Revert "vfio: Make BARs native endian"

This reverts commit c40708176a6b52b73bec14796b7c71b882ceb102.

The resulting code wrongly assumed target and host endianness are
the same which is not always the case for PPC64.

[aw: or potentially any host supporting VFIO and TCG]

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
vfio: make rom read endian sensitive

All memory regions used by VFIO are LITTLE_ENDIAN and they
already take care of endiannes when accessing real device BARs
except ROM - it was broken on BE hosts.

This fixes endiannes for ROM BARs the same way as it is done
for other BARs.

This has been tested on PPC64 BE/LE host/guest in all possible
combinations including TCG.

Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
[aik: added commit log]
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
slirp: udp: fix NULL pointer dereference because of uninitialized socket

When guest sends udp packet with source port and source addr 0,
uninitialized socket is picked up when looking for matching and already
created udp sockets, and later passed to sosendto() where NULL pointer
dereference is hit during so->slirp->vnetwork_mask.s_addr access.

Fix this by checking that the socket is not just a socket stub.

This is CVE-2014-3640.

Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Reported-by: Xavier Mehrenberger <xavier.mehrenberger@airbus.com>
Reported-by: Stephane Duverger <stephane.duverger@eads.net>
Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
tcx: Implement hardware acceleration

The S24/TCX framebuffer is a mildly accelerated video card with
blitter, stippler and hardware cursor.

* Solaris and NetBSD 6.x use all the hardware acceleration features
* The Xorg driver (used by Linux) can use the hardware cursor only

This patch implements hardware acceleration in both 8 bit and 24 bit
modes. It is based on the NetBSD driver sources and from tests with
Solaris.

Signed-off-by: Olivier Danet <odanet@caramail.com>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Merge remote-tracking branch 'remotes/awilliam/tags/vfio-pci-for-qemu-20140923.0' into staging

Endian updates to re-fix cross endian host and guest and
enable the same for ROM loading (Alexey)

# gpg: Signature made Tue 23 Sep 2014 18:03:03 BST using RSA key ID 3BB08B22
# gpg: Can't check signature: public key not found

* remotes/awilliam/tags/vfio-pci-for-qemu-20140923.0:
  vfio: make rom read endian sensitive
  Revert "vfio: Make BARs native endian"

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
virtio: Fix wrong type cast from pointer to long

Compiler warning (w32, w64):

include/hw/virtio/virtio_ring.h:142:26: warning:
 cast from pointer to integer of different size [-Wpointer-to-int-cast]

When sizeof(long) < sizeof(void *), this is not only a warning but a
real program error.

Add also missing blanks in the same statement.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1411536002-14088-1-git-send-email-sw@weilnetz.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-signed' into staging

tcx: Implement hardware acceleration

# gpg: Signature made Tue 23 Sep 2014 22:52:34 BST using RSA key ID AE0F321F
# gpg: Can't check signature: public key not found

* remotes/mcayland/tags/qemu-sparc-signed:
  tcx: Implement hardware acceleration

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Update OpenBIOS images

Update OpenBIOS images to SVN r1320 built from submodule.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' into staging

Update OpenBIOS images

# gpg: Signature made Thu 25 Sep 2014 13:35:55 BST using RSA key ID AE0F321F
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C  C9C4 5BC2 C56F AE0F 321F

* remotes/mcayland/tags/qemu-openbios-signed:
  Update OpenBIOS images

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
trace: [ust] Fix format string computation in tcg-enabled events

TCG-enabled events start with two format strings. Delay per-argument format
computation until requested ('Event.formats').

Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
trace: docs: add trace file description

When user used the trace print command from docs/tracing.txt:
  ./scripts/simpletrace.py trace-events trace-*

the user maybe be misled by the "trace-*", because if user
directly copy the comand line to run, there alway print the
bored message:
"usage: ./scripts/simpletrace.py <trace-events> <trace-file>"

then we should describe that the "trace-*" represented.

Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
trace: [qmp] Add commands to query and control event tracing state

Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu>
Message-id: 20140825111957.31112.31733.stgit@fimbulvetr.bsc.es
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
trace: [hmp] Reimplement "trace-event" and "info trace-events" using QMP

Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu>
Message-id: 20140825112002.31112.60143.stgit@fimbulvetr.bsc.es
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
trace-events: drop orphan virtio_blk_data_plane_complete_request

This trace event has not been in use since commit
b002254dbd4c19a01f29790f840f983803e26893 ("virtio-blk: Unify
{non-,}dataplane's request handlings").

Cc: Fam Zheng <famz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1411394595-15300-2-git-send-email-stefanha@redhat.com
trace-events: drop orphan usb_mtp_data_out

This trace event was added in commit
840a178c94dbd3f5b5550fb8621620cb761de72d ("usb: mtp filesharing") but
never used.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1411394595-15300-3-git-send-email-stefanha@redhat.com
trace-events: drop orphan iscsi trace events

iscsi_aio_write16_cb, iscsi_aio_writev, iscsi_aio_read16_cb, and
iscsi_aio_readv have not not been in use since commit
063c3378a9e3c25cc0afac3c72e4823d0621e352 ("block/iscsi: introduce
bdrv_co_{readv, writev, flush_to_disk}").

These were the only trace events in block/iscsi.c so drop the the
trace.h include.

Cc: Peter Lieven <pl@kamp.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1411394595-15300-4-git-send-email-stefanha@redhat.com
trace: tighten up trace-events regex to fix bad parse

Use \w for properties and trace event names since they are both drawn
from [a-zA-Z0-9_] character sets.

The .* for matching properties was too aggressive and caused the
following failure with foo(int rc) "(this is a test)":

  Traceback (most recent call last):
    File "scripts/tracetool.py", line 139, in <module>
      main(sys.argv)
    File "scripts/tracetool.py", line 134, in main
      binary=binary, probe_prefix=probe_prefix)
    File "scripts/tracetool/__init__.py", line 334, in generate
      events = _read_events(fevents)
    File "scripts/tracetool/__init__.py", line 262, in _read_events
      res.append(Event.build(line))
    File "scripts/tracetool/__init__.py", line 225, in build
      return Event(name, props, fmt, args, arg_fmts)
    File "scripts/tracetool/__init__.py", line 185, in __init__
      % ", ".join(unknown_props))
  ValueError: Unknown properties: foo(int, rc)

Cc: Lluís Vilanova <vilanova@ac.upc.edu>
Reported-by: Eric Auger <eric.auger@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1411468626-20450-1-git-send-email-stefanha@redhat.com
cleanup-trace-events.pl: Tighten search for trace event call

The script can get fooled too easily.  For instance, it finds
trace_megasas_io_read_start when looking for trace_megasas_io_read,
and incorrectly concludes that event megasas_io_read is used.

Supply -w to git-grep to tighten the search.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1411476811-24251-2-git-send-email-armbru@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
trace-events: Drop unused megasas trace event

Event megasas_io_read was added in commit e8f943c, but never used.
Drop it.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1411476811-24251-3-git-send-email-armbru@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
trace-events: Drop orphaned monitor trace event

Event monitor_protocol_event is unused since commit 7517517.  Drop it.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1411476811-24251-4-git-send-email-armbru@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>