aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2015-06-03hw/pci: made pci_bus_is_root a PCIBusClass methodMarcel Apfelbaum
Refactoring it as a method of PCIBusClass will allow different implementations for subclasses. Removed the assumption that the root bus does not have a parent device because is specific only to the default class implementation. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03acpi: add implementation of aml_while() termMarcel Apfelbaum
Commit 68e6b0af7 (acpi: add aml_while() term) added the definition of aml_while without the actual implementation. Implement the term. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2015-06-03acpi: add acpi_send_gpe_event() to rise sci for hotplugZhu Guihua
Add a new API named acpi_send_gpe_event() to send hotplug SCI. This API can be used by pci, cpu and memory hotplug. This patch is rebased on master. Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2015-06-03virtio: 64bit features fixups.Gerd Hoffmann
Commit "019a3ed virtio: make features 64bit wide" missed a few changes, as I've noticed while trying to rebase the virtio-1 branch to latest master. This patch adds them. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-06-03virtio-pci: don't try to mask or unmask vqs without notifiersJason Wang
We should validate the vq index against nvqs_with_notifiers. Otherwise we may try to mask or unmask vector for vqs without notifiers (e.g control vq). This will lead qemu abort on kvm_irqchip_commit_routes() when trying to boot win8.1 guest. Fixes 851c2a75a6e80c8aa5e713864d98cfb512e7229b ("virtio-pci: speedup MSI-X masking and unmasking") Reported-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-06-03hw/q35: fix floppy controller definition in ich9Marcel Apfelbaum
In DSDT FDC0 declares the IO region as IO(Decode16, 0x03F2, 0x03F2, 0x00, 0x04). Use the same in lpc_ich9 initialization code. Now the floppy drive is detected correctly on Windows. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-06-03acpi: add missing ssdtMichael S. Tsirkin
commit 5cb18b3d7bff2a83275ee98af2a14eb9e21c93ab TPM2 ACPI table support was missing a file, so build with iasl fails (build without iasl works since it uses the generated hex files). Reported-by: "Daniel P. Berrange" <berrange@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-06-03virtio-ccw/migration: Migrate config vector for virtio devicesJason J. Herne
virtio_ccw_{save|load}_config are missing code to save and restore a vdev's config_vector value. This causes some virtio devices to become disabled following a migration. This patch fixes a bug whereby the qmp/hmp balloon command (virsh setmem) silently fails to update the guest's available memory because the device was not properly migrated. This will break compatibility, but vmstate_s390_cpu was bumped from version 2 to version 4 between v2.3.0 and v2.4.0 without a compat handler. Furthermore, there is no production environment yet so migration is fenced anyway between any relevant version of 2.3 and 2.4. Signed-off-by: Jason J. Herne <jjherne@linux.vnet.ibm.com> Message-Id: <1433343843-803-1-git-send-email-jjherne@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2015-06-03virtio-ccw: add support for 9pfsPierre Morel
This patch adds 9pfs support for virtio-ccw by registering the virtio_ccw_9p_info type and adding associated callbacks. Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2015-06-03cadence_gem: Fix Rx buffer size field maskSai Pavan Boddu
This patch corrects the Rx buffer size field mask to mask bits 23 to 16 to match Xilinx UG585 documentation. Signed-off-by: Sai Pavan Boddu <saipava@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/display/tc6393xb.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/arm/nseries.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/alpha/typhoon.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/unicore32/puv3.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/lm32/milkymist.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/lm32/lm32_boards.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/ppc/prep.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/sparc/sun4m.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/timer/arm_timer.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/isa/i82378.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/isa/lpc_ich9.c: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Since ich9_lpc_pm_init only requests one irq, so let it just call qemu_allocate_irq. Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/i386/pc: Fix misusing qemu_allocate_irqs for single irqShannon Zhao
Since pc_allocate_cpu_irq only requests one irq, so let it just call qemu_allocate_irq. Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/intc/exynos4210_gic.c: Fix memory leak by adjusting orderShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/arm/omap_sx1.c: Fix memory leak spotted by valgrindShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/ppc/e500.c: Fix memory leakShannon Zhao
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/alpha/dp264.c: Fix memory leak spotted by valgrindShannon Zhao
