qemu.git
2 years agoVersion 1.0.1 stable-1.0 v1.0.1
Justin M. Forbes [Thu, 2 Feb 2012 22:44:08 +0000]
Version 1.0.1

Signed-off-by: Justin M. Forbes <jforbes@redhat.com>

2 years agoMerge branch 's390-1.0' of git://repo.or.cz/qemu/agraf
Justin M. Forbes [Wed, 1 Feb 2012 17:25:23 +0000]
Merge branch 's390-1.0' of git://repo.or.cz/qemu/agraf

2 years agoMerge branch 'ppc-1.0' of git://repo.or.cz/qemu/agraf
Justin M. Forbes [Wed, 1 Feb 2012 17:24:47 +0000]
Merge branch 'ppc-1.0' of git://repo.or.cz/qemu/agraf

2 years agoe1000: bounds packet size against buffer size
Anthony Liguori [Mon, 23 Jan 2012 13:30:43 +0000]
e1000: bounds packet size against buffer size

Otherwise we can write beyond the buffer and corrupt memory.  This is tracked
as CVE-2012-0029.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agos390: fix cpu hotplug / cpu activity on interrupts
Christian Borntraeger [Sun, 20 Nov 2011 23:12:03 +0000]
s390: fix cpu hotplug / cpu activity on interrupts

The add_del/running_cpu code and env->halted are tracking stopped cpus.
Sleeping cpus (idle and enabled for interrupts) are waiting inside the
kernel.
No interrupt besides the restart can move a cpu from stopped to
operational. This is already handled over there. So lets just remove
the bogus wakup from the common interrupt delivery, otherwise any
interrupt will wake up a cpu, even if this cpu is stopped (Thus leading
to strange hangs on sigp restart)

This fixes
echo 0 > /sys/devices/system/cpu/cpu0/online
echo 1 > /sys/devices/system/cpu/cpu0/online
in the guest

Signed-off-by: Christian Borntraeger<borntraeger@de.ibm.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
(cherry picked from commit 93116ac0cf9734e7b28886aedf03848b37d6785e)

2 years agos390x: add TR function for EXECUTE
Alexander Graf [Fri, 18 Nov 2011 15:45:54 +0000]
s390x: add TR function for EXECUTE

Newer gcc versions (or glibc?) also generate code that tries to EXECUTE
the TR opcode. Implement it so that we don't break valid guests.

Reported-by: Andreas Faerber <afaerber@suse.de>
Signed-off-by: Alexander Graf <agraf@suse.de>

2 years agopseries: Don't try to munmap() a malloc()ed TCE table
David Gibson [Wed, 11 Jan 2012 19:46:27 +0000]
pseries: Don't try to munmap() a malloc()ed TCE table

For the pseries machine, TCE (IOMMU) tables can either be directly
malloc()ed in qemu or, when running on a KVM which supports it, mmap()ed
from a KVM ioctl.  The latter option is used when available, because it
allows the (frequent bottlenext) H_PUT_TCE hypercall to be KVM accelerated.
However, even when KVM is persent, TCE acceleration is not always possible.
Only KVM HV supports this ioctl(), not KVM PR, or the kernel could run out
of contiguous memory to allocate the new table.  In this case we need to
fall back on the malloc()ed table.

When a device is removed, and we need to remove the TCE table, we need to
either munmap() or free() the table as appropriate for how it was
allocated.  The code is supposed to do that, but we buggily fail to
initialize the tcet->fd variable in the malloc() case, which is used as a
flag to determine which is the right choice.

This patch fixes the bug, and cleans up error messages relating to this
path while we're at it.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>

2 years agopseries: Populate "/chosen/linux,stdout-path" in the FDT
David Gibson [Tue, 13 Dec 2011 04:24:34 +0000]
pseries: Populate "/chosen/linux,stdout-path" in the FDT

There is a device tree property "/chosen/linux,stdout-path" which indicates
which device should be used as stdout - ie. "the console".

Currently we don't specify anything, which means both firmware and Linux
choose something arbitrarily. Use the routine we added in the last patch
to pick a default vty and specify it as stdout.

Currently SLOF doesn't use the property, but we are hoping to update it
to do so.

Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
(cherry picked from commit 68f3a94c64bbaaf8c7f2daa70de1b5d87a432f86)

2 years agopseries: Add a routine to find a stable "default" vty and use it
David Gibson [Mon, 12 Dec 2011 18:24:33 +0000]
pseries: Add a routine to find a stable "default" vty and use it

In vty_lookup() we have a special case for supporting early debug in
the kernel. This accepts reg == 0 as a special case to mean "any vty".

We implement this by searching the vtys on the bus and returning the
first we find. This means that the vty we chose depends on the order
the vtys are specified on the QEMU command line - because that determines
the order of the vtys on the bus.

We'd rather the command line order was irrelevant, so instead return
the vty with the lowest reg value. This is still a guess as to what the
user really means, but it is at least stable WRT command line ordering.

Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>

[agraf] fix braces
(cherry picked from commit 98331f8ad6a3e2cfbb402d72e6be47eac7706251)

2 years agopseries: Emit device tree nodes in reg order
David Gibson [Mon, 12 Dec 2011 18:24:32 +0000]
pseries: Emit device tree nodes in reg order

Although in theory the device tree has no inherent ordering, in practice
the order of nodes in the device tree does effect the order that devices
are detected by software.

Currently the ordering is determined by the order the devices appear on
the QEMU command line. Although that does give the user control over the
ordering, it is fragile, especially when the user does not generate the
command line manually - eg. when using libvirt etc.

