aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2017-02-18hw/m68k: Remove dummy machineThomas Huth
Since it is now possible to instantiate a CPU and RAM with the "none" machine, too, and a kernel can be loaded there with the generic loader device, there is no more need for the m68k "dummy" machine. Thus let's remove this unmaintained file now. Reviewed-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Thomas Huth <huth@tuxfamily.org>
2017-02-16Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* GUEST_PANICKED improvements (Anton) * vCont gdbstub rewrite (Claudio) * Fix CPU creation with -device (Liyang) * Logging fixes for pty chardevs (Ed) * Makefile "move if changed" fix (Lin) * First part of cpu_exec refactoring (me) * SVM emulation fix (me) * apic_delivered fix (Pavel) * "info ioapic" fix (Peter) * qemu-nbd socket activation (Richard) * QOMification of mcf_uart (Thomas) # gpg: Signature made Thu 16 Feb 2017 17:37:31 GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (23 commits) target-i386: correctly propagate retaddr into SVM helpers vl: log available guest crash information report guest crash information in GUEST_PANICKED event i386/cpu: add crash-information QOM property Makefile: avoid leaving the temporary QEMU_PKGVERSION header file vl: Move the cpu_synchronize_all_post_init() after generic devices initialization qemu-nbd: Implement socket activation. qemu-doc: Clarify that -vga std is now the default cpu-exec: remove outermost infinite loop cpu-exec: avoid repeated sigsetjmp on interrupts cpu-exec: avoid cpu_loop_exit in cpu_handle_interrupt cpu-exec: tighten barrier on TCG_EXIT_REQUESTED cpu-exec: fix icount out-of-bounds access hw/char/mcf_uart: QOMify the ColdFire UART gdbstub: Fix vCont behaviour move vm_start to cpus.c char: drop data written to a disconnected pty apic: reset apic_delivered global variable on machine reset qemu-char: socket backend: disconnect on write error test-vmstate: remove yield_until_fd_readable ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-16report guest crash information in GUEST_PANICKED eventAnton Nefedov
it's not very convenient to use the crash-information property interface, so provide a CPU class callback to get the guest crash information, and pass that information in the event Signed-off-by: Anton Nefedov <anton.nefedov@virtuozzo.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Message-Id: <1487053524-18674-3-git-send-email-den@openvz.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-16hw/char/mcf_uart: QOMify the ColdFire UARTThomas Huth
Use type_init() etc. to adapt the ColdFire UART to the latest QEMU device conventions. Signed-off-by: Thomas Huth <huth@tuxfamily.org> Message-Id: <1485586582-6490-1-git-send-email-huth@tuxfamily.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-16apic: reset apic_delivered global variable on machine resetPavel Dovgalyuk
This patch adds call to apic_reset_irq_delivered when the virtual machine is reset. Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Message-Id: <20170131114054.276.62201.stgit@PASHA-ISP> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-16kvm/ioapic: correct kvm ioapic versionPeter Xu
Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1486106298-3699-4-git-send-email-peterx@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-16ioapic: fix error report value of def versionPeter Xu
It should be 0x20, rather than 0x11. Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1486106298-3699-3-git-send-email-peterx@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-16kvm/ioapic: dump real object instead of a fake onePeter Xu
When we do "info ioapic" for kvm ioapic, we were building up a temporary ioapic object. Let's fetch the real one and update correspond to the real object as well. This fixes printing uninitialized version field in ioapic_print_redtbl(). Reported-by: Peter Maydell <peter.maydell@linaro.org> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1486106298-3699-2-git-send-email-peterx@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-15net: e1000e: fix an infinite loop issueLi Qiang
This issue is like the issue in e1000 network card addressed in this commit: e1000: eliminate infinite loops on out-of-bounds transfer start. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-02-15net: imx: limit buffer descriptor countPrasad J Pandit
