aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2014-03-04Merge remote-tracking branch 'remotes/borntraeger/tags/kvm-s390-20140227' ↵Peter Maydell
into staging Several features, fixes and cleanups for kvm/s390: - sclp event facility: cleanup structure. This allows to use realize/unrealize as well as migration support via vmsd - reboot: Two fixes that make reboot much more reliable - ipl: make elf loading more robust - flic interrupt controller: This allows to migrate floating interrupts, as well as clear them on reset etc. - enable async_pf feature of KVM on s390 - several sclp fixes and cleanups - several sigp fixes and cleanups * remotes/borntraeger/tags/kvm-s390-20140227: (22 commits) s390x/ipl: Fix crash of ELF images with arbitrary entry points s390x/kvm: Rework priv instruction handlers s390x/kvm: Add missing SIGP CPU RESET order s390x/kvm: Rework SIGP INITIAL CPU RESET handler s390x/cpu: Use ioctl to reset state in the kernel s390-ccw.img: new binary rom to match latest fixes s390-ccw.img: Fix sporadic errors with ccw boot image - initialize css s390-ccw.img: Fix sporadic reboot hangs: Initialize next_idx s390x/event-facility: exploit realize/unrealize s390x/event-facility: add support for live migration s390x/event-facility: code restructure s390x/event-facility: some renaming s390x/sclp: Fixed setting of condition code register s390x/sclp: Add missing checks to SCLP handler s390x/sclp: Fixed the size of sccb and code parameter s390x/eventfacility: mask out commands s390x/virtio-hcall: Specification exception for illegal subcodes s390x/virtio-hcall: Add range check for hypervisor call s390x/kvm: Fixed bad SIGP SET-ARCHITECTURE handler s390x/async_pf: Check for apf extension and enable pfault ... Conflicts: linux-headers/linux/kvm.h Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-04Merge remote-tracking branch 'remotes/bonzini/scsi-next' into stagingPeter Maydell
* remotes/bonzini/scsi-next: block/iscsi: fix segfault if writesame fails scsi-disk: Add support for port WWN and index descriptors in VPD page 83h block/iscsi: query for supported VPD pages block/iscsi: fix deadlock on scsi check condition scsi-bus: Fix transfer length for VERIFY with BYTCHK=11b scsi: report thin provisioning errors with werror=report scsi: Change scsi sense buf size to 252 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-04Merge remote-tracking branch 'remotes/mcayland/qemu-sparc' into stagingPeter Maydell
* remotes/mcayland/qemu-sparc: sun4m: Add Sun CG3 framebuffer initialisation function sun4m: Add Sun CG3 framebuffer and corresponding OpenBIOS FCode ROM sun4m: fix slavio timer RUN/STOP bit sun4m: Set HostID in NVRAM Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-27Merge remote-tracking branch ↵Peter Maydell
'remotes/awilliam/tags/vfio-pci-for-qemu-20140226.0' into staging Updates include: - Coverify fixes for vfio & pci-assign (Markus) - VFIO blacklisting support for known brokwn PCI option ROMs (Bandan) # gpg: Signature made Wed 26 Feb 2014 18:15:28 GMT using RSA key ID 3BB08B22 # gpg: Can't check signature: public key not found * remotes/awilliam/tags/vfio-pci-for-qemu-20140226.0: vfio: blacklist loading of unstable roms qdev-monitor: set DeviceState opts before calling realize pci-assign: Fix potential read beyond buffer on -EBUSY vfio: Fix overrun after readlink() fills buffer completely Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-27sun4m: Add Sun CG3 framebuffer initialisation functionMark Cave-Ayland
In order to allow the user to choose the framebuffer for sparc-softmmu, add -vga tcx and -vga cg3 options to the QEMU command line. If no option is specified, the default TCX framebuffer is used. Since proprietary FCode ROMs use a resolution of 1152x900, slightly relax the validation rules to allow both displays to be initiated at the higher resolution used by these ROMs upon request (OpenBIOS FCode ROMs default to the normal QEMU sun4m default resolution of 1024x768). Finally move any fprintf(stderr ...) statements in the areas affected by this patch over to the new error_report() function. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Blue Swirl <blauwirbel@gmail.com> CC: Anthony Liguori <aliguori@amazon.com> CC: Peter Maydell <peter.maydell@linaro.org> CC: Bob Breuer <breuerr@mc.net> CC: Artyom Tarasenko <atar4qemu@gmail.com>
2014-02-27sun4m: Add Sun CG3 framebuffer and corresponding OpenBIOS FCode ROMMark Cave-Ayland
The CG3 framebuffer is a simple 8-bit framebuffer for use with operating systems such as early Solaris that do not have drivers for TCX. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Blue Swirl <blauwirbel@gmail.com> CC: Anthony Liguori <aliguori@amazon.com> CC: Peter Maydell <peter.maydell@linaro.org> CC: Bob Breuer <breuerr@mc.net> CC: Artyom Tarasenko <atar4qemu@gmail.com>
2014-02-27sun4m: fix slavio timer RUN/STOP bitMark Cave-Ayland