valgrind complains about: ==7055== 58 bytes in 1 blocks are definitely lost in loss record 1,471 of 2,192 ==7055== at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==7055== by 0x24410F: malloc_and_trace (vl.c:2556) ==7055== by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3) ==7055== by 0x64DEFD7: g_strndup (in /usr/lib64/libglib-2.0.so.0.3600.3) ==7055== by 0x650181A: g_vasprintf (in /usr/lib64/libglib-2.0.so.0.3600.3) ==7055== by 0x64DF0CC: g_strdup_vprintf (in /usr/lib64/libglib-2.0.so.0.3600.3) ==7055== by 0x64DF188: g_strdup_printf (in /usr/lib64/libglib-2.0.so.0.3600.3) ==7055== by 0x242F81: qemu_find_file (vl.c:2121) ==7055== by 0x217A32: clipper_init (dp264.c:105) ==7055== by 0x2484DA: main (vl.c:4249) Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/i386/acpi-build: decref after useShannon Zhao
valgrind complains about: ==16447== 48 bytes in 2 blocks are definitely lost in loss record 2,033 of 3,310 ==16447== at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==16447== by 0x2E4FD7: malloc_and_trace (vl.c:2546) ==16447== by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3) ==16447== by 0x53EC3F: qint_from_int (qint.c:33) ==16447== by 0x53B426: qmp_output_type_int (qmp-output-visitor.c:162) ==16447== by 0x539257: visit_type_uint32 (qapi-visit-core.c:147) ==16447== by 0x471D07: property_get_uint32_ptr (object.c:1651) ==16447== by 0x47000C: object_property_get (object.c:822) ==16447== by 0x472428: object_property_get_qobject (qom-qobject.c:37) ==16447== by 0x25701A: build_append_pci_bus_devices (acpi-build.c:520) ==16447== by 0x25902E: build_ssdt (acpi-build.c:1004) ==16447== by 0x25A0A8: acpi_build (acpi-build.c:1420) Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/ide/pci: Fix memory leakShannon Zhao
valgrind complains about: ==16447== 16 bytes in 2 blocks are definitely lost in loss record 1,304 of 3,310 ==16447== at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==16447== by 0x2E4FD7: malloc_and_trace (vl.c:2546) ==16447== by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3) ==16447== by 0x36FB47: qemu_extend_irqs (irq.c:55) ==16447== by 0x36FBD3: qemu_allocate_irqs (irq.c:64) ==16447== by 0x3B4B44: bmdma_init (pci.c:464) ==16447== by 0x3B547B: pci_piix_init_ports (piix.c:144) ==16447== by 0x3B55D2: pci_piix_ide_realize (piix.c:164) ==16447== by 0x3EAEC6: pci_qdev_realize (pci.c:1790) ==16447== by 0x36C685: device_set_realized (qdev.c:1058) ==16447== by 0x47179E: property_set_bool (object.c:1514) ==16447== by 0x470098: object_property_set (object.c:837) Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-03hw/i386/pc_piix: Fix memory leakShannon Zhao
valgrind complains about: ==16447== 8 bytes in 1 blocks are definitely lost in loss record 552 of 3,310 ==16447== at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==16447== by 0x2E4FD7: malloc_and_trace (vl.c:2546) ==16447== by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3) ==16447== by 0x36FB47: qemu_extend_irqs (irq.c:55) ==16447== by 0x36FBD3: qemu_allocate_irqs (irq.c:64) ==16447== by 0x24E622: pc_init1 (pc_piix.c:287) ==16447== by 0x24E76A: pc_init_pci (pc_piix.c:310) ==16447== by 0x2E9360: main (vl.c:4226) ==16447== 128 bytes in 1 blocks are definitely lost in loss record 2,569 of 3,310 ==16447== at 0x4C2845D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==16447== by 0x2E4FD7: malloc_and_trace (vl.c:2546) ==16447== by 0x64C770E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3600.3) ==16447== by 0x36FB47: qemu_extend_irqs (irq.c:55) ==16447== by 0x36FBD3: qemu_allocate_irqs (irq.c:64) ==16447== by 0x25BEB2: kvm_i8259_init (i8259.c:133) ==16447== by 0x24E1F1: pc_init1 (pc_piix.c:219) ==16447== by 0x24E76A: pc_init_pci (pc_piix.c:310) ==16447== by 0x2E9360: main (vl.c:4226) Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-02apic: convert ->busdev.qdev casts to C castsZhu Guihua
Use C casts to avoid accessing ICCDevice's qdev field directly. Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Acked-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2015-06-02pc: Ensure non-zero CPU ref count after attaching to ICC busAndreas Färber
Setting the parent bus of a device increases its ref count, which we ultimately want to level out. However it is only safe to do so after the last reference to the device in local code, as qom-set or similar operations might decrease the ref count. Therefore move the object_unref() from pc_new_cpu() into its callers. The APIC operations on the last CPU in pc_cpus_init() are still potentially insecure, but that is beyond the scope of this code movement. Signed-off-by: Andreas Färber <afaerber@suse.de> Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2015-06-02fdc: Fix MSR.RQM flagKevin Wolf
