aboutsummaryrefslogtreecommitdiff
path: root/hw/char
AgeCommit message (Collapse)Author
2024-10-15hw/char/pl011: Use correct masks for IBRD and FBRDPeter Maydell
In commit b88cfee90268cad we defined masks for the IBRD and FBRD integer and fractional baud rate divider registers, to prevent the guest from writing invalid values which could cause division-by-zero. Unfortunately we got the mask values the wrong way around: the FBRD register is six bits and the IBRD register is 16 bits, not vice-versa. You would only run into this bug if you programmed the UART to a baud rate of less than 9600, because for 9600 baud and above the IBRD value will fit into 6 bits, as per the table in https://developer.arm.com/documentation/ddi0183/g/programmers-model/register-descriptions/fractional-baud-rate-register--uartfbrd The only visible effects would be that the value read back from the register by the guest would be truncated, and we would print an incorrect baud rate in the debug logs. Cc: qemu-stable@nongnu.org Fixes: b88cfee90268 ("hw/char/pl011: Avoid division-by-zero in pl011_get_baudrate()") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2610 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Gavin Shan <gshan@redhat.com> Message-id: 20241007144732.2491331-1-peter.maydell@linaro.org
2024-10-04Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingPeter Maydell
* pc: Add a description for the i8042 property * kvm: support for nested FRED * tests/unit: fix warning when compiling test-nested-aio-poll with LTO * kvm: refactoring of VM creation * target/i386: expose IBPB-BRTYPE and SBPB CPUID bits to the guest * hw/char: clean up serial * remove virtfs-proxy-helper * target/i386/kvm: Report which action failed in kvm_arch_put/get_registers * qom: improvements to object_resolve_path*() # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmb++MsUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroPVnwf/cdvfxvDm22tEdlh8vHlV17HtVdcC # Hw334M/3PDvbTmGzPBg26lzo4nFS6SLrZ8ETCeqvuJrtKzqVk9bI8ssZW5KA4ijM # nkxguRPHO8E6U33ZSucc+Hn56+bAx4I2X80dLKXJ87OsbMffIeJ6aHGSEI1+fKVh # pK7q53+Y3lQWuRBGhDIyKNuzqU4g+irpQwXOhux63bV3ADadmsqzExP6Gmtl8OKM # DylPu1oK7EPZumlSiJa7Gy1xBqL4Rc4wGPNYx2RVRjp+i7W2/Y1uehm3wSBw+SXC # a6b7SvLoYfWYS14/qCF4cBL3sJH/0f/4g8ZAhDDxi2i5kBr0/5oioDyE/A== # =/zo4 # -----END PGP SIGNATURE----- # gpg: Signature made Thu 03 Oct 2024 21:04:27 BST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (23 commits) qom: update object_resolve_path*() documentation qom: set *ambiguous on all paths qom: rename object_resolve_path_type() "ambiguousp" target/i386/kvm: Report which action failed in kvm_arch_put/get_registers kvm: Allow kvm_arch_get/put_registers to accept Error** accel/kvm: refactor dirty ring setup minikconf: print error entirely on stderr 9p: remove 'proxy' filesystem backend driver hw/char: Extract serial-mm hw/char/serial.h: Extract serial-isa.h hw: Remove unused inclusion of hw/char/serial.h target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest kvm: refactor core virtual machine creation into its own function kvm/i386: replace identity_base variable with a constant kvm/i386: refactor kvm_arch_init and split it into smaller functions kvm: replace fprintf with error_report()/printf() in kvm_init() kvm/i386: fix return values of is_host_cpu_intel() kvm/i386: make kvm_filter_msr() and related definitions private to kvm module hw/i386/pc: Add a description for the i8042 property tests/unit: remove block layer code from test-nested-aio-poll ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org> # Conflicts: # hw/arm/Kconfig # hw/arm/pxa2xx.c
2024-10-03hw/char: Extract serial-mmBernhard Beschow
hw/char/serial currently contains the implementation of both TYPE_SERIAL and TYPE_SERIAL_MM. According to serial_class_init(), TYPE_SERIAL is an internal class while TYPE_SERIAL_MM is used by numerous machine types directly. Let's move the latter into its own module which makes the dependencies more obvious and the code more tidy. The includes and the dependencies have been converted mechanically except in the hw/char directories which were updated manually. The result was compile-tested. Now, only hw/char makes direct use of TYPE_SERIAL: # grep -r -e "select SERIAL" | grep -v SERIAL_ hw/char/Kconfig: select SERIAL hw/char/Kconfig: select SERIAL hw/char/Kconfig: select SERIAL hw/char/Kconfig: select SERIAL hw/char/Kconfig: select SERIAL # grep -r -e "/serial\\.h" include/hw/char/serial-mm.h:#include "hw/char/serial.h" hw/char/serial-pci-multi.c:#include "hw/char/serial.h" hw/char/serial.c:#include "hw/char/serial.h" hw/char/serial-isa.c:#include "hw/char/serial.h" hw/char/serial-pci.c:#include "hw/char/serial.h" Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Link: https://lore.kernel.org/r/20240905073832.16222-4-shentey@gmail.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-03hw/char/serial.h: Extract serial-isa.hBernhard Beschow
