aboutsummaryrefslogtreecommitdiff
path: root/hw/intc
AgeCommit message (Collapse)Author
2014-09-29hw/intc/imx_avic.c: Remove unused function imx_avic_set_prio()Peter Maydell
The function imx_avic_set_prio() is unused; delete it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1410723223-17711-3-git-send-email-peter.maydell@linaro.org
2014-09-02Fix debug print warningGonglei
Steps: 1.enable qemu debug print, using simply scprit as below: grep "//#define DEBUG" * -rl | xargs sed -i "s/\/\/#define DEBUG/#define DEBUG/g" 2. make -j 3. get some warning: hw/i2c/pm_smbus.c: In function 'smb_ioport_writeb': hw/i2c/pm_smbus.c:142: warning: format '%04x' expects type 'unsigned int', but argument 2 has type 'hwaddr' hw/i2c/pm_smbus.c:142: warning: format '%02x' expects type 'unsigned int', but argument 3 has type 'uint64_t' hw/i2c/pm_smbus.c: In function 'smb_ioport_readb': hw/i2c/pm_smbus.c:209: warning: format '%04x' expects type 'unsigned int', but argument 2 has type 'hwaddr' hw/intc/i8259.c: In function 'pic_ioport_read': hw/intc/i8259.c:373: warning: format '%02x' expects type 'unsigned int', but argument 2 has type 'hwaddr' hw/input/pckbd.c: In function 'kbd_write_command': hw/input/pckbd.c:232: warning: format '%02x' expects type 'unsigned int', but argument 2 has type 'uint64_t' hw/input/pckbd.c: In function 'kbd_write_data': hw/input/pckbd.c:333: warning: format '%02x' expects type 'unsigned int', but argument 2 has type 'uint64_t' hw/isa/apm.c: In function 'apm_ioport_writeb': hw/isa/apm.c:44: warning: format '%x' expects type 'unsigned int', but argument 2 has type 'hwaddr' hw/isa/apm.c:44: warning: format '%02x' expects type 'unsigned int', but argument 3 has type 'uint64_t' hw/isa/apm.c: In function 'apm_ioport_readb': hw/isa/apm.c:67: warning: format '%x' expects type 'unsigned int', but argument 2 has type 'hwaddr' hw/timer/mc146818rtc.c: In function 'cmos_ioport_write': hw/timer/mc146818rtc.c:394: warning: format '%02x' expects type 'unsigned int', but argument 3 has type 'uint64_t' hw/i386/pc.c: In function 'port92_write': hw/i386/pc.c:479: warning: format '%02x' expects type 'unsigned int', but argument 2 has type 'uint64_t' Fix them. Cc: qemu-trivial@nongnu.org Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-08-29hw/intc/arm_gic: honor target mask in gic_update()Sergey Fedorov
Take IRQ target mask into account when determining the highest priority pending interrupt. Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com> Acked-by: Christoffer Dall <christoffer.dall@linaro.org> Message-id: 1407947471-26981-1-git-send-email-serge.fdrv@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-29arm_gic: Use GIC_NR_SGIS constantAdam Lackorzynski
Use constant rather than a plain number. Acked-by: Christoffer Dall <christoffer.dall@linaro.org> Signed-off-by: Adam Lackorzynski <adam@os.inf.tu-dresden.de> Message-id: 1408372255-12358-5-git-send-email-adam@os.inf.tu-dresden.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-29arm_gic: Do not force PPIs to edge-triggered modeAdam Lackorzynski
Only SGIs must be WI, done by forcing them to their default (edge-triggered). Acked-by: Christoffer Dall <christoffer.dall@linaro.org> Signed-off-by: Adam Lackorzynski <adam@os.inf.tu-dresden.de> Message-id: 1408372255-12358-4-git-send-email-adam@os.inf.tu-dresden.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-29arm_gic: GICD_ICFGR: Write model only for pre v1 GICsAdam Lackorzynski
Setting the model is only available in pre-v1 GIC models. Acked-by: Christoffer Dall <christoffer.dall@linaro.org> Signed-off-by: Adam Lackorzynski <adam@os.inf.tu-dresden.de> Message-id: 1408372255-12358-3-git-send-email-adam@os.inf.tu-dresden.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-29arm_gic: Fix read of GICD_ICFGRAdam Lackorzynski
The GICD_ICFGR register covers 4 interrupts per byte. Acked-by: Christoffer Dall <christoffer.dall@linaro.org> Signed-off-by: Adam Lackorzynski <adam@os.inf.tu-dresden.de> Message-id: 1408372255-12358-2-git-send-email-adam@os.inf.tu-dresden.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-15intc: i8259: Convert Array allocation to g_new0Peter Crosthwaite
To be more array friendly and to indicate the IRQs are initially disconnected. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-08-15ppc: convert g_new(qemu_irq usages to g_new0Peter Crosthwaite
To indicate the IRQs are initially disconnected. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-08-15apic: Fix reported DFR contentJan Kiszka
IA-32 SDM, Figure 10-14: Bits 27:0 are reserved as 1. Fixes Jailhouse hypervisor start with in-kernel irqchips off. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-06-27xics: Implement xics_ics_free()Alexey Kardashevskiy
This implements interrupt release function so IRQs can be returned back to the pool for reuse in cases such as PCI hot plug. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alexander Graf <agraf@suse.de>
