summary refs log tree commit diff stats
path: root/hw (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
| * | s390x: add I/O adapter registrationCornelia Huck2014-05-206-0/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | Register an I/O adapter interrupt source for when virtio-ccw devices start using adapter interrupts. Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
| * | s390x: split flic into kvm and non-kvm partsCornelia Huck2014-05-203-287/+357
| |/ | | | | | | | | | | | | | | | | | | | | | | | | Introduce a common parent class for both cases, where kvm and non-kvm can hook up callbacks. This will be used by follow-on patches for adapter registration and mapping. We now always have a flic, regardless of whether we use kvm; the non-kvm implementation just doesn't do anything. Reviewed-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
* | Merge remote-tracking branch 'remotes/bonzini/scsi-next' into stagingPeter Maydell2014-05-223-3/+6
|\ \ | |/ |/| | | | | | | | | | | | | | | * remotes/bonzini/scsi-next: megasas: remove buildtime strings block: iscsi build fix if LIBISCSI_FEATURE_IOVECTOR is not defined virtio-scsi: Plug memory leak on virtio_scsi_push_event() error path scsi: Document intentional fall through in scsi_req_length() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * megasas: remove buildtime stringsOlaf Hering2014-05-201-2/+2
| | | | | | | | | | | | | | | | | | | | Using __DATE__ or __TIME__ in binary pkgs changes the checksum of compiled binaries if they get rebuilt, even if there are no other source changes. Replace the dynamic strings with some equally informative static strings. Signed-off-by: Olaf Hering <olaf@aepfle.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * virtio-scsi: Plug memory leak on virtio_scsi_push_event() error pathMarkus Armbruster2014-05-161-1/+2
| | | | | | | | | | | | | | | | Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * scsi: Document intentional fall through in scsi_req_length()Markus Armbruster2014-05-161-0/+2
| | | | | | | | | | | | | | For clarity, and to hush up Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | Merge remote-tracking branch 'remotes/qmp-unstable/queue/qmp' into stagingPeter Maydell2014-05-192-15/+59
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * remotes/qmp-unstable/queue/qmp: qapi: skip redundant includes monitor: Add netdev_del id argument completion. monitor: Add netdev_add type argument completion. monitor: Add set_link arguments completion. monitor: Add chardev-add backend argument completion. monitor: Add chardev-remove command completion. monitor: Convert sendkey to use command_completion. qapi: Show qapi-commands.py invocation in qapi-code-gen.txt qapi: Replace uncommon use of the error API by the common one tests: Don't call visit_end_struct() after visit_start_struct() fails hw: Don't call visit_end_struct() after visit_start_struct() fails hmp: Call visit_end_struct() after visit_start_struct() succeeds qapi: Un-inline visit of implicit struct qapi-visit.py: Clean up a sloppy use of field prefix qapi: Clean up shadowing of parameters and locals in inner scopes qapi-visit.py: Clean up confusing push_indent() / pop_indent() use qapi: Replace start_optional()/end_optional() by optional() qapi: Remove unused Visitor callbacks start_handle(), end_handle() qapi: Normalize marshalling's visitor initialization and cleanup qapi: Update qapi-code-gen.txt example to match current code Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | qapi: Replace uncommon use of the error API by the common oneMarkus Armbruster2014-05-152-6/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We commonly use the error API like this: err = NULL; foo(..., &err); if (err) { goto out; } bar(..., &err); Every error source is checked separately. The second function is only called when the first one succeeds. Both functions are free to pass their argument to error_set(). Because error_set() asserts no error has been set, this effectively means they must not be called with an error set. The qapi-generated code uses the error API differently: // *errp was initialized to NULL somewhere up the call chain frob(..., errp); gnat(..., errp); Errors accumulate in *errp: first error wins, subsequent errors get dropped. To make this work, the second function does nothing when called with an error set. Requires non-null errp, or else the second function can't see the first one fail. This usage has also bled into visitor tests, and two device model object property getters rtc_get_date() and balloon_stats_get_all(). With the "accumulate" technique, you need fewer error checks in callers, and buy that with an error check in every callee. Can be nice. However, mixing the two techniques is confusing. You can't use the "accumulate" technique with functions designed for the "check separately" technique. You can use the "check separately" technique with functions designed for the "accumulate" technique, but then error_set() can't catch you setting an error more than once. Standardize on the "check separately" technique for now, because it's overwhelmingly prevalent. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
