Commit Graph

13529 Commits

Author SHA1 Message Date
Shannon Zhao
dc17ab1de5 hw/acpi/aml-build: Add aml_memory32_fixed() term
Add aml_memory32_fixed() for describing device mmio region in resource
template. These can be used to generating DSDT table for ACPI on ARM.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1432522520-8068-6-git-send-email-zhaoshenglong@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-29 11:28:55 +01:00
Shannon Zhao
f5d8c8cd79 hw/arm/virt-acpi-build: Basic framework for building ACPI tables on ARM
Introduce a preliminary framework in virt-acpi-build.c with the main
ACPI build functions. It exposes the generated ACPI contents to
guest over fw_cfg.

The required ACPI v5.1 tables for ARM are:
- RSDP: Initial table that points to XSDT
- RSDT: Points to FADT GTDT MADT tables
- FADT: Generic information about the machine
- GTDT: Generic timer description table
- MADT: Multiple APIC description table
- DSDT: Holds all information about system devices/peripherals, pointed by FADT

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 1432522520-8068-5-git-send-email-zhaoshenglong@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-29 11:28:54 +01:00
Shannon Zhao
6a1f001be3 hw/arm/virt: Record PCIe ranges in MemMapEntry array
To generate ACPI table for PCIe controller, we need the base and size of
the PCIe ranges. Record these ranges in MemMapEntry array, then we could
share and use them for generating ACPI table.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Message-id: 1432522520-8068-4-git-send-email-zhaoshenglong@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-29 11:28:54 +01:00
Shannon Zhao
afe0b3803f hw/arm/virt: Move common definitions to virt.h
Move some common definitions to virt.h. These will be used by
generating ACPI tables.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1432522520-8068-3-git-send-email-zhaoshenglong@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-29 11:28:54 +01:00
Shannon Zhao
ff80dc7fa8 hw/acpi/aml-build: Make enum values to be upper case to match coding style
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 1432522520-8068-2-git-send-email-zhaoshenglong@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-29 11:28:54 +01:00
Gerd Hoffmann
641381c1fc spice: don't update mm_time when spice-server is stopped.
Skip mm_time updates (in qxl device memory) in case the guest is stopped.
Guest isn't able to look anyway, and it causes problems with migration.

Also make sure the initial state for spice server is stopped.

Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-05-29 09:56:01 +02:00
Marc-André Lureau
246ca55faf virtio-console: notify chardev when writable
When the virtio serial is writable, notify the chardev backend
with qemu_chr_accept_input().

Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-05-29 09:56:01 +02:00
Peter Maydell
0915aed584 -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
 
 iQIcBAABAgAGBQJVX4p0AAoJEH3vgQaq/DkOuLAQAIWV1mHP5ZjzN81eeFxxe4VI
 gD2CgJ1MddFQcVplHjhj7ppwYKqusldvRhvxb5LO2hhtYDNDisFRotFF1zsnWNfo
 /CjSG9U/GUCKs1VDJ0XRIpCRohQHIZnhRb/GmVSuPx4tT2aDu4J1YEYpCYG78ajD
 YpHPmnE3LuJnzMwXHTB3WaF6AWyYNbA4mX7cH8kfHVZS8zPBMZi9v80QJSg1Tb9u
 XysiFsdQt8LHP3n/EShdv7cFt131nZxZeWozHQwzk2RKniI8iuJsZw/uf+GIPNDp
 52klQXIdTLw4xJAfNt1zntbLNXrcbP2VTwgKRYQEOeyL1BzCym03W/LwJwMFhAPC
 mnB8QU/HFkpQj7cqALB4drc5BNGeSfwkcDODK+yhe1vjKV78LE/zOmrVxUA/rEKa
 IBJYv0k44JijAJxyZIijSVBH69OZPBtczEmHkcI6k8THonQlpNB0oLOj97oDGqM+
 bFYrPRK0WKfG7enC2cPLAdXC3xSwWXumReA4xeIw/FMpQJHAmkt2xEE6VI+zKZUD
 h4bL4l6nKFX1bQ+0A08Z6UQIAhC1p1F/ZQmjoTSQezRAR2Nd9NfEOl8iUnJMIUTr
 3NPmtZLTqv/rBZdCpgBZ/8a+sBja9met91DGCd5fJ6rmHpTc9qiRQkemhyho8UDv
 vfeWvrQz4WHLEhCIbFEI
 =JDLF
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

# gpg: Signature made Fri May 22 20:58:44 2015 BST using RSA key ID AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
#      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

