aboutsummaryrefslogtreecommitdiff
path: root/hw/misc
AgeCommit message (Collapse)Author
2024-08-28hw/misc/bcm2835_property: Fix handling of FRAMEBUFFER_SET_PALETTEPeter Maydell
The documentation of the "Set palette" mailbox property at https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface#set-palette says it has the form: Length: 24..1032 Value: u32: offset: first palette index to set (0-255) u32: length: number of palette entries to set (1-256) u32...: RGBA palette values (offset to offset+length-1) We get this wrong in a couple of ways: * we aren't checking the offset and length are in range, so the guest can make us spin for a long time by providing a large length * the bounds check on our loop is wrong: we should iterate through 'length' palette entries, not 'length - offset' entries Fix the loop to implement the bounds checks and get the loop condition right. In the process, make the variables local to this switch case, rather than function-global, so it's clearer what type they are when reading the code. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240723131029.1159908-2-peter.maydell@linaro.org (cherry picked from commit 0892fffc2abaadfb5d8b79bb0250ae1794862560) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (Mjt: context fix due to lack of v9.0.0-1812-g5d5f1b60916a "hw/misc: Implement mailbox properties for customer OTP and device specific private keys" also remove now-unused local `n' variable which gets removed in the next change in this file, v9.0.0-2720-g32f1c201eedf "hw/misc/bcm2835_property: Avoid overflow in OTP access properties")
2024-04-10hw/misc/applesmc: Fix memory leak in reset() handlerPhilippe Mathieu-Daudé
AppleSMCData is allocated with g_new0() in applesmc_add_key(): release it with g_free(). Leaked since commit 1ddda5cd36 ("AppleSMC device emulation"). Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2272 Reported-by: Zheyu Ma <zheyuma97@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20240408095217.57239-3-philmd@linaro.org>
2024-04-10hw/misc/applesmc: Do not call DeviceReset from DeviceRealizePhilippe Mathieu-Daudé
QDev core layer always call DeviceReset() after DeviceRealize(), no need to do it manually. Remove the extra call. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20240408095217.57239-2-philmd@linaro.org>
2024-03-26hw/misc/stm32l4x5_rcc: Propagate period when enabling a clockArnaud Minier
The "clock_set_mul_div" function doesn't propagate the clock period to the children if it is changed (e.g. by enabling/disabling a clock multiplexer). This was overlooked during the implementation due to late changes. This commit propagates the change if the multiplier or divider changes. Fixes: ec7d83acbd ("hw/misc/stm32l4x5_rcc: Add an internal clock multiplexer object") Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Message-ID: <20240317103918.44375-2-arnaud.minier@telecom-paris.fr> [PMD: Check clock_set_mul_div() return value] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20240325152827.73817-4-philmd@linaro.org>
2024-03-26hw/misc/stm32l4x5_rcc: Inline clock_update() in clock_mux_update()Philippe Mathieu-Daudé
Trivial inlining in preliminary patch to make the next one easier to review. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20240325152827.73817-3-philmd@linaro.org>
2024-03-25misc/pca955*: Move models under hw/gpioCédric Le Goater
The PCA9552 and PCA9554 devices are both I2C GPIO controllers and the PCA9552 also can drive LEDs. Do all the necessary adjustments to move the models under hw/gpio. Cc: Glenn Miles <milesg@linux.vnet.ibm.com> Signed-off-by: Cédric Le Goater <clg@redhat.com> Message-ID: <20240325134833.1484265-1-clg@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-03-12Merge tag 'pull-request-2024-03-12' of https://gitlab.com/thuth/qemu into ↵Peter Maydell