The RQM bit in MSR should be set whenever the guest is supposed to access the FIFO, and it should be cleared in all other cases. This is important so the guest can't continue writing/reading the FIFO beyond the length that it's suppossed to access (see CVE-2015-3456). Commit e9077462 fixed the CVE by adding code that avoids the buffer overflow; however it doesn't correct the wrong behaviour of the floppy controller which should already have cleared RQM. Currently, RQM stays set all the time and during all phases while a command is being processed. This is error-prone because the command has to explicitly clear the flag if it doesn't need data (and indeed, the two buggy commands that are the culprits for the CVE just forgot to do that). This patch clears RQM immediately as soon as all bytes that are expected have been received. If the the FIFO is used in the next phase, the flag has to be set explicitly there. It also clear RQM after receiving all bytes even if the phase transition immediately sets it again. While it's technically not necessary at the moment because the state between clearing and setting RQM is not observable by the guest, this is more explicit and matches how real hardware works. It will actually become necessary in qemu once asynchronous code paths are introduced. This alone should have been enough to fix the CVE, but now we have two lines of defense - even better. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-8-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-06-02fdc: Disentangle phases in fdctrl_read_data()Kevin Wolf
This commit makes similar improvements as have already been made to the write function: Instead of relying on a flag in the MSR to distinguish controller phases, use the explicit phase that we store now. Assertions of the right MSR flags are added. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-7-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-06-02fdc: Code cleanup in fdctrl_write_data()Kevin Wolf
Factor out a few common lines of code, reformat, improve comments. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-6-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-06-02fdc: Use phase in fdctrl_write_data()Kevin Wolf
Instead of relying on a flag in the MSR to distinguish controller phases, use the explicit phase that we store now. Assertions of the right MSR flags are added. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-5-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-06-02fdc: Introduce fdctrl->phaseKevin Wolf
The floppy controller spec describes three different controller phases, which are currently not explicitly modelled in our emulation. Instead, each phase is represented by a combination of flags in registers. This patch makes explicit in which phase the controller currently is. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Acked-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-4-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-06-02fdc: Rename fdctrl_set_fifo() to fdctrl_to_result_phase()Kevin Wolf
What callers really do with this function is to switch from execution phase (including data transfers) to result phase where the guest can read out one or more status bytes from the FIFO (the number depends on the command). Rename the function accordingly. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-3-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-06-02fdc: Rename fdctrl_reset_fifo() to fdctrl_to_command_phase()Kevin Wolf
What all callers of fdctrl_reset_fifo() really want to do is to start the command phase, where writes to the data port initiate a new command. The function doesn't only clear the FIFO, but also sets up the state so that a new command can be received. Rename it to reflect this. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-2-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-06-02Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2015-06-02' ↵Peter Maydell
into staging Monitor patches # gpg: Signature made Tue Jun 2 09:16:07 2015 BST using RSA key ID EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" * remotes/armbru/tags/pull-monitor-2015-06-02: (21 commits) monitor: Change return type of monitor_cur_is_qmp() to bool monitor: Rename monitor_ctrl_mode() to monitor_is_qmp() monitor: Turn int command_mode into bool in_command_mode monitor: Drop do_qmp_capabilities()'s superfluous QMP check monitor: Unbox Monitor member mc and rename to qmp monitor: Rename monitor_control_read(), monitor_control_event() monitor: Rename handle_user_command() to handle_hmp_command() monitor: Limit QError use to command handlers monitor: Inline monitor_has_error() into its only caller monitor: Wean monitor_protocol_emitter() off mon->error monitor: Propagate errors through invalid_qmp_mode() monitor: Propagate errors through qmp_check_input_obj() monitor: Propagate errors through qmp_check_client_args() monitor: Drop unused "new" HMP command interface monitor: Use trad. command interface for HMP pcie_aer_inject_error monitor: Use traditional command interface for HMP device_add monitor: Use traditional command interface for HMP drive_del monitor: Convert client_migrate_info to QAPI monitor: Improve and document client_migrate_info protocol error monitor: Clean up after previous commit ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-06-02hw/arm/virt: change indentation in a15memmapEric Auger
Re-indent in a15memmap after VIRT_PLATFORM_BUS introduction Signed-off-by: Eric Auger <eric.auger@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org> Message-id: 1433244554-12898-5-git-send-email-eric.auger@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-06-02hw/arm/virt: add dynamic sysbus device supportEric Auger