So order the device tree based on the reg value, ie. the address of on
the VIO bus of the devices. This gives us a sane and stable ordering.

Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>

[agraf] add braces
(cherry picked from commit 05c194384f836240ea4c2da5fa3be43a54bff021)

2 years agokvm-ppc: halt secondary cpus when guest reset
Liu Yu-B13201 [Mon, 28 Nov 2011 20:41:18 +0000]
kvm-ppc: halt secondary cpus when guest reset

When guest reset, we need to halt secondary cpus until guest kick them.
This already works for tcg. The patch add the support for kvm.

Signed-off-by: Liu Yu <yu.liu@freescale.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
[agraf: remove in-kernel irqchip code]
(cherry picked from commit 157feeadbaec09fe4dca539a24f6f6d327d6eeb6)

2 years agopseries: Fix array overrun bug in PCI code
David Gibson [Mon, 28 Nov 2011 20:21:39 +0000]
pseries: Fix array overrun bug in PCI code

spapr_populate_pci_devices() containd a loop with PCI_NUM_REGIONS (7)
iterations.  However this overruns the 'bars' global array, which only has
6 elements. In fact we only want to run this loop for things listed in the
bars array, so this patch corrects the loop bounds to reflect that.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
(cherry picked from commit 135712de61dfa22368e98914d65b8b0860ec8505)

2 years agoconsole: Fix segfault on screendump without VGA adapter
Alexander Graf [Fri, 18 Nov 2011 15:41:59 +0000]
console: Fix segfault on screendump without VGA adapter

When trying to create a screen dump without having any VGA adapter
inside the guest, QEMU segfaults.

This is because it's trying to switch back to the "previous" screen
it was on before dumping the VGA screen. Unfortunately, in my case
there simply is no previous screen so it accesses a NULL pointer.

Fix it by checking if previous_active_console is actually available.

This is 1.0 material.

Signed-off-by: Alexander Graf <agraf@suse.de>

2 years agoMerge branch 'master' of ssh://git.qemu.org/pub/git/qemu-stable-1.0
Justin M. Forbes [Tue, 10 Jan 2012 20:41:17 +0000]
Merge branch 'master' of ssh://git.qemu.org/pub/git/qemu-stable-1.0

2 years agorbd: always set out parameter in qemu_rbd_snap_list
Josh Durgin [Wed, 7 Dec 2011 01:05:10 +0000]
rbd: always set out parameter in qemu_rbd_snap_list

The caller expects psn_tab to be NULL when there are no snapshots or
an error occurs. This results in calling g_free on an invalid address.

Reported-by: Oliver Francke <Oliver@filoo.de>
Signed-off-by: Josh Durgin <josh.durgin@dreamhost.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2 years agoDocumentation: Add qemu-img -t parameter in man page
Kevin Wolf [Wed, 7 Dec 2011 12:57:13 +0000]
Documentation: Add qemu-img -t parameter in man page

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>

2 years agoqemu-img rebase: Fix for undersized backing files
Kevin Wolf [Wed, 7 Dec 2011 11:42:10 +0000]
qemu-img rebase: Fix for undersized backing files

Backing files may be smaller than the corresponding COW file. When
reading directly from the backing file, qemu-img rebase must consider
this and assume zero sectors after the end of backing files.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>

2 years agocoroutine: switch per-thread free pool to a global pool
Avi Kivity [Mon, 5 Dec 2011 17:20:12 +0000]
coroutine: switch per-thread free pool to a global pool

ucontext-based coroutines use a free pool to reduce allocations and
deallocations of coroutine objects.  The pool is per-thread, presumably
to improve locality.  However, as coroutines are usually allocated in
a vcpu thread and freed in the I/O thread, the pool accounting gets
screwed up and we end allocating and freeing a coroutine for every I/O
request.  This is expensive since large objects are allocated via the
kernel, and are not cached by the C runtime.

Fix by switching to a global pool.  This is safe since we're protected
by the global mutex.

Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2 years agoqiov: prevent double free or use-after-free
Paolo Bonzini [Fri, 25 Nov 2011 11:06:22 +0000]
qiov: prevent double free or use-after-free

qemu_iovec_destroy does not clear the QEMUIOVector fully, and the data
could thus be used after free or freed again.  While I do not know any
example in the tree, I observed this using virtio-scsi (and SCSI
scatter/gather) when canceling DMA requests.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2 years agoPPC: Fix linker scripts on ppc hosts
Alexander Graf [Mon, 12 Dec 2011 21:36:01 +0000]
PPC: Fix linker scripts on ppc hosts

When compiling qemu statically with multilib on PPC, we hit the
same issue that commit 845f2c2812d9ed24b36c02a3d06ee83aeafe8b49
is fixing. Do the same here.

Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit 665a04ae1cbfa8004a38cf0fe99ba799c978a1fe)

2 years agotarget-sh4: ignore ocbp and ocbwb instructions
Aurelien Jarno [Sat, 7 Jan 2012 14:20:12 +0000]
target-sh4: ignore ocbp and ocbwb instructions

ocbp and ocbwb controls the writeback of a cache line to memory. They
are supposed to do nothing in case of a cache miss. Given QEMU only
partially emulate caches, it is safe to ignore these instructions.

This fixes a kernel oops when trying to access an rtl8139 NIC with
recent versions.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit 0cdb95549fedc73e13c147ab9dcabcc303426a07)

2 years agousb-ohci: td.cbp incorrectly updated near page end
Andriy Gapon [Thu, 22 Dec 2011 09:34:30 +0000]
usb-ohci: td.cbp incorrectly updated near page end

The current code that updates the cbp value after a transfer looks like this:
td.cbp += ret;
if ((td.cbp & 0xfff) + ret > 0xfff) {
<handle page overflow>
because the 'ret' value is effectively added twice the check may fire too early
when the overflow hasn't happened yet.

