In case s->version is shorter than 4 bytes we overflow the memcpy src
buffer. Fix it by clearing the target buffer, then copy only the
amount of bytes we actually have.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from 314b1811c1)
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
When the MMUCR TI bit is set, all the UTLB and ITLB entries should be
flushed.
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit e781d1285fc3b81d689ba25360c6c272116387fa)
This is a workaround only, and is a partial revert
of a few changes to BMDMAState which removed pci_dev
field on the way.
- cmd646 pci_from_bm() expects bm->unit value to
correspond with bm data being passed to callback
as opaque pointer. This breaks when write to dma
control register of second channel happens when no
dma operation is in progress, so bm->unit is zero
for second channel, and pci_from_bm() returns garbage
pointer. Crash happens shortly after that while
dereferencing that pointer.
v0->v1: cleaned up dead code from pci_from_bm.
Signed-off-by: Igor V. Kovalenko <igor.v.kovalenko@gmail.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
(cherry picked from commit 90228ee395)
here's a trivial patch to fix the spelling of "compatibility":
Signed-off-by: Vagrant Cascadian <vagrant@freegeek.org>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
(cherry picked from commit 66c80e7575)
Fix the floppy controller init wrappers to set the drive properties
only in case the DriveInfo pointers passed in are non NULL. This allows
to set the properties using -global.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit 995bf0ca57)
Save/restore information necessary to continue in progress PIO/ATAPI CMD
transfers.
This includes the IO buffer.
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit ed487bb1d6)
Fix a race condition where qemu finds that there are not enough virtio
ring buffers available and the guest make more buffers available before
qemu can enable notifications.
Signed-off-by: Tom Lendacky <toml@us.ibm.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 06b1297017)
This fixes a segfault due to buffer overrun in the usb-serial device.
The memcpy was incrementing the start location by recv_used yet, the
computation of first_size (how much to write at the end of the buffer
before wrapping to the front) was not accounting for it. This causes the
next element after the receive buffer (recv_ptr) to get overwritten with
random data.
Signed-off-by: David Ahern <daahern@cisco.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 4ab4183d76)
If an I/O request fails right away instead of getting an error only in the
callback, we still need to consider rerror/werror.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 6c510fbf60)
Current code assumes that only write requests are ever going to be restarted.
This is wrong since rerror=stop exists. Instead of directly starting writes,
use the same request processing as used for new requests.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit f1b5286803)
We need a function that handles a single request. Create one by splitting out
code from virtio_blk_handle_output.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit bc6694d43a)
This fixes CONFIG_FB_CIRRUS for Linux guests and probably much more:
When switching away from linearly mapped vram, we also have to restore
the I/O handlers for the LFB.
This regression was once introduced by commit 2bec46dc97.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 4516e45f82)
Win32 suffers from a very big memory leak when dealing with SCSI devices.
Each read/write request allocates memory with qemu_memalign (ie
VirtualAlloc) but frees it with qemu_free (ie free).
Pair all qemu_memalign() calls with qemu_vfree() to prevent such leaks.
Signed-off-by: Herve Poussineau <hpoussin@reactos.org>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit f8a83245d9)
Commit 930c86820e introduced a regression to eth_send: eth_tx_desc_put
manipulates the host's tx descriptor copy before writing it back, but
two lines down the descriptor is evaluated again, leaving us with an
invalid next address if host and guest endianness differ. So this was
the actual issue commit 2e87c5b937 tried to paper over.
Signed-off-by: Jan Kiszka <jan.kiszka@web.de>
Signed-off-by: malc <av1474@comtv.ru>
(cherry picked from commit 07b064e9de)
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Commit b3a219883e uncovered that we attached the Wolfson with an I2C
address shifted left by one. Fixing this makes sound work again for
the Musicpal.
Signed-off-by: Jan Kiszka <jan.kiszka@web.de>
Signed-off-by: malc <av1474@comtv.ru>
(cherry picked from commit 6425822964)
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This patch adds compat property entries for ide-disk.ver and
scsi-disk.ver to pc-0.10 and pc-0.11. With this patch applied
the scsi and ide disks report "0.10" and "0.11" as version when
you start qemu with "-M pc-0.10" or "-M pc-0.11".