Allows sysbus devices to be instantiated from command line by using -device option. Machvirt creates a platform bus at init. The dynamic sysbus devices are attached to this platform bus device. The platform bus device registers a machine init done notifier whose role will be to bind the dynamic sysbus devices. Indeed dynamic sysbus devices are created after machine init. machvirt also registers a notifier that will build the device tree nodes for the platform bus and its children dynamic sysbus devices. Signed-off-by: Eric Auger <eric.auger@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1433244554-12898-4-git-send-email-eric.auger@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-06-02hw/arm/boot: arm_load_kernel implemented as a machine init done notifierEric Auger
Device tree nodes for the platform bus and its children dynamic sysbus devices are added in a machine init done notifier. To load the dtb once, after those latter nodes are built and before ROM freeze, the actual arm_load_kernel existing code is moved into a notifier notify function, arm_load_kernel_notify. arm_load_kernel now only registers the corresponding notifier. Machine files that do not support platform bus stay unchanged. Machine files willing to support dynamic sysbus devices must call arm_load_kernel before sysbus-fdt arm_register_platform_bus_fdt_creator to make sure dynamic sysbus device nodes are integrated in the dtb. Signed-off-by: Eric Auger <eric.auger@linaro.org> Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com> Reviewed-by: Alexander Graf <agraf@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1433244554-12898-3-git-send-email-eric.auger@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-06-02xen/pt: unknown PCI config space fields should be read-onlyJan Beulich
... by default. Add a per-device "permissive" mode similar to pciback's to allow restoring previous behavior (and hence break security again, i.e. should be used only for trusted guests). This is part of XSA-131. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>)
2015-06-02xen/pt: add a few PCI config space field descriptionsJan Beulich
Since the next patch will turn all not explicitly described fields read-only by default, those fields that have guest writable bits need to be given explicit descriptors. This is a preparatory patch for XSA-131. Signed-off-by: Jan Beulich <jbeulich@suse.com>
2015-06-02xen/pt: mark reserved bits in PCI config space fieldsJan Beulich
The adjustments are solely to make the subsequent patches work right (and hence make the patch set consistent), namely if permissive mode (introduced by the last patch) gets used (as both reserved registers and reserved fields must be similarly protected from guest access in default mode, but the guest should be allowed access to them in permissive mode). This is a preparatory patch for XSA-131. Signed-off-by: Jan Beulich <jbeulich@suse.com>
2015-06-02xen/pt: mark all PCIe capability bits read-onlyJan Beulich
xen_pt_emu_reg_pcie[]'s PCI_EXP_DEVCAP needs to cover all bits as read- only to avoid unintended write-back (just a precaution, the field ought to be read-only in hardware). This is a preparatory patch for XSA-131. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2015-06-02xen/pt: split out calculation of throughable mask in PCI config space handlingJan Beulich
This is just to avoid having to adjust that calculation later in multiple places. Note that including ->ro_mask in get_throughable_mask()'s calculation is only an apparent (i.e. benign) behavioral change: For r/o fields it doesn't matter > whether they get passed through - either the same flag is also set in emu_mask (then there's no change at all) or the field is r/o in hardware (and hence a write won't change it anyway). This is a preparatory patch for XSA-131. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>
2015-06-02xen/pt: correctly handle PM status bitJan Beulich
xen_pt_pmcsr_reg_write() needs an adjustment to deal with the RW1C nature of the not passed through bit 15 (PCI_PM_CTRL_PME_STATUS). This is a preparatory patch for XSA-131. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2015-06-02xen/pt: consolidate PM capability emu_maskJan Beulich
There's no point in xen_pt_pmcsr_reg_{read,write}() each ORing PCI_PM_CTRL_STATE_MASK and PCI_PM_CTRL_NO_SOFT_RESET into a local emu_mask variable - we can have the same effect by setting the field descriptor's emu_mask member suitably right away. Note that xen_pt_pmcsr_reg_write() is being retained in order to allow later patches to be less intrusive. This is a preparatory patch for XSA-131. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com>
2015-06-02xen/MSI: don't open-code pass-through of enable bit modificationsJan Beulich
Without this the actual XSA-131 fix would cause the enable bit to not get set anymore (due to the write back getting suppressed there based on the OR of emu_mask, ro_mask, and res_mask). Note that the fiddling with the enable bit shouldn't really be done by qemu, but making this work right (via libxc and the hypervisor) will require more extensive changes, which can be postponed until after the security issue got addressed. This is a preparatory patch for XSA-131. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-17 08:11:19 +0000