This patch makes iPXE work with the rtl8139 emulation. The rtl8139
driver in iPXE issues a 16bit access on the ChipCmd register
(offset 0x37) to check the status of the rx buffer. The offset of the
ioport access was getting fixed up to 0x36 in qemu, causing the value
read in iPXE to be invalid.

This fixes an issue with iPXE reporting timeouts during TFTP transfers.

Reposting this here because it is trivial enough and the original post
on qemu-devel didn't attract much attention.

Also, the inw() which was causing the issue has been replaced with an
inb() in upstream iPXE:
https://git.ipxe.org/ipxe.git/commit/91dd64ad25baa27954a7518e73df4fca8a2d0c93Signed-off-by: NJulian Pidancet <julian.pidancet@gmail.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

get_str_sep() can fail, but net_slirp_hostfwd_remove() doesn't check.
Works, because it initializes buf[] to "", which get_str_sep() doesn't
touch when it fails.  Coverity doesn't like it, and neither do I.

Change it to work exactly like slirp_hostfwd().
Acked-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Add check for the EFD_NONBLOCK and EFD_CLOEXEC flags to the
CONFIG_EVENTFD test.
This fixes the following build failure on Fedora 9:

      CC    event_notifier.o
    event_notifier.c: In function `event_notifier_init':
    event_notifier.c:21: error: `EFD_NONBLOCK' undeclared (first use in this function)
    event_notifier.c:21: error: (Each undeclared identifier is reported only once
    event_notifier.c:21: error: for each function it appears in.)
    event_notifier.c:21: error: `EFD_CLOEXEC' undeclared (first use in this function)
    make: *** [event_notifier.o] Error 1
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Change the default on x86 Linux hosts to building PIE (position
independent executables); instead of restricting the option to
user-only targets, apply it to all targets.

In addition, set the relocation sections to read-only (relro) when
available; this reduces the attack surface by disallowing changes to
relocation tables at runtime.

While PIE reduces performance and relro increases load time, it
greatly improves security, with the potential to reduce a code
execution vulnerability to a self denial of service.

Non-x86 are not changed, as they require TCG changes; neither are
non-Linux, due to lack of test coverage.
Signed-off-by: NAvi Kivity <avi@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Ivshmem cannot work, and the command lspci cannot show ivshmem BAR2 in the guest.
As for pci_register_bar(), parameter MemoryRegion should be s->bar instead of s->ivshmem.
Reviewed-by: NAvi Kivity <avi@redhat.com>
Signed-off-by: NHongyong Zang <zanghongyong@huawei.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Check pending bit only if vector mask status changed.
This is not really important for qemu.git but helps
fix a bug in qemu-kvm.git.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

>From: Jan Kiszka <jan.kiszka@siemens.com>

Only accesses to the MSI-X table must trigger a call to
msix_handle_mask_update, otherwise the vector
value might be out of range.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Only go over the table when function is masked.
This is not really important for qemu.git but helps
fix a bug in qemu-kvm.git.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

zlib.h is not a local include file, therefore it should be included
using <> instead of "".
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

AT_REMOVEDIR is not defined on all systems.  Pass the raw flags from the
9p protocol, which are always there.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Avoid a conflict on the definition of struct file_handle by
using a replacement name.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Now when you try to migrate with qed, you get:

(qemu) migrate tcp:localhost:1025
Block format 'qed' used by device 'ide0-hd0' does not support feature 'live migration'
(qemu)
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

We don't reopen the actual file, but instead invoke the close and open routines.
We specifically ignore the backing file since it's contents are read-only and
therefore immutable.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Image files have two types of data: immutable data that describes things like
image size, backing files, etc. and mutable data that includes offset and
reference count tables.

Today, image formats aggressively cache mutable data to improve performance.  In
some cases, this happens before a guest even starts.  When dealing with live
migration, since a file is open on two machines, the caching of meta data can
lead to data corruption.

This patch addresses this by introducing a mechanism to invalidate any cached
mutable data a block driver may have which is then used by the live migration
code.

NB, this still requires coherent shared storage.  Addressing migration without
coherent shared storage (i.e. NFS) requires additional work.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Now when you try to migrate with ivshmem, you get a proper QMP error:

(qemu) migrate tcp:localhost:1025
Migration is disabled when using feature 'peer mode' in device 'ivshmem'
(qemu)
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This lets different subsystems register an Error that is thrown whenever
migration is attempted.  This works nicely because it gracefully supports
things like hotplug.

Right now, if multiple errors are registered, only one of them is reported.
I expect that for 1.1, we'll extend query-migrate to return all of the reasons
why migration is disabled at any given point in time.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Commit 0c402e5a is incomplete
and misses one of the two function pointer calls in
usb_host_scan_dev().  Add the additional port handling logic
to the other call too.

Spotted by Coverity.