The sun4m architecture has one 'system' timer and one timer per CPU. The CPU timers can be configured in two modes: * 22 bits Counter/Timer. Periodic interrupts. * 54 bits User timer. For profiling. In this mode, the Run/Stop bit controls the timer. The run/stop bit controls the timer only when it is in "User" mode, but its state shall be persistent. Signed-off-by: Olivier Danet <odanet@caramail.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2014-02-27s390x/ipl: Fix crash of ELF images with arbitrary entry pointsThomas Huth
When loading S390 kernels, the current code expects an ELF file with the start address 0x10000. Other ELF files cause a segmentation fault. To avoid these crashes, we should get the start address from the ELF file instead of always using a hard-coded address. Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com> Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2014-02-27s390x/event-facility: exploit realize/unrealizeHeinz Graalfs
init/exit functionality of abstract SCLPEvent class is now exploiting realize/unrealize. Signed-off-by: Heinz Graalfs <graalfs@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2014-02-27s390x/event-facility: add support for live migrationHeinz Graalfs
Add support for live migration using VMStateDescription. Signed-off-by: Heinz Graalfs <graalfs@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2014-02-27s390x/event-facility: code restructureHeinz Graalfs
Code restructure in order to simplify class hierarchy - remove S390SCLPDevice abstract base class and move function pointers into new SCLPEventFacilityClass - implement SCLPEventFacility as SysBusDevice - use define constants for instance creation strings The following ascii-art shows the class structure wrt the SCLP EventFacility before (CURRENT) and after the restructure (NEW): ---- CURRENT: "s390-sclp-events-bus" +-------------------------+ | SCLPEventsBus | |-------------------------| |BusState qbus | +-------------------------+ +-------------------------+ | SCLPEventFacility | - to be replaced by new SCLPEventFacility, |-------------------------| which will be a SysBusDevice |SCLPEventsBus sbus | |DeviceState *qdev | |unsigned int receive_mask| +-------------------------+ +-------------------------+ | S390SCLPDeviceClass | - to be replaced by new SCLPEventFacilityClass |-------------------------| |DeviceClass qdev | |*(init)() | +-------------------------+ "s390-sclp-event-facility" | instance-of | V "s390-sclp-device" - this is an abstract class +-------------------------+ | S390SCLPDevice (A)| - to be replaced by new SCLPEventFacility |-------------------------| |SysBusDevice busdev | |SCLPEventFacility *ef | | | |*(sclp_command_handler)()| - these 2 go to new SCLPEventFacilityClass |*(event_pending)() | +-------------------------+ ---- NEW: "s390-sclp-events-bus" +-------------------------+ | SCLPEventsBus | |-------------------------| |BusState qbus | +-------------------------+ +-------------------------+ | SCLPEventFacilityClass | |-------------------------| |DeviceClass parent_class | | | |*(init)() | |*(command_handler)() | |*(event_pending)() | +-------------------------+ "s390-sclp-event-facility" +-------------------------+ | SCLPEventFacility | |-------------------------| |SysBusDevice parent_class| |SCLPEventsBus sbus | |unsigned int receive_mask| +-------------------------+ Signed-off-by: Heinz Graalfs <graalfs@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2014-02-27s390x/event-facility: some renamingHeinz Graalfs
Do some renaming to shorten some identifiers and to emphasize sclp. Signed-off-by: Heinz Graalfs <graalfs@linux.vnet.ibm.com> Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2014-02-27s390x/sclp: Add missing checks to SCLP handlerThomas Huth
If the 51 most significant bits of the SCCB address are zero or equal to the prefix, we should throw an specification exception, too. Also moved the check for privileged mode to sclp_service_call() to have all program checks in one place now. Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2014-02-27s390x/sclp: Fixed the size of sccb and code parameterThomas Huth
The pointer to the SCCB should not be limited to 32 bits only. In contrast to this, the command word parameter is only 32 bits (the upper 32 bits should be ignored). Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2014-02-27s390x/eventfacility: mask out commandsChristian Borntraeger
As a followup to commit 5f04c14a10fa7f259bc0808f35a0beda49f7821e (s390-sclp: Define New SCLP Codes) we should mask the sclp command not only in base sclp, but also in the event facility. Based on an initial patch from Ralf Hoppe. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2014-02-27s390x/virtio-hcall: Specification exception for illegal subcodesThomas Huth
