summaryrefslogtreecommitdiffstats
path: root/hw
Commit message (Collapse)AuthorAgeFilesLines
* Merge remote-tracking branch ↵Peter Maydell2016-05-1236-522/+1740
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/pmaydell/tags/pull-target-arm-20160512' into staging target-arm queue: * blizzard, omap_lcdc: code cleanup to remove DEPTH != 32 dead code * QOMify various ARM devices * bcm2835_property: use cached values when querying framebuffer * hw/arm/nseries: don't allocate large sized array on the stack * fix LPAE descriptor address masking (only visible for EL2) * fix stage 2 exec permission handling for AArch32 * first part of supporting syndrome info for data aborts to EL2 * virt: NUMA support * work towards i.MX6 support * avoid unnecessary TLB flush on TCR_EL2, TCR_EL3 writes # gpg: Signature made Thu 12 May 2016 14:29:14 BST using RSA key ID 14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" * remotes/pmaydell/tags/pull-target-arm-20160512: (43 commits) hw/arm: QOM'ify versatilepb.c hw/arm: QOM'ify strongarm.c hw/arm: QOM'ify stellaris.c hw/arm: QOM'ify spitz.c hw/arm: QOM'ify pxa2xx_pic.c hw/arm: QOM'ify pxa2xx.c hw/arm: QOM'ify integratorcp.c hw/arm: QOM'ify highbank.c hw/arm: QOM'ify armv7m.c target-arm: Avoid unnecessary TLB flush on TCR_EL2, TCR_EL3 writes hw/display/blizzard: Remove blizzard_template.h hw/display/blizzard: Expand out macros i.MX: Add sabrelite i.MX6 emulation. i.MX: Add i.MX6 SOC implementation. i.MX: Add the Freescale SPI Controller FIFO: Add a FIFO32 implementation i.MX: Add i.MX6 System Reset Controller device. ARM: Factor out ARM on/off PSCI control functions ACPI: Virt: Generate SRAT table ACPI: move acpi_build_srat_memory to common place ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/arm: QOM'ify versatilepb.cxiaoqiang.zhao2016-05-121-7/+6Star
| | | | | | | | | | | | | | | | Drop the use of old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/arm: QOM'ify strongarm.cxiaoqiang.zhao2016-05-121-38/+28Star
| | | | | | | | | | | | | | | | Drop the use of old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/arm: QOM'ify stellaris.cxiaoqiang.zhao2016-05-121-24/+24
| | | | | | | | | | | | | | | | | | * Drop the use of old SysBus init function and use instance_init * Use DeviceClass::vmsd instead of 'vmstate_register' function Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/arm: QOM'ify spitz.cxiaoqiang zhao2016-05-121-14/+9Star
| | | | | | | | | | | | | | | | Drop the use of old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/arm: QOM'ify pxa2xx_pic.cxiaoqiang.zhao2016-05-121-7/+0Star
| | | | | | | | | | | | | | | | | | Remove the empty 'pxa2xx_pic_initfn' and it's setup code in the 'pxa2xx_pic_class_init' Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/arm: QOM'ify pxa2xx.cxiaoqiang.zhao2016-05-121-15/+11Star
| | | | | | | | | | | | | | | | Drop the use of old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/arm: QOM'ify integratorcp.cxiaoqiang.zhao2016-05-121-20/+12Star
| | | | | | | | | | | | | | | | | | * Drop the use of old SysBus init function and use instance_init * Remove the empty 'icp_pic_class_init' from Typeinfo Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/arm: QOM'ify highbank.cxiaoqiang.zhao2016-05-121-7/+5Star
| | | | | | | | | | | | | | | | Drop the use of old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/arm: QOM'ify armv7m.cxiaoqiang.zhao2016-05-121-6/+5Star
| | | | | | | | | | | | | | | | Drop the use of old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/display/blizzard: Remove blizzard_template.hPeter Maydell2016-05-122-99/+77Star
| | | | | | | | | | | | | | | | | | | | | | We no longer need to do the "multiply include this header" trick with blizzard_template.h, and it is only used in a single .c file, so just put its contents inline in blizzard.c. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1462371352-21498-3-git-send-email-peter.maydell@linaro.org
| * hw/display/blizzard: Expand out macrosPeter Maydell2016-05-121-38/+17Star
| | | | | | | | | | | | | | | | | | | | | | | | | | Now that we can assume that only depth 32 is possible, there's no need for the COPY_PIXEL1 and PIXEL_TYPE macros, and the SKIP_PIXEL, COPY_PIXEL and SWAP_WORDS macros aren't used at all. Expand out COPY_PIXEL1 and PIXEL_TYPE where they are used, delete the unused macro definitions, and expand out the uses of glue(name_prefix, DEPTH). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1462371352-21498-2-git-send-email-peter.maydell@linaro.org