2014-06-27spapr: Move interrupt allocator to xicsAlexey Kardashevskiy
The current allocator returns IRQ numbers from a pool and does not support IRQs reuse in any form as it did not keep track of what it previously returned, it only keeps the last returned IRQ. Some use cases such as PCI hot(un)plug may require IRQ release and reallocation. This moves an allocator from SPAPR to XICS. This switches IRQ users to use new API. This uses LSI/MSI flags to know if interrupt is allocated. The interrupt release function will be posted as a separate patch. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alexander Graf <agraf@suse.de>
2014-06-27xics: Disable flags reset on xics resetAlexey Kardashevskiy
Since islsi[] array has been merged into the ICSState struct, we must not reset flags as they tell if the interrupt is in use. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alexander Graf <agraf@suse.de>
2014-06-27xics: Add xics_find_source()Alexey Kardashevskiy
PAPR allows having multiple interrupt sources such as PHB. This adds a source lookup function and makes use of it. Since at the moment QEMU only supports a single source, no change in behaviour is expected. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alexander Graf <agraf@suse.de>
2014-06-27xics: Add flags for interruptsAlexey Kardashevskiy
The existing interrupt allocation scheme in SPAPR assumes that interrupts are allocated at the start time, continously and the config will not change. However, there are cases when this is not going to work such as: 1. migration - we will have to have an ability to choose interrupt numbers for devices in the command line and this will create gaps in interrupt space. 2. PCI hotplug - interrupts from unplugged device need to be returned back to interrupt pool, otherwise we will quickly run out of interrupts. This replaces a separate lslsi[] array with a byte in the ICSIRQState struct and defines "LSI" and "MSI" flags. Neither of these flags set signals that the descriptor is not allocated and not in use. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alexander Graf <agraf@suse.de>
2014-06-27spapr: Fix RTAS token numbersAlexey Kardashevskiy
At the moment spapr_rtas_register() allocates a new token number for every new RTAS callback so numbers are not fixed and depend on the number of supported RTAS handlers and the exact order of spapr_rtas_register() calls. These tokens are copied into the device tree and remain the same during the guest lifetime. When we start another guest to receive a migration, it calls spapr_rtas_register() as well. If the number of RTAS handlers or their order is different in QEMU on source and destination sides, the "/rtas" node in the device tree will differ. Since migration overwrites the device tree (as it overwrites the entire RAM), the actual RTAS config on the destination side gets broken. This defines global contant values for every RTAS token which QEMU is using today. This changes spapr_rtas_register() to accept a token number instead of allocating one. This changes all users of spapr_rtas_register(). This changes XICS-KVM not to cache tokens registered with KVM as they constant now. This makes TOKEN_BASE global as RTAS_XXX use TOKEN_BASE as a base. TOKEN_MAX is moved and renamed too and its value is changed to the last token + 1. Boundary checks for token values are adjusted. This reserves token numbers for "os-term" handlers and PCI hotplug which we are working on. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alexander Graf <agraf@suse.de>
2014-06-19armv7m_nvic: fix AIRCR implementationOran Avraham
The returned reset value was wrong (off by one zero nibble), and qemu didn't log unimplemented writes to the PRIGROUP field. Signed-off-by: Oran Avraham <oranav@gmail.com> Message-id: 1403010447-4627-1-git-send-email-oranav@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-06-16PPC: openpic_kvm: Implement resetAlexander Graf
When we trigger a system reset, the in-kernel openpic controller should also get reset. This happens through a write to the GCR.RESET register which is the same mechanism a guest would use to manually reset the device. Signed-off-by: Alexander Graf <agraf@suse.de>
2014-06-16openpic: Reset IRQ source private membersPaul Janzen
The openpic emulation code maintains an allowable-CPU's bitmap ("destmask") for each IRQ source which is calculated from the IDR register value whenever the guest OS writes to it. However, if the guest OS relies on the system to set the IDR register to a default value at reset, and does not write IDR, then destmask does not get updated, and interrupts do not get propagated to the guest. Additionally, if an IRQ source is marked as critical, the source's internal "output" and "nomask" fields are not correctly reset when the PIC is reset. Fix both these issues by calling write_IRQreg_idr from within openpic_reset, instead of simply setting the IDR register to the specified idr_reset value. Signed-off-by: Paul Janzen <pcj@pauljanzen.org> Signed-off-by: Alexander Graf <agraf@suse.de>