So far, the DIAG 500 hypervisor call was only setting -EINVAL in R2 when a guest tried to call this function with an illegal subcode. This patch now changes the behavior so that a specification exception is thrown instead, since this is the common behavior of other DIAG functions (and other CPU instructions) when being called with illegal parameters. Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2014-02-27s390x/virtio-hcall: Add range check for hypervisor callThomas Huth
The handler for diag 500 did not check whether the requested function was in the supported range, so illegal values could crash QEMU in the worst case. Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> CC: qemu-stable@nongnu.org
2014-02-27s390x/async_pf: Check for apf extension and enable pfaultDominik Dingel
S390 can also use async page faults, to enhance guest scheduling. In case of live migration we want to disable the feature and let all pending request finish. Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com> Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2014-02-27s390x/kvm: implement floating-interrupt controller deviceJens Freimann
This patch implements a floating-interrupt controller device (flic) which interacts with the s390 flic kvm_device. Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2014-02-26Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20140226' into staging target-arm queue: * fixes for various Coverity-spotted bugs * support new KVM device control API for VGIC * support KVM VGIC save/restore/migration * more AArch64 system mode foundations * support ARMv8 CRC instructions for A32/T32 * PL330 minor fixes and cleanup # gpg: Signature made Wed 26 Feb 2014 17:51:32 GMT using RSA key ID 14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" * remotes/pmaydell/tags/pull-target-arm-20140226: (45 commits) dma/pl330: implement dmaadnh instruction dma/pl330: Fix buffer depth dma/pl330: Add event debugging printfs dma/pl330: Rename parent_obj dma/pl330: printf format type sweep. dma/pl330: Fix misleading type dma/pl330: Delete overly verbose debug printf target-arm: Add support for AArch32 ARMv8 CRC32 instructions include/qemu/crc32c.h: Rename include guards to match filename target-arm: Add utility function for checking AA32/64 state of an EL target-arm: Implement AArch64 view of CPACR target-arm: A64: Implement MSR (immediate) instructions target-arm: Store AIF bits in env->pstate for AArch32 target-arm: A64: Implement WFI target-arm: Get MMU index information correct for A64 code target-arm: Implement AArch64 OSLAR_EL1 sysreg as WI target-arm: Implement AArch64 dummy breakpoint and watchpoint registers target-arm: Implement AArch64 ID and feature registers target-arm: Implement AArch64 generic timers target-arm: Implement AArch64 MPIDR ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-26Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into ↵Peter Maydell
staging Net patches # gpg: Signature made Tue 25 Feb 2014 13:32:33 GMT using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/net-pull-request: virtio-net: use qemu_get_queue() where possible vhost_net: use offload API instead of bypassing it net: remove implicit peer from offload API net: Disable netmap backend when not supported net: add offloading support to netmap backend net: make tap offloading callbacks static net: virtio-net and vmxnet3 use offloading API net: TAP uses NetClientInfo offloading callbacks net: extend NetClientInfo for offloading net: change vnet-hdr TAP prototypes opencores_eth: flush queue whenever can_receive can go from false to true Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-26Merge remote-tracking branch 'remotes/kraxel/tags/pull-audio-3' into stagingPeter Maydell
hda-audio: qom cleanups # gpg: Signature made Mon 24 Feb 2014 12:19:48 GMT using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-audio-3: hda-audio: qom cleanups Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-26vfio: blacklist loading of unstable romsBandan Das
Certain cards such as the Broadcom BCM57810 have rom quirks that exhibit unstable system behavior duing device assignment. In the particular case of 57810, rom execution hangs and if a FLR follows, the device becomes inoperable until a power cycle. This change blacklists loading of rom for such cards unless the user specifies a romfile or rombar=1 on the cmd line Signed-off-by: Bandan Das <bsd@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2014-02-26pci-assign: Fix potential read beyond buffer on -EBUSYMarkus Armbruster
readlink() doesn't write a terminating null byte. assign_failed_examine() passes the unterminated string to strrchr(). Oops. Terminate it. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2014-02-26vfio: Fix overrun after readlink() fills buffer completelyMarkus Armbruster
readlink() returns the number of bytes written to the buffer, and it doesn't write a terminating null byte. vfio_init() writes it itself. Overruns the buffer when readlink() filled it completely. Fix by treating readlink() filling the buffer completely as error, like we do in pci-assign.c's assign_failed_examine(). Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2014-02-26dma/pl330: implement dmaadnh instructionPeter Crosthwaite
