summaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2016-02-18hw/sd/sd.c: QOMifyPeter Maydell1-22/+77
Turn the SD card into a QOM device. This conversion only changes the device itself; the various functions which are effectively methods on the device are not touched at this point. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 1455646193-13238-3-git-send-email-peter.maydell@linaro.org
2016-02-18hw/sd/sdhci.c: Remove x-drive propertyPeter Maydell1-6/+0
The following commits will remove support for the old sdhci-pci command line syntax using the x-drive property: -device sdhci-pci,x-drive=mydrive -drive id=mydrive,[...] and replace it with an explicit sd device: -device sdhci-pci -drive id=mydrive,[...] -device sd,drive=mydrive (This is OK because x-drive is experimental.) This commit removes the x-drive property so that old style command lines will fail with a reasonable error message: -device sdhci-pci,x-drive=mydrive: Property '.x-drive' not found Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Message-id: 1455646193-13238-2-git-send-email-peter.maydell@linaro.org
2016-02-18ARM: PL061: Cleaning field of PL061 device stateWei Huang1-4/+2
This patch removes the float_high field of PL061State, which doesn't seem to be used anywhere. Because this changes the device state, the version ID is also bumped up for the reason of compatiblity. Signed-off-by: Wei Huang <wei@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1455729552-28026-3-git-send-email-wei@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-02-18ARM: PL061: Clear PL061 device state after resetWei Huang1-4/+27
Current QEMU doesn't clear PL061 state after reset. This causes a weird issue with guest reboot via GPIO. Here is the device state with two reboot requests: (PL061State fields) data old_in_data istate VM boot 0 0 0 After 1st ACPI reboot request 8 8 8 After VM PL061 driver ACK 8 8 0 After VM reboot 8 8 0 ------------------------------------------------------------ 2nd ACPI reboot request 8 In the second reboot request above, because the old_in_data field is 8, QEMU decides that there is a pending edge IRQ already (see pl061_update()) in input; so it doesn't raise up IRQ again. As a result the second reboot request is lost. The correct way is to clear PL061 device state after reset. The default reset state is found from the documents listed below. Per Peter's suggestion that QEMU automatically calls reset function after device initialization, this patch removes calling pl061_reset() from pl061_initfn(). Reference: [1] PL061 Technical Reference Manual [2] Stellaris LM3S8962 Microcontroller Data Sheet [3] Stellaris LM3S5P31 Microcontroller Data Sheet Signed-off-by: Wei Huang <wei@redhat.com> Message-id: 1455729552-28026-2-git-send-email-wei@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-02-18hw/ppc/spapr: Halt CPU when powering off via RTAS callThomas Huth1-0/+1
The LoPAPR specification defines the following for the RTAS power-off call: "On successful operation, does not return". However, the implementation in QEMU currently returns and runs the guest CPU again for some more cycles. This caused some trouble with the new ppc implementation of the kvm-unit-tests recently. So let's make sure that the QEMU implementation follows the spec, thus stop the CPU to make sure that the RTAS call does not return to the guest anymore. Signed-off-by: Thomas Huth <thuth@redhat.com> Tested-by: Andrew Jones <drjones@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17pseries: Include missing pseries-2.5 compat properties in pseries-2.4David Gibson1-0/+1
Commit 4b23699 "pseries: Add pseries-2.6 machine type" added a new SPAPR_COMPAT_2_5 macro in the usual way. However, it didn't add this macro to the existing SPAPR_COMPAT_2_4 macro so that pseries-2.4 inherits newer compatibility properties which are needed for 2.5 and earlier. This corrects the oversight. Reported-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com>
2016-02-17cuda: remove CUDA_GET_SET_IIC/CUDA_COMBINED_FORMAT_IIC commandsHervé Poussineau1-23/+0
We currently don't emulate the I2C bus provided by CUDA. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17cuda: remove GET_6805_ADDR commandHervé Poussineau1-3/+0
It doesn't seem to be used, and operating systems should accept a 'unknown command' answer. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17cuda: port SET_TIME command to new frameworkHervé Poussineau1-6/+18
Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17cuda: port GET_TIME command to new frameworkHervé Poussineau1-8/+21
Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17cuda: port SET_POWER_MESSAGES command to new frameworkHervé Poussineau1-3/+16
Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17cuda: port FILE_SERVER_FLAG command to new frameworkHervé Poussineau1-1/+16
This command tells if computer should automatically wake-up after a power loss. Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17cuda: port RESET_SYSTEM command to new frameworkHervé Poussineau1-4/+13
Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17cuda: port POWERDOWN command to new frameworkHervé Poussineau1-4/+13
Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17cuda: port SET_DEVICE_LIST command to new frameworkHervé Poussineau3-10/+27
Also implement the command, by taking device list mask into account when polling ADB devices. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17cuda: port SET_AUTO_RATE command to new frameworkHervé Poussineau2-6/+31
Also implement the command, by removing the hardcoded period of 20 ms/50 Hz and replacing it by the one requested by user. Update VMState version to store this new parameter. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17cuda: port AUTOPOLL command to new frameworkHervé Poussineau1-15/+25
Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17cuda: move unknown commands reject out of switchHervé Poussineau1-14/+16
Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17cuda: add a framework to handle commandsHervé Poussineau1-0/+34
Next commits will port existing CUDA commands to this framework. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17hw/ppc/spapr: Implement the h_set_xdabr hypercallThomas Huth1-0/+22
The H_SET_XDABR hypercall is similar to H_SET_DABR, but also sets the extended DABR (DABRX) register. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17hw/ppc/spapr: Implement h_set_dabrThomas Huth1-5/+20
According to LoPAPR, h_set_dabr should simply set DABRX to 3 (if the register is available), and load the parameter into DABR. If DABRX is not available, the hypervisor has to check the "Breakpoint Translation" bit of the DABR register first. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17hw/ppc/spapr: Add h_set_sprg0 hypercallThomas Huth1-2/+13
This is a very simple hypercall that only sets up the SPRG0 register for the guest (since writing to SPRG0 was only permitted to the hypervisor in older versions of the PowerISA). Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17migration: ensure htab_save_first completes after timeoutDavid Gibson1-1/+6
htab_save_first_pass could return without finishing its work due to timeout. The patch checks if another invocation of it is necessary and will call it in htab_save_complete if necessary. Signed-off-by: Jianjun Duan <duanj@linux.vnet.ibm.com> Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> [removed overlong line] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-17target-ppc: Remove hack for ppc_hash64_load_hpte*() with HV KVMDavid Gibson1-7/+0
With HV KVM, the guest's hash page table (HPT) is managed by the kernel and not directly accessible to QEMU. This means that spapr->htab is NULL and normally env->external_htab would also be NULL for each cpu. However, that would cause ppc_hash64_load_hpte*() to do the wrong thing in the few cases where QEMU does need to load entries from the in-kernel HPT. Specifically, seeing external_htab is NULL, they would look for an HPT within the guest's address space instead. To stop that we have an ugly hack in the pseries machine type code to set external htab to (void *)1 instead. This patch removes that hack by having ppc_hash64_load_hpte*() explicitly check kvmppc_kern_htab instead, which makes more sense. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2016-02-17pseries: Move hash page table allocation to reset timeDavid Gibson1-74/+56
At the moment the size of the hash page table (HPT) is fixed based on the maximum memory allowed to the guest. As such, we allocate the table during machine construction, and just clear it at reset. However, we're planning to implement a PAPR extension allowing the hash page table to be resized at runtime. This will mean that on reset we want to revert it to the default size. It also means that when migrating, we need to make sure the destination allocates an HPT of size matching the host, since the guest could have changed it before the migration. This patch replaces the spapr_alloc_htab() and spapr_reset_htab() functions with a new spapr_reallocate_hpt() function. This is called at reset and inbound migration only, not during machine init any more. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2016-02-17pseries: Add helper to calculate recommended hash page table sizeDavid Gibson1-10/+14
At present we calculate the recommended hash page table (HPT) size for a pseries guest just once in ppc_spapr_init() before allocating the HPT. In future patches we're going to want this calculation in other places, so this splits it out into a helper function. While we're at it, change the calculation to use ctz() instead of an explicit loop. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2016-02-17pseries: Simplify handling of the hash page table fdDavid Gibson1-45/+41
When migrating the 'pseries' machine type with KVM, we use a special fd to access the hash page table stored within KVM. Usually, this fd is opened at the beginning of migration, and kept open until the migration is complete. However, if there is a guest reset during the migration, the fd can become stale and we need to re-open it. At the moment we use an 'htab_fd_stale' flag in sPAPRMachineState to signal this, which is checked in the migration iterators. But that's rather ugly. It's simpler to just close and invalidate the fd on reset, and lazily re-open it in migration if necessary. This patch implements that change. This requires a small addition to the machine state's instance_init, so that htab_fd is initialized to -1 (telling the migration code it needs to open it) instead of 0, which could be a valid fd. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2016-02-17hw: fix some debug message format stringsAlyssa Milburn2-4/+6