2014-06-16openpic: Move definition of openpic_resetPaul Janzen
This patch moves the definition of openpic_reset after the various register read/write functions. No functional change. It is in preparation for using the register read/write functions in openpic_reset. Signed-off-by: Paul Janzen <pcj@pauljanzen.org> Signed-off-by: Alexander Graf <agraf@suse.de>
2014-06-16savevm: Remove all the unneeded version_minimum_id_old (x86)Juan Quintela
After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Acked-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-16savevm: Remove all the unneeded version_minimum_id_old (ppc)Juan Quintela
After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Acked-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2014-06-10hw/intc/openpic: Remove unused function IRQ_testbit()Peter Maydell
The IRQ_testbit() function is never used; remove it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-06-10s390x/kvm: inject via flicCornelia Huck
Try to inject floating interrupts via the flic if it is available. This allows us to inject the full range of floating interrupts. Reviewed-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-06-10s390x/kvm: make flic play well with old kernelsCornelia Huck
If we run with an old kernel that does not support KVM_CAP_IRQ_ROUTING, we don't have to do anything in the ->register_io_adapter and ->io_adapter_map callbacks and therefore should return 0 instead of -ENOSYS (just as the non-kvm flic does). This fixes using adapter interrupts when running under an older kernel, which broke with "s390x: add I/O adapter registration". Reported-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-06-09intc: xilinx_uartlite: Convert SBD::init -> instance_initPeter Crosthwaite
SysBusDevice::init is depracated. Convert to Object::init as prescribed by QOM conventions. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
2014-05-20s390x/virtio-ccw: wire up irq routing and irqfdsCornelia Huck
Make use of the new s390 adapter irq routing support to enable real in-kernel irqfds for virtio-ccw with adapter interrupts. Note that s390 doesn't provide the common KVM_CAP_IRQCHIP capability, but rather needs KVM_CAP_S390_IRQCHIP to be enabled. This is to ensure backward compatibility. Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-05-20s390x: add I/O adapter registrationCornelia Huck
Register an I/O adapter interrupt source for when virtio-ccw devices start using adapter interrupts. Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-05-20s390x: split flic into kvm and non-kvm partsCornelia Huck
Introduce a common parent class for both cases, where kvm and non-kvm can hook up callbacks. This will be used by follow-on patches for adapter registration and mapping. We now always have a flic, regardless of whether we use kvm; the non-kvm implementation just doesn't do anything. Reviewed-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-05-15Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20140515' ↵Peter Maydell
into staging migration/next for 20140515 # gpg: Signature made Thu 15 May 2014 02:32:25 BST using RSA key ID 5872D723 # gpg: Can't check signature: public key not found * remotes/juanquintela/tags/migration/20140515: usb: fix up post load checks migration: show average throughput when migration finishes savevm: Remove all the unneeded version_minimum_id_old (rest) savevm: Remove all the unneeded version_minimum_id_old (usb) Split ram_save_block arch_init: Simplify code for load_xbzrle() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-15Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20140513' into staging target-arm queue: * update libvixl to 1.4 * remove version_minimum_id_old from ARM devices * stellaris_enet tx/rx/migration overhaul * various minor fixes for coverity issues # gpg: Signature made Tue 13 May 2014 16:25:12 BST using RSA key ID 14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" * remotes/pmaydell/tags/pull-target-arm-20140513: hw/arm/omap_gpmc: Avoid buffer overrun filling prefetch FIFO hw/arm/stellaris: Correct handling of GPTM TAR register hw/timer/exynos4210_mct: Avoid overflow in exynos4210_ltick_recalc_count hw/dma/omap_dma: Add (uint32_t) casts when shifting uint16_t by 16 hw/arm/omap1: Avoid unintended sign extension writing omap_rtc YEARS_REG hw/net/cadence_gem: Remove dead code hw/intc/allwinner-a10-pic: Add missing 'break' target-arm/helper.c: Don't flush the TLB if SCTLR is rewritten unchanged hw/net/stellaris_enet: Convert to vmstate hw/net/stellaris_enet: Get rid of rx_fifo pointer hw/net/stellaris_enet: Fix debug format strings hw/net/stellaris_enet: Correctly implement the TR and THR registers hw/net/stellaris_enet: Rewrite tx fifo handling code hw/net/stellaris_enet: Correct handling of packet padding hw/net/stellaris_enet: Restructure tx_fifo code to avoid buffer overrun savevm: Remove all the unneeded version_minimum_id_old (arm) disas/libvixl: Update to libvixl 1.4 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-14savevm: Remove all the unneeded version_minimum_id_old (rest)Juan Quintela