staging * Add missing ERRP_GUARD() statements in functions that need it * Prefer fast cpu_env() over slower CPU QOM cast macro # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmXwPhYRHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbWHvBAAgKx5LHFjz3xREVA+LkDTQ49mz0lK3s32 # SGvNlIHjiaDGVttVYhVC4sinBWUruG4Lyv/2QN72OJBzn6WUsEUQE3KPH1d7Y3/s # wS9X7mj70n4kugWJqeIJP5AXSRasHmWoQ4QJLVQRJd6+Eb9jqwep0x7bYkI1de6D # bL1Q7bIfkFeNQBXaiPWAm2i+hqmT4C1r8HEAGZIjAsMFrjy/hzBEjNV+pnh6ZSq9 # Vp8BsPWRfLU2XHm4WX0o8d89WUMAfUGbVkddEl/XjIHDrUD+Zbd1HAhLyfhsmrnE # jXIwSzm+ML1KX4MoF5ilGtg8Oo0gQDEBy9/xck6G0HCm9lIoLKlgTxK9glr2vdT8 # yxZmrM9Hder7F9hKKxmb127xgU6AmL7rYmVqsoQMNAq22D6Xr4UDpgFRXNk2/wO6 # zZZBkfZ4H4MpZXbd/KJpXvYH5mQA4IpkOy8LJdE+dbcHX7Szy9ksZdPA+Z10hqqf # zqS13qTs3abxymy2Q/tO3hPKSJCk1+vCGUkN60Wm+9VoLWGoU43qMc7gnY/pCS7m # 0rFKtvfwFHhokX1orK0lP/ppVzPv/5oFIeK8YDY9if+N+dU2LCwVZHIuf2/VJPRq # wmgH2vAn3JDoRKPxTGX9ly6AMxuZaeP92qBTOPap0gDhihYzIpaCq9ecEBoTakI7 # tdFhV0iRr08= # =NiP4 # -----END PGP SIGNATURE----- # gpg: Signature made Tue 12 Mar 2024 11:35:50 GMT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2024-03-12' of https://gitlab.com/thuth/qemu: (55 commits) user: Prefer fast cpu_env() over slower CPU QOM cast macro target/xtensa: Prefer fast cpu_env() over slower CPU QOM cast macro target/tricore: Prefer fast cpu_env() over slower CPU QOM cast macro target/sparc: Prefer fast cpu_env() over slower CPU QOM cast macro target/sh4: Prefer fast cpu_env() over slower CPU QOM cast macro target/rx: Prefer fast cpu_env() over slower CPU QOM cast macro target/ppc: Prefer fast cpu_env() over slower CPU QOM cast macro target/openrisc: Prefer fast cpu_env() over slower CPU QOM cast macro target/nios2: Prefer fast cpu_env() over slower CPU QOM cast macro target/mips: Prefer fast cpu_env() over slower CPU QOM cast macro target/microblaze: Prefer fast cpu_env() over slower CPU QOM cast macro target/m68k: Prefer fast cpu_env() over slower CPU QOM cast macro target/loongarch: Prefer fast cpu_env() over slower CPU QOM cast macro target/i386/hvf: Use CPUState typedef target/hexagon: Prefer fast cpu_env() over slower CPU QOM cast macro target/cris: Prefer fast cpu_env() over slower CPU QOM cast macro target/avr: Prefer fast cpu_env() over slower CPU QOM cast macro target/alpha: Prefer fast cpu_env() over slower CPU QOM cast macro target: Replace CPU_GET_CLASS(cpu -> obj) in cpu_reset_hold() handler bulk: Call in place single use cpu_env() ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-03-12bulk: Access existing variables initialized to &S->F when availablePhilippe Mathieu-Daudé
When a variable is initialized to &struct->field, use it in place. Rationale: while this makes the code more concise, this also helps static analyzers. Mechanical change using the following Coccinelle spatch script: @@ type S, F; identifier s, m, v; @@ S *s; ... F *v = &s->m; <+... - &s->m + v ...+> Inspired-by: Zhao Liu <zhao1.liu@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240129164514.73104-2-philmd@linaro.org> Acked-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> [thuth: Dropped hunks that need a rebase, and fixed sizeof() in pmu_realize()] Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-03-12hw/misc/xlnx-versal-trng: Check returned bool in trng_prop_fault_event_set()Zhao Liu
As the comment in qapi/error, dereferencing @errp requires ERRP_GUARD(): * = Why, when and how to use ERRP_GUARD() = * * Without ERRP_GUARD(), use of the @errp parameter is restricted: * - It must not be dereferenced, because it may be null. ... * ERRP_GUARD() lifts these restrictions. * * To use ERRP_GUARD(), add it right at the beginning of the function. * @errp can then be used without worrying about the argument being * NULL or &error_fatal. * * Using it when it's not needed is safe, but please avoid cluttering * the source with useless code. But in trng_prop_fault_event_set, @errp is dereferenced without ERRP_GUARD(): visit_type_uint32(v, name, events, errp); if (*errp) { return; } Currently, since trng_prop_fault_event_set() doesn't get the NULL @errp parameter as a "set" method of object property, it hasn't triggered the bug that dereferencing the NULL @errp. And since visit_type_uint32() returns bool, check the returned bool directly instead of dereferencing @errp, then we needn't the add missing ERRP_GUARD(). Suggested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240223085653.1255438-5-zhao1.liu@linux.intel.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-03-11hw/misc/ivshmem: Fix missing ERRP_GUARD() for error_prepend()Zhao Liu