* remotes/jnsnow/tags/ide-pull-request:
  ahci: do not remap clb/fis unconditionally
  macio: move unaligned DMA write code into separate pmac_dma_write() function
  macio: move unaligned DMA read code into separate pmac_dma_read() function
  qtest: pre-buffer hex nibs
  libqos/ahci: Swap memread/write with bufread/write
  qtest: add memset to qtest protocol
  qtest: Add base64 encoded read/write
  qtest: allow arbitrarily long sends
  qtest/ahci: add migrate halted dma test
  qtest/ahci: add halted dma test
  qtest/ahci: add flush migrate test
  qtest/ahci: add migrate dma test
  qtest/ahci: Add migration test
  ich9/ahci: Enable Migration
  libqos: Add migration helpers
  libqos/ahci: Fix sector set method
  libqos/ahci: Add halted command helpers
  glib: remove stale compat functions
  configure: require glib 2.22

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-26 11:31:03 +01:00
John Snow
cd6cb73beb ahci: do not remap clb/fis unconditionally
This continues the IOMMU fix from 2.3, where we should not attempt
to remap the CLB or FIS RX buffers if the AHCI device is currently
running.

The same applies to migration: keep our mitts off these registers
unless the device is supposed to be on.

Does not impact backwards compatibility for the AHCI device.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1431470173-30847-2-git-send-email-jsnow@redhat.com
2015-05-22 15:58:22 -04:00
Mark Cave-Ayland
bd4214fc92 macio: move unaligned DMA write code into separate pmac_dma_write() function
Similarly switch the macio IDE routines over to use the new function and
tidy-up the remaining code as required.

[Maintainer edit: printf format codes adjusted for 32/64bit. --js]

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Acked-by: John Snow <jsnow@redhat.com>
Message-id: 1425939893-14404-3-git-send-email-mark.cave-ayland@ilande.co.uk
Signed-off-by: John Snow <jsnow@redhat.com>
2015-05-22 15:58:22 -04:00
Mark Cave-Ayland
4827ac1e8f macio: move unaligned DMA read code into separate pmac_dma_read() function
This considerably helps simplify the complexity of the macio read routines and
by switching macio CDROM accesses to use the new code, fixes the issue with
the CDROM device being detected intermittently by Darwin/OS X.

[Maintainer edit: printf format codes adjusted for 32/64bit. --js]

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ailande.co.uk>
Acked-by: John Snow <jsnow@redhat.com>
Message-id: 1425939893-14404-2-git-send-email-mark.cave-ayland@ilande.co.uk
Signed-off-by: John Snow <jsnow@redhat.com>
2015-05-22 15:58:22 -04:00
John Snow
04329029a8 ich9/ahci: Enable Migration
Lift the flag preventing the migration of the ICH9/AHCI devices.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1430417242-11859-5-git-send-email-jsnow@redhat.com
2015-05-22 15:58:22 -04:00
Christoph Hellwig
aacd5650c6 nvme: support NVME_VOLATILE_WRITE_CACHE feature
The SCSI emulation in the Linux NVMe driver really wants to know
if a device has a volatile write cache.  Given that qemu has moved
away from a model where we report the backing store WCE bit to
one where the WCE bit is supposed to be part of the migratable
guest-visible state we always return 1 here.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2015-05-22 17:08:00 +02:00
Peter Maydell
eba05e922e serial: fix multi-pci card error cleanup.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJVWxTBAAoJEEy22O7T6HE48boP/0e+WavR48nhASyYNLTW5SR7
 NmOPqN964HN0dDP3S5jItD1GP2DtPb/9kQga0l8b/t5X89oW23ZjB6EHlVDLboNS
 b0zc6ahcvNpvNRm/DYEv8zZCXU9e6qwCUKfo/TZ7L74bP0/2ol49Ry3fvKZrs/JK
 M8emDFh3CoVvvQoLO1eUpoj9ATi20I28silVFgaHeU7kB/qGXoQCPiO8Wu5GBGgS
 HvtfB2VA0tn4D/NeWO5ll78GhO+TtB0SXsFfW9ln7wlYAgTv0/7mPaS4ELTTeSye
 ThBR/CN7ArKINPIEEDIJUT2y8Hv4XeKgFTH1WjAce3LMjx1kGeA6mfOsXm63YCgj
 JqMJhnxSkNY4GqHLxzb6+KYgqOq7KVPsjbUyHR52M2thl0PEEbP9Ft/XXZT6WAkB
 8ISjk+vmfojAEVYXjk/ZZvDTkws+53r/aWO5FakObAj/l2Sk8FtrBMJyqdo/+2QO
 6GCJUVnmPVhGpaT94ysCwihIJl6CPpARAFWwKKleCZx2AENL7amk8HxilaDcJE5S
 /is3c7YIc6vL5PENUuyoAIsnvWhnocSvwGvsMtWkLtrnGbCYaEGyLpk1ty12PSQM
 e2kWd/qxIerKECyJ1+BPZb8zewR0o9wxHX/qZtrfOo9zsSwc8JOZFw8s1HWxDMj8
 XbqDYzHlmBUvMg8kQY02
 =4NPQ
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kraxel/tags/pull-serial-20150519-1' into staging