Below is one of the possible changes that correct the behavior:

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

2 years agousb-host: properly release port on unplug & exit
Gerd Hoffmann [Thu, 5 Jan 2012 14:49:18 +0000]
usb-host: properly release port on unplug & exit

Factor out port release into a separate function.  Call release function
in exit notifier too.  Add explicit call the USBDEVFS_RELEASE_PORT
ioctl, just closing the hub file handle seems not to be enougth.  Make
sure we release the port before resetting the device, otherwise host
drivers will not re-attach.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

2 years agousb-storage: cancel I/O on reset
Gerd Hoffmann [Wed, 4 Jan 2012 17:13:54 +0000]
usb-storage: cancel I/O on reset

When resetting the usb-storage device we'll have to carefully cancel
and clear any requests which might be in flight, otherwise we'll confuse
the state machine.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

2 years agoFix parse of usb device description with multiple configurations
Cao,Bing Bu [Tue, 13 Dec 2011 01:22:20 +0000]
Fix parse of usb device description with multiple configurations

Changed From V1:
Use DPRINTF instead of fprintf,because it is not an error.

When testing ipod on QEMU by He Jie Xu<xuhj@linux.vnet.ibm.com>,qemu made a assertion.
We found that the ipod with 2 configurations,and the usb-linux did not parse the descriptor correctly.
The descr_len returned is the total length of the all configurations,not one configuration.
The older version will through the other configurations instead of skip,continue parsing the descriptor of interfaces/endpoints in other configurations,then went wrong.

This patch will put the configuration descriptor parse in loop outside and dispel the other configurations not requested.

Signed-off-by: Cao,Bing Bu <mars@linux.vnet.ibm.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

2 years agopc: fix event_idx compatibility for virtio devices
Anthony Liguori [Sun, 18 Dec 2011 19:07:03 +0000]
pc: fix event_idx compatibility for virtio devices

event_idx was introduced in 0.15 and must be disabled for all virtio-pci devices
(including virtio-balloon-pci).

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agopc: add pc-0.15
Anthony Liguori [Sun, 18 Dec 2011 18:59:12 +0000]
pc: add pc-0.15

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agocris: Handle conditional stores on CRISv10
Stefan Sandstrom [Mon, 12 Dec 2011 10:38:31 +0000]
cris: Handle conditional stores on CRISv10

Signed-off-by: Stefan Sandstrom <Stefan.Sandstrom@axis.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>

2 years agoconfigure: Enable build by default PIE / read-only relocation sections on OpenBSD...
Brad [Tue, 29 Nov 2011 00:53:49 +0000]
configure: Enable build by default PIE / read-only relocation sections on OpenBSD amd64/i386.

Enable build by default PIE / read-only relocation sections for the QEMU
binaries on OpenBSD amd64/i386.

Signed-off-by: Brad Smith <brad@comstyle.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

2 years agotarget-i386: fix cmpxchg instruction emulation
Andreas Gustafsson [Sun, 11 Dec 2011 20:46:32 +0000]
target-i386: fix cmpxchg instruction emulation

When the i386 cmpxchg instruction is executed with a memory operand
and the comparison result is "unequal", do the memory write before
changing the accumulator instead of the other way around, because
otherwise the new accumulator value will incorrectly be used in the
comparison when the instruction is restarted after a page fault.

This bug was originally reported on 2010-04-25 as
https://bugs.launchpad.net/qemu/+bug/569760

Signed-off-by: Andreas Gustafsson <gson@gson.org>

2 years agohw/9pfs: Use the correct signed type for different variables
Aneesh Kumar K.V [Wed, 21 Dec 2011 07:07:23 +0000]
hw/9pfs: Use the correct signed type for different variables

Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

2 years agohw/9pfs: replace iovec manipulation with QEMUIOVector
Stefan Hajnoczi [Wed, 21 Dec 2011 07:07:22 +0000]
hw/9pfs: replace iovec manipulation with QEMUIOVector

The v9fs_read() and v9fs_write() functions rely on iovec[] manipulation
code should be replaced with QEMUIOVector to avoid duplicating code.
In the future it may be possible to make the code even more concise by
using QEMUIOVector consistently across virtio and 9pfs.

The "v" format specifier for pdu_marshal() and pdu_unmarshal() is
dropped since it does not actually pack/unpack anything.  The specifier
was also not implemented to update the offset variable and could only be
used at the end of a format string, another sign that this shouldn't
really be a format specifier.  Instead, see the new
v9fs_init_qiov_from_pdu() function.

This change avoids a possible iovec[] buffer overflow when indirect
vrings are used since the number of vectors is now limited by the
underlying VirtQueueElement and cannot be out-of-bounds.

Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

2 years agohw/9pfs: Use the correct file descriptor in Fsdriver Callback
Aneesh Kumar K.V [Sun, 4 Dec 2011 17:05:28 +0000]
hw/9pfs: Use the correct file descriptor in Fsdriver Callback

Fsdriver callback that operate on file descriptor need to
differentiate between directory fd and file fd.

