aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2017-02-14Merge remote-tracking branch 'remotes/rth/tags/pull-or-20170214' into stagingPeter Maydell
Queued openrisc patches # gpg: Signature made Mon 13 Feb 2017 21:21:03 GMT # gpg: using RSA key 0xAD1270CC4DD0279B # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>" # gpg: aka "Richard Henderson <rth@redhat.com>" # gpg: aka "Richard Henderson <rth@twiddle.net>" # Primary key fingerprint: 9CB1 8DDA F8E8 49AD 2AFC 16A4 AD12 70CC 4DD0 279B * remotes/rth/tags/pull-or-20170214: (24 commits) target/openrisc: Optimize for r0 being zero target/openrisc: Tidy handling of delayed branches target/openrisc: Tidy ppc/npc implementation target/openrisc: Optimize l.jal to next target/openrisc: Fix madd target/openrisc: Implement muld, muldu, macu, msbu target/openrisc: Represent MACHI:MACLO as a single unit target/openrisc: Implement msync target/openrisc: Enable trap, csync, msync, psync for user mode target/openrisc: Set flags on helpers target/openrisc: Use movcond where appropriate target/openrisc: Keep SR_CY and SR_OV in a separate variables target/openrisc: Keep SR_F in a separate variable target/openrisc: Invert the decoding in dec_calc target/openrisc: Put SR[OVE] in TB flags target/openrisc: Streamline arithmetic and OVE target/openrisc: Rationalize immediate extraction target/openrisc: Tidy insn dumping target/openrisc: Implement lwa, swa target/openrisc: Fix exception handling status registers ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-14target/openrisc: Rename the cpu from or32 to or1kRichard Henderson
This is in keeping with the toolchain and or1ksim. Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-02-13virtio/migration: Migrate virtio-net to VMStateDr. David Alan Gilbert
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20170203160651.19917-5-dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Merge fix against Halil's removal of the '_start' field in VMSTATE_VBUFFER_MULTIPLY
2017-02-13migration: consolidate VMStateField.startHalil Pasic
The member VMStateField.start is used for two things, partial data migration for VBUFFER data (basically provide migration for a sub-buffer) and for locating next in QTAILQ. The implementation of the VBUFFER feature is broken when VMSTATE_ALLOC is used. This however goes unnoticed because actually partial migration for VBUFFER is not used at all. Let's consolidate the usage of VMStateField.start by removing support for partial migration for VBUFFER. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Message-Id: <20170203175217.45562-1-pasic@linux.vnet.ibm.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2017-02-13Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20170213-1' into ↵Peter Maydell
staging vga: bugfixes for cirrus and virtio-gpu # gpg: Signature made Mon 13 Feb 2017 08:14:47 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-vga-20170213-1: Revert "cirrus: allow zero source pitch in pattern fill rops" cirrus: fix patterncopy checks cirrus: replace debug printf with trace points vga: replace debug printf with trace points virtio-gpu: fix resource leak in virgl_cmd_resource_unref virtio-gpu: fix memory leak in set scanout Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-13Merge remote-tracking branch 'remotes/awilliam/tags/vfio-updates-20170210.0' ↵Peter Maydell
into staging VFIO updates 2017-02-10 - Fix GTT wrap-around for Skylake IGD assignment (Alex Williamson) - Tag vfio-pci-igd-lpc-bridge as bridge device category (Thomas Huth) - Don't build calxeda-xgmac or amd-xgbe except on ARM (Thomas Huth) # gpg: Signature made Fri 10 Feb 2017 21:34:33 GMT # gpg: using RSA key 0x239B9B6E3BB08B22 # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" # gpg: aka "Alex Williamson <alex@shazbot.org>" # gpg: aka "Alex Williamson <alwillia@redhat.com>" # gpg: aka "Alex Williamson <alex.l.williamson@gmail.com>" # Primary key fingerprint: 42F6 C04E 540B D1A9 9E7B 8A90 239B 9B6E 3BB0 8B22 * remotes/awilliam/tags/vfio-updates-20170210.0: hw/vfio: Add CONFIG switches for calxeda-xgmac and amd-xgbe hw/vfio/pci-quirks: Set category of the "vfio-pci-igd-lpc-bridge" device vfio-pci: Fix GTT wrap-around for Skylake+ IGD Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10hw/vfio: Add CONFIG switches for calxeda-xgmac and amd-xgbeThomas Huth
Both devices seem to be specific to the ARM platform. It's confusing for the users if they show up on other target architectures, too (e.g. when the user runs QEMU with "-device ?" to get a list of supported devices). Thus let's introduce proper configuration switches so that the devices are only compiled and included when they are really required. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2017-02-10hw/vfio/pci-quirks: Set category of the "vfio-pci-igd-lpc-bridge" deviceThomas Huth