serial: fix multi-pci card error cleanup.

# gpg: Signature made Tue May 19 11:47:29 2015 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-serial-20150519-1:
  serial: fix multi-pci card error cleanup.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-19 14:10:33 +01:00
Gerd Hoffmann
a48da7b5bc serial: fix multi-pci card error cleanup.
Put the number of serial ports into a local variable in
multi_serial_pci_realize, then increment the port count
(pci->ports) as we initialize the serial port cores.

Now pci->ports always holds the number of successfully
initialized ports and we can use multi_serial_pci_exit
to properly cleanup the already initialized bits in case
of a init failure.

https://bugzilla.redhat.com/show_bug.cgi?id=970551

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
2015-05-19 12:47:08 +02:00
Gonglei
176c324feb vga-pci: QOMify
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-05-19 11:40:01 +02:00
Gonglei
c69f6c7dcf qxl: QOMify
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-05-19 11:40:01 +02:00
Gonglei
d338bae33a cirrus_vga: QOMify
QOMify pci-cirrus-vga like isa-cirrus-vga device.

Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-05-19 11:40:01 +02:00
Peter Crosthwaite
082587b741 arm: xlnx-ep108: Add bootloading
Add bootloader support using standard ARM bootloader.

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: b829abaf2b70d02b28e79301553cbd74afc416a1.1431381507.git.peter.crosthwaite@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-18 16:41:14 +01:00
Peter Crosthwaite
b79b9d28f6 arm: xlnx-ep108: Add external RAM
Zynq MPSoC supports external DDR RAM. Add a RAM at 0 to the model.

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 2c25e2a4198402a6477aef2975d5df7c415dd341.1431381507.git.peter.crosthwaite@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-18 16:41:14 +01:00
Peter Crosthwaite
859a0c5b5f arm: Add xlnx-ep108 machine
Add a machine model for the Xilinx ZynqMP SoC EP108 board.

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 3896b34c862f370dc0679e4428bf3848d1f9f83c.1431381507.git.peter.crosthwaite@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-18 16:41:13 +01:00
Peter Crosthwaite
3bade2a9e6 arm: xlnx-zynqmp: Add UART support
There are 2x Cadence UARTs in Zynq MP. Add them.

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: e30795536f77599fabc1052278d846ccd52322e2.1431381507.git.peter.crosthwaite@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-18 16:41:13 +01:00
Peter Crosthwaite
8ae57b2fa3 char: cadence_uart: Split state struct and type into header
Create a new header for Cadence UART to allow using the device with
modern SoC programming conventions. The state struct needs to be
visible to embed the device in SoC containers.

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 46a0fbd45b6b205f54c4a8c778deb75c77f8abdf.1431381507.git.peter.crosthwaite@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-18 16:41:12 +01:00
Peter Crosthwaite
e86da3cb40 char: cadence_uart: Clean up variable names
Clean up some variable names in preparation for migrating the state struct
and type cast macro to a public header. The acronym "UART" on it's own is
not specific enough to be used in a more global namespace so preface with
"cadence". Fix the capitalisation of "uart" in the state type while touching
the typename. Preface macros used by the state struct itself with CADENCE_UART
so they don't conflict in namespace either.

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 3812b7426c338beae9e082557f3524a99310ddc6.1431381507.git.peter.crosthwaite@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-18 16:41:12 +01:00
Peter Crosthwaite
14ca2e462e arm: xlnx-zynqmp: Add GEM support
There are 4x Cadence GEMs in ZynqMP. Add them.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 7d3e68e5495d145255f0ee567046415e3a26d67e.1431381507.git.peter.crosthwaite@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-18 16:41:11 +01:00
Peter Crosthwaite
f49856d4e6 net: cadence_gem: Split state struct and type into header
Create a new header for Cadence GEM to allow using the device with
modern SoC programming conventions. The state struct needs to be
visible to embed the device in SoC containers.