Cc: Markus Armbruster <armbru@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Coverity thinks q could be NULL there and warns.
I believe it can't be NULL there.
Add assert to prove it.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Until recently all scsi commands sent to scsi-disk did either transfer
data or finished instantly.  The correct implementation of
SYNCRONIZE_CACHE changed the picture though, and usb-storage needs
a fix to handle that case correctly.

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

scsi keeps track of the tag in SCSIRequest,
no need to store a separate copy.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Put status word into device state, fill it in command_complete, have
usb_msd_send_status just send it out.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

usb_msd_send_status can be called from different code paths, move the
debug message into the function to make sure it is printed
unconditionally.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Fix obvious typos (decrement and off-by-one error) in pcmpestrm and pcmpistrm
which resulted in infinite loop. Reported by Frank Mehnert,
spotted also by Coverity (bug 84752853).
Reported-by: NFrank Mehnert <frank.mehnert@oracle.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Happily passes (size_t)-1 to rom_add_blob_fixed(), which promptly dies
attempting to malloc that much.  Spotted by Coverity.

Bonus fix for ROMs larger than INT_MAX bytes: return ssize_t instead
of int.  Bug can't bite, because the only user load_aout() limits ROM
size to an int value.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

This patch replace the previous implementation with this simplified and
more complete version (no shutdown when psret == 1).
Signed-off-by: NFabien Chouteau <chouteau@adacore.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

cppcheck report:
  gdbstub.c:1781: error: Memory leak: s

Rearranging of the code avoids the leak.

v2:
Replace the g_malloc0() by g_new0() (suggested by Stuart Brady).
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

In both cases, val is computed, but then not used in the
subsequent line, which then re-computes the quantity in
a different type (int32_t vs unsigned long).

Keep the computation type that's been working so far.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

* 's390-1.0' of git://repo.or.cz/qemu/agraf:
  s390x: initialize virtio dev region
  tcg: Use TCGReg for standard tcg-target entry points.
  tcg: Standardize on TCGReg as the enum for hard registers
  s390x: Add shutdown for TCG s390-virtio machine
  s390: Fix cpu shutdown for KVM
  s390: fix short kernel command lines
  s390: fix reset hypercall to reset the status
  s390x: implement SIGP restart and shutdown
  s390x: implement rrbe instruction properly
  s390x: update R and C bits in storage key
  s390x: make ipte 31-bit aware
  s390x: add ldeb instruction

* 'ppc-1.0' of git://repo.or.cz/qemu/agraf:
  pseries: Fix qdev.id handling in the VIO bus code
  pseries: Allow kernel's early debug output to work
  pseries: Default reg for vty should be SPAPR_VTY_BASE_ADDRESS
  pseries: Check we have a chardev in spapr_vty_init()
  pseries: Fix buggy spapr_vio_find_by_reg()
  pseries: Correct RAM size check for SLOF
  PPC: Fix for the gdb single step problem on an rfi instruction
  tcg-ppc64: Fix compile errors for userspace only builds with gcc 4.6
  pseries: Fix initialization of sPAPREnvironment structure

The variable is assigned a value which is never used,
so remove variable and assignment.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: Nmalc <av1474@comtv.ru>

When the user creates a device on the command line with -device, they
can specify the id, using id=foo. Currently the VIO bus code overwrites
this id with it's own value. We should only set qdev.id if it is not
already set by the user.

The device tree code uses qdev.id for the device tree node name, however
we can't rely on the user specifiying the id using proper device tree
syntax, ie. device@reg. So separate the device tree node name from the
qdev.id, but use the same syntax, so they will match by default.
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

The PAPR specification defines a virtual TTY/console interface for guest
OSes to use via the H_PUT_TERM_CHAR and H_GET_TERM_CHAR hypercalls.  There
can be multiple virtual ttys, so these take a "termno" parameter.  This
encodes which vty to use as the 'reg' property on the device tree node
associated with that vty.

However, with the early debug options enabled, the Linux kernel will
attempt debugging output through the vty very early, before it has read
the device tree.  In this case it always uses a termno of 0.  This works
on the existing PowerVM hypervisor, so we assume there must be a hack /
feature in there which interprets termno==0 to mean the default primary
console.

To help with debugging kernels, including existing distribution kernels,
this patch implements a similar feature / hack in qemu.  If termno==0
is supplied to H_{GET,PUT}_TERM_CHAR, they use the first available vty
device instead.

We need to be careful in the case that the user has manually created
an spapr-vty at address 0. So first we search for the specified reg and
only if that doesn't match do we fall back.
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

In commit b4a78527 ("Place pseries vty
devices at addresses more similar to existing machines"), we changed the
default reg for the vty to 0x30000000, however we didn't update the default
value for a user specified vty device. Fix that.
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

If qemu is run like:

 qemu-system-ppc64 -nodefaults -device spapr-vty

We end up in spapr_vty_init() with dev->chardev == NULL. Currently
that leads to a segfault because we unconditionally call
qemu_chr_add_handlers().

Although we could make that call conditional, I think a spapr-vty
without a chardev is basically useless so fail the init. This is
similar to what the serial code does for example.
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>