| * i.MX: Add sabrelite i.MX6 emulation.Jean-Christophe DUBOIS2016-05-122-1/+122
| | | | | | | | | | | | | | | | The sabrelite supports one SPI FLASH memory on SPI1 Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * i.MX: Add i.MX6 SOC implementation.Jean-Christophe DUBOIS2016-05-122-0/+450
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For now we only support the following devices: * up to 4 Cortex A9 cores * A9 MPCORE (SCU, GIC, TWD) * 5 i.MX UARTs * 2 EPIT timers * 1 GPT timer * 3 I2C controllers * 7 GPIO controllers * 6 SDHC controllers * 5 SPI controllers * 1 CCM device * 1 SRC device * various ROM/RAM areas. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * i.MX: Add the Freescale SPI ControllerJean-Christophe DUBOIS2016-05-122-0/+455
| | | | | | | | | | | | Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * i.MX: Add i.MX6 System Reset Controller device.Jean-Christophe DUBOIS2016-05-122-0/+265
| | | | | | | | | | | | | | | | | | This controller is also present in i.MX5X devices but they are not yet emulated by QEMU. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ACPI: Virt: Generate SRAT tableShannon Zhao2016-05-121-0/+52
| | | | | | | | | | | | | | | | | | To support NUMA, it needs to generate SRAT ACPI table. Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Message-id: 1461667229-9216-6-git-send-email-zhaoshenglong@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ACPI: move acpi_build_srat_memory to common placeShannon Zhao2016-05-122-29/+20Star
| | | | | | | | | | | | | | | | | | | | | | | | Move acpi_build_srat_memory to common place so that it could be reused by ARM. Rename it to build_srat_memory. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Message-id: 1461667229-9216-5-git-send-email-zhaoshenglong@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ACPI: Fix the definition of proximity in AcpiSratMemoryAffinityShannon Zhao2016-05-121-2/+1Star
| | | | | | | | | | | | | | | | | | | | | | | | | | ACPI spec says that Proximity Domain is an "Integer that represents the proximity domain to which the processor belongs". So define it as a uint32_t. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Message-id: 1461667229-9216-4-git-send-email-zhaoshenglong@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ACPI: Add GICC Affinity StructureShannon Zhao2016-05-121-1/+1
| | | | | | | | | | | | | | | | | | Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Message-id: 1461667229-9216-3-git-send-email-zhaoshenglong@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ARM: Virt: Set numa-node-id for cpu and memory nodesShannon Zhao2016-05-122-6/+45
| | | | | | | | | | | | | | | | | | | | Generate memory nodes according to NUMA topology. Set numa-node-id property for cpu and memory nodes. Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Message-id: 1461667229-9216-2-git-send-email-zhaoshenglong@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/display: QOM'ify exynos4210_fimd.cxiaoqiang zhao2016-05-121-7/+12
| | | | | | | | | | | | | | | | | | | | * Drop the old SysBus init function and use instance_init * Move graphic_console_init into realize stage Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Message-id: 1462417489-28603-2-git-send-email-zxq_yx_007@163.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/arm/nseries: Allocating Large sized arrays to heapZhou Jie2016-05-121-1/+2
| | | | | | | | | | | | | | | | | | | | n8x0_init has a huge stack usage of 65536 bytes approx. Moving large arrays to heap to reduce stack usage. Signed-off-by: Zhou Jie <zhoujie2011@cn.fujitsu.com> Message-id: 1461651308-894-1-git-send-email-zhoujie2011@cn.fujitsu.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * bcm2835_property: use cached values when querying framebufferSylvain Garrigues2016-05-121-9/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As the framebuffer settings are copied into the result message before it is reconfigured, inconsistent behavior can happen when, for instance, you set with a single message the width, height, and depth, and ask at the same time to allocate the buffer and get the pitch and the size. In this case, the reported pitch and size would be incorrect as they were computed with the initial values of width, height and depth, not the ones the client requested. Signed-off-by: Sylvain Garrigues <sylvain@sylvaingarrigues.com> Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Message-id: 1461325343-24995-1-git-send-email-sylvain@sylvaingarrigues.com [PMM: folded a couple of long lines] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/intc: QOM'ify omap_intc.cxiaoqiang zhao2016-05-121-26/+38