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 374ef70452)
This patch adds a new property named 'ver' to scsi-disk which allows to
specify the version which the virtual disk/cdrom should report to the
guest. By default this is the qemu version (i.e. 0.12). usage:
-drive if=none,id=disk,file=...
-device lsi
-device scsi-disk,drive=disk,bus=scsi.0,unit=0,ver=42
You can also switch the version for all scsi drives using:
-global scsi-disk.ver=42
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 383b4d9b79)
This patch adds a new property named 'ver' to ide-drive which allows to
specify the version which the virtual disk/cdrom should report to the
guest. By default this is the qemu version (i.e. 0.12). usage:
-drive if=none,id=disk,file=...
-device ide-drive,bus=ide.0,unit=0,drive=disk,ver=42
You can also switch the version for all ide drives using:
-global ide-drive.ver=42
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 47c0634030)
Since commit 747bbdf7 QEMU_WARN_UNUSED_RESULT is never defined as it is
conditional on a define from config-host.h which is included only later.
Include that file earlier to get the warnings back.
Reactivating it unfortunately leads to some warnings about unused qdev_init
results. These calls are changed to qdev_init_nofail to avoid build failures.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit beb6f0de7a)
So '-M pc-0.10' and '-M pc-0.11' will use the fw_cfg rom load method
by default.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 20a86364c9)
This patch adds a pci bus property 'rombar' which specifies whenever
the pci rom should be loaded via pci rom bar (default) or via fw_cfg.
The later can be used for compatibility with older qemu versions where
no pci rom bar is present.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 88169ddf82)
This patch changes the way rom loading via fw_cfg is handled.
Instead of having pc_init1() call a function which passed all
roms to the firmware config we simply pass a pointer to fw_cfg
to the rom loader.
Advantage: loading roms via firmware works also for devices which
are initialized after pc_init1(), i.e. everyting added via -device.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 8832cb805d)
Changes:
- make dir argument mandatory, we allways have one anyway
(vgaroms or genroms).
- check for duplicates, skip loading if found.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit de9352bcae)
Changes:
- Drop extra file argument from rom_add_file().
- Drop fw_dir check in do_info_roms, we allways have a dir name.
- code style fixes.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit bdb5ee3064)
Add a new machine type for qemu 0.12.
Also fixup the 0.11 machine type: msi for virtio-blk-pci was enabled
after the 0.11 release, so turn it off in the 0.11 machine type.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 2cae6f5e34)
Similarly to what has been done in e405a2ba91,
ignore rom intended to be loaded by the bios in find_rom() and rom_copy().
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit f21a59c224)
Since patch ed757e140c0ada220f213036e4497315d24ca8bct, virtio will
sometimes clear all status registers on bus master disable, which loses
information such as VIRTIO_CONFIG_S_FAILED bit. This is a result of
a patch being misapplied: code uses ! instead of ~ for bit
operations as in Yan's original patch. This obviously does not make
sense.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 49e75cf388)
Check that the cursor dimensions passed from the guest for the
DEFINE_CURSOR command don't overflow the available space in the
cursor.image[] or cursor.mask[] arrays before copying data from the
guest into those arrays.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit f2d928d44e)
The first such option rom will load at address 0, which isn't very nice,
and the second will report a conflict and abort, which is horrible.
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit e405a2ba91)
Stepping through the SS-5's OBP initialization routines
it looks like reading fdc main status register should
clear the fd interrupt.
The patch doesn't fix problems with fdc on sparc platform,
it only fixes fdc detection.
Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
According to the SCSI-2 specification,
http://ldkelley.com/SCSI2/SCSI2/SCSI2/SCSI2-08.html#8.2.5 ,
"if the allocation length of the command descriptor block (CDB) is too
small to transfer all of the parameters, the additional length shall
not be adjusted to reflect the truncation."
The 36 mandatory bytes of response are written to outbuf, and then
only the length requested in CDB is transferred.
Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
ROMs need to be loaded if they are anywhere in the requested area, not
only at the very beginning. This fixes Multiboot with ELF kernels that
have more than one program header.