The includes where updated based on compile errors. Now, the inclusion of the header roughly matches Kconfig dependencies: # grep -r -e "select SERIAL_ISA" hw/ppc/Kconfig: select SERIAL_ISA hw/isa/Kconfig: select SERIAL_ISA hw/sparc64/Kconfig: select SERIAL_ISA hw/i386/Kconfig: select SERIAL_ISA hw/i386/Kconfig: select SERIAL_ISA # for serial_hds_isa_init() Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Link: https://lore.kernel.org/r/20240905073832.16222-3-shentey@gmail.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-03hw: Remove unused inclusion of hw/char/serial.hBernhard Beschow
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Link: https://lore.kernel.org/r/20240905073832.16222-2-shentey@gmail.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-03hw/char: Remove unused serial_set_frequencyDr. David Alan Gilbert
serial_set_frequnecy has been unused since it was added in 2009: 038eaf82c8 ("serial: Add interface to set reference oscillator frequency") It looks like the 'baudbase' is now a property anyway so the wrapper isn't needed. Remove it. Signed-off-by: Dr. David Alan Gilbert <dave@treblig.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-10-01hw/char: Remove omap2_uartPeter Maydell
Remove the OMAP2 specific code from omap_uart.c. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240903160751.4100218-40-peter.maydell@linaro.org
2024-09-19hw/char/stm32l4x5_usart.c: Enable USART ACK bit responseJacob Abrams
SW modifying USART_CR1 TE bit should cuase HW to respond by altering USART_ISR TEACK bit, and likewise for RE and REACK bit. This resolves some but not all issues necessary for the official STM USART HAL driver to function as is. Fixes: 87b77e6e01ca ("hw/char/stm32l4x5_usart: Enable serial read and write") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2540 Signed-off-by: Jacob Abrams <satur9nine@gmail.com> Message-id: 20240911043255.51966-1-satur9nine@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-09-13hw/char: replace assert(0) with g_assert_not_reached()Pierrick Bouvier
Use of assert(false) can trip spurious control flow warnings from some versions of GCC (i.e. using -fsanitize=thread with gcc-12): error: control reaches end of non-void function [-Werror=return-type] default: assert(0); | } | ^ Solve that by unifying the code base on g_assert_not_reached() instead. Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240910221606.1817478-5-pierrick.bouvier@linaro.org> [PMD: Add description suggested by Eric Blake] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-09-13hw/char/escc: convert Sun mouse to use QemuInputHandlerMark Cave-Ayland
Update the Sun mouse implementation to use QemuInputHandler instead of the legacy qemu_add_mouse_event_handler() function. Note that this conversion adds extra sunmouse_* members to ESCCChannelState but they are not added to the migration stream (similar to the Sun keyboard members). If this were desired in future, the Sun devices should be split into separate devices and added to the migration stream there instead. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2518 Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Carl Hauser <chauser@pullman.com> Message-ID: <20240904102301.175706-1-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-09-13hw/char/pl011: Rename RX FIFO methodsPhilippe Mathieu-Daudé
In preparation of having a TX FIFO, rename the RX FIFO methods. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240719181041.49545-12-philmd@linaro.org>
2024-09-13hw/char/pl011: Warn when using disabled transmitterPhilippe Mathieu-Daudé