Based on the original patch from Sassan Panahinejad <sassan@sassan.me.uk>

Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

2 years agohw/9pfs: Add qdev.reset callback for virtio-9p-pci device
Aneesh Kumar K.V [Sun, 4 Dec 2011 17:05:28 +0000]
hw/9pfs: Add qdev.reset callback for virtio-9p-pci device

Add the device reset callback

Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

2 years agohw/9pfs: Reset server state during TVERSION
Deepak C Shetty [Sun, 4 Dec 2011 17:05:28 +0000]
hw/9pfs: Reset server state during TVERSION

As per the 9p rfc, during TVERSION its necessary to clean all the active
fids, so that we start the session from a clean state. Its also needed in
scenarios where the guest is booting off 9p, and boot fails, and client
restarts, without any knowledge of the past, it will issue a TVERSION again
so this ensures that we always start from a clean state.

Signed-off-by: Deepak C Shetty <deepakcs@linux.vnet.ibm.com>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

2 years agohw/9pfs: use migration blockers to prevent live migration when virtfs export path...
Aneesh Kumar K.V [Sun, 4 Dec 2011 17:05:28 +0000]
hw/9pfs: use migration blockers to prevent live migration when virtfs export path is mounted

Now when you try to migrate with VirtFS export path mounted, you get a proper QMP error:

(qemu) migrate tcp:localhost:4444
Migration is disabled when VirtFS export path '/tmp/' is mounted in the guest using mount_tag 'v_tmp'
(qemu)

Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

2 years agohw/9pfs: Improve portability to older systems
Aneesh Kumar K.V [Sun, 4 Dec 2011 17:05:27 +0000]
hw/9pfs: Improve portability to older systems

handle fs driver require a set of newly added syscalls. Don't
Compile handle FS driver if those syscalls are not available.
Instead of adding #ifdef for all those syscalls we check for
open by handle syscall. If that is available then rest of the
syscalls used by the driver should be available.

Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

2 years agoexec.c: Fix subpage memory access to RAM MemoryRegion
Andreas Färber [Wed, 30 Nov 2011 15:26:21 +0000]
exec.c: Fix subpage memory access to RAM MemoryRegion

Commit 95c318f5e1f88d7e5bcc6deac17330fd4806a2d3 (Fix segfault in mmio
subpage handling code.) prevented a segfault by making all subpage
registrations over an existing memory page perform an unassigned access.
Symptoms were writes not taking effect and reads returning zero.

Very small page sizes are not currently supported either,
so subpage memory areas cannot fully be avoided.

Therefore change the previous fix to use a new IO_MEM_SUBPAGE_RAM
instead of IO_MEM_UNASSIGNED. Suggested by Avi.

Reviewed-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
Cc: Avi Kivity <avi@redhat.com>
Cc: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agomalta: Fix regression (i8259 interrupts did not work)
Stefan Weil [Tue, 29 Nov 2011 05:34:48 +0000]
malta: Fix regression (i8259 interrupts did not work)

Commit 5632ae46d5bda798e971dae48ebb318ac2c3686a passes the address
of i8259 to qemu_irq_proxy. i8259 is an auto variable with undefined
value outside of mips_malta_init.

This made the interrupt proxy unusable: either QEMU crashes, or
the interrupt handler was not called.

Ethernet for example no longer worked with MIPS Malta.

v2:
While v1 used a static variable for i8259, this patch introduces
a qdev for the malta machine. i8259 is now part of the device status.
This is a minimal qdev implementation to keep the patch small.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit e9b40fd34ceb23461083d505a444a389c094455b)

2 years agoUpdate version for 1.0 release v1.0
Anthony Liguori [Thu, 1 Dec 2011 20:04:21 +0000]
Update version for 1.0 release

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agoMakefile: use full path for qapi-generated directory
Michael Roth [Tue, 29 Nov 2011 22:47:49 +0000]
Makefile: use full path for qapi-generated directory

Generally $(BUILD_DIR) == $(CURDIR), but that isn't necessarilly the
case, so use $(BUILD_DIR)/qapi-generated for generated files to
avoid potentionally sticking generating files in odd places outside
the build's include paths.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agoqapi: fix guardname generation
Michael Roth [Tue, 29 Nov 2011 22:47:48 +0000]
qapi: fix guardname generation

Fix a bug in handling dotted paths, and exclude directory prefixes
from generated guardnames to avoid odd/pseudo-random guardnames in
generated headers.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agoUpdate version for 1.0-rc4 v1.0-rc4
Anthony Liguori [Mon, 28 Nov 2011 17:37:57 +0000]
Update version for 1.0-rc4

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agoccid: Fix buffer overrun in handling of VSC_ATR message
Markus Armbruster [Mon, 28 Nov 2011 19:27:37 +0000]
ccid: Fix buffer overrun in handling of VSC_ATR message

ATR size exceeding the limit is diagnosed, but then we merrily use it
anyway, overrunning card->atr[].

The message is read from a character device.  Obvious security
implications unless the other end of the character device is trusted.

Spotted by Coverity.  CVE-2011-4111.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agoRevert "fix out of tree build"
Anthony Liguori [Mon, 28 Nov 2011 18:45:28 +0000]
Revert "fix out of tree build"

This reverts commit be85c90b74f56dca51782fa3080fcdf88593e045.

This patch is incorrect and breaks the build with a freshly cloned git tree.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agoconfigure: avoid screening of --{en, dis}able-usb-redir options
Max Filippov [Thu, 24 Nov 2011 12:11:31 +0000]
configure: avoid screening of --{en, dis}able-usb-redir options

--*dir) option pattern precede --{en,dis}able-usb-redir) patterns in the
option analysis switch, making the latter options have no effect.

There were some --*dir that are supported by Autoconf and not by QEMU configure.
The aim was to let QEMU packagers use the rpm (or similar) macro that overrides
directories for their distribution.

Replace --*dir with exact option names.