Implement the missing DMAADNH instruction. This is a minor variant of the DMAADDH instruction, so factor out to a common implementation for both (dmaadxh). Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: 73ab13532a7cae53441da89b46c279b5f50785e3.1393372019.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-26dma/pl330: Fix buffer depthPeter Crosthwaite
This is the product of the data-width and the depth arguments, I.e the depth of the FIFO is in terms of data entries and not bytes (which is what the original implementation was suggesting). Fix. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: c34de31031511538ccdb3164b48ee8a6a973ebd4.1393372019.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-26dma/pl330: Add event debugging printfsPeter Crosthwaite
These are helpful to anyone trying to debug event sequencing. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: e82a0ad804db3de4f46839e55a9d287735ef870d.1393372019.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-26dma/pl330: Rename parent_objPeter Crosthwaite
As per current QOM conventions. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: abb137347ea1ee9c31487b544f3d5435fb17f6a4.1393372019.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-26dma/pl330: printf format type sweep.Peter Crosthwaite
Use PRI formats as appropriate rather than raw %x and %d. This fixes debug printfery on some host platforms. Fix types of debug only variables as appropriate. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: dbb5f5fd048b2d4a3cb5c6357577d11211a7a585.1393372019.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-26dma/pl330: Fix misleading typePeter Crosthwaite
This type really should just be a regular int as no usages rely on it's 32 bitness (it's only meaningful as a bit position and not a bit mask). This also fixes a printf which uses the variable with a regular %d. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 2a99d31f377aee371476d9da8fd0d1b7efa30f63.1393372019.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-26dma/pl330: Delete overly verbose debug printfPeter Crosthwaite
When using event synchronisation, this particular debug printf floods. Just delete it. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: dd94d19493f97c47497b9d8caf74ca43e70d58fd.1393372019.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-26target-arm: Store AIF bits in env->pstate for AArch32Peter Maydell
To avoid complication in code that otherwise would not need to care about whether EL1 is AArch32 or AArch64, we should store the interrupt mask bits (CPSR.AIF in AArch32 and PSTATE.DAIF in AArch64) in one place consistently regardless of EL1's mode. Since AArch64 has an extra enable bit (D for debug exceptions) which isn't visible in AArch32, this means we need to keep the enables in env->pstate. (This is also consistent with the general approach we're taking that we handle 32 bit CPUs as being like AArch64/ARMv8 CPUs but which only run in 32 bit mode.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
2014-02-26target-arm: Implement AArch64 TTBR*Peter Maydell
Implement the AArch64 TTBR* registers. For v7 these were already 64 bits to handle LPAE, but implemented as two separate uint32_t fields. Combine them into a single uint64_t which can be used for all purposes. Since this requires touching every use, take the opportunity to rename the field to the architectural name. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
2014-02-26hw: arm_gic_kvm: Add KVM VGIC save/restore logicChristoffer Dall
Save and restore the ARM KVM VGIC state from the kernel. We rely on QEMU to marshal the GICState data structure and therefore simply synchronize the kernel state with the QEMU emulated state in both directions. We take some care on the restore path to check the VGIC has been configured with enough IRQs and CPU interfaces that we can properly restore the state, and for separate set/clear registers we first fully clear the registers and then set the required bits. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org> Message-id: 1392687921-26921-1-git-send-email-christoffer.dall@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-26arm: vgic device control api supportChristoffer Dall
Support creating the ARM vgic device through the device control API and setting the base address for the distributor and cpu interfaces in KVM VMs using this API. Because the older KVM_CREATE_IRQCHIP interface needs the irq chip to be created prior to creating the VCPUs, we first test if we can use the device control API in kvm_arch_irqchip_create (using the test flag from the device control API). If we cannot, it means we have to fall back to KVM_CREATE_IRQCHIP and use the older ioctl at this point in time. If however, we can use the device control API, we don't do anything and wait until the arm_gic_kvm driver initializes and let that use the device control API. Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org> Message-id: 1392687720-26806-5-git-send-email-christoffer.dall@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-26hw/intc/arm_gic: Fix GIC_SET_LEVELChristoffer Dall