i.MX Fast Ethernet Controller uses buffer descriptors to manage data flow to/fro receive & transmit queues. While transmitting packets, it could continue to read buffer descriptors if a buffer descriptor has length of zero and has crafted values in bd.flags. Set an upper limit to number of buffer descriptors. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-02-15net: e1000e: fix dead code in e1000e_write_packet_to_guestPaolo Bonzini
Because is_first is declared inside a loop, it is always true. The store is dead, and so is the "else" branch of "if (is_first)". is_last is okay though. Reported by Coverity. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-02-14Merge remote-tracking branch 'remotes/rth/tags/pull-or-20170214' into stagingPeter Maydell
Queued openrisc patches # gpg: Signature made Mon 13 Feb 2017 21:21:03 GMT # gpg: using RSA key 0xAD1270CC4DD0279B # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>" # gpg: aka "Richard Henderson <rth@redhat.com>" # gpg: aka "Richard Henderson <rth@twiddle.net>" # Primary key fingerprint: 9CB1 8DDA F8E8 49AD 2AFC 16A4 AD12 70CC 4DD0 279B * remotes/rth/tags/pull-or-20170214: (24 commits) target/openrisc: Optimize for r0 being zero target/openrisc: Tidy handling of delayed branches target/openrisc: Tidy ppc/npc implementation target/openrisc: Optimize l.jal to next target/openrisc: Fix madd target/openrisc: Implement muld, muldu, macu, msbu target/openrisc: Represent MACHI:MACLO as a single unit target/openrisc: Implement msync target/openrisc: Enable trap, csync, msync, psync for user mode target/openrisc: Set flags on helpers target/openrisc: Use movcond where appropriate target/openrisc: Keep SR_CY and SR_OV in a separate variables target/openrisc: Keep SR_F in a separate variable target/openrisc: Invert the decoding in dec_calc target/openrisc: Put SR[OVE] in TB flags target/openrisc: Streamline arithmetic and OVE target/openrisc: Rationalize immediate extraction target/openrisc: Tidy insn dumping target/openrisc: Implement lwa, swa target/openrisc: Fix exception handling status registers ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-14target/openrisc: Rename the cpu from or32 to or1kRichard Henderson
This is in keeping with the toolchain and or1ksim. Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-02-13virtio/migration: Migrate virtio-net to VMStateDr. David Alan Gilbert
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20170203160651.19917-5-dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Merge fix against Halil's removal of the '_start' field in VMSTATE_VBUFFER_MULTIPLY
2017-02-13migration: consolidate VMStateField.startHalil Pasic
The member VMStateField.start is used for two things, partial data migration for VBUFFER data (basically provide migration for a sub-buffer) and for locating next in QTAILQ. The implementation of the VBUFFER feature is broken when VMSTATE_ALLOC is used. This however goes unnoticed because actually partial migration for VBUFFER is not used at all. Let's consolidate the usage of VMStateField.start by removing support for partial migration for VBUFFER. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Message-Id: <20170203175217.45562-1-pasic@linux.vnet.ibm.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2017-02-13Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20170213-1' into ↵Peter Maydell
staging vga: bugfixes for cirrus and virtio-gpu # gpg: Signature made Mon 13 Feb 2017 08:14:47 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-vga-20170213-1: Revert "cirrus: allow zero source pitch in pattern fill rops" cirrus: fix patterncopy checks cirrus: replace debug printf with trace points vga: replace debug printf with trace points virtio-gpu: fix resource leak in virgl_cmd_resource_unref virtio-gpu: fix memory leak in set scanout Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-13Merge remote-tracking branch 'remotes/awilliam/tags/vfio-updates-20170210.0' ↵Peter Maydell
into staging VFIO updates 2017-02-10 - Fix GTT wrap-around for Skylake IGD assignment (Alex Williamson) - Tag vfio-pci-igd-lpc-bridge as bridge device category (Thomas Huth) - Don't build calxeda-xgmac or amd-xgbe except on ARM (Thomas Huth) # gpg: Signature made Fri 10 Feb 2017 21:34:33 GMT # gpg: using RSA key 0x239B9B6E3BB08B22 # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" # gpg: aka "Alex Williamson <alex@shazbot.org>" # gpg: aka "Alex Williamson <alwillia@redhat.com>" # gpg: aka "Alex Williamson <alex.l.williamson@gmail.com>" # Primary key fingerprint: 42F6 C04E 540B D1A9 9E7B 8A90 239B 9B6E 3BB0 8B22 * remotes/awilliam/tags/vfio-updates-20170210.0: hw/vfio: Add CONFIG switches for calxeda-xgmac and amd-xgbe hw/vfio/pci-quirks: Set category of the "vfio-pci-igd-lpc-bridge" device vfio-pci: Fix GTT wrap-around for Skylake+ IGD Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10hw/vfio: Add CONFIG switches for calxeda-xgmac and amd-xgbeThomas Huth