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agocutils: Make strtosz & friends leave follow set to callers
Markus Armbruster [Tue, 22 Nov 2011 08:46:06 +0000]
cutils: Make strtosz & friends leave follow set to callers

strtosz() & friends require the size to be at the end of the string,
or be followed by whitespace or ','.  I find this surprising, because
the name suggests it works like strtol().

The check simplifies callers that accept exactly that follow set
slightly.  No such callers exist.

The check is redundant for callers that accept a smaller follow set,
and thus need to check themselves anyway.  Right now, this is the case
for all but one caller.  All of them neglected to check, or checked
incorrectly, but the previous few commits fixed them up.

Finally, the check is problematic for callers that accept a larger
follow set.  This is the case in monitor_parse_command().
Fortunately, the problems there are relatively harmless.

monitor_parse_command() uses strtosz() for argument type 'o'.  When
the last argument is of type 'o', a trailing ',' is diagnosed
differently than other trailing junk:

    (qemu) migrate_set_speed 1x
    invalid size
    (qemu) migrate_set_speed 1,
    migrate_set_speed: extraneous characters at the end of line

A related inconsistency exists with non-last arguments.  No such
command exists, but let's use memsave to explore the inconsistency.

The monitor permits, but does not require whitespace between
arguments.  For instance, "memsave (1-1)1024foo" is parsed as command
memsave with three arguments 0, 1024 and "foo".  Yes, this is daft,
but at least it's consistently daft.

If I change memsave's second argument from 'i' to 'o', then "memsave
(1-1)1foo" is rejected, because the size is followed by an 'f'.  But
"memsave (1-1)1," is still accepted, and duly saves to file ",".

We don't have any users of strtosz that profit from the check.  In the
users we have, it appears to encourage sloppy error checking, or gets
in the way.  Drop the bothersome check.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agoqemu-img: Tighten parsing of size arguments
Markus Armbruster [Tue, 22 Nov 2011 08:46:05 +0000]
qemu-img: Tighten parsing of size arguments

strtosz_suffix() fails unless the size is followed by 0, whitespace or
','.  Useless here, because we need to fail for any junk following the
size, even if it starts with whitespace or ','.  Check manually.
Things like "qemu-img create xxx 1024," and "qemu-img convert -S '1024
junk'" are now caught.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agox86/cpuid: Tighten parsing of tsc_freq=FREQ
Markus Armbruster [Tue, 22 Nov 2011 08:46:04 +0000]
x86/cpuid: Tighten parsing of tsc_freq=FREQ

cpu_x86_find_by_name() uses strtosz_suffix_unit(), but screws up the
error checking.  It detects some failures, but not all.  Undetected
failures result in a zero tsc_khz value (error value -1 divided by
1000), which means "no tsc_freq set".

To reproduce, try "-cpu qemu64,tsc_freq=9999999T".
strtosz_suffix_unit() fails, because the value overflows int64_t,

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agovl: Tighten parsing of -m argument
Markus Armbruster [Tue, 22 Nov 2011 08:46:03 +0000]
vl: Tighten parsing of -m argument

strtosz_suffix() fails unless the size is followed by 0, whitespace or
','.  Useless here, because we need to fail for any junk following the
size, even if it starts with whitespace or ','.  Check manually.
Things like "-m 1024," are now caught.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agovl: Tighten parsing of -numa's parameter mem
Markus Armbruster [Tue, 22 Nov 2011 08:46:02 +0000]
vl: Tighten parsing of -numa's parameter mem

strtosz_suffix() fails unless the size is followed by 0, whitespace or
','.  Useless here, because we need to fail for any junk following the
size, even if it starts with whitespace or ','.  Check manually.

Things like

    -smp 4 -numa "node,mem=1024,cpus=0-1" -numa "node,mem=1024 cpus=2-3"

are now caught.  Before, the second -numa's argument was silently
interpreted as just "node,mem=1024".

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agocutils: Drop broken support for zero strtosz default_suffix
Markus Armbruster [Tue, 22 Nov 2011 08:46:01 +0000]
cutils: Drop broken support for zero strtosz default_suffix

Commit 9f9b17a4's strtosz() defaults a missing suffix to 'M', except
it rejects fractions then (switch case 0).

When commit d8427002 introduced strtosz_suffix(), that changed:
fractions are no longer rejected, because we go to switch case 'M' on
missing suffix now.  Not mentioned in commit message, probably
unintentional.  Not worth changing back now.

Because case 0 is still around, you can get the old behavior by
passing a zero default_suffix to strtosz_suffix() or
strtosz_suffix_unit().  Undocumented and not used.  Drop.

Commit d8427002 also neglected to update the function comment.  Fix it
up.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agoconfigure: tighten pie toolchain support test for tls variables
Avi Kivity [Wed, 23 Nov 2011 09:24:25 +0000]
configure: tighten pie toolchain support test for tls variables

Some toolchains don't support pie properly when tls variables are
in use.  Disallow pie when such toolchains are detected.

Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agousb-redir: Don't try to write to the chardev after a close event
Hans de Goede [Sat, 19 Nov 2011 09:22:47 +0000]
usb-redir: Don't try to write to the chardev after a close event

Since we handle close async in a bh, do_write and thus write can get
called after receiving a close event. This patch adds a check to
the usb-redir write callback to not call qemu_chr_fe_write on a closed
backend.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agousb-redir: Device disconnect + re-connect robustness fixes
Hans de Goede [Sat, 19 Nov 2011 09:22:46 +0000]
usb-redir: Device disconnect + re-connect robustness fixes

These fixes mainly target the other side sending some (error status)
packets after a disconnect packet. In some cases these would get queued
up and then reported to the controller when a new device gets connected.