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: a98b5df6440c5bff8f813a26bb53ce1cfefb4c4c.1431381507.git.peter.crosthwaite@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-18 16:41:11 +01:00
Peter Crosthwaite
448f19e231 net: cadence_gem: Clean up variable names
Cleanup some variable names in preparation for migrating the state
struct and type cast macro to a public header. The acronym "GEM" on
its own is not specific enough to be used in a more global namespace
so preface with "cadence". Fix the capitalisation of "gem" in the
state type while touching the typename. Also preface the GEM_MAXREG
macro as this will need to migrate to public header.

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 8e2b0687b3a7b7a3fde5ba2f3bee6f3b911e84ef.1431381507.git.peter.crosthwaite@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-18 16:41:10 +01:00
Peter Crosthwaite
bf4cb10966 arm: xlnx-zynqmp: Connect CPU Timers to GIC
Connect the GPIO outputs from the individual CPUs for the timers to the
GIC.

Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: a7866a4f0c903c91fa3034210b4d2879aa4bfcb9.1431381507.git.peter.crosthwaite@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-18 16:41:10 +01:00
Peter Crosthwaite
7729e1f4b3 arm: xlnx-zynqmp: Add GIC
Add the GIC and connect IRQ outputs to the CPUs. The GIC regions are
under-decoded through a 64k address region so implement aliases
accordingly.

Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 5853189965728d676106d9e94e76b9bb87981cb5.1431381507.git.peter.crosthwaite@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-18 16:41:09 +01:00
Peter Crosthwaite
f0a902f764 arm: Introduce Xilinx ZynqMP SoC
With quad Cortex-A53 CPUs.

Use SMC PSCI, with the standard policy of secondaries starting in
power-off.

Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: a16202a6c7b79e446e5289d38cb18d2ee4b897a0.1431381507.git.peter.crosthwaite@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-18 16:41:09 +01:00
Petr Matousek
e907746266 fdc: force the fifo access to be in bounds of the allocated buffer
During processing of certain commands such as FD_CMD_READ_ID and
FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory access could
get out of bounds leading to memory corruption with values coming
from the guest.

Fix this by making sure that the index is always bounded by the
allocated memory.

This is CVE-2015-3456.

Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: John Snow <jsnow@redhat.com>
2015-05-12 18:52:57 -04:00
Peter Maydell
5ae79fe825 hw/arm/highbank.c: Wire FIQ between CPU <> GIC
Connect FIQ output of the GIC CPU interfaces to the CPUs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-18-git-send-email-peter.maydell@linaro.org
2015-05-12 11:57:19 +01:00
Fabian Aggeler
27192e390d hw/arm/vexpress.c: Wire FIQ between CPU <> GIC
Connect FIQ output of the GIC CPU interfaces to the CPUs.

Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-17-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-3-git-send-email-greg.bellows@linaro.org
[PMM: minor format tweak]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-12 11:57:18 +01:00
Greg Bellows
8e7b4ca08b hw/arm/virt.c: Wire FIQ between CPU <> GIC
Connect FIQ output of the GIC CPU interfaces to the CPUs.

Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-16-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-4-git-send-email-greg.bellows@linaro.org
[PMM: minor format tweak]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-12 11:57:18 +01:00
Peter Maydell
dadbb58f59 hw/intc/arm_gic: Add grouping support to gic_update()
Add support to gic_update() for determining the current IRQ
and FIQ status when interrupt grouping is supported. This
simply requires that instead of always raising IRQ we
check the group of the highest priority pending interrupt
and the GICC_CTLR.FIQEn bit to see whether we should raise
IRQ or FIQ.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1430502643-25909-15-git-send-email-peter.maydell@linaro.org
2015-05-12 11:57:18 +01:00
Fabian Aggeler
c5619bf9e8 hw/intc/arm_gic: Change behavior of IAR writes
Grouping (GICv2) and Security Extensions change the behavior of IAR
reads. Acknowledging Group0 interrupts is only allowed from Secure
state and acknowledging Group1 interrupts from Secure state is only
allowed if AckCtl bit is set.

Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-14-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-14-git-send-email-greg.bellows@linaro.org
[PMM: simplify significantly by reusing the existing
 gic_get_current_pending_irq() rather than reimplementing the
 same logic here]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-12 11:57:18 +01:00
Fabian Aggeler
f9c6a7f139 hw/intc/arm_gic: Change behavior of EOIR writes
Grouping (GICv2) and Security Extensions change the behavior of EOIR
writes. Completing Group0 interrupts is only allowed from Secure state.

Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-13-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-13-git-send-email-greg.bellows@linaro.org
[PMM: Rather than go to great lengths to ignore the UNPREDICTABLE case
 of a Secure EOI of a Group1 (NS) irq with AckCtl == 0, we just let
 it fall through; add a comment about it.]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-12 11:57:18 +01:00
Fabian Aggeler
7c0fa108d9 hw/intc/arm_gic: Handle grouping for GICC_HPPIR
Grouping (GICv2) and Security Extensions change the behaviour of reads
of the highest priority pending interrupt register (ICCHPIR/GICC_HPPIR).

Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-12-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-12-git-send-email-greg.bellows@linaro.org
[PMM: make utility fn static; coding style fixes; AckCtl has an effect
 for GICv2 without security extensions as well; removed checks on enable
 bits because these are done when we set current_pending[cpu]]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-12 11:57:18 +01:00
Fabian Aggeler
8150847061 hw/intc/arm_gic: Restrict priority view
GICs with Security Extensions restrict the non-secure view of the
interrupt priority and priority mask registers.

Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-11-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-15-git-send-email-greg.bellows@linaro.org
[PMM: minor code tweaks; fixed missing masking in gic_set_priority_mask
and gic_set_priority]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-12 11:57:17 +01:00
Fabian Aggeler
08efa9f2d1 hw/intc/arm_gic: Implement Non-secure view of RPR
For GICs with Security Extensions Non-secure reads have a restricted
view on the current running priority.

Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-10-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-11-git-send-email-greg.bellows@linaro.org
[PMM: make function static, minor comment tweak]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-12 11:57:17 +01:00
Fabian Aggeler
3295186083 hw/intc/arm_gic: Make ICCICR/GICC_CTLR banked
ICCICR/GICC_CTLR is banked in GICv1 implementations with Security
Extensions or in GICv2 in independent from Security Extensions.
This makes it possible to enable forwarding of interrupts from
the CPU interfaces to the connected processors for Group0 and Group1.

We also allow to set additional bits like AckCtl and FIQEn by changing
the type from bool to uint32. Since the field does not only store the
enable bit anymore and since we are touching the vmstate, we use the
opportunity to rename the field to cpu_ctlr.

Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-9-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-9-git-send-email-greg.bellows@linaro.org
[PMM: rewrote to store state in a single uint32_t rather than
 keeping the NS and S banked variants separate; this considerably
 simplifies the get/set functions]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-12 11:57:17 +01:00
Fabian Aggeler
822e9cc310 hw/intc/arm_gic: Make ICCBPR/GICC_BPR banked
This register is banked in GICs with Security Extensions. Storing the
non-secure copy of BPR in the abpr, which is an alias to the non-secure
copy for secure access. ABPR itself is only accessible from secure state
if the GIC implements Security Extensions.

Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-8-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-10-git-send-email-greg.bellows@linaro.org
[PMM: rewrote to fix style issues and correct handling of GICv2
 without security extensions]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-12 11:57:17 +01:00
Fabian Aggeler
679aa175e8 hw/intc/arm_gic: Make ICDDCR/GICD_CTLR banked
ICDDCR/GICD_CTLR is banked if the GIC has the security extensions,
and the S (or only) copy has separate enable bits for Group0 and
Group1 enable if the GIC implements interrupt groups.

EnableGroup0 (Bit [1]) in GICv1 is architecturally IMPDEF. Since this
bit (Enable Non-secure) is present in the integrated GIC of the Cortex-A9
MPCore, we support this bit in our GICv1 implementation too.

Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-7-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-8-git-send-email-greg.bellows@linaro.org
[PMM: rewritten to store the state in a single s->ctlr uint32,
 with the NS register handled as an alias of bit 1 in that value;
 added vmstate version bump]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-12 11:57:17 +01:00
Peter Maydell
eb8b9530b0 hw/intc/arm_gic_kvm.c: Save and restore GICD_IGROUPRn state
Now that the GIC base class has state fields for the GICD_IGROUPRn
registers, make kvm_arm_gic_get() and kvm_arm_gic_put() write and
read them. This allows us to remove the check that made us
fail migration if the guest had set any of the group register bits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-6-git-send-email-peter.maydell@linaro.org
2015-05-12 11:57:17 +01:00
Fabian Aggeler
c27a5ba948 hw/intc/arm_gic: Add Interrupt Group Registers
The Interrupt Group Registers allow the guest to configure interrupts
into one of two groups, where Group0 are higher priority and may
be routed to IRQ or FIQ, and Group1 are lower priority and always
routed to IRQ. (In a GIC with the security extensions Group0 is
Secure interrupts and Group 1 is NonSecure.)
The GICv2 always supports interrupt grouping; the GICv1 does only
if it implements the security extensions.