We shouldn't transmit characters when the full UART or its transmitter is disabled. However we don't want to break the possibly incomplete "my first bare metal assembly program"s, so we choose to simply display a warning when this occurs. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240719181041.49545-9-philmd@linaro.org>
2024-09-13hw/char/pl011: Extract pl011_read_rxdata() from pl011_read()Philippe Mathieu-Daudé
To keep MemoryRegionOps read/write handlers with similar logic, factor pl011_read_txdata() out of pl011_read(), similar to what the previous commit did to pl011_write(). No functional change intended. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240719181041.49545-8-philmd@linaro.org>
2024-09-13hw/char/pl011: Extract pl011_write_txdata() from pl011_write()Philippe Mathieu-Daudé
When implementing FIFO, this code will become more complex. Start by factoring it out to a new pl011_write_txdata() function. No functional change intended. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240719181041.49545-7-philmd@linaro.org>
2024-09-13hw/char/pl011: Split RX/TX path of pl011_reset_fifo()Philippe Mathieu-Daudé
To be able to reset the RX or TX FIFO separately, split pl011_reset_fifo() in two. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240719181041.49545-6-philmd@linaro.org>
2024-09-13hw/char/pl011: Move pl011_loopback_enabled|tx() aroundPhilippe Mathieu-Daudé
We'll soon use pl011_loopback_enabled() and pl011_loopback_tx() from functions defined before their declarations. In order to avoid forward-declaring them, move them around. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20240719181041.49545-5-philmd@linaro.org>
2024-09-13hw/char/pl011: Move pl011_put_fifo() earlierPhilippe Mathieu-Daudé
Avoid forward-declaring pl011_put_fifo() by moving it earlier. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20240719181041.49545-4-philmd@linaro.org>
2024-09-13hw/char/pl011: Remove unused 'readbuff' fieldPhilippe Mathieu-Daudé
Since its introduction in commit cdbdb648b7 ("ARM Versatile Platform Baseboard emulation.") PL011State::readbuff as never been used. Remove it. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20240719181041.49545-3-philmd@linaro.org>
2024-09-13hw/char: Remove TYPE_ETRAX_FS_SERIAL devicePhilippe Mathieu-Daudé
We just removed the single machine using it (axis-dev88). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Message-ID: <20240904143603.52934-9-philmd@linaro.org>
2024-09-13hw: Use device_class_set_legacy_reset() instead of opencodingPeter Maydell
Use device_class_set_legacy_reset() instead of opencoding an assignment to DeviceClass::reset. This change was produced with: spatch --macro-file scripts/cocci-macro-file.h \ --sp-file scripts/coccinelle/device-reset.cocci \ --keep-comments --smpl-spacing --in-place --dir hw Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240830145812.1967042-8-peter.maydell@linaro.org
2024-07-29hw/char/bcm2835_aux: Fix assert when receive FIFO fills upFrederik van Hövell
When a bare-metal application on the raspi3 board reads the AUX_MU_STAT_REG MMIO register while the device's buffer is at full receive FIFO capacity (i.e. `s->read_count == BCM2835_AUX_RX_FIFO_LEN`) the assertion `assert(s->read_count < BCM2835_AUX_RX_FIFO_LEN)` fails. Reported-by: Cryptjar <cryptjar@junk.studio> Suggested-by: Cryptjar <cryptjar@junk.studio> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/459 Signed-off-by: Frederik van Hövell <frederik@fvhovell.nl> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> [PMM: commit message tweaks] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-07-23util/fifo8: Rename fifo8_pop_buf() -> fifo8_pop_bufptr()Philippe Mathieu-Daudé
Since fifo8_pop_buf() return a const buffer (which points directly into the FIFO backing store). Rename it using the 'bufptr' suffix to better reflect that it is a pointer to the internal buffer that is being returned. This will help differentiate with methods *copying* the FIFO data. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20240722160745.67904-6-philmd@linaro.org>
2024-07-23hw/char/goldfish: Use DMA memory APIPhilippe Mathieu-Daudé
Rather than using address_space_rw(..., 0 or 1), use the simpler DMA memory API which expand to the same code. This allows removing a cast on the 'buf' variable which is really const. Since 'buf' is only used in the CMD_READ_BUFFER case, we can reduce its scope. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240723181850.46000-1-philmd@linaro.org>