As the comment in qapi/error, passing @errp to error_prepend() requires ERRP_GUARD(): * = Why, when and how to use ERRP_GUARD() = * * Without ERRP_GUARD(), use of the @errp parameter is restricted: ... * - It should not be passed to error_prepend(), error_vprepend() or * error_append_hint(), because that doesn't work with &error_fatal. * ERRP_GUARD() lifts these restrictions. * * To use ERRP_GUARD(), add it right at the beginning of the function. * @errp can then be used without worrying about the argument being * NULL or &error_fatal. ERRP_GUARD() could avoid the case when @errp is &error_fatal, the user can't see this additional information, because exit() happens in error_setg earlier than information is added [1]. The ivshmem_common_realize() passes @errp to error_prepend(), and as a DeviceClass.realize method, there are too many possible callers to check the impact of this defect; it may or may not be harmless. Thus it is necessary to protect @errp with ERRP_GUARD(). To avoid the issue like [1] said, add missing ERRP_GUARD() at the beginning of this function. [1]: Issue description in the commit message of commit ae7c80a7bd73 ("error: New macro ERRP_GUARD()"). Cc: Juan Quintela <quintela@trasno.org> Cc: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Cc: Michael Galaxy <mgalaxy@akamai.com> Cc: Steve Sistare <steven.sistare@oracle.com> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Message-ID: <20240311033822.3142585-17-zhao1.liu@linux.intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-03-07hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoCInès Varhol
Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20240305210444.310665-3-ines.varhol@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-03-05hw/misc/stm32l4x5_rcc: Add write protections to CR registerArnaud Minier
Add write protections for the fields in the CR register. PLL configuration write protections (among others) have not been handled yet. This is planned in a future patch set. Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Message-id: 20240303140643.81957-7-arnaud.minier@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2024-03-05hw/misc/stm32l4x5_rcc: Handle Register UpdatesArnaud Minier
Update the RCC state and propagate frequency changes when writing to the RCC registers. Currently, ICSCR, CIER, the reset registers and the stop mode registers are not implemented. Some fields have not been implemented due to uncertainty about how to handle them (Like the clock security system or bypassing mecanisms). Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Message-id: 20240303140643.81957-6-arnaud.minier@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2024-03-05hw/misc/stm32l4x5_rcc: Initialize PLLs and clock multiplexersArnaud Minier
Instantiate the whole clock tree and using the Clock multiplexers and the PLLs defined in the previous commits. This allows to statically define the clock tree and easily follow the clock signal from one end to another. Also handle three-phase reset now that we have defined a known base state for every object. (Reset handling based on hw/misc/zynq_sclr.c) Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Message-id: 20240303140643.81957-5-arnaud.minier@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2024-03-05hw/misc/stm32l4x5_rcc: Add an internal PLL Clock objectArnaud Minier