The device has "bridge" in its name, so it should obviously be in the category DEVICE_CATEGORY_BRIDGE. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2017-02-10vfio-pci: Fix GTT wrap-around for Skylake+ IGDAlex Williamson
Previous IGD, up through Broadwell, only seem to write GTT values into the first 1MB of space allocated for the BDSM, but clearly the GTT can be multiple MB in size. Our test in vfio_igd_quirk_data_write() correctly filters out indexes beyond 1MB, but given the 1MB mask we're using, we re-apply writes only to the first 1MB of the guest allocated BDSM. We can't assume either the host or guest BDSM is naturally aligned, so we can't simply apply a different mask. Instead, save the host BDSM and do the arithmetic to subtract the host value to get the BDSM offset and add it to the guest allocated BDSM. Reported-by: Alexander Indenbaum <alexander.indenbaum@gmail.com> Tested-by: Alexander Indenbaum <alexander.indenbaum@gmail.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2017-02-10Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20170210' into staging target-arm queue: * aspeed: minor fixes * virt: declare fwcfg and virtio-mmio as DMA coherent in DT & ACPI * arm: enable basic TCG emulation of PMU for AArch64 # gpg: Signature made Fri 10 Feb 2017 18:06:30 GMT # gpg: using RSA key 0x3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20170210: aspeed/smc: use a modulo to check segment limits aspeed/smc: handle dummies only in fast read mode aspeed: remove useless comment on controller segment size aspeed: check for negative values returned by blk_getlength() hw/arm/virt: Declare fwcfg as dma cache coherent in dt hw/arm/virt: Declare fwcfg as dma cache coherent in ACPI hw/arm/virt: Declare virtio-mmio as dma cache coherent in ACPI target-arm: Declare virtio-mmio as dma-coherent in dt target-arm: Enable vPMU support under TCG mode target-arm: Add support for PMU register PMINTENSET_EL1 target-arm: Add support for AArch64 PMU register PMXEVTYPER_EL0 target-arm: Add support for PMU register PMSELR_EL0 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10aspeed/smc: use a modulo to check segment limitsCédric Le Goater
The size of a segment is not necessarily a power of 2. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486648058-520-5-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10aspeed/smc: handle dummies only in fast read modeCédric Le Goater
HW works fine in normal read mode with dummy bytes being set. So let's check this case to not transfer bytes. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1486648058-520-4-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10aspeed: remove useless comment on controller segment sizeCédric Le Goater
The flash devices used for the FMC controller (BMC firmware) are well defined for each Aspeed machine and are all smaller than the default mapping window size, at least for CE0 which is the chip the SoC boots from. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486648058-520-3-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10aspeed: check for negative values returned by blk_getlength()Cédric Le Goater
write_boot_rom() does not check for negative values. This is more a problem for coverity than the actual code as the size of the flash device is checked when the m25p80 object is created. If there is anything wrong with the backing file, we should not even reach that path. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1486648058-520-2-git-send-email-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10hw/arm/virt: Declare fwcfg as dma cache coherent in dtAlexander Graf
Fw-cfg recently learned how to directly access guest memory and does so in cache coherent fashion. Tell the guest about that fact when it's using DT. Signed-off-by: Alexander Graf <agraf@suse.de> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org> Message-id: 1486644810-33181-5-git-send-email-agraf@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10hw/arm/virt: Declare fwcfg as dma cache coherent in ACPIAlexander Graf
Fw-cfg recently learned how to directly access guest memory and does so in cache coherent fashion. Tell the guest about that fact when it's using ACPI. Signed-off-by: Alexander Graf <agraf@suse.de> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org> Message-id: 1486644810-33181-4-git-send-email-agraf@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10hw/arm/virt: Declare virtio-mmio as dma cache coherent in ACPIAlexander Graf