2024-07-11hw/char/pl011: Avoid division-by-zero in pl011_get_baudrate()Zheyu Ma
In pl011_get_baudrate(), when we calculate the baudrate we can accidentally divide by zero. This happens because although (as the specification requires) we treat UARTIBRD = 0 as invalid, we aren't correctly limiting UARTIBRD and UARTFBRD values to the 16-bit and 6-bit ranges the hardware allows, and so some non-zero values of UARTIBRD can result in a zero divisor. Enforce the correct register field widths on guest writes and on inbound migration to avoid the division by zero. ASAN log: ==2973125==ERROR: AddressSanitizer: FPE on unknown address 0x55f72629b348 (pc 0x55f72629b348 bp 0x7fffa24d0e00 sp 0x7fffa24d0d60 T0) #0 0x55f72629b348 in pl011_get_baudrate hw/char/pl011.c:255:17 #1 0x55f726298d94 in pl011_trace_baudrate_change hw/char/pl011.c:260:33 #2 0x55f726296fc8 in pl011_write hw/char/pl011.c:378:9 Reproducer: cat << EOF | qemu-system-aarch64 -display \ none -machine accel=qtest, -m 512M -machine realview-pb-a8 -qtest stdio writeq 0x1000b024 0xf8000000 EOF Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240702155752.3022007-1-zheyuma97@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-05-28hw: arm: Remove use of tabs in some source filesTanmay Patil
Some of the source files for older devices use hardcoded tabs instead of our current coding standard's required spaces. Fix these in the following files: - hw/arm/boot.c - hw/char/omap_uart.c - hw/gpio/zaurus.c - hw/input/tsc2005.c This commit is mostly whitespace-only changes; it also adds curly-braces to some 'if' statements. This addresses part of https://gitlab.com/qemu-project/qemu/-/issues/373 but some other files remain to be handled. Signed-off-by: Tanmay Patil <tanmaynpatil105@gmail.com> Message-id: 20240508081502.88375-1-tanmaynpatil105@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: tweaked commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-05-28hw/char: Correct STM32L4x5 usart register CR2 field ADD_0 sizeInès Varhol
Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Message-id: 20240505141613.387508-1-ines.varhol@telecom-paris.fr Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-04-30hw/char/stm32l4x5_usart: Fix memory corruption by adding correct class_sizeThomas Huth
"make check-qtest-aarch64" recently started failing on FreeBSD builds, and valgrind on Linux also detected that there is something fishy with the new stm32l4x5-usart: The code forgot to set the correct class_size here, so the various class_init functions in this file wrote beyond the allocated buffer when setting the subc->type field. Fixes: 4fb37aea7e ("hw/char: Implement STM32L4x5 USART skeleton") Message-ID: <20240429075908.36302-1-thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-04-25hw/char/stm32l4x5_usart: Add options for serial parameters settingArnaud Minier
Add a function to change the settings of the serial connection. Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240329174402.60382-4-arnaud.minier@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-04-25hw/char/stm32l4x5_usart: Enable serial read and writeArnaud Minier
Implement the ability to read and write characters to the usart using the serial port. The character transmission is based on the cmsdk-apb-uart implementation. Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240329174402.60382-3-arnaud.minier@telecom-paris.fr [PMM: fixed a few checkpatch nits] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-04-25hw/char: Implement STM32L4x5 USART skeletonArnaud Minier
Add the basic infrastructure (register read/write, type...) to implement the STM32L4x5 USART. Also create different types for the USART, UART and LPUART of the STM32L4x5 to deduplicate code and enable the implementation of different behaviors depending on the type. Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240329174402.60382-2-arnaud.minier@telecom-paris.fr [PMM: update to new reset hold method signature; fixed a few checkpatch nits] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-04-25hw, target: Add ResetType argument to hold and exit phase methodsPeter Maydell
