKzN6/0N2PSxUkdcvtTTbxxx78SOkVP74BICI
 q+IrwGGckfNoF2KIImKK2i09lsBqdW0GSK39RCPt2GBWWuThgJOjITGvGTD5PMz1
 uKBJJ2syO4MlmRhTbwM+slhSPiC5SCi0mWqE0y+RSpbbix12tTZ6FGkVTdgxH4L3
 f55LQz+u7jJiqNlY/K146nfbHbvKOvamupWvG112QabFSXotq0Iy2Q2py2rLJ6Ud
 GbSlAGSQ7KykD3NSu+UHV893lb/dZUb2cozER2qMXvO1md5643hsYvw+t5a6UYCV
 YsOM6nt+C575WUJfz/TNyVpRPgPU7hDYDEUKg7Qjn4MdMv50d+Zc+HG8BfvCXE3D
 UH+4kGDjCc9Ibgk5zmuc60Nka2xFKMq01615S7fVr5jRNgG8z+PcvkGuh+wIXXuJ
 rU5zBlPRozqqwOm256v9
 =76Uv
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

# gpg: Signature made Fri Jul 31 23:24:06 2015 BST using RSA key ID AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
#      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

* remotes/jnsnow/tags/ide-pull-request:
  ahci: fix ICC mask definition
  macio: re-add TRIM support

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-03 10:44:23 +01:00
Aurelien Jarno
c99d69694a tcg/mips: fix add2
The add2 code in the tcg_out_addsub2 function doesn't take into account
the case where rl == al == bl. In that case we can't compute the carry
after the addition. As it corresponds to a multiplication by 2, the
carry bit is the bit 31.

While this is a corner case, this prevents x86-64 guests to boot on a
MIPS host.

Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2015-08-01 09:39:50 +02:00
Aurelien Jarno
3c8691f568 tcg/s390x: Mask TCGMemOp appropriately for indexing
Commit 2b7ec66f fixed TCGMemOp masking following the MO_AMASK addition,
but two cases were forgotten in the TCG S390 backend.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2015-08-01 09:39:37 +02:00