Virtio-mmio devices can directly access guest memory and do so in cache coherent fashion. Tell the guest about that fact when it's using ACPI. Signed-off-by: Alexander Graf <agraf@suse.de> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org> Message-id: 1486644810-33181-3-git-send-email-agraf@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10target-arm: Declare virtio-mmio as dma-coherent in dtAlexander Graf
QEMU emulated hardware is always dma coherent with its guest. We do annotate that correctly on the PCI host controller, but left out virtio-mmio. Recent kernels have started to interpret that flag rather than take dma coherency as granted with virtio-mmio. While that is considered a kernel bug, as it breaks previously working systems, it showed that our dt description is incomplete. This patch adds the respective marker that allows guest OSs to evaluate that our virtio-mmio devices are indeed cache coherent. Signed-off-by: Alexander Graf <agraf@suse.de> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Message-id: 1486644810-33181-2-git-send-email-agraf@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10target-arm: Enable vPMU support under TCG modeWei Huang
This patch contains several fixes to enable vPMU under TCG mode. It first removes the checking of kvm_enabled() while unsetting ARM_FEATURE_PMU. With it, the .pmu option can be used to turn on/off vPMU under TCG mode. Secondly the PMU node of DT table is now created under TCG. The last fix is to disable the masking of PMUver field of ID_AA64DFR0_EL1. Signed-off-by: Wei Huang <wei@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1486504171-26807-5-git-send-email-wei@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10ahci: advertise HOST_CAP_64Ladi Prosek
The AHCI emulation code supports 64-bit addressing and should advertise this fact in the Host Capabilities register. Both Linux and Windows drivers test this bit to decide if the upper 32 bits of various registers may be written to, and at least some versions of Windows have a bug where DMA is attempted with an address above 4GB but, in the absence of HOST_CAP_64, the upper 32 bits are left unititialized which leads to a memory corruption. [Maintainer edit: This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1411105, which affects Windows Server 2008 SP2 in some cases.] Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1484305370-6220-1-git-send-email-lprosek@redhat.com [Amended commit message --js] Signed-off-by: John Snow <jsnow@redhat.com>
2017-02-10Revert "cirrus: allow zero source pitch in pattern fill rops"Gerd Hoffmann
This reverts commit 5858dd1801883309bdd208d72ddb81c4e9fee30c. Conflicts: hw/display/cirrus_vga.c Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1486645341-5010-2-git-send-email-kraxel@redhat.com
2017-02-10cirrus: fix patterncopy checksGerd Hoffmann
The blit_region_is_unsafe checks don't work correctly for the patterncopy source. It's a fixed-sized region, which doesn't depend on cirrus_blt_{width,height}. So go do the check in cirrus_bitblt_common_patterncopy instead, then tell blit_is_unsafe that it doesn't need to verify the source. Also handle the case where we blit from cirrus_bitbuf correctly. This patch replaces 5858dd1801883309bdd208d72ddb81c4e9fee30c. Security impact: I think for the most part error on the safe side this time, refusing blits which should have been allowed. Only exception is placing the blit source at the end of the video ram, so cirrus_blt_srcaddr + 256 goes beyond the end of video memory. But even in that case I'm not fully sure this actually allows read access to host memory. To trick the commit 5858dd18 security checks one has to pick very small cirrus_blt_{width,height} values, which in turn implies only a fraction of the blit source will actually be used. Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1486645341-5010-1-git-send-email-kraxel@redhat.com
2017-02-10cirrus: replace debug printf with trace pointsGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486561893-26470-2-git-send-email-kraxel@redhat.com
2017-02-10vga: replace debug printf with trace pointsGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486561893-26470-1-git-send-email-kraxel@redhat.com
2017-02-10virtio-gpu: fix resource leak in virgl_cmd_resource_unrefGerd Hoffmann
When the guest sends VIRTIO_GPU_CMD_RESOURCE_UNREF without detaching the backing storage beforehand (VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING) we'll leak memory. This patch fixes it for 3d mode, simliar to the 2d mode fix in commit "b8e2392 virtio-gpu: call cleanup mapping function in resource destroy". Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485167210-4757-1-git-send-email-kraxel@redhat.com
2017-02-10virtio-gpu: fix memory leak in set scanoutLi Qiang