Both devices seem to be specific to the ARM platform. It's confusing for the users if they show up on other target architectures, too (e.g. when the user runs QEMU with "-device ?" to get a list of supported devices). Thus let's introduce proper configuration switches so that the devices are only compiled and included when they are really required. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2017-02-10hw/vfio/pci-quirks: Set category of the "vfio-pci-igd-lpc-bridge" deviceThomas Huth
The device has "bridge" in its name, so it should obviously be in the category DEVICE_CATEGORY_BRIDGE. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2017-02-10vfio-pci: Fix GTT wrap-around for Skylake+ IGDAlex Williamson
Previous IGD, up through Broadwell, only seem to write GTT values into the first 1MB of space allocated for the BDSM, but clearly the GTT can be multiple MB in size. Our test in vfio_igd_quirk_data_write() correctly filters out indexes beyond 1MB, but given the 1MB mask we're using, we re-apply writes only to the first 1MB of the guest allocated BDSM. We can't assume either the host or guest BDSM is naturally aligned, so we can't simply apply a different mask. Instead, save the host BDSM and do the arithmetic to subtract the host value to get the BDSM offset and add it to the guest allocated BDSM. Reported-by: Alexander Indenbaum <alexander.indenbaum@gmail.com> Tested-by: Alexander Indenbaum <alexander.indenbaum@gmail.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2017-02-10Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20170210' into staging target-arm queue: * aspeed: minor fixes * virt: declare fwcfg and virtio-mmio as DMA coherent in DT & ACPI * arm: enable basic TCG emulation of PMU for AArch64 # gpg: Signature made Fri 10 Feb 2017 18:06:30 GMT # gpg: using RSA key 0x3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20170210: aspeed/smc: use a modulo to check segment limits aspeed/smc: handle dummies only in fast read mode aspeed: remove useless comment on controller segment size aspeed: check for negative values returned by blk_getlength() hw/arm/virt: Declare fwcfg as dma cache coherent in dt hw/arm/virt: Declare fwcfg as dma cache coherent in ACPI hw/arm/virt: Declare virtio-mmio as dma cache coherent in ACPI target-arm: Declare virtio-mmio as dma-coherent in dt target-arm: Enable vPMU support under TCG mode target-arm: Add support for PMU register PMINTENSET_EL1 target-arm: Add support for AArch64 PMU register PMXEVTYPER_EL0 target-arm: Add support for PMU register PMSELR_EL0 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10aspeed/smc: use a modulo to check segment limitsCédric Le Goater
The size of a segment is not necessarily a power of 2. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486648058-520-5-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10aspeed/smc: handle dummies only in fast read modeCédric Le Goater
HW works fine in normal read mode with dummy bytes being set. So let's check this case to not transfer bytes. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1486648058-520-4-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10aspeed: remove useless comment on controller segment sizeCédric Le Goater
The flash devices used for the FMC controller (BMC firmware) are well defined for each Aspeed machine and are all smaller than the default mapping window size, at least for CE0 which is the chip the SoC boots from. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486648058-520-3-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10aspeed: check for negative values returned by blk_getlength()Cédric Le Goater
write_boot_rom() does not check for negative values. This is more a problem for coverity than the actual code as the size of the flash device is checked when the m25p80 object is created. If there is anything wrong with the backing file, we should not even reach that path. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1486648058-520-2-git-send-email-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10hw/arm/virt: Declare fwcfg as dma cache coherent in dtAlexander Graf