| * | hw: Don't call visit_end_struct() after visit_start_struct() failsMarkus Armbruster2014-05-152-14/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When visit_start_struct() fails, visit_end_struct() must not be called. rtc_get_date() and balloon_stats_all() call it anyway. As far as I can tell, they're only used with the string output visitor, which doesn't care. Fix them anyway. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
* | | Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-8' into stagingPeter Maydell2014-05-192-82/+317
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Input code update: - add keycode mapping helpers to core. - start switching devices to new input api. - misc bugfixes. # gpg: Signature made Fri 16 May 2014 07:43:45 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-input-8: input: sparc32 kbd: claim en-us layout input: sparc32 kbd: fix some key mappings input: remove sparc keymap hack input: switch sparc32 kbd to new input api input: switch ps/2 mouse to new input api input: switch ps/2 kbd to new input api input: use KeyValue directly in sendkey monitor command input: add qemu_input_handler_deactivate input: key mapping helpers ps2: set ps/2 output buffer size as the same as kernel Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | input: sparc32 kbd: claim en-us layoutGerd Hoffmann2014-05-161-1/+1
| | | | | | | | | | | | | | | | | | | | Reported-by: Olivier Danet <odanet@caramail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | | input: sparc32 kbd: fix some key mappingsGerd Hoffmann2014-05-161-14/+16
| | | | | | | | | | | | | | | | | | | | Reported-by: Olivier Danet <odanet@caramail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | | input: switch sparc32 kbd to new input apiGerd Hoffmann2014-05-161-59/+170
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Nasty 0xe0 logic is gone. We map through QKeyCode now, giving us a nice, readable mapping table. Quick smoke test in OpenFirmware looks ok. Careful check from arch maintainers would be very nice, especially on the capslock and numlock logic. I'm not fully sure whenever I got it translated correctly and also what it is supposed to do in the first place ... Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | | input: switch ps/2 mouse to new input apiGerd Hoffmann2014-05-161-15/+52
| | | | | | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | | input: switch ps/2 kbd to new input apiGerd Hoffmann2014-05-161-1/+24
| | | | | | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | | ps2: set ps/2 output buffer size as the same as kernelGonglei2014-05-161-6/+68
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to the PS/2 Mouse/Keyboard Protocol, the keyboard outupt buffer size is 16 bytes. And the PS2_QUEUE_SIZE 256 was introduced in Qemu from the very beginning. When I started a redhat5.6 32bit guest, meanwhile tapped the keyboard as quickly as possible, the screen would show me "i8042.c: No controller found". As a result, I couldn't use the keyboard in the VNC client. Previous discussion about the issue in maillist: http://thread.gmane.org/gmane.comp.emulators.qemu/43294/focus=47180 This patch has been tested on redhat5.6 32-bit/suse11sp3 64-bit guests. More easy meathod to reproduce: 1.boot a guest with libvirt. 2.connect to VNC client. 3.as you see the BIOS, bootloader, Linux booting, run the follow simply shell script: for((i=0;i<10000000;i++)) do virsh send-key redhat5.6 KEY_A; done Actual results: dmesg show "i8042.c: No controller found." And the keyboard is out of work. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | | Merge remote-tracking branch 'remotes/bonzini/scsi-next' into stagingPeter Maydell2014-05-194-24/+90
|\ \ \ | |/ / |/| / | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | * remotes/bonzini/scsi-next: [PATCH] block/iscsi: bump year in copyright notice block/iscsi: allow cluster_size of 4K and greater block/iscsi: clarify the meaning of ISCSI_CHECKALLOC_THRES block/iscsi: speed up read for unallocated sectors block/iscsi: allow fall back to WRITE SAME without UNMAP MAINTAINERS: mark megasas as maintained megasas: Add MSI support megasas: Enable MSI-X support megasas: Implement LD_LIST_QUERY scsi: Improve error messages more scsi-disk: Improve error messager if can't get version number Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * megasas: Add MSI supportHannes Reinecke2014-04-281-6/+43
| | | | | | | | | | | | | | Some hardware instances do support MSI, so we should do likewise. Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * megasas: Enable MSI-X supportHannes Reinecke2014-04-281-12/+5
| | | | | | | | | | | | | | | | MSI-X support has been fixed in qemu, so we can enable it again. Signed-off-by: Hannes Reinecke <hare@suse.de> [Do not change VMSTATE_PCI_DEVICE to PCIE. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * megasas: Implement LD_LIST_QUERYHannes Reinecke2014-04-282-0/+26
| | | | | | | | | | | | | | | | | | | | Newer firmware implement a LD_LIST_QUERY command, and due to a driver issue no drives might be detected if this command isn't supported. So add emulation for this command, too. Cc: qemu-stable@nongnu.org Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * scsi: Improve error messages morePaolo Bonzini2014-04-282-7/+12