This object represents the PLLs and their channels. The PLLs allow for a more fine-grained control of the clocks frequency. The migration handling is based on hw/misc/zynq_sclr.c. Three phase reset will be handled in a later commit. Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Message-id: 20240303140643.81957-4-arnaud.minier@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2024-03-05hw/misc/stm32l4x5_rcc: Add an internal clock multiplexer objectArnaud Minier
This object is used to represent every multiplexer in the clock tree as well as every clock output, every presecaler, frequency multiplier, etc. This allows to use a generic approach for every component of the clock tree (except the PLLs). The migration handling is based on hw/misc/zynq_sclr.c. Three phase reset will be handled in a later commit. Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20240303140643.81957-3-arnaud.minier@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2024-03-05hw/misc/stm32l4x5_rcc: Implement STM32L4x5_RCC skeletonArnaud Minier
Add the necessary files to add a simple RCC implementation with just reads from and writes to registers. Also instantiate the RCC in the STM32L4x5_SoC. It is needed for accurate emulation of all the SoC clocks and timers. Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Acked-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240303140643.81957-2-arnaud.minier@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-02-27hw/misc/bcm2835_property: Add missed BCM2835 propertiesSergey Kambalin
Our model of the bcm2835 mailbox is missing a few properties that we need for the raspi4 kernel: * RPI_FWREQ_GET_CLOCKS * RPI_FWREQ_GET_THROTTLED * RPI_FWREQ_VCHIQ_INIT Add minimal implementations of them. Signed-off-by: Sergey Kambalin <sergey.kambalin@auriga.com> Message-id: 20240226000259.2752893-40-sergey.kambalin@auriga.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> [PMM: improved commit message] Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2024-02-23ppc/pnv: Add a pca9554 I2C device to powernv10-rainierGlenn Miles
For powernv10-rainier, the Power Hypervisor code expects to see a pca9554 device connected to the 3rd PNV I2C engine on port 1 at I2C address 0x25 (or left-justified address of 0x4A). This is used by the hypervisor code to detect if a "Cable Card" is present. Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Glenn Miles <milesg@linux.vnet.ibm.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
2024-02-23misc: Add a pca9554 GPIO device modelGlenn Miles
Specs are available here: https://www.nxp.com/docs/en/data-sheet/PCA9554_9554A.pdf This is a simple model supporting the basic registers for GPIO mode. The device also supports an interrupt output line but the model does not yet support this. Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Glenn Miles <milesg@linux.vnet.ibm.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
2024-02-23misc/pca9552: Let external devices set pca9552 inputsGlenn Miles
Allow external devices to drive pca9552 input pins by adding input GPIO's to the model. This allows a device to connect its output GPIO's to the pca9552 input GPIO's. In order for an external device to set the state of a pca9552 pin, the pin must first be configured for high impedance (LED is off). If the pca9552 pin is configured to drive the pin low (LED is on), then external input will be ignored. Here is a table describing the logical state of a pca9552 pin given the state being driven by the pca9552 and an external device: PCA9552 Configured State | Hi-Z | Low | ------+------+-----+ External Hi-Z | Hi | Low | Device ------+------+-----+ State Low | Low | Low | ------+------+-----+ Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au> Signed-off-by: Glenn Miles <milesg@linux.vnet.ibm.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
2024-02-23misc/pca9552: Fix inverted input statusGlenn Miles