Signed-off-by: Kevin Wolf <mail@kevin-wolf.de>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit 935effc2bb)
It was possible to load roms at address 0, but commit
632cf034b4 started to forbid that, which
broke at least ARM versatile.
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit f9e69bd9cf)
Otherwise, the driver does not work in Linux after the INT_DISABLE changes in
PCI.
Michael Tsirkin had a patch to do this, I'm not sure what happened to it.
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 17a7a5c59c4d72dd1d5666f348b010be6b10163c)
Now that we load the option roms via fw_cfg, we can stop copying
them to the 0xc000 -> 0xe000. The patch does just that.
Also the rom loader gets simplified as all remaining users of the
rom loader load the bits at a fixed address so the packing and
aligning logic can go away.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 632cf034b4)
roms: use fw_cfg for vgabios and option rom loading, additionally to
deploying them the traditional way (copy to 0xc0000 -> 0xe0000 range).
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 379526a40e)
This patch adds a file transfer interface to fw_cfg. Intended to be
used for passing non-pci option roms and vgabios to seabios. Namespace
is modeled after the existing cbfs filesystem support in seabios.
Reading the new FW_CFG_FILE_DIR entry returns a file list.
Fields there are in network byte order (aka bigendian).
aliguori: fix fw_cfg.h for multiboot.bin, add proper fw_cfg.h declarations,
quiet fprintf() in fw_cfg.c
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit abe147e0ce)
This patch adds a romfile property to the pci bus. It allows to specify
a romfile to load into the rom bar of the pci device. The default value
comes from a new field in PCIDeviceInfo. The property allows to change
the file and also to disable the rom loading using an empty string.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 8c52c8f320)
Currently, we preload option roms into the option rom space in memory. This
prevents DDIM from functioning correctly which severely limits the number
of roms we can support.
This patch introduces a pci_add_option_rom() which registers the
PCI_ROM_ADDRESS bar which points to our option rom. It also converts over
the cirrus vga adapter, the rtl8139, virtio, and the e1000 to use this
new mechanism.
The result is that PXE boot functions even with three unique types of cards.
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit c2039bd0ff)
SCSI controllers have no trouble existing without any attached
disks. This could be achieved with the (legacy) monitor syntax
pci_add pci_addr=auto storage if=scsi
This is now denied with
scsi requires a backing file/device.
failed to add if=scsi
There is no need for this denial and it breaks compatability
with existing QEMU usage, so remove the check for presence
of a drive.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit ec7efac4a9)
0.11 uses as instance ide io_base, get it back
Signed-off-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 47f5ba7248)
Floppy used the io_base address to register savevm region.
This reverts commit 2966b390d0.
Signed-off-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit aef30c3c6a)
The cursor pixmap size we calculate later ends up being 4096 dwords
long by the looks of it. This boots an F12 LiveCD now.
Signed-off-by: Dave Airlie <airlied@linux.ie>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 8095cb3ed2)
This patch enables dirty log tracking whenever it's needed and disables it
when it is not.
We unconditionally enable dirty log tracking on reset, restart dirty log
tracking when PCI IO regions are remapped, and disable/enable it based on
commands from the guest.
Rebased-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit b5cc6e32ba)
VMware VGA requires that the depth presented to the guest is the same as the
DisplaySurface that it renders to. This is because it performs a very simple
memcpy() to blit from one surface to another.
We currently hardcode a 24-bit depth. The surface allocator for SDL may, and
usually will, allocate a surface with a different depth causing screen
corruption.
This changes the code to allocate the DisplaySurface before initializing the
device which allows the depth of the DisplaySurface to be used instead of
hardcoding something.
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit a6109ff1b5)
Apparently, VBE maps the VGA vram to a fixed physical location. KVM requires
that all mappings of the VGA vram have dirty tracking enabled on them. Any
access to the VGA vram through the VBE mapping currently fails to result in
dirty page tracking updates causing a black screen.
This is the true root cause of VMware VGA not working correctly under KVM and
likely also an issue with some of the std-vga black screen issues too.
Cirrus does not enable VBE so it would not be a problem when using Cirrus.
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Rebased-by: Dave Airlie <airlied@redhat.com>
(cherry picked from commit f0138a63a4)
Gerd Hoffmann