| | | | | | | | | | | | | | | | | | | | | | Remove the "scsi-block:" prefix for error messages as suggested by Markus. Improve the previous patch by making the message the same for both scsi-block and scsi-generic, including the strerror() output in both and making an explicit reference to SG_IO. Also s/can not/cannot/. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * scsi-disk: Improve error messager if can't get version numberFam Zheng2014-04-281-2/+7
| | | | | | | | | | | | | | | | | | More often it is that bdrv_ioctl fails due to not supported by driver or whatever reason, in this case we should be specific, because "interface too old" is very confusing. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell2014-05-151-1/+1
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | virtio update looks like a quiet week minor bugfix in virtio by myself Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Tue 13 May 2014 14:37:23 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: virtio: allow mapping up to max queue size Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | virtio: allow mapping up to max queue sizeMichael S. Tsirkin2014-05-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's a loop from i < num_sg and the array is VIRTQUEUE_MAX_SIZE - so it's OK if the value read is VIRTQUEUE_MAX_SIZE. Not a big problem in practice as people don't use such big queues, but it's inelegant. Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | | Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20140515' ↵Peter Maydell2014-05-1559-137/+71
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging migration/next for 20140515 # gpg: Signature made Thu 15 May 2014 02:32:25 BST using RSA key ID 5872D723 # gpg: Can't check signature: public key not found * remotes/juanquintela/tags/migration/20140515: usb: fix up post load checks migration: show average throughput when migration finishes savevm: Remove all the unneeded version_minimum_id_old (rest) savevm: Remove all the unneeded version_minimum_id_old (usb) Split ram_save_block arch_init: Simplify code for load_xbzrle() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | usb: fix up post load checksMichael S. Tsirkin2014-05-141-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Correct post load checks: 1. dev->setup_len == sizeof(dev->data_buf) seems fine, no need to fail migration 2. When state is DATA, passing index > len will cause memcpy with negative length, resulting in heap overflow First of the issues was reported by dgilbert. Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
| * | | savevm: Remove all the unneeded version_minimum_id_old (rest)Juan Quintela2014-05-1451-122/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
| * | | savevm: Remove all the unneeded version_minimum_id_old (usb)Juan Quintela2014-05-148-13/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com>
* | | | Merge remote-tracking branch ↵Peter Maydell2014-05-1566-308/+269
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/pmaydell/tags/pull-target-arm-20140513' into staging target-arm queue: * update libvixl to 1.4 * remove version_minimum_id_old from ARM devices * stellaris_enet tx/rx/migration overhaul * various minor fixes for coverity issues # gpg: Signature made Tue 13 May 2014 16:25:12 BST using RSA key ID 14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" * remotes/pmaydell/tags/pull-target-arm-20140513: hw/arm/omap_gpmc: Avoid buffer overrun filling prefetch FIFO hw/arm/stellaris: Correct handling of GPTM TAR register hw/timer/exynos4210_mct: Avoid overflow in exynos4210_ltick_recalc_count hw/dma/omap_dma: Add (uint32_t) casts when shifting uint16_t by 16 hw/arm/omap1: Avoid unintended sign extension writing omap_rtc YEARS_REG hw/net/cadence_gem: Remove dead code hw/intc/allwinner-a10-pic: Add missing 'break' target-arm/helper.c: Don't flush the TLB if SCTLR is rewritten unchanged hw/net/stellaris_enet: Convert to vmstate hw/net/stellaris_enet: Get rid of rx_fifo pointer hw/net/stellaris_enet: Fix debug format strings hw/net/stellaris_enet: Correctly implement the TR and THR registers hw/net/stellaris_enet: Rewrite tx fifo handling code hw/net/stellaris_enet: Correct handling of packet padding hw/net/stellaris_enet: Restructure tx_fifo code to avoid buffer overrun savevm: Remove all the unneeded version_minimum_id_old (arm) disas/libvixl: Update to libvixl 1.4 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | | hw/arm/omap_gpmc: Avoid buffer overrun filling prefetch FIFOPeter Maydell2014-05-131-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In fill_prefetch_fifo(), if the device we are reading from is 16 bit, then we must not try to transfer an odd number of bytes into the FIFO. This could otherwise have resulted in our overrunning the prefetch.fifo array by one byte. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
| * | | | hw/arm/stellaris: Correct handling of GPTM TAR registerPeter Maydell2014-05-131-3/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We don't implement very much of the GPTM TAR register, and what we do is wrong. The "are we in RT mode?" field is in s->config, not s->control. Correct this, use LOG_UNIMP rather than hw_error() for the cases we don't support, and avoid an unlabelled fallthrough that makes Coverity complain. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