In virtio_gpu_set_scanout function, when creating the 'rect' its refcount is set to 2, by pixman_image_create_bits and qemu_create_displaysurface_pixman function. This can lead a memory leak issues. This patch avoid this issue. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 5884626f.5b2f6b0a.1bfff.3037@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-07stellaris: Use the 'unimplemented' device for parts we don't implementPeter Maydell
Use the 'unimplemented' dummy device to cover regions of the SoC device memory map which we don't have proper device implementations for yet. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1484247815-15279-4-git-send-email-peter.maydell@linaro.org
2017-02-07hw/misc: New "unimplemented" sysbus devicePeter Maydell
Create a new "unimplemented" sysbus device, which simply accepts all read and write accesses, and implements them as read-as-zero, write-ignored, with logging of the access as LOG_UNIMP. This is useful for stubbing out bits of an SoC or board model which haven't been written yet. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1484247815-15279-3-git-send-email-peter.maydell@linaro.org
2017-02-07stellaris: Document memory map and which SoC devices are unimplementedPeter Maydell
Add a comment documenting the memory map of the SoC devices and which are not implemented. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1484247815-15279-2-git-send-email-peter.maydell@linaro.org
2017-02-07hw/arm/integratorcp: Support specifying features via -cpuJulian Brown
Since the integratorcp board creates the CPU object directly rather than via cpu_arm_init(), we have to call the CPU class parse_features() method ourselves if we want to support the user passing features via the -cpu command line argument as well as just the cpu name. Do so. Signed-off-by: Julian Brown <julian@codesourcery.com> [PMM: split out into its own patch] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-07sd: sdhci: check data length during dma_memory_readPrasad J Pandit
While doing multi block SDMA transfer in routine 'sdhci_sdma_transfer_multi_blocks', the 's->fifo_buffer' starting index 'begin' and data length 's->data_count' could end up to be same. This could lead to an OOB access issue. Correct transfer data length to avoid it. Cc: qemu-stable@nongnu.org Reported-by: Jiang Xin <jiangxin1@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20170130064736.9236-1-ppandit@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-07aspeed: add a watchdog controllerCédric Le Goater
This enables reboot of a guest from U-Boot and Linux. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-id: 1485452251-1593-3-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-07wdt: Add Aspeed watchdog device modelCédric Le Goater
The Aspeed SoC includes a set of watchdog timers using 32-bit decrement counters, which can be based either on the APB clock or a 1 MHz clock. The watchdog timer is designed to prevent system deadlock and, in general, it should be restarted before timeout. When a timeout occurs, different types of signals can be generated, ARM reset, SOC reset, System reset, CPU Interrupt, external signal or boot from alternate block. The current model only performs the system reset function as this is used by U-Boot and Linux. Signed-off-by: Joel Stanley <joel@jms.id.au> Message-id: 1485452251-1593-2-git-send-email-clg@kaod.org [clg: - fixed compile breakage - fixed io region size - added watchdog_perform_action() on timer expiry - wrote a commit log - merged fixes from Andrew Jeffery to scale the reload value ] Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-07integratorcp: adding vmstate for save/restorePavel Dovgalyuk
VMState added by this patch preserves correct loading of the integratorcp device state. Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Message-id: 20170131114310.6768.79416.stgit@PASHA-ISP [PMM: removed unnecessary minimum_version_id_old lines] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-06vmstate registration: check return valuesDr. David Alan Gilbert
Check qdev's call to vmstate_register_with_alias_id; that gets most of the common uses; there's hundreds of calls via vmstate_register which could get fixed over time. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-Id: <20170202125956.21942-4-dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2017-02-06vmstate_register_with_alias_id: Take an Error **Dr. David Alan Gilbert
I'll be adding an error to it in a subsequent patch. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-Id: <20170202125956.21942-2-dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2017-02-06Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20170206-1' into ↵Peter Maydell