This patch implements the ability to read and write the registers;
the actual functionality the bits control will be added in a
subsequent patch.

Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-5-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-7-git-send-email-greg.bellows@linaro.org
[PMM: bring GIC_*_GROUP macros into line with the others, ie a
 simple SET/CLEAR/TEST rather than GROUP0/GROUP1;
 utility gic_has_groups() function;
 minor style fixes;
 bump vmstate version]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-12 11:57:17 +01:00
Peter Maydell
a9d853533c hw/intc/arm_gic: Switch to read/write callbacks with tx attributes
Switch the GIC's MMIO callback functions to the read_with_attrs
and write_with_attrs functions which provide MemTxAttrs. This will
allow the GIC to correctly handle secure and nonsecure register
accesses.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1430502643-25909-4-git-send-email-peter.maydell@linaro.org
2015-05-12 11:57:16 +01:00
Fabian Aggeler
5543d1abb6 hw/intc/arm_gic: Add Security Extensions property
Add a QOM property which allows the GIC Security Extensions to be
enabled. These are an optional part of the GICv1 and GICv2 architecture.
This commit just adds the property and some sanity checks that it
is only enabled on GIC revisions that support it.

Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-3-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-5-git-send-email-greg.bellows@linaro.org
[PMM: changed property name, added checks that it isn't set for
 older GIC revisions or if using the KVM VGIC; reworded commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-12 11:57:16 +01:00
Fabian Aggeler
44f5529647 hw/intc/arm_gic: Create outbound FIQ lines
Create the outbound FIQ lines from the GIC to the CPUs; these are
used if the GIC has security extensions or grouping support.

Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-2-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-2-git-send-email-greg.bellows@linaro.org
[PMM: added FIQ lines to kvm-arm-gic so its interface is the same;
tweaked commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-12 11:57:16 +01:00
Peter Maydell
16b781aaef hw/sd: Don't pass BlockBackend to sd_reset()
The only valid BlockBackend to pass to sd_reset() is the one for
the SD card, which is sd->blk. Drop the second argument from this
function in favour of having it just use sd->blk.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1430683444-9797-1-git-send-email-peter.maydell@linaro.org
2015-05-12 11:57:16 +01:00
Adrian Huang
165cdaf857 armv7m_nvic: systick: Reload the RELOAD value and count down only if ENABLE bit is set
Consider the following pseudo code to configure SYSTICK (The
recommended programming sequence from "the definitive guide to the
arm cortex-m3"):
    SYSTICK Reload Value Register = 0xffff
    SYSTICK Current Value Register = 0
    SYSTICK Control and Status Register = 0x7

The pseudo code "SYSTICK Current Value Register = 0" leads to invoking
systick_reload(). As a consequence, the systick.tick member is updated
and the systick timer starts to count down when the ENABLE bit of
SYSTICK Control and Status Register is cleared.

The worst case is that: during the system initialization, the reset
value of the SYSTICK Control and Status Register is 0x00000000.
When the code "SYSTICK Current Value Register = 0" is executed, the
systick.tick member is accumulated with "(s->systick.reload + 1) *
systick_scale(s)". The systick_scale() gets the external_ref_clock
scale because the CLKSOURCE bit of the SYSTICK Control and Status
Register is cleared. This is the incorrect behavior because of the
code "SYSTICK Control and Status Register = 0x7". Actually, we want
the processor clock instead of the external reference clock.

This incorrect behavior defers the generation of the first interrupt.

The patch fixes the above-mentioned issue by setting the systick.tick
member and modifying the systick timer only if the ENABLE bit of
the SYSTICK Control and Status Register is set.

In addition, the Cortex-M3 Devices Generic User Guide mentioned that
"When ENABLE is set to 1, the counter loads the RELOAD value from the
SYST RVR register and then counts down". This patch adheres to the
statement of the user guide.

Signed-off-by: Adrian Huang <adrianhuang0701@gmail.com>
Reviewed-by: Jim Huang <jserv.tw@gmail.com>
[PMM: minor tweak to comment text]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-12 11:57:16 +01:00