| | | | | | | | | | | | | | | | | | | | * Split the old SysBus init into an instance_init and a DeviceClass::realize function * Drop the old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/intc: QOM'ify grlib_irqmp.cxiaoqiang.zhao2016-05-121-11/+16
| | | | | | | | | | | | | | | | | | | | | | * Split the old SysBus init into an instance_init and a DeviceClass::realize function * Drop the old SysBus init function Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: corrected "can not" to "cannot" in error message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/intc: QOM'ify slavio_intctl.cxiaoqiang.zhao2016-05-121-8/+6Star
| | | | | | | | | | | | | | | | Drop the old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/intc: QOM'ify pl190.cxiaoqiang.zhao2016-05-121-7/+6Star
| | | | | | | | | | | | | | | | Drop the old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/intc: QOM'ify imx_avic.cxiaoqiang.zhao2016-05-121-8/+7Star
| | | | | | | | | | | | | | | | Drop the old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/intc: QOM'ify exynos4210_gic.cxiaoqiang.zhao2016-05-121-19/+20
| | | | | | | | | | | | | | | | | | | | * Drop the old SysBus init function and use instance_init * Split the exynos4210_irq_gate_init into an instance_init and a DeviceClass::realize function Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/intc: QOM'ify exynos4210_combiner.cxiaoqiang.zhao2016-05-121-8/+6Star
| | | | | | | | | | | | | | | | Drop the old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/intc: QOM'ify etraxfs_pic.cxiaoqiang.zhao2016-05-121-7/+6Star
| | | | | | | | | | | | | | | | | | | | Drop the old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * omap_lcdc: Remove support for DEPTH != 32Pooja Dhannawat2016-05-122-51/+7Star
| | | | | | | | | | | | | | | | | | | | | | surface_bits_per_pixel() always returns 32 so, removing other dead code which is based on DEPTH !== 32 Signed-off-by: Pooja Dhannawat <dhannawatpooja1@gmail.com> Message-id: 1459260142-9144-1-git-send-email-dhannawatpooja1@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * blizzard: Remove support for DEPTH != 32Pooja Dhannawat2016-05-122-66/+5Star
| | | | | | | | | | | | | | | | | | | | Removing support for DEPTH != 32 from blizzard template header and file that includes it, as macro DEPTH == 32 only used. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Pooja Dhannawat <dhannawatpooja1@gmail.com> Message-id: 1458971873-2768-1-git-send-email-dhannawatpooja1@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2016-05-12' into ↵Peter Maydell2016-05-122-14/+12Star
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging QAPI patches for 2016-05-12 # gpg: Signature made Thu 12 May 2016 08:49:04 BST using RSA key ID EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" * remotes/armbru/tags/pull-qapi-2016-05-12: (23 commits) qapi: Change visit_type_FOO() to no longer return partial objects qapi: Simplify semantics of visit_next_list() qapi: Fix string input visitor handling of invalid list tests/string-input-visitor: Add negative integer tests qapi: Split visit_end_struct() into pieces qmp: Tighten output visitor rules qmp: Don't reuse qmp visitor after grabbing output spapr_drc: Expose 'null' in qom-get when there is no fdt qmp: Support explicit null during visits qapi: Add visit_type_null() visitor tests: Add check-qnull qapi: Document visitor interfaces, add assertions qmp-input: Refactor when list is advanced qmp-input: Require struct push to visit members of top dict qom: Wrap prop visit in visit_start_struct qapi-commands: Wrap argument visit in visit_start_struct qmp-input: Don't consume input when checking has_member qapi: Use strict QMP input visitor in more places qapi: Consolidate QMP input visitor creation qmp-input: Clean up stack handling ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | qapi: Simplify semantics of visit_next_list()Eric Blake2016-05-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The semantics of the list visit are somewhat baroque, with the following pseudocode when FooList is used: start() for (prev = head; cur = next(prev); prev = &cur) { visit(&cur->value) } Note that these semantics (advance before visit) requires that the first call to next() return the list head, while all other calls return the next element of the list; that is, every visitor implementation is