staging usb: various bugfixes, mostly xhci. # gpg: Signature made Mon 06 Feb 2017 11:26:35 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-usb-20170206-1: xhci: fix event queue IRQ handling usb: ccid: check ccid apdu length xhci: guard xhci_kick_epctx against recursive calls xhci: don't kick in xhci_submit and xhci_fire_ctl_transfer xhci: rename xhci_complete_packet to xhci_try_complete_packet xhci: only free completed transfers usb: accept usb3 control requests usb/uas: more verbose error message hw/usb/dev-hid: Improve guest compatibility of usb-tablet Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-06xhci: fix event queue IRQ handlingGerd Hoffmann
The qemu xhci emulation doesn't handle the ERDP_EHB flag correctly. When the host adapter queues a new event the ERDP_EHB flag is set. The flag is cleared (via w1c) by the guest when it updates the ERDP (event ring dequeue pointer) register to notify the host adapter which events it has fetched. An IRQ must be raised in case the ERDP_EHB flag flips from clear to set. If the flag is set already (which implies there are events queued up which are not yet processed by the guest) xhci must *not* raise a IRQ. Qemu got that wrong and raised an IRQ on every event, thereby generating spurious interrupts in case we've queued events faster than the guest processed them. This patch fixes that. With that change in place we also have to check ERDP updates, to see whenever the guest has fetched all queued events. In case there are still pending events set ERDP_EHB and raise an IRQ again, to make sure the events don't linger unseen forever. The linux kernel driver and the microsoft windows driver (shipped with win8+) can deal with the spurious interrupts without problems. The renesas windows driver (v2.1.39) which can be used on older windows versions is quite upset though. It does spurious ERDP updates now and then (not every time, seems we must hit a race window for this to happen), which in turn makes the qemu xhci emulation think the event ring is full. Things go south from here ... tl;dr: This is the "fix xhci on win7" patch. Cc: M.Cerveny@computer.org Cc: 1373228@bugs.launchpad.net Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486104705-13761-1-git-send-email-kraxel@redhat.com
2017-02-06usb: ccid: check ccid apdu lengthPrasad J Pandit
CCID device emulator uses Application Protocol Data Units(APDU) to exchange command and responses to and from the host. The length in these units couldn't be greater than 65536. Add check to ensure the same. It'd also avoid potential integer overflow in emulated_apdu_from_guest. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20170202192228.10847-1-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-06xhci: guard xhci_kick_epctx against recursive callsGerd Hoffmann
Track xhci_kick_epctx processing being active in a variable. Check the variable before calling xhci_kick_epctx from xhci_kick_ep. Add an assert to make sure we don't call recursively into xhci_kick_epctx. Cc: 1653384@bugs.launchpad.net Fixes: 94b037f2a451b3dc855f9f2c346e5049a361bd55 Reported-by: Fabian Lesniak <fabian@lesniak-it.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486035372-3621-1-git-send-email-kraxel@redhat.com Message-id: 1485790607-31399-5-git-send-email-kraxel@redhat.com
2017-02-06xhci: don't kick in xhci_submit and xhci_fire_ctl_transferGerd Hoffmann
xhci_submit and xhci_fire_ctl_transfer are is called from xhci_kick_epctx processing loop only, so there is no need to call xhci_kick_epctx make sure processing continues. Also eecursive calls into xhci_kick_epctx can cause trouble. Drop the xhci_kick_epctx calls. Cc: 1653384@bugs.launchpad.net Fixes: 94b037f2a451b3dc855f9f2c346e5049a361bd55 Reported-by: Fabian Lesniak <fabian@lesniak-it.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485790607-31399-4-git-send-email-kraxel@redhat.com
2017-02-06xhci: rename xhci_complete_packet to xhci_try_complete_packetGerd Hoffmann
Make clear that this isn't guaranteed to actually complete the transfer, the usb packet can still be in flight after calling that function. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485790607-31399-3-git-send-email-kraxel@redhat.com
2017-02-06xhci: only free completed transfersGerd Hoffmann
Most callsites check already, one was missed. Cc: 1653384@bugs.launchpad.net Fixes: 94b037f2a451b3dc855f9f2c346e5049a361bd55 Reported-by: Fabian Lesniak <fabian@lesniak-it.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485790607-31399-2-git-send-email-kraxel@redhat.com
2017-02-06usb: accept usb3 control requestsGerd Hoffmann
Windows 10 reportedly sends these, so accept them in case the device in question is a superspeed (usb3) device. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485870727-21956-2-git-send-email-kraxel@redhat.com