| * | | | hw/timer/exynos4210_mct: Avoid overflow in exynos4210_ltick_recalc_countPeter Maydell2014-05-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add casts to avoid potentially overflowing the multiplications of 32 bit quantities in exynos4210_ltick_recalc_count(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
| * | | | hw/dma/omap_dma: Add (uint32_t) casts when shifting uint16_t by 16Peter Maydell2014-05-131-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add missing (uint32_t) casts in cases where we're trying to put a uint16_t value into the top half of a 32-bit field. These were already present in some but not all places. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
| * | | | hw/arm/omap1: Avoid unintended sign extension writing omap_rtc YEARS_REGPeter Maydell2014-05-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When writing to the YEARS_REG register, if the year value is 99 then the multiplication by 31536000 will overflow into the sign bit of a 32 bit value and then be erroneously sign-extended if time_t is 64 bits. Add a cast to avoid this. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
| * | | | hw/net/cadence_gem: Remove dead codePeter Maydell2014-05-131-7/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 191946c moved the code to handle padding to minimum length from after the handling of the CRC to before it. This means that the CRC code doesn't need to cope with the possibility that the size is less than 60; remove this dead code. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
| * | | | hw/intc/allwinner-a10-pic: Add missing 'break'Peter Maydell2014-05-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add missing 'break' after handling of AW_A10_PIC_BASE_ADDR write. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
| * | | | hw/net/stellaris_enet: Convert to vmstatePeter Maydell2014-05-131-68/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Convert this device to use vmstate for its save/load, including providing a post_load function that sanitizes inbound data to avoid possible buffer overflows if it is malicious. The sanitizing fixes CVE-2013-4532 (though nobody should be relying on the security properties of most of the unmaintained ARM board models anyway, and migration doesn't actually work on this board due to issues in other device models). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
| * | | | hw/net/stellaris_enet: Get rid of rx_fifo pointerPeter Maydell2014-05-131-21/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The rx_fifo pointer is awkward to migrate, and is actually redundant since it is always possible to determine it from the current rx[].len/.data and rx_fifo_len. Remove both rx_fifo and rx_fifo_len from the state, replacing them with a simple rx_fifo_offset which points at the current location in the RX fifo. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
| * | | | hw/net/stellaris_enet: Fix debug format stringsPeter Maydell2014-05-131-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix various debug format strings which were incorrect for the data type, so that building with debug enabled is possible. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
| * | | | hw/net/stellaris_enet: Correctly implement the TR and THR registersPeter Maydell2014-05-131-2/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Packet transmission for the stellaris ethernet controller can be triggered in one of two ways: * by setting a threshold value in the THR register; when the FIFO fill level reaches the threshold, the h/w starts transmitting. Software has to finish filling the FIFO before the transmit process completes to avoid a (silent) underrun * by software writing to the TR register to explicitly trigger transmission Since QEMU transmits packets instantaneously (from the guest's point of view), implement "transmit based on threshold" with our existing mechanism of "transmit as soon as we have the whole packet", with the additional wrinkle that we don't transmit if the packet size is below the specified threshold, and implement "transmit by specific request" properly. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
| * | | | hw/net/stellaris_enet: Rewrite tx fifo handling codePeter Maydell2014-05-131-42/+77
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The datasheet is clear that the frame length written to the DATA register is actually stored in the TX FIFO; this means we don't need to keep both tx_frame_len and tx_fifo_len state separately. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
| * | | | hw/net/stellaris_enet: Correct handling of packet paddingPeter Maydell2014-05-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The PADEN bit in the transmit control register enables padding of short data packets out to the required minimum length. However a typo here meant we were adjusting tx_fifo_len rather than tx_frame_len, so the padding didn't actually happen. Fix this bug. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Cc: qemu-stable@nongnu.org