required to track extra state to decide whether to return the input as-is, or to advance. It also requires an argument of 'GenericList **' to next(), solely because the first iteration might need to modify the caller's GenericList head, so that all other calls have to do a layer of dereferencing. Thankfully, we only have two uses of list visits in the entire code base: one in spapr_drc (which completely avoids visit_next_list(), feeding in integers from a different source than uint8List), and one in qapi-visit.py. That is, all other list visitors are generated in qapi-visit.c, and share the same paradigm based on a qapi FooList type, so we can refactor how lists are laid out with minimal churn among clients. We can greatly simplify things by hoisting the special case into the start() routine, and flipping the order in the loop to visit before advance: start(head) for (tail = *head; tail; tail = next(tail)) { visit(&tail->value) } With the simpler semantics, visitors have less state to track, the argument to next() is reduced to 'GenericList *', and it also becomes obvious whether an input visitor is allocating a FooList during visit_start_list() (rather than the old way of not knowing if an allocation happened until the first visit_next_list()). As a minor drawback, we now allocate in two functions instead of one, and have to pass the size to both functions (unless we were to tweak the input visitors to cache the size to start_list for reuse during next_list, but that defeats the goal of less visitor state). The signature of visit_start_list() is chosen to match visit_start_struct(), with the new parameters after 'name'. The spapr_drc case is a virtual visit, done by passing NULL for list, similarly to how NULL is passed to visit_start_struct() when a qapi type is not used in those visits. It was easy to provide these semantics for qmp-output and dealloc visitors, and a bit harder for qmp-input (several prerequisite patches refactored things to make this patch straightforward). But it turned out that the string and opts visitors munge enough other state during visit_next_list() to make it easier to just document and require a GenericList visit for now; an assertion will remind us to adjust things if we need the semantics in the future. Several pre-requisite cleanup patches made the reshuffling of the various visitors easier; particularly the qmp input visitor. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1461879932-9020-24-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
| * | qapi: Split visit_end_struct() into piecesEric Blake2016-05-122-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As mentioned in previous patches, we want to call visit_end_struct() functions unconditionally, so that visitors can release resources tied up since the matching visit_start_struct() without also having to worry about error priority if more than one error occurs. Even though error_propagate() can be safely used to ignore a second error during cleanup caused by a first error, it is simpler if the cleanup cannot set an error. So, split out the error checking portion (basically, input visitors checking for unvisited keys) into a new function visit_check_struct(), which can be safely skipped if any earlier errors are encountered, and leave the cleanup portion (which never fails, but must be called unconditionally if visit_start_struct() succeeded) in visit_end_struct(). Generated code in qapi-visit.c has diffs resembling: |@@ -59,10 +59,12 @@ void visit_type_ACPIOSTInfo(Visitor *v, | goto out_obj; | } | visit_type_ACPIOSTInfo_members(v, obj, &err); |- error_propagate(errp, err); |- err = NULL; |+ if (err) { |+ goto out_obj; |+ } |+ visit_check_struct(v, &err); | out_obj: |- visit_end_struct(v, &err); |+ visit_end_struct(v); | out: and in qapi-event.c: @@ -47,7 +47,10 @@ void qapi_event_send_acpi_device_ost(ACP | goto out; | } | visit_type_q_obj_ACPI_DEVICE_OST_arg_members(v, &param, &err); |- visit_end_struct(v, err ? NULL : &err); |+ if (!err) { |+ visit_check_struct(v, &err); |+ } |+ visit_end_struct(v); | if (err) { | goto out; Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1461879932-9020-20-git-send-email-eblake@redhat.com> [Conflict with a doc fixup resolved] Signed-off-by: Markus Armbruster <armbru@redhat.com>
| * | spapr_drc: Expose 'null' in qom-get when there is no fdtEric Blake2016-05-121-5/+1Star