2017-02-06usb/uas: more verbose error messageGerd Hoffmann
Print some more details in case we get a unknown control request, to ease trouble-shooting. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485870727-21956-1-git-send-email-kraxel@redhat.com
2017-02-06hw/usb/dev-hid: Improve guest compatibility of usb-tabletPhil Dennis-Jordan
1. Set bInterfaceProtocol to 0x00 for usb-tablet. This should be non-zero for boot protocol devices only, which the usb-tablet is not. 2. Set the usb-tablet's usage to "mouse" in the report descriptor. The boot protocol of 0x02 specifically confused OS X/macOS' HID driver stack, causing it to generate additional bogus HID events with relative motion in addition to the tablet's absolute coordinate events. Absolute pointing devices with HID Report Descriptor usage of 0x01 (pointing) are treated by the macOS HID driver as analog sticks, and absolute coordinates are not directly translated to absolute mouse cursor positions. Changing it to 0x02 (mouse) fixes the problem, and does not have any adverse effect in other operating systems and windowing systems. (VMWare does the same thing.) Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Message-id: 1485365075-32702-1-git-send-email-phil@philjordan.eu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-06Split ISA and sysbus versions of m48t59 deviceDavid Gibson
The m48t59 device supports both ISA and direct sysbus attached versions of the device in the one .c file. This can be awkward for some embedded machine types which need the sysbus M48T59, but don't want to pull in the ISA bus code and its other dependencies. Therefore, this patch splits out the code for the ISA attached M48T59 into its own C file. It will be built when both CONFIG_M48T59 and CONFIG_ISA_BUS are enabled. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-06Allow ISA bus to be configured outDavid Gibson
Currently, the code to handle the legacy ISA bus is always included in qemu. However there are lots of platforms that don't include ISA legacy devies, and quite a few that have never used ISA legacy devices at all. This patch allows the ISA bus code to be disabled in the configuration for platforms where it doesn't make sense. For now, the default configs are adjusted to include ISA on all platforms including PCI: anything with PCI can at least in principle add an i82378 PCI->ISA bridge. Also, CONFIG_IDE_CORE which is already in pci.mak requires ISA support. We also explicitly enable ISA on some other non-PCI platforms which include ISA devices: moxie, sparc and unicore32. We may want to pare this down in future. The platforms that will lose ISA by default are: cris, lm32, microblazeel, microblaze, openrisc, s390x, tricore, xtensaeb, xtensa. As far as I can tell none of these ever used ISA. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-06Split serial-isa into its own config optionDavid Gibson
At present, the core device model code for 8250-like serial ports (serial.c) and the code for serial ports attached to ISA-style legacy IO (serial-isa.c) are both controlled by the CONFIG_SERIAL variable. There are lots and lots of embedded platforms that have 8250-like serial ports but have never had anything resembling ISA legacy IO. Therefore, split serial-isa into its own CONFIG_SERIAL_ISA option so it can be disabled for platforms where it's not appropriate. For now, I enabled CONFIG_SERIAL_ISA in every default-config where CONFIG_SERIAL is enabled, excepting microblaze, or32, and xtensa. As best as I can tell, those platforms never used legacy ISA, and also don't include PCI support (which would allow connection of a PCI->ISA bridge and/or a southbridge including legacy ISA serial ports). Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Thomas Huth <thuth@redhat.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-03Merge remote-tracking branch 'remotes/sstabellini/tags/xen-20170202' into ↵Peter Maydell
staging Xen 2017/02/02 # gpg: Signature made Thu 02 Feb 2017 18:26:58 GMT # gpg: using RSA key 0x894F8F4870E1AE90 # gpg: Good signature from "Stefano Stabellini <sstabellini@kernel.org>" # gpg: aka "Stefano Stabellini <stefano.stabellini@eu.citrix.com>" # Primary key fingerprint: D04E 33AB A51F 67BA 07D3 0AEA 894F 8F48 70E1 AE90 * remotes/sstabellini/tags/xen-20170202: xen: use qdev_unplug() instead of g_free() in xen_pv_find_xendev() MAINTAINERS: Update xen-devel mailing list address xen-platform: add missing disk unplug option xen-platform: add support for unplugging NVMe disks... xen-platform: re-structure unplug_disks Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-13 13:36:46 +0000