Signed-off-by: Alyssa Milburn <fuzzie@fuzzie.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-02-16Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell3-9/+11
* Coverity fixes for IPMI and mptsas * qemu-char fixes from Daniel and Marc-André * Bug fixes that break qemu-iotests * Changes to fix reset from panicked state * checkpatch false positives for designated initializers * TLS support in the NBD servers and clients # gpg: Signature made Tue 16 Feb 2016 16:27:17 GMT using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" * remotes/bonzini/tags/for-upstream: (28 commits) nbd: enable use of TLS with nbd-server-start command nbd: enable use of TLS with qemu-nbd server nbd: enable use of TLS with NBD block driver nbd: implement TLS support in the protocol negotiation nbd: use "" as a default export name if none provided nbd: always query export list in fixed new style protocol nbd: allow setting of an export name for qemu-nbd server nbd: make client request fixed new style if advertised nbd: make server compliant with fixed newstyle spec nbd: invert client logic for negotiating protocol version nbd: convert to using I/O channels for actual socket I/O nbd: convert blockdev NBD server to use I/O channels for connection setup nbd: convert qemu-nbd server to use I/O channels for connection setup nbd: convert block client to use I/O channels for connection setup qemu-nbd: add support for --object command line arg qom: add helpers for UserCreatable object types ipmi: sensor number should not exceed MAX_SENSORS mptsas: fix wrong formula mptsas: fix memory leak mptsas: add missing va_end ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-02-16ipmi: sensor number should not exceed MAX_SENSORSCédric Le Goater1-8/+8
Fix a number of off-by-ones, one of them spotted by Coverity. Signed-off-by: Cédric Le Goater <clg@fr.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-02-16mptsas: fix wrong formulaPaolo Bonzini1-1/+1
MPI_DOORBELL_WHO_INIT_SHIFT is being repeated twice. Reported by Coverity. Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-02-16mptsas: fix memory leakPaolo Bonzini1-0/+1
Reported by Coverity. Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-02-16mptsas: add missing va_endPaolo Bonzini1-0/+1
Reported by Coverity. Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-02-16all: Clean up includesPeter Maydell7-0/+7
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Blake <eblake@redhat.com>
2016-02-16hw/block/nand.c: Include osdep.h firstPeter Maydell1-2/+3
Include osdep.h as the first header in nand.c; this has to be done manually because coccinelle gets confused by the way that this C file includes itself. We fix some odd spacing in #includes while we are in the area. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Blake <eblake@redhat.com>
2016-02-12Merge remote-tracking branch 'remotes/sstabellini/tags/xen-2016-02-12' into ↵Peter Maydell3-13/+2
staging Xen 2016-02-12 # gpg: Signature made Fri 12 Feb 2016 17:28:09 GMT using RSA key ID 70E1AE90 # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>" * remotes/sstabellini/tags/xen-2016-02-12: xen: Drop __XEN_LATEST_INTERFACE_VERSION__ checks from prior to Xen 4.2 xen: move xenforeignmemory compat layer into common place xen: drop XenXC and associated interface wrappers xen: drop xen_xc_hvm_inject_msi wrapper xen: drop support for Xen 4.1 and older. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-02-11Merge remote-tracking branch ↵Peter Maydell6-22/+30
'remotes/mjt/tags/pull-trivial-patches-2016-02-11' into staging trivial patches for 2016-02-11 # gpg: Signature made Thu 11 Feb 2016 12:16:04 GMT using RSA key ID A4C3D7DB # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" * remotes/mjt/tags/pull-trivial-patches-2016-02-11: w32: include winsock2.h before windows.h Adds keycode 86 to the hid_usage_keys translation table. s390x: remove s390-zipl.rom Passthru CCID card: QOMify Emulated CCID card: QOMify ES1370: QOMify char: fix parameter name / type in BSD codepath qmp-spec: fix index in doc rdma: remove check on time_spent when calculating mbs qemu-sockets: simplify error handling cpu: cpu_save/cpu_load is no more qom: Correct object_property_get_int() description man: virtfs-proxy-helper: Rework awkward sentence remove libtool support Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-02-11Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into stagingPeter Maydell5-153/+214