After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-13hw/intc/allwinner-a10-pic: Add missing 'break'Peter Maydell
Add missing 'break' after handling of AW_A10_PIC_BASE_ADDR write. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
2014-05-13savevm: Remove all the unneeded version_minimum_id_old (arm)Juan Quintela
After commit 767adce2d, they are redundant. This way we don't assign them except when needed. Once there, there were lots of cases where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (apart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> [PMM: fixed minor conflict, corrected commit message typos] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-13apic: do not accept SIPI on the bootstrap processorPaolo Bonzini
SIPI interrupts are ignored on the bootstrap. Never accept one. Cc: Andreas Faerber <afaerber@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-05-13xilinx_intc: Fix writes into MER registerGuenter Roeck
The MER register only has two valid bits. This is now used by the linux kernel to auto-detect endianness, and causes Linux 3.15-rc1 and later to hang when run under qemu-microblaze. Mask valid bits before writing the register to solve the problem. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@gmail.com> [Edgar: Untabified] Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
2014-05-07Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pc,net,MAINTAINERS,build updates MAINTAINERS updated with link to the security process documentation apic version modified to make more guests happy On top of that, bugfixes all over the place Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 07 May 2014 17:15:29 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: configure: make source tree build more robust MAINTAINERS: addresses for responsible disclosure pm_smbus: correctly report unclaimed cycles smbus: return -1 if nothing found at the given address smbus: allow returning an error from reads apic: use emulated lapic version 0x14 on pc machines >= 2.1 pc: add compat_props placeholder for 2.0 machine type i8259: don't abort when trying to use level sensitive irqs acpi: fix tables for no-hpet configuration acpi-build: properly decrement objects' reference counters acpi/pcihp.c: Rewrite acpi_pcihp_get_bsel using object_property_get_int Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-07apic: use emulated lapic version 0x14 on pc machines >= 2.1Gabriel L. Somlo
Add "version" property to local apic, and have it default to 0x14 for pc machines starting at 2.1. For compatibility with previous releases, pc machines up to 2.0 will have their local apic version set to 0x11. Signed-off-by: Gabriel L. Somlo <somlo@cmu.edu> Acked-by: Alexander Graf <agraf@suse.de> Reviewed-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-05-07i8259: don't abort when trying to use level sensitive irqsHervé Poussineau
This is a guest-triggerable error, as seen when using Xenix 2.3.4. Replace hw_error by LOG_UNIMPL, so that guests can continue. With this patch, I can install and use Xenix 2.3.4a without any problem. I can also start installation of Xenix 2.3.4q, but it fails due to not finding an hard disk. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-05-07Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20140505' ↵Peter Maydell
into staging migration/next for 20140505 # gpg: Signature made Mon 05 May 2014 21:27:24 BST using RSA key ID 5872D723 # gpg: Can't check signature: public key not found * remotes/juanquintela/tags/migration/20140505: (36 commits) migration: expose xbzrle cache miss rate migration: expose the bitmap_sync_count to the end migration: Add counts of updating the dirty bitmap XBZRLE: Fix one XBZRLE corruption issues migration: remove duplicate code Coverity: Fix failure path for qemu_accept in migration Init the XBZRLE.lock in ram_mig_init Provide init function for ram migration Count used RAMBlock pages for migration_dirty_pages Make qemu_peek_buffer loop until it gets it's data Disallow outward migration while awaiting incoming migration virtio: validate config_len on load virtio-net: out-of-bounds buffer write on load openpic: avoid buffer overrun on incoming migration ssi-sd: fix buffer overrun on invalid state load savevm: Ignore minimum_version_id_old if there is no load_state_old usb: sanity check setup_index+setup_len in post_load vmstate: s/VMSTATE_INT32_LE/VMSTATE_INT32_POSITIVE_LE/ virtio-scsi: fix buffer overrun on invalid state load zaurus: fix buffer overrun on invalid state load ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-05openpic: avoid buffer overrun on incoming migrationMichael Roth