The GIC_SET_LEVEL macro unfortunately overwrote the entire level bitmask instead of just or'ing on the necessary bits, causing active level PPIs on a core to clear PPIs on other cores. Cc: qemu-stable@nongnu.org Reported-by: Rob Herring <rob.herring@linaro.org> Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org> Message-id: 1393031030-8692-1-git-send-email-christoffer.dall@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-02-26hw/arm/musicpal: Remove nonexistent CDTP2, CDTP3 registersPeter Maydell
The ethernet device in the musicpal only has two tx queues, but we modelled it with four CTDP registers, presumably a cut and paste from the rx queue registers. Since the tx_queue[] array is only 2 entries long this allowed a guest to overrun this buffer. Remove the nonexistent registers. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1392737293-10073-1-git-send-email-peter.maydell@linaro.org Acked-by: Jan Kiszka <jan.kiszka@web.de> Cc: qemu-stable@nongnu.org
2014-02-26hw/intc/exynos4210_combiner: Don't overrun output_irq array in initPeter Maydell
The Exynos4210 combiner has IIC_NIRQ inputs and IIC_NGRP outputs; use the correct constant in the loop initializing our output sysbus IRQs so that we don't overrun the output_irq[] array. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1392659611-8439-1-git-send-email-peter.maydell@linaro.org Reviewed-by: Andreas Färber <afaerber@suse.de> Cc: qemu-stable@nongnu.org
2014-02-26hw/timer/arm_timer: Avoid array overrun for bad addressesPeter Maydell
The integrator's timer read/write functions log an error for bad addresses in guest accesses, but were falling through and using an out of bounds array index rather than returning early. Fix this. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Message-id: 1392647854-8067-4-git-send-email-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org
2014-02-26hw/net/stellaris_enet: Avoid unintended sign extensionPeter Maydell
Add a cast to avoid an unintended sign extension that would mean we returned 0xffffffff in the high 32 bits for an IA0 read if bit 31 in the MAC address was 1. (This is harmless since we'll only be doing 4 byte reads, but it could be confusing, so best avoided.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Message-id: 1392647854-8067-3-git-send-email-peter.maydell@linaro.org
2014-02-26hw/misc/arm_sysctl: Fix bad boundary check on mb clock accessesPeter Maydell
Fix incorrect use of sizeof() rather than ARRAY_SIZE() to guard accesses into the mb_clock[] array, which was allowing a malicious guest to overwrite the end of the array. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Message-id: 1392647854-8067-2-git-send-email-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org
2014-02-26xilinx: Delete hw/include/xilinx.hPeter Crosthwaite
This is now obsolete - remove the header and all its inclusions. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2014-02-26xilinx: Inline usages of xilinx_axi*_init()Peter Crosthwaite
Inline the only usage of each of xilinx_axiethernet_init and xilinx_axidma_init. Converts this init to at least a semi-recent QOM styling. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2014-02-26xilinx: Inline usage of xilinx_ethlite_create()Peter Crosthwaite
Inline the only usage. Converts this init to at least a semi-recent QOM styling. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2014-02-26xilinx: Inline usages of xilinx_timer_create()Peter Crosthwaite
Inline these usages. Converts these init to at least a semi-recent QOM styling. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2014-02-26xilinx: Inline usages of xilinx_intc_create()Peter Crosthwaite
Inline these usages. Converts these init to at least a semi-recent QOM styling. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2014-02-26microblaze/ml605: Define macros for irq/memory mapsPeter Crosthwaite
Define (missing) macros for the interrupt and memory maps for the sake of self documentation. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2014-02-26ppc/virtex_ml507: Define macros for irq/memory mapsPeter Crosthwaite
Define macros for the interrupt and memory maps for the sake of self documentation. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2014-02-26microblaze/s3adsp_1800: Define macros for irq mapPeter Crosthwaite
Define macros for the interrupt map for the sake of self documentation. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-20 07:35:32 +0000