We pass a ResetType argument to the Resettable class enter phase method, but we don't pass it to hold and exit, even though the callsites have it readily available. This means that if a device cared about the ResetType it would need to record it in the enter phase method to use later on. Pass the type to all three of the phase methods to avoid having to do that. Commit created with for dir in hw target include; do \ spatch --macro-file scripts/cocci-macro-file.h \ --sp-file scripts/coccinelle/reset-type.cocci \ --keep-comments --smpl-spacing --in-place \ --include-headers --dir $dir; done and no manual edits. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Luc Michel <luc.michel@amd.com> Message-id: 20240412160809.1260625-5-peter.maydell@linaro.org
2024-04-10hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugsPhilippe Mathieu-Daudé
Replace qemu_bh_new_guarded() by virtio_bh_new_guarded() so the bus and device use the same guard. Otherwise the DMA-reentrancy protection can be bypassed. Fixes: CVE-2024-3446 Cc: qemu-stable@nongnu.org Suggested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20240409105537.18308-4-philmd@linaro.org>
2024-03-09hw/char/xen_console: Fix missing ERRP_GUARD() for error_prepend()Zhao Liu
As the comment in qapi/error, passing @errp to error_prepend() requires ERRP_GUARD(): * = Why, when and how to use ERRP_GUARD() = * * Without ERRP_GUARD(), use of the @errp parameter is restricted: ... * - It should not be passed to error_prepend(), error_vprepend() or * error_append_hint(), because that doesn't work with &error_fatal. * ERRP_GUARD() lifts these restrictions. * * To use ERRP_GUARD(), add it right at the beginning of the function. * @errp can then be used without worrying about the argument being * NULL or &error_fatal. ERRP_GUARD() could avoid the case when @errp is the pointer of error_fatal, the user can't see this additional information, because exit() happens in error_setg earlier than information is added [1]. The xen_console_connect() passes @errp to error_prepend() without ERRP_GUARD(). There're 2 places will call xen_console_connect(): - xen_console_realize(): the @errp is from DeviceClass.realize()'s parameter. - xen_console_frontend_changed(): the @errp points its caller's @local_err. To avoid the issue like [1] said, add missing ERRP_GUARD() at the beginning of xen_console_connect(). [1]: Issue description in the commit message of commit ae7c80a7bd73 ("error: New macro ERRP_GUARD()"). Cc: Stefano Stabellini <sstabellini@kernel.org> Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Paul Durrant <paul@xen.org> Cc: "Marc-André Lureau" <marcandre.lureau@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com> Message-ID: <20240228163723.1775791-15-zhao1.liu@linux.intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-03-05hw/char/pl011: Add support for loopbackTong Ho
This patch adds loopback for sent characters, sent BREAK, and modem-control signals. Loopback of send and modem-control is often used for uart self tests in real hardware but missing from current pl011 model, resulting in self-test failures when running in QEMU. This implementation matches what is observed in real pl011 hardware placed in loopback mode: 1. Input characters and BREAK events from serial backend are ignored, but 2. Both TX characters and BREAK events are still sent to serial backend, in addition to be looped back to RX. Signed-off-by: Tong Ho <tong.ho@amd.com> Signed-off-by: Francisco Iglesias <francisco.iglesias@amd.com> Message-id: 20240227054855.44204-1-tong.ho@amd.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-02-15hw/sparc/grlib: split out the headers for each peripheralsClément Chigot
Split out the headers for each peripherals and move them in their right hardware directory. Update Copyright and add SPDX-License-Identifier at the same time. Co-developed-by: Frederic Konrad <konrad.frederic@yahoo.fr> Signed-off-by: Clément Chigot <chigot@adacore.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240131085047.18458-2-chigot@adacore.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-02-14hw/char/parallel-isa: Implement relocation and enabling/disabling for ↵Bernhard Beschow