| * | | | hw/net/stellaris_enet: Restructure tx_fifo code to avoid buffer overrunPeter Maydell2014-05-131-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current tx_fifo code has a corner case where the guest can overrun the fifo buffer: if automatic CRCs are disabled we allow the guest to write the CRC word even if there isn't actually space for it in the FIFO. The datasheet is unclear about exactly how the hardware deals with this situation; the most plausible answer seems to be that the CRC word is just lost. Implement this fix by separating the "can we stuff another word in the FIFO" logic from the "should we transmit the packet now" check. This also moves us closer to the real hardware, which has a number of ways it can be configured to trigger sending the packet, some of which we don't implement. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Cc: qemu-stable@nongnu.org
| * | | | savevm: Remove all the unneeded version_minimum_id_old (arm)Juan Quintela2014-05-1362-162/+57
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After commit 767adce2d, they are redundant. This way we don't assign them except when needed. Once there, there were lots of cases where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (apart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> [PMM: fixed minor conflict, corrected commit message typos] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | | | Merge remote-tracking branch 'remotes/kvm/uq/master' into stagingPeter Maydell2014-05-153-8/+10
|\ \ \ \ | |/ / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * remotes/kvm/uq/master: pc: port 92 reset requires a low->high transition cpu: make CPU_INTERRUPT_RESET available on all targets apic: do not accept SIPI on the bootstrap processor target-i386: preserve FPU and MSR state on INIT target-i386: fix set of registers zeroed on reset kvm: forward INIT signals coming from the chipset kvm: reset state from the CPU's reset method target-i386: the x86 CPL is stored in CS.selector - auto update hflags accordingly. target-i386: set eflags prior to calling cpu_x86_load_seg_cache() in seg_helper.c target-i386: set eflags and cr0 prior to calling cpu_x86_load_seg_cache() in smm_helper.c target-i386: set eflags prior to calling svm_load_seg_cache() in svm_helper.c pci-assign: limit # of msix vectors pci-assign: Fix a bug when map MSI-X table memory failed kvm: make one_reg helpers available for everyone target-i386: Remove unused data from local array Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | pc: port 92 reset requires a low->high transitionPaolo Bonzini2014-05-131-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The PIIX datasheet says that "before another INIT pulse can be generated via [port 92h], [bit 0] must be written back to a zero. This bug is masked right now because a full reset will clear the value of port 92h. But once we implement soft reset correctly, the next attempt to enable the A20 line by setting bit 1 (and leaving the others untouched) will cause another reset. Reviewed-by: Anthony Liguori <aliguori@us.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | | apic: do not accept SIPI on the bootstrap processorPaolo Bonzini2014-05-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SIPI interrupts are ignored on the bootstrap. Never accept one. Cc: Andreas Faerber <afaerber@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | | pci-assign: limit # of msix vectorsMichael S. Tsirkin2014-05-131-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | KVM only supports MSIX table size up to 256 vectors, but some assigned devices support more vectors, at the moment attempts to assign them fail with EINVAL. Tweak the MSIX capability exposed to guest to limit table size to a supported value. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Gonglei <arei.gonglei@huawei.com> Cc: qemu-stable@nongnu.org Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | | pci-assign: Fix a bug when map MSI-X table memory failedGonglei2014-05-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When mmapping memory for the MSI-X table failsthe dev->msix_table is not set to NULL and assigned_dev_unregister_msix_mmio() will cause a segfault when trying to munmap it. Signed-off-by: Gonglei Arei <arei.gonglei@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
* | | | Merge remote-tracking branch 'remotes/bonzini/configure' into stagingPeter Maydell2014-05-131-0/+1
|\ \ \ \ | |/ / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * remotes/bonzini/configure: libcacard: remove libcacard-specific CFLAGS and LIBS from global vars build: simplify and fix fix-obj-vars build: convert some obj-specific CFLAGS to use new foo.o-cflags syntax build: add support for per-object -cflags and -libs to all rules Makefile: use $(INSTALL_LIB) for modules not $(INSTALL_PROG) Makefile.target: use $(INSTALL_PROG) for installing, not $(INSTALL) Makefile: strip tools and modules too build: simplify Makefile.target around unnest-vars invocations build: simplify Makefile.target a bit, use just one rule for softmmu build: Fix per-object variables for Makefile.target Signed-off-by: Peter Maydell <peter.maydell@linaro.org>