# gpg: Signature made Wed 10 Feb 2016 19:23:29 GMT using RSA key ID AAFC390E # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" * remotes/jnsnow/tags/ide-pull-request: ahci: prohibit "restarting" the FIS or CLB engines ahci: explicitly reject bad engine states on post_load ahci: handle LIST_ON and FIS_ON in map helpers ahci: Do not unmap NULL addresses fdc: always compile-check debug prints ide: fix device_reset to not ignore pending AIO ide: Add silent DRQ cancellation ide: replace blk_drain_all by blk_drain ide: move buffered DMA cancel to core ide: code motion ide: Prohibit RESET on IDE drives Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-02-11Adds keycode 86 to the hid_usage_keys translation table.Daniel Serpell1-1/+1
This key is present in international keyboards, between left shift and the 'Z' key, ant is described in the HID usage tables as "Keyboard Non-US \ and |": http://www.usb.org/developers/hidpage/Hut1_12v2.pdf This patch fixes the usb-kbd devices. Signed-off-by: Daniel Serpell <daniel.serpell@gmail.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-02-11s390x: remove s390-zipl.romMichael Tokarev2-2/+1
This is an s390 boot rom which was used in s390-virtio machine. but since commit 3538fb6f89dd9bb2e7e59de2bfad52a45321c744 "s390x: remove s390-virtio machine", this file isn't used. The only place it is referenced in the code is an unused define ZIPL_FILENAME. There's also comment in hw/s390/ipl.c which I'm modifying too, to refer to s390-ccw.img instead. Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2016-02-11Passthru CCID card: QOMifyCao jin1-6/+8
Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-02-11Emulated CCID card: QOMifyCao jin1-10/+13
Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-02-11ES1370: QOMifyCao jin1-3/+7
Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-02-11bcm2835_property: implement "get board revision" queryStephen Warren4-2/+8
Return a valid value from the BCM2835 property mailbox query "get board revision". This query is used by U-Boot. Implementing it fixes the first obvious difference between qemu and real HW. The value returned is currently hard-coded to match the RPi2 I own. Other values are legal, e.g. different board manufacturer field values are likely to exist in the wild. Cc: Andrew Baumann <Andrew.Baumann@microsoft.com> Signed-off-by: Stephen Warren <swarren@wwwdotorg.org> Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Message-id: 1454993910-24077-1-git-send-email-swarren@wwwdotorg.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-02-11hw/arm/virt: fix max-cpus checkAndrew Jones1-5/+5
mach-virt doesn't yet support hotplug, but command lines specifying -smp <num>,maxcpus=<bigger-num> don't fail. Of course specifying bigger-num as something bigger than the machine supports, e.g. > 8 on a gicv2 machine, should fail though. This fix also makes mach- virt's max-cpus check truly consistent with the one in vl.c:main, as the one there was already correctly checking max-cpus instead of smp-cpus. Reported-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org> Message-id: 1454511578-24863-1-git-send-email-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-02-11sd: limit 'req.cmd' while using as an array indexPrasad J Pandit1-2/+5
While processing standard SD commands, the 'req.cmd' value could lead to OOB read when used as an index into 'sd_cmd_type' or 'sd_cmd_class' arrays. Limit 'req.cmd' value to avoid such an access. Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453315857-1352-1-git-send-email-ppandit@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-02-10ahci: prohibit "restarting" the FIS or CLB enginesJohn Snow1-19/+20
If the FIS or DMA engines are already started, do not allow them to be "restarted." As a side-effect of this change, the migration post-load routine must be modified to cope. If the engines are listed as "on" in the migrated registers, they must be cleared to allow the startup routine to see the transition from "off" to "on". As a second side-effect, the extra argument to ahci_cond_engine_start is removed in favor of consistent behavior. Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1454103689-13042-5-git-send-email-jsnow@redhat.com
2016-02-10ahci: explicitly reject bad engine states on post_loadJohn Snow1-8/+13
Currently, we let ahci_cond_start_engines reject weird configurations where either the DMA (CLB) or FIS engines are said to be started, but their matching on/off control bit is toggled off. There should be no way to achieve this, since any time you toggle the control bit off, the status bit should always follow synchronously. Preparing for a refactor in cond_start_engines, move the rejection logic straight up into post_load. Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1454103689-13042-4-git-send-email-jsnow@redhat.com
2016-02-10ahci: handle LIST_ON and FIS_ON in map helpersJohn Snow1-10/+18
Instead of relying on ahci_cond_start_engines to maintain the engine status indicators itself, have the lower-layer CLB and FIS mapper helpers do it themselves. This makes the cond_start routine slightly nicer to read, and makes sure that the status indicators will always be correct. Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1454103689-13042-3-git-send-email-jsnow@redhat.com
2016-02-10ahci: Do not unmap NULL addressesJohn Snow1-0/+8
Definitely don't try to unmap a garbage address. Reported-by: Zuozhi fzz <zuozhi.fzz@alibaba-inc.com> Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1454103689-13042-2-git-send-email-jsnow@redhat.com
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-26 22:05:04 +0000