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that the QMP output visitor supports an explicit null output, we should utilize it to make it easier to diagnose the difference between a missing fdt ('null') vs. a present-but-empty one ('{}'). (Note that this reverts the behavior of commit ab8bf1d, taking us back to the behavior of commit 6c2f9a1 [which in turn stemmed from a crash fix in 1d10b44]; but that this time, the change is intentional and not an accidental side-effect.) Signed-off-by: Eric Blake <eblake@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <1461879932-9020-17-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
* | usb: Support compilation without poll.hStefan Weil2016-05-111-1/+12
| | | | | | | | | | | | | | | | | | This is a hack to support compilation with Mingw-w64 which provides a libusb-1.0 package, but no poll.h. Signed-off-by: Stefan Weil <sw@weilnetz.de> Message-id: 1458630800-10088-1-git-send-email-sw@weilnetz.de Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | usb-mtp: fix usb_mtp_get_device_info so that libmtp on the guest doesn't ↵Isaac Lozano2016-05-111-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | complain If an application uses libmtp on the guest system, it will complain with the warning message: LIBMTP WARNING: VendorExtensionID: ffffffff LIBMTP WARNING: VendorExtensionDesc: (null) LIBMTP WARNING: this typically means the device is PTP (i.e. a camera) but not a MTP device at all. Trying to continue anyway. This is because libmtp expects a MTP Vendor Extension ID of 0x00000006 and a MTP Version of 0x0064. These numbers are taken from Microsoft's MTP Vendor Extension Identification Message page and are what most physical devices show. Signed-off-by: Isaac Lozano <109lozanoi@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1460892593-5908-1-git-send-email-109lozanoi@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | usb:xhci: no DMA on HC resetRoman Kagan2016-05-111-1/+4
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is a rough fix to a memory corruption we are observing when running VMs with xhci USB controller and OVMF firmware. Specifically, on the following call chain xhci_reset xhci_disable_slot xhci_disable_ep xhci_set_ep_state QEMU overwrites guest memory using stale guest addresses. This doesn't happen when the guest (firmware) driver sets up xhci for the first time as there are no slots configured yet. However when the firmware hands over the control to the OS some slots and endpoints are already set up with their context in the guest RAM. Now the OS' driver resets the controller again and xhci_set_ep_state then reads and writes that memory which is now owned by the OS. As a quick fix, skip calling xhci_set_ep_state in xhci_disable_ep if the device context base address array pointer is zero (indicating we're in the HC reset and no DMA is possible). Cc: qemu-stable@nongnu.org Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Message-id: 1462384435-1034-1-git-send-email-rkagan@virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20160509-1' into ↵Peter Maydell2016-05-091-44/+78
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging vga security fixes (CVE-2016-3710, CVE-2016-3712) # gpg: Signature made Mon 09 May 2016 13:39:30 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-vga-20160509-1: vga: make sure vga register setup for vbe stays intact (CVE-2016-3712). vga: update vga register setup on vbe changes vga: factor out vga register setup vga: add vbe_enabled() helper vga: fix banked access bounds checking (CVE-2016-3710) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * vga: make sure vga register setup for vbe stays intact (CVE-2016-3712).Gerd Hoffmann2016-05-021-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT registers, to make sure the vga registers will always have the values needed by vbe mode. This makes sure the sanity checks applied by vbe_fixup_regs() are effective. Without this guests can muck with shift_control, can turn on planar vga modes or text mode emulation while VBE is active, making qemu take code paths meant for CGA compatibility, but with the very large display widths and heigts settable using VBE registers. Which is good for one or another buffer overflow. Not that critical as they typically read overflows happening somewhere in the display code. So guests can DoS by crashing qemu with a segfault, but it is probably not possible to break out of the VM. Fixes: CVE-2016-3712 Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com> Reported-by: P J P <ppandit@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * vga: update vga register setup on vbe changesGerd Hoffmann2016-05-021-0/+1