* Fully reset device state on disconnect
* Don't allow a connect message when already connected
* Ignore iso and interrupt status messages when disconnected

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agousb-redir: Call qemu_chr_fe_open/close
Hans de Goede [Sat, 19 Nov 2011 09:22:45 +0000]
usb-redir: Call qemu_chr_fe_open/close

To let the chardev now we're ready start receiving data. This is necessary
with the spicevmc chardev to get it registered with the spice-server.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agospice-qemu-char: Generate chardev open/close events
Hans de Goede [Sat, 19 Nov 2011 09:22:44 +0000]
spice-qemu-char: Generate chardev open/close events

Define a state callback and make that generate chardev open/close events when
called by the spice-server.

Notes:

1) For all but the newest spice-server versions (which have a fix for this)
the code ignores these events for a spicevmc with a subtype of vdagent, this
subtype specific knowledge is undesirable, but unavoidable for now, see:
http://lists.freedesktop.org/archives/spice-devel/2011-July/004837.html

2) This code deliberately sends the events immediately rather then from a
bh. This is done this way because:
a) There is no need to do it from a bh; and
b) Doing it from a bh actually causes issues because the spice-server may send
data immediately after the open and when the open runs from a bh, then
qemu_chr_be_can_write will return 0 for the first write which the spice-server
does not expect, when this happens the spice-server will never retry the write
causing communication to stall.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agoqemu-char: rename qemu_chr_event to qemu_chr_be_event and make it public
Hans de Goede [Sat, 19 Nov 2011 09:22:43 +0000]
qemu-char: rename qemu_chr_event to qemu_chr_be_event and make it public

Rename qemu_chr_event to qemu_chr_be_event, since it is only to be
called by backends and make it public so that it can be used by chardev
code which lives outside of qemu-char.c

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years ago9pfs: improve portability to older systems
Aneesh Kumar K.V [Wed, 23 Nov 2011 06:16:27 +0000]
9pfs: improve portability to older systems

I guess we can also make sure we don't  call local_ioc_getversion at
all.

Reported-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agotci: Make flush_icache_range() inline
Stefan Weil [Thu, 24 Nov 2011 22:16:10 +0000]
tci: Make flush_icache_range() inline

This is standard for other tcg targets and improves tci, too.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agoeepro100: Fix alignment requirement for statistical counters
Stefan Weil [Wed, 23 Nov 2011 21:20:30 +0000]
eepro100: Fix alignment requirement for statistical counters

According to Intel's Open Source Software Developer Manual,
the dump counters address must be Dword aligned.

The new code enforces this alignment, so s->statsaddr may now
be used with stw_le_pci_dma() and stl_le_pci_dma().

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agovirtio: add and use virtio_set_features
Paolo Bonzini [Thu, 24 Nov 2011 12:28:52 +0000]
virtio: add and use virtio_set_features

vdev->guest_features is not masking features that are not supported by
the guest.  Fix this by introducing a common wrapper to be used by all
virtio bus implementations.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years ago9pfs: improve portability to older systems
Paolo Bonzini [Mon, 21 Nov 2011 08:29:11 +0000]
9pfs: improve portability to older systems

Small requirements on "new" features have percolated to virtio-9p-local.c.
In particular, the utimensat wrapper actually only supports dirfd = AT_FDCWD
and flags = AT_SYMLINK_NOFOLLOW in the fallback code.  Remove the arguments
so that virtio-9p-local.c will not use AT_* constants.

At the same time, fail local_ioc_getversion if the ioctl is not supported
by the host.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agoMerge remote-tracking branch 'kwolf/block-stable' into staging
Anthony Liguori [Mon, 28 Nov 2011 17:15:10 +0000]
Merge remote-tracking branch 'kwolf/block-stable' into staging

2 years agoMerge remote-tracking branch 'kraxel/usb.32' into staging
Anthony Liguori [Mon, 28 Nov 2011 17:12:39 +0000]
Merge remote-tracking branch 'kraxel/usb.32' into staging

2 years agoMerge remote-tracking branch 'stefanha/trivial-patches' into staging
Anthony Liguori [Mon, 28 Nov 2011 17:11:09 +0000]
Merge remote-tracking branch 'stefanha/trivial-patches' into staging

2 years agoRevert "i386: derive '-cpu host' from KVM_GET_SUPPORTED_CPUID"
Anthony Liguori [Sun, 27 Nov 2011 17:13:01 +0000]
Revert "i386: derive '-cpu host' from KVM_GET_SUPPORTED_CPUID"

This reverts commit 66e3dd9282141b5ae75637c9676002cf3ceeb988.

From Avi,

 "Anthony, I think we should revert that commit and refactor cpuid for
  1.1.  The logic is spread over too many places which makes it hard to
  reason about."

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agotci: Add entry to MAINTAINERS
Stefan Weil [Thu, 24 Nov 2011 22:20:43 +0000]
tci: Add entry to MAINTAINERS

This should have be part of my TCI patch series.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

2 years agoMAINTAINERS: add checkpatch
Blue Swirl [Sat, 26 Nov 2011 09:51:23 +0000]
MAINTAINERS: add checkpatch

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

2 years agocheckpatch.pl: fix CAST detection
Florian Mickler [Fri, 25 Nov 2011 09:24:16 +0000]
checkpatch.pl: fix CAST detection

We should only claim that something is a cast if we did not encouter a
token before, that did set av_pending.