Fw-cfg recently learned how to directly access guest memory and does so in cache coherent fashion. Tell the guest about that fact when it's using DT. Signed-off-by: Alexander Graf <agraf@suse.de> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org> Message-id: 1486644810-33181-5-git-send-email-agraf@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10hw/arm/virt: Declare fwcfg as dma cache coherent in ACPIAlexander Graf
Fw-cfg recently learned how to directly access guest memory and does so in cache coherent fashion. Tell the guest about that fact when it's using ACPI. Signed-off-by: Alexander Graf <agraf@suse.de> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org> Message-id: 1486644810-33181-4-git-send-email-agraf@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10hw/arm/virt: Declare virtio-mmio as dma cache coherent in ACPIAlexander Graf
Virtio-mmio devices can directly access guest memory and do so in cache coherent fashion. Tell the guest about that fact when it's using ACPI. Signed-off-by: Alexander Graf <agraf@suse.de> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org> Message-id: 1486644810-33181-3-git-send-email-agraf@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10target-arm: Declare virtio-mmio as dma-coherent in dtAlexander Graf
QEMU emulated hardware is always dma coherent with its guest. We do annotate that correctly on the PCI host controller, but left out virtio-mmio. Recent kernels have started to interpret that flag rather than take dma coherency as granted with virtio-mmio. While that is considered a kernel bug, as it breaks previously working systems, it showed that our dt description is incomplete. This patch adds the respective marker that allows guest OSs to evaluate that our virtio-mmio devices are indeed cache coherent. Signed-off-by: Alexander Graf <agraf@suse.de> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Message-id: 1486644810-33181-2-git-send-email-agraf@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10target-arm: Enable vPMU support under TCG modeWei Huang
This patch contains several fixes to enable vPMU under TCG mode. It first removes the checking of kvm_enabled() while unsetting ARM_FEATURE_PMU. With it, the .pmu option can be used to turn on/off vPMU under TCG mode. Secondly the PMU node of DT table is now created under TCG. The last fix is to disable the masking of PMUver field of ID_AA64DFR0_EL1. Signed-off-by: Wei Huang <wei@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1486504171-26807-5-git-send-email-wei@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10ahci: advertise HOST_CAP_64Ladi Prosek
The AHCI emulation code supports 64-bit addressing and should advertise this fact in the Host Capabilities register. Both Linux and Windows drivers test this bit to decide if the upper 32 bits of various registers may be written to, and at least some versions of Windows have a bug where DMA is attempted with an address above 4GB but, in the absence of HOST_CAP_64, the upper 32 bits are left unititialized which leads to a memory corruption. [Maintainer edit: This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1411105, which affects Windows Server 2008 SP2 in some cases.] Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1484305370-6220-1-git-send-email-lprosek@redhat.com [Amended commit message --js] Signed-off-by: John Snow <jsnow@redhat.com>
2017-02-10Revert "cirrus: allow zero source pitch in pattern fill rops"Gerd Hoffmann
This reverts commit 5858dd1801883309bdd208d72ddb81c4e9fee30c. Conflicts: hw/display/cirrus_vga.c Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1486645341-5010-2-git-send-email-kraxel@redhat.com
2017-02-10cirrus: fix patterncopy checksGerd Hoffmann
The blit_region_is_unsafe checks don't work correctly for the patterncopy source. It's a fixed-sized region, which doesn't depend on cirrus_blt_{width,height}. So go do the check in cirrus_bitblt_common_patterncopy instead, then tell blit_is_unsafe that it doesn't need to verify the source. Also handle the case where we blit from cirrus_bitbuf correctly. This patch replaces 5858dd1801883309bdd208d72ddb81c4e9fee30c. Security impact: I think for the most part error on the safe side this time, refusing blits which should have been allowed. Only exception is placing the blit source at the end of the video ram, so cirrus_blt_srcaddr + 256 goes beyond the end of video memory. But even in that case I'm not fully sure this actually allows read access to host memory. To trick the commit 5858dd18 security checks one has to pick very small cirrus_blt_{width,height} values, which in turn implies only a fraction of the blit source will actually be used. Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1486645341-5010-1-git-send-email-kraxel@redhat.com