| | | | | | | | | | | | | | Call the new vbe_update_vgaregs() function on vbe configuration changes, to make sure vga registers are up-to-date. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * vga: factor out vga register setupGerd Hoffmann2016-05-021-34/+44
| | | | | | | | | | | | | | | | | | When enabling vbe mode qemu will setup a bunch of vga registers to make sure the vga emulation operates in correct mode for a linear framebuffer. Move that code to a separate function so we can call it from other places too. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * vga: add vbe_enabled() helperGerd Hoffmann2016-05-021-4/+9
| | | | | | | | | | | | Makes code a bit easier to read. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * vga: fix banked access bounds checking (CVE-2016-3710)Gerd Hoffmann2016-05-021-6/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | vga allows banked access to video memory using the window at 0xa00000 and it supports a different access modes with different address calculations. The VBE bochs extentions support banked access too, using the VBE_DISPI_INDEX_BANK register. The code tries to take the different address calculations into account and applies different limits to VBE_DISPI_INDEX_BANK depending on the current access mode. Which is probably effective in stopping misprogramming by accident. But from a security point of view completely useless as an attacker can easily change access modes after setting the bank register. Drop the bogus check, add range checks to vga_mem_{readb,writeb} instead. Fixes: CVE-2016-3710 Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | Revert "acpi: mark PMTIMER as unlocked"Gerd Hoffmann2016-05-021-1/+0Star
|/ | | | | | | | | | | | | This reverts commit 7070e085d490c396f9237c8f10bf8b6e69cd0066. Commit message claims locking is not needed, but that appears to not be true, seabios ehci driver runs into timekeeping problems with this, see https://bugzilla.redhat.com/show_bug.cgi?id=1322713 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1460702609-25971-1-git-send-email-kraxel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* acpi: fix bios linker loadder COMMAND_ALLOCATE on bigendian hostIgor Mammedov2016-05-011-3/+2Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'make check' fails with: ERROR:tests/bios-tables-test.c:493:load_expected_aml: assertion failed: (g_file_test(aml_file, G_FILE_TEST_EXISTS)) since commit: caf50c7166a6ed96c462ab5db4b495e1234e4cc6 tests: pc: acpi: drop not needed 'expected SSDT' blobs Assert happens because qemu-system-x86_64 generates SSDT table and test looks for a corresponding expected table to compare with. However there is no expected SSDT blob anymore, since QEMU souldn't generate one. As it happens BIOS is not able to read ACPI tables from QEMU and fallbacks to embeded legacy ACPI codepath, which generates SSDT. That happens due to wrongly sized endiannes conversion which makes uint8_t BiosLinkerLoaderEntry.alloc.zone end up with 0 due to truncation of 32 bit integer which on host is 1 or 2. Fix it by dropping invalid cpu_to_le32() as uint8_t doesn't require any conversion. RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1330174 Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
* spapr_drc: fix aborts during DRC-count based hotplugMichael Roth2016-04-262-5/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | CPU/memory resources can be signalled en-masse via spapr_hotplug_req_add_by_count(), and when doing so, actually change the meaning of the 'drc' parameter passed to spapr_hotplug_req_event() to be a count rather than an index. f40eb92 added a hook in spapr_hotplug_req_event() to record when a device had been 'signalled' to the guest, but that code assumes that drc is always an index. In cases where it's a count, such as memory hotplug, the DRC lookup will fail, leading to an assert. Fix this by only explicitly setting the signalled state for cases where we are doing PCI hotplug. For other resources types, since we cannot selectively track whether a resource has been signalled in cases where we signal attach as a count, set the 'signalled' state to true immediately upon making the resource available via drck->attach(). Reported-by: Bharata B Rao <bharata@linux.vnet.ibm.com> Cc: Bharata B Rao <bharata@linux.vnet.ibm.com> Cc: david@gibson.dropbear.id.au Cc: qemu-ppc@nongnu.org Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-01-09 07:48:25 +0100