This fixes the operator * in the line below to be detected as binary (vs
unary).

kmalloc(sizeof(struct alphatrack_ocmd) * true_size, GFP_KERNEL);

Reported-by: Peter Chubb <nicta.com.au>
Signed-off-by: Florian Mickler <florian@mickler.org>
(cherry-picked from Linux kernel commit c023e4734c3e8801e0ecb5e81b831d42a374d861)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

2 years agotarget-xtensa: fix MMUv3 initialization
Max Filippov [Tue, 22 Nov 2011 07:59:16 +0000]
target-xtensa: fix MMUv3 initialization

- ITLB/DTLB ways 5 and 6 have 4 and 8 entries respectively;
- ITLB/DTLB way 6 attr field is set to 3 on reset.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

2 years agousb-host: add usb_host_do_reset function.
Gerd Hoffmann [Wed, 16 Nov 2011 11:37:17 +0000]
usb-host: add usb_host_do_reset function.

Add a special function to reset the host usb device.  It tracks the time
needed by the USBDEVFS_RESET ioctl and prints a warning in case it needs
too long.  Usually it should be finished in 200 - 300 miliseconds.
Warning threshold is one second.

Intention is to help troubleshooting by indicating that the usb device
stopped responding even to a reset request and is possibly broken.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

2 years agovpc: Add missing error handling in alloc_block
Kevin Wolf [Wed, 23 Nov 2011 10:38:01 +0000]
vpc: Add missing error handling in alloc_block

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>

2 years agovdi: Fix memory leak
Kevin Wolf [Tue, 22 Nov 2011 15:57:34 +0000]
vdi: Fix memory leak

The block map is allocated in vdi_open, but was never freed.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2 years agovvfat: Add migration blocker
Kevin Wolf [Tue, 22 Nov 2011 15:52:13 +0000]
vvfat: Add migration blocker

vvfat caches more or less everything when in writable mode. For migration
to work, it would have to be invalidated. Block migration for now when
in writable mode (default is readonly).

Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2 years agovpc: Add migration blocker
Kevin Wolf [Tue, 22 Nov 2011 15:51:12 +0000]
vpc: Add migration blocker

vpc caches the BAT. For migration to work, it would have to be
invalidated. Block migration for now.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2 years agovmdk: Add migration blocker
Kevin Wolf [Tue, 22 Nov 2011 15:50:27 +0000]
vmdk: Add migration blocker

VMDK caches L2 tables. For migration to work, they would have to be
invalidated. Block migration for now.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2 years agovdi: Add migration blocker
Kevin Wolf [Tue, 22 Nov 2011 15:46:26 +0000]
vdi: Add migration blocker

vdi caches the block map. For migration to work, it would have to be
invalidated. Block migration for now.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2 years agoqcow: Add migration blocker
Kevin Wolf [Tue, 22 Nov 2011 15:44:45 +0000]
qcow: Add migration blocker

qcow caches L2 tables. For migration to work, they would have to be
invalidated. Block migration for now.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2 years agousb-ehci: add register names
Gerd Hoffmann [Fri, 18 Nov 2011 09:49:25 +0000]
usb-ehci: add register names

The mmio register name list only had the names for four port status
registers.  We emulate a EHCI adapter with six ports though, the last
two ones are listed as "unknown" in traces.  Fix it.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

2 years agousb-ehci: codestyle fixups
Gerd Hoffmann [Fri, 18 Nov 2011 09:48:47 +0000]
usb-ehci: codestyle fixups

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

2 years agousb-hub: implement reset
Gerd Hoffmann [Wed, 23 Nov 2011 12:31:08 +0000]
usb-hub: implement reset

based on a patch from hkran@linux.vnet.ibm.com

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

2 years agofix out of tree build
Stefano Stabellini [Tue, 22 Nov 2011 17:27:15 +0000]
fix out of tree build

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>

2 years agortl8139: Fix invalid IO access alignment
Julian Pidancet [Wed, 23 Nov 2011 01:03:15 +0000]
rtl8139: Fix invalid IO access alignment

This patch makes iPXE work with the rtl8139 emulation. The rtl8139
driver in iPXE issues a 16bit access on the ChipCmd register
(offset 0x37) to check the status of the rx buffer. The offset of the
ioport access was getting fixed up to 0x36 in qemu, causing the value
read in iPXE to be invalid.

This fixes an issue with iPXE reporting timeouts during TFTP transfers.

Reposting this here because it is trivial enough and the original post
on qemu-devel didn't attract much attention.

Also, the inw() which was causing the issue has been replaced with an
inb() in upstream iPXE:
https://git.ipxe.org/ipxe.git/commit/91dd64ad25baa27954a7518e73df4fca8a2d0c93

Signed-off-by: Julian Pidancet <julian.pidancet@gmail.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>

2 years agousb-hub: wakeup on detach too.
Gerd Hoffmann [Tue, 22 Nov 2011 12:20:14 +0000]
usb-hub: wakeup on detach too.

When detaching devices from the usb hub we must wakeup too,
otherwise the host misses the detach event.

Commit 4a33a9ea06f6fbb08d8311a7cfed72975344f9ab does the
same for device attach.

Found by hkran@linux.vnet.ibm.com

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

2 years agousb: fix usb_qdev_init error handling.
Gerd Hoffmann [Tue, 22 Nov 2011 11:48:14 +0000]
usb: fix usb_qdev_init error handling.

qdev doesn't call the ->exit callback on ->init failures, so we have to
take care ourself that we cleanup property on errors.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

2 years agousb: make usb_create_simple catch and pass up errors.
Gerd Hoffmann [Tue, 22 Nov 2011 11:39:58 +0000]
usb: make usb_create_simple catch and pass up errors.