TYPE_ISA_PARALLEL The real SuperI/O chips emulated by QEMU allow for relocating and enabling or disabling their SuperI/O functions via software. So far this is not implemented. Prepare for that by adding isa_parallel_set_{enabled,iobase}. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-Id: <20240114123911.4877-10-shentey@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-02-14hw/char/serial-isa: Implement relocation and enabling/disabling for ↵Bernhard Beschow
TYPE_ISA_SERIAL The real SuperI/O chips emulated by QEMU allow for relocating and enabling or disabling their SuperI/O functions via software. So far this is not implemented. Prepare for that by adding isa_serial_set_{enabled,iobase}. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-Id: <20240114123911.4877-9-shentey@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-02-14hw/char/parallel: Move portio_list from ParallelState to ISAParallelStateBernhard Beschow
ParallelState::portio_list isn't used inside ParallelState context but only inside ISAParallelState context, so move it there. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20240114123911.4877-4-shentey@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-01-26hw/char/imx_serial: Implement receive FIFO and ageing timerRayhan Faizel
This patch implements a 32 half word FIFO as per imx serial device specifications. If a non empty FIFO is below the trigger level, an ageing timer will tick for a duration of 8 characters. On expiry, AGTIM will be set triggering an interrupt. AGTIM timer resets when there is activity in the receive FIFO. Otherwise, RRDY is set when trigger level is exceeded. The receive trigger level is 8 in newer kernel versions and 1 in older ones. This change will break migration compatibility for the imx boards. Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com> Message-id: 20240125151931.83494-1-rayhan.faizel@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: commit message tidyups] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-12-29hw/char: Constify VMStateRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231221031652.119827-26-richard.henderson@linaro.org>
2023-11-07hw/xen: add support for Xen primary console in emulated modeDavid Woodhouse
The primary console is special because the toolstack maps a page into the guest for its ring, and also allocates the guest-side event channel. The guest's grant table is even primed to export that page using a known grant ref#. Add support for all that in emulated mode, so that we can have a primary console. For reasons unclear, the backends running under real Xen don't just use a mapping of the well-known GNTTAB_RESERVED_CONSOLE grant ref (which would also be in the ring-ref node in XenStore). Instead, the toolstack sets the ring-ref node of the primary console to the GFN of the guest page. The backend is expected to handle that special case and map it with foreignmem operations instead. We don't have an implementation of foreignmem ops for emulated Xen mode, so just make it map GNTTAB_RESERVED_CONSOLE instead. This would probably work for real Xen too, but we can't work out how to make real Xen create a primary console of type "ioemu" to make QEMU drive it, so we can't test that; might as well leave it as it is for now under Xen. Now at last we can boot the Xen PV shim and run PV kernels in QEMU. Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Paul Durrant <paul@xen.org>
2023-11-07hw/xen: update Xen console to XenDevice modelDavid Woodhouse
This allows (non-primary) console devices to be created on the command line and hotplugged. Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Paul Durrant <paul@xen.org>
2023-11-03Merge tag 'pull-target-arm-20231102' of ↵Stefan Hajnoczi
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * linux-user/elfload: Add missing arm64 hwcap values * stellaris-gamepad: Convert to qdev * docs/specs: Convert various txt docs to rST * MAINTAINERS: Make sure that gicv3_internal.h is covered, too * hw/arm/pxa2xx_gpio: Pass CPU using QOM link property * hw/watchdog/wdt_imx2: Trace MMIO access and timer activity * hw/misc/imx7_snvs: Trace MMIO access * hw/misc/imx6_ccm: Convert DPRINTF to trace events * hw/i2c/pm_smbus: Convert DPRINTF to trace events * target/arm: Enable FEAT_MOPS insns in user-mode emulation * linux-user: Report AArch64 hwcap2 fields above bit 31 * target/arm: Make FEAT_MOPS SET* insns handle Xs == XZR correctly * target/arm: Fix SVE STR increment * hw/char/stm32f2xx_usart: implement TX interrupts * target/arm: Correctly propagate stage 1 BTI guarded bit in a two-stage walk * xlnx-versal-virt: Add AMD/Xilinx TRNG device * tag 'pull-target-arm-20231102' of https://git.linaro.org/people/pmaydell/qemu-arm: (33 commits) tests/qtest: Introduce tests for AMD/Xilinx Versal TRNG device hw/arm: xlnx-versal-virt: Add AMD/Xilinx TRNG device hw/misc: Introduce AMD/Xilix Versal TRNG device target/arm: Correctly propagate stage 1 BTI guarded bit in a two-stage walk hw/char/stm32f2xx_usart: Add more definitions for CR1 register hw/char/stm32f2xx_usart: Update IRQ when DR is written hw/char/stm32f2xx_usart: Extract common IRQ update code to update_irq() target/arm: Fix SVE STR increment target/arm: Make FEAT_MOPS SET* insns handle Xs == XZR correctly linux-user: Report AArch64 hwcap2 fields above bit 31 target/arm: Enable FEAT_MOPS insns in user-mode emulation hw/i2c/pm_smbus: Convert DPRINTF to trace events hw/misc/imx6_ccm: Convert DPRINTF to trace events hw/misc/imx7_snvs: Trace MMIO access hw/watchdog/wdt_imx2: Trace timer activity hw/watchdog/wdt_imx2: Trace MMIO access hw/arm/pxa2xx_gpio: Pass CPU using QOM link property MAINTAINERS: Make sure that gicv3_internal.h is covered, too docs/specs/vmgenid: Convert to rST docs/specs/vmcoreinfo: Convert to rST ... Conflicts: hw/input/stellaris_input.c The qdev conversion in this pull request ("stellaris-gamepad: Convert to qdev") eliminates the vmstate_register() call that was converted to vmstate_register_any() in the conflicting migration pull request. vmstate_register_any() is no longer necessary now that this device has been converted to qdev, so take this pull request's version of stellaris_gamepad.c over the previous pull request's stellaris_input.c (the file was renamed). Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-11-02hw/char/stm32f2xx_usart: Update IRQ when DR is writtenHans-Erik Floryd
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com> Message-id: 20231030151528.1138131-3-hans-erik.floryd@rt-labs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-02hw/char/stm32f2xx_usart: Extract common IRQ update code to update_irq()Hans-Erik Floryd
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com> Message-id: 20231030151528.1138131-2-hans-erik.floryd@rt-labs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-01hw/char/mcf_uart: Have mcf_uart_create() return DeviceStatePhilippe Mathieu-Daudé
There is no point in having mcf_uart_init() demote the DeviceState pointer and return a void one. Directly return the real typedef. mcf_uart_init() do both init + realize: rename as mcf_uart_create(). Similarly, mcf_uart_mm_init() do init / realize / mmap: rename as mcf_uart_create_mmap(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20231019104929.16517-1-philmd@linaro.org> Signed-off-by: Thomas Huth <huth@tuxfamily.org>
2023-10-19ui/input: Constify QemuInputHandler structurePhilippe Mathieu-Daudé
Access to QemuInputHandlerState::handler are read-only. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20231017131251.43708-1-philmd@linaro.org>
2023-10-12hw/char: riscv_htif: replace exit calls with proper shutdownClément Chigot
This replaces the exit calls by shutdown requests, ensuring a proper cleanup of Qemu. Otherwise, some connections like gdb could be broken before its final packet ("Wxx") is being sent. This part, being done inside qemu_cleanup function, can be reached only when the main loop exits after a shutdown request. Signed-off-by: Clément Chigot <chigot@adacore.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20231003071427.188697-5-chigot@adacore.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2023-09-21hw/other: spelling fixesMichael Tokarev
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2023-09-11hw/char/riscv_htif: Fix the console syscall on big endian hostsThomas Huth
Values that have been read via cpu_physical_memory_read() from the guest's memory have to be swapped in case the host endianess differs from the guest. Fixes: a6e13e31d5 ("riscv_htif: Support console output via proxy syscall") Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bmeng@tinylab.org> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-Id: <20230721094720.902454-3-thuth@redhat.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-02 04:33:28 +0000