2017-02-10cirrus: replace debug printf with trace pointsGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486561893-26470-2-git-send-email-kraxel@redhat.com
2017-02-10vga: replace debug printf with trace pointsGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486561893-26470-1-git-send-email-kraxel@redhat.com
2017-02-10virtio-gpu: fix resource leak in virgl_cmd_resource_unrefGerd Hoffmann
When the guest sends VIRTIO_GPU_CMD_RESOURCE_UNREF without detaching the backing storage beforehand (VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING) we'll leak memory. This patch fixes it for 3d mode, simliar to the 2d mode fix in commit "b8e2392 virtio-gpu: call cleanup mapping function in resource destroy". Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485167210-4757-1-git-send-email-kraxel@redhat.com
2017-02-10virtio-gpu: fix memory leak in set scanoutLi Qiang
In virtio_gpu_set_scanout function, when creating the 'rect' its refcount is set to 2, by pixman_image_create_bits and qemu_create_displaysurface_pixman function. This can lead a memory leak issues. This patch avoid this issue. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 5884626f.5b2f6b0a.1bfff.3037@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-07stellaris: Use the 'unimplemented' device for parts we don't implementPeter Maydell
Use the 'unimplemented' dummy device to cover regions of the SoC device memory map which we don't have proper device implementations for yet. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1484247815-15279-4-git-send-email-peter.maydell@linaro.org
2017-02-07hw/misc: New "unimplemented" sysbus devicePeter Maydell
Create a new "unimplemented" sysbus device, which simply accepts all read and write accesses, and implements them as read-as-zero, write-ignored, with logging of the access as LOG_UNIMP. This is useful for stubbing out bits of an SoC or board model which haven't been written yet. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1484247815-15279-3-git-send-email-peter.maydell@linaro.org
2017-02-07stellaris: Document memory map and which SoC devices are unimplementedPeter Maydell
Add a comment documenting the memory map of the SoC devices and which are not implemented. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1484247815-15279-2-git-send-email-peter.maydell@linaro.org
2017-02-07hw/arm/integratorcp: Support specifying features via -cpuJulian Brown
Since the integratorcp board creates the CPU object directly rather than via cpu_arm_init(), we have to call the CPU class parse_features() method ourselves if we want to support the user passing features via the -cpu command line argument as well as just the cpu name. Do so. Signed-off-by: Julian Brown <julian@codesourcery.com> [PMM: split out into its own patch] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-07sd: sdhci: check data length during dma_memory_readPrasad J Pandit
While doing multi block SDMA transfer in routine 'sdhci_sdma_transfer_multi_blocks', the 's->fifo_buffer' starting index 'begin' and data length 's->data_count' could end up to be same. This could lead to an OOB access issue. Correct transfer data length to avoid it. Cc: qemu-stable@nongnu.org Reported-by: Jiang Xin <jiangxin1@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20170130064736.9236-1-ppandit@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-07aspeed: add a watchdog controllerCédric Le Goater
This enables reboot of a guest from U-Boot and Linux. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-id: 1485452251-1593-3-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-07wdt: Add Aspeed watchdog device modelCédric Le Goater