Use qdev_init() instead of qdev_init_nofail(), usb device initialization
can fail, most common case being port and device speed mismatch.  Handle
failures correctly and pass up NULL pointers then.

Also fixup usb_create_simple() callers (only one was buggy) to properly
check for NULL pointers before referncing the usb_create_simple() return
value.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

2 years agoslirp: Clean up net_slirp_hostfwd_remove()'s use of get_str_sep()
Markus Armbruster [Wed, 16 Nov 2011 14:45:59 +0000]
slirp: Clean up net_slirp_hostfwd_remove()'s use of get_str_sep()

get_str_sep() can fail, but net_slirp_hostfwd_remove() doesn't check.
Works, because it initializes buf[] to "", which get_str_sep() doesn't
touch when it fails.  Coverity doesn't like it, and neither do I.

Change it to work exactly like slirp_hostfwd().

Acked-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>

2 years agosheepdog: Avoid deadlock in error path
Dong Xu Wang [Tue, 22 Nov 2011 02:56:58 +0000]
sheepdog: Avoid deadlock in error path

s->lock should be unlocked before leaving add_aio_request.

Signed-off-by: Dong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2 years agoscsi-generic: add as boot device
Paolo Bonzini [Fri, 18 Nov 2011 15:32:02 +0000]
scsi-generic: add as boot device

There is no reason why a scsi-generic device cannot boot if it has
the right type, and indeed it provides already a bootindex property.
So register those devices too.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2 years agoscsi: fix fw path
Paolo Bonzini [Fri, 18 Nov 2011 16:03:45 +0000]
scsi: fix fw path

The pre-1.0 firmware path for SCSI devices already included the LUN
using the suffix argument to add_boot_device_path.  Avoid that it is
included twice, and convert the colons to commas for consistency with
other kinds of devices

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2 years agousb-msd: do not register twice in the boot order
Paolo Bonzini [Fri, 18 Nov 2011 15:32:00 +0000]
usb-msd: do not register twice in the boot order

USB mass storage devices are registered twice in the boot order.
To avoid having to keep the two paths in sync, pass the bootindex
property down to the scsi-disk device and let it register itself.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2 years agovirtio-blk: fix cross-endian config space
Paolo Bonzini [Fri, 18 Nov 2011 15:31:59 +0000]
virtio-blk: fix cross-endian config space

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

2 years agoUpdate version for 1.0-rc3 release v1.0-rc3
Anthony Liguori [Mon, 21 Nov 2011 20:59:11 +0000]
Update version for 1.0-rc3 release

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agoconfigure: check for EFD_NONBLOCK | EFD_CLOEXEC flags
Max Filippov [Mon, 21 Nov 2011 00:54:58 +0000]
configure: check for EFD_NONBLOCK | EFD_CLOEXEC flags

Add check for the EFD_NONBLOCK and EFD_CLOEXEC flags to the
CONFIG_EVENTFD test.
This fixes the following build failure on Fedora 9:

CC event_notifier.o
    event_notifier.c: In function `event_notifier_init':
    event_notifier.c:21: error: `EFD_NONBLOCK' undeclared (first use in this function)
    event_notifier.c:21: error: (Each undeclared identifier is reported only once
    event_notifier.c:21: error: for each function it appears in.)
    event_notifier.c:21: error: `EFD_CLOEXEC' undeclared (first use in this function)
    make: *** [event_notifier.o] Error 1

Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agoconfigure: build position independent executables on x86-Linux hosts
Avi Kivity [Tue, 15 Nov 2011 18:12:17 +0000]
configure: build position independent executables on x86-Linux hosts

Change the default on x86 Linux hosts to building PIE (position
independent executables); instead of restricting the option to
user-only targets, apply it to all targets.

In addition, set the relocation sections to read-only (relro) when
available; this reduces the attack surface by disallowing changes to
relocation tables at runtime.

While PIE reduces performance and relro increases load time, it
greatly improves security, with the potential to reduce a code
execution vulnerability to a self denial of service.

Non-x86 are not changed, as they require TCG changes; neither are
non-Linux, due to lack of test coverage.

Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agoivshmem: fix PCI BAR2 registration during initialization
Hongyong Zang [Mon, 21 Nov 2011 10:56:18 +0000]
ivshmem: fix PCI BAR2 registration during initialization

Ivshmem cannot work, and the command lspci cannot show ivshmem BAR2 in the guest.
As for pci_register_bar(), parameter MemoryRegion should be s->bar instead of s->ivshmem.

Reviewed-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Hongyong Zang <zanghongyong@huawei.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agomsix: avoid mask updates if mask is unchanged
Michael S. Tsirkin [Mon, 21 Nov 2011 16:57:50 +0000]
msix: avoid mask updates if mask is unchanged

Check pending bit only if vector mask status changed.
This is not really important for qemu.git but helps
fix a bug in qemu-kvm.git.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agomsix: Prevent bogus mask updates on MMIO accesses
Michael S. Tsirkin [Mon, 21 Nov 2011 16:57:31 +0000]
msix: Prevent bogus mask updates on MMIO accesses

>From: Jan Kiszka <jan.kiszka@siemens.com>

Only accesses to the MSI-X table must trigger a call to
msix_handle_mask_update, otherwise the vector
value might be out of range.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

2 years agomsix: track function masked in pci device state
Michael S. Tsirkin [Mon, 21 Nov 2011 16:57:21 +0000]
msix: track function masked in pci device state

Only go over the table when function is masked.
This is not really important for qemu.git but helps
fix a bug in qemu-kvm.git.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>