CVE-2013-4534 opp->nb_cpus is read from the wire and used to determine how many IRQDest elements to read into opp->dst[]. If the value exceeds the length of opp->dst[], MAX_CPU, opp->dst[] can be overrun with arbitrary data from the wire. Fix this by failing migration if the value read from the wire exceeds MAX_CPU. Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Reviewed-by: Alexander Graf <agraf@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05arm: Clean up fragile use of error_is_set() in realize() methodsMarkus Armbruster
Using error_is_set(ERRP) to find out whether a function failed is either wrong, fragile, or unnecessarily opaque. It's wrong when ERRP may be null, because errors go undetected when it is. It's fragile when proving ERRP non-null involves a non-local argument. Else, it's unnecessarily opaque (see commit 84d18f0). I guess the error_is_set(errp) in the DeviceClass realize() methods are merely fragile right now, because I can't find a call chain that passes a null errp argument. Make the code more robust and more obviously correct: receive the error in a local variable, then propagate it through the parameter. Signed-off-by: Markus Armbruster <armbru@redhat.com> Acked-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-05-05hw: Consistently name Error ** objects errp, and not errMarkus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-05-02Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20140501' into staging target-arm queue: * implement XScale cache lockdown cp15 ops * fix v7M CPUID base register * implement WFE and YIELD as yields for A64 * fix A64 "BLR LR" * support Cortex-A57 in virt machine model * a few other minor AArch64 bugfixes # gpg: Signature made Thu 01 May 2014 15:42:17 BST using RSA key ID 14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" * remotes/pmaydell/tags/pull-target-arm-20140501: hw/arm/virt: Add support for Cortex-A57 hw/arm/virt: Put GIC register banks on 64K boundaries hw/arm/virt: Create the GIC ourselves rather than (ab)using a15mpcore_priv target-arm: Correct a comment refering to EL0 target-arm: A64: Fix a typo when declaring TLBI ops target-arm: A64: Handle blr lr target-arm: Make vbar_write 64bit friendly on 32bit hosts target-arm: implement WFE/YIELD as a yield for AArch64 armv7m_nvic: fix CPUID Base Register target-arm: Implement XScale cache lockdown operations as NOPs Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-01armv7m_nvic: fix CPUID Base RegisterRabin Vincent
cp15.c0_cpuid is never initialized for ARMv7-M; take the value directly from cpu->midr instead. Signed-off-by: Rabin Vincent <rabin@rab.in> Message-id: 1398036308-32166-1-git-send-email-rabin@rab.in Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-30ppc: use kvm_vcpu_enable_cap()Cornelia Huck
Convert existing users of KVM_ENABLE_CAP to new helper. Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Alexander Graf <agraf@suse.de> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-04-27misc: Use cpu_physical_memory_read and cpu_physical_memory_writeStefan Weil
These functions don't need type casts (as does cpu_physical_memory_rw) and also make the code better readable. Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-04-17allwinner-a10-pic: fix behaviour of pending registerBeniamino Galvani
The pending register is read-only and the value returned upon a read reflects the state of irq input pins (interrupts are level triggered). This patch implements such behaviour. Signed-off-by: Beniamino Galvani <b.galvani@gmail.com> Reviewed-by: Li Guang <lig.fnst@cn.fujitsu.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: 1395771730-16882-3-git-send-email-b.galvani@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-17allwinner-a10-pic: set vector address when an interrupt is pendingBeniamino Galvani
This patch implements proper updating of the vector register which should hold, according to the A10 user manual, the vector address for the interrupt currently active on the CPU IRQ input. Interrupt priority is not implemented at the moment and thus the first pending interrupt is returned. Signed-off-by: Beniamino Galvani <b.galvani@gmail.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Li Guang <lig.fnst@cn.fujitsu.com> Message-id: 1395771730-16882-2-git-send-email-b.galvani@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-03PPC: openpic_kvm: Filter memory events properlyAlexander Graf
Commit 6f1834a2b exposed a bug in openpic_kvm where we don't filter for memory events that only happen to the region we want to know events about. Add proper filtering, fixing the e500plat target with KVM. Signed-off-by: Alexander Graf <agraf@suse.de> Message-id: 1396431718-14908-1-git-send-email-agraf@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-25 00:55:45 +0000