The Aspeed SoC includes a set of watchdog timers using 32-bit decrement counters, which can be based either on the APB clock or a 1 MHz clock. The watchdog timer is designed to prevent system deadlock and, in general, it should be restarted before timeout. When a timeout occurs, different types of signals can be generated, ARM reset, SOC reset, System reset, CPU Interrupt, external signal or boot from alternate block. The current model only performs the system reset function as this is used by U-Boot and Linux. Signed-off-by: Joel Stanley <joel@jms.id.au> Message-id: 1485452251-1593-2-git-send-email-clg@kaod.org [clg: - fixed compile breakage - fixed io region size - added watchdog_perform_action() on timer expiry - wrote a commit log - merged fixes from Andrew Jeffery to scale the reload value ] Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-07integratorcp: adding vmstate for save/restorePavel Dovgalyuk
VMState added by this patch preserves correct loading of the integratorcp device state. Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Message-id: 20170131114310.6768.79416.stgit@PASHA-ISP [PMM: removed unnecessary minimum_version_id_old lines] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-06vmstate registration: check return valuesDr. David Alan Gilbert
Check qdev's call to vmstate_register_with_alias_id; that gets most of the common uses; there's hundreds of calls via vmstate_register which could get fixed over time. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-Id: <20170202125956.21942-4-dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2017-02-06vmstate_register_with_alias_id: Take an Error **Dr. David Alan Gilbert
I'll be adding an error to it in a subsequent patch. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-Id: <20170202125956.21942-2-dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2017-02-06Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20170206-1' into ↵Peter Maydell
staging usb: various bugfixes, mostly xhci. # gpg: Signature made Mon 06 Feb 2017 11:26:35 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-usb-20170206-1: xhci: fix event queue IRQ handling usb: ccid: check ccid apdu length xhci: guard xhci_kick_epctx against recursive calls xhci: don't kick in xhci_submit and xhci_fire_ctl_transfer xhci: rename xhci_complete_packet to xhci_try_complete_packet xhci: only free completed transfers usb: accept usb3 control requests usb/uas: more verbose error message hw/usb/dev-hid: Improve guest compatibility of usb-tablet Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-06xhci: fix event queue IRQ handlingGerd Hoffmann
The qemu xhci emulation doesn't handle the ERDP_EHB flag correctly. When the host adapter queues a new event the ERDP_EHB flag is set. The flag is cleared (via w1c) by the guest when it updates the ERDP (event ring dequeue pointer) register to notify the host adapter which events it has fetched. An IRQ must be raised in case the ERDP_EHB flag flips from clear to set. If the flag is set already (which implies there are events queued up which are not yet processed by the guest) xhci must *not* raise a IRQ. Qemu got that wrong and raised an IRQ on every event, thereby generating spurious interrupts in case we've queued events faster than the guest processed them. This patch fixes that. With that change in place we also have to check ERDP updates, to see whenever the guest has fetched all queued events. In case there are still pending events set ERDP_EHB and raise an IRQ again, to make sure the events don't linger unseen forever. The linux kernel driver and the microsoft windows driver (shipped with win8+) can deal with the spurious interrupts without problems. The renesas windows driver (v2.1.39) which can be used on older windows versions is quite upset though. It does spurious ERDP updates now and then (not every time, seems we must hit a race window for this to happen), which in turn makes the qemu xhci emulation think the event ring is full. Things go south from here ... tl;dr: This is the "fix xhci on win7" patch. Cc: M.Cerveny@computer.org Cc: 1373228@bugs.launchpad.net Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486104705-13761-1-git-send-email-kraxel@redhat.com
2017-02-06usb: ccid: check ccid apdu lengthPrasad J Pandit
CCID device emulator uses Application Protocol Data Units(APDU) to exchange command and responses to and from the host. The length in these units couldn't be greater than 65536. Add check to ensure the same. It'd also avoid potential integer overflow in emulated_apdu_from_guest. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20170202192228.10847-1-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-02-06 17:14:09 +0000