The pca9552 INPUT0 and INPUT1 registers are supposed to hold the logical values of the LED pins. A logical 0 should be seen in the INPUT0/1 registers for a pin when its corresponding LSn bits are set to 0, which is also the state needed for turning on an LED in a typical usage scenario. Existing code was doing the opposite and setting INPUT0/1 bit to a 1 when the LSn bit was set to 0, so this commit fixes that. Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au> Signed-off-by: Glenn Miles <milesg@linux.vnet.ibm.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
2024-02-16Merge tag 'hw-misc-20240215' of https://github.com/philmd/qemu into stagingPeter Maydell
Misc HW patch queue - Remove unused MIPS SAAR* registers (Phil) - Remove warning when testing the TC58128 NAND EEPROM (Peter) - KConfig cleanups around ISA SuperI/O and MIPS (Paolo) - QDev API uses sanitization (Philippe) - Split AHCI model as PCI / SysBus (Philippe) - Add SMP support to SPARC Leon3 board (Clément) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmXOUD4ACgkQ4+MsLN6t # wN6gWRAAjf+6Z9VUvvHqZoaSJW49k+GRUelTI2tyN+eGfetAx9dk8aIbpbV1X12d # pc56jsSi6ICT7baCegtxHszhYJr2e9A2QLCAOJt+Oz87kEGes3ONVVKAk7pwjKxt # m8pmU3uXWgFvU6PoFBhGBa6LiZBulgLNXBUwzmEhc9PpPkR49ULdDp/qxtWvxOV5 # xYBktFlkiT+AvHq3QWCnDIaw+pH5ghEq9BI4xFOvvvqSqdHEqsGAaiKPa9Po0Gfz # Ap9qsm4FxKxhGoeQWtAIP8TvN3pFFSXMysziP6Xt1rffKsvF9ioghGKRM6BgQfqD # ZetjcFbcf7dQu3zZVy8ljYcymMxfZcWWVVq4CMC68lPQE97hz1CT3PJjgd77dKfi # z60uRkOGaiPW5iIGT9+vdQxZ5K3HivKyjuHOdV8V4HnWO3oqgfDtNHn5RKed0qUg # g1FoWriJGsDixdx1vd0EoH2/oTxy4HIsFv7a1OjiZyBLjO+EeEZ3+H9pqUHqBxva # +Dv70z9F1sv5dzcUXH+oCgTbnKlJ90Q+e3vj0wGdlBncVsgIwbtgqYelhUEl+xJX # Mu6KNUo5ANVP38ZKG0GSMCZHfcUjc5s+5rG55NbTN0HiF56a6D2KlQAuXdUsGE1J # 7i4cwipJmfxzbdPDlSb3kBxm5pFexEk6nROF9kTHQj3ZBMMvIls= # =nOX+ # -----END PGP SIGNATURE----- # gpg: Signature made Thu 15 Feb 2024 17:56:14 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'hw-misc-20240215' of https://github.com/philmd/qemu: (56 commits) hw/ide/ich9: Use AHCIPCIState typedef hw/ide/ahci: Move SysBus definitions to 'ahci-sysbus.h' hw/ide/ahci: Remove SysbusAHCIState::num_ports field hw/ide/ahci: Do not pass 'ports' argument to ahci_realize() hw/ide/ahci: Convert AHCIState::ports to unsigned hw/ide/ahci: Pass AHCI context to ahci_ide_create_devs() hw/ide/ahci: Inline ahci_get_num_ports() hw/ide/ahci: Rename AHCI PCI function as 'pdev' hw/ide/ahci: Expose AHCIPCIState structure hw/i386/q35: Use DEVICE() cast macro with PCIDevice object hw/i386/q35: Simplify pc_q35_init() since PCI is always enabled MAINTAINERS: Add myself as reviewer for TCG Plugins MAINTAINERS: replace Fabien by myself as Leon3 maintainer hw/sparc/leon3: Initialize GPIO before realizing CPU devices hw/sparc/leon3: Pass DeviceState opaque argument to leon3_start_cpu() hw/sparc/leon3: Pass DeviceState opaque argument to leon3_set_pil_in() hw/sparc/leon3: check cpu_id in the tiny bootloader hw/sparc/leon3: implement multiprocessor hw/sparc/leon3: remove SP initialization target/sparc: implement asr17 feature for smp ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-02-15hw/misc/macio: Realize IDE controller before accessing itPhilippe Mathieu-Daudé
We should not wire IRQs on unrealized device. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240213130341.1793-7-philmd@linaro.org>
2024-02-15hw/misc/mips_itu: Remove MIPSITUState::saar fieldPhilippe Mathieu-Daudé
This field is not set. Remove it along with the dead code it was guarding. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240209090513.9401-7-philmd@linaro.org>
2024-02-15hw/misc/mips_itu: Remove MIPSITUState::cpu0 fieldPhilippe Mathieu-Daudé
Since previous commit the MIPSITUState::cpu0 field is not used anymore. Remove it. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240209090513.9401-6-philmd@linaro.org>
2024-02-15target/mips: Remove CPUMIPSState::saarp fieldPhilippe Mathieu-Daudé
This field is never set, so remove the unreachable code. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240209090513.9401-5-philmd@linaro.org>
2024-02-15hw/misc/mips: Reduce itc_reconfigure() scopePhilippe Mathieu-Daudé
Previous commit removed the MT*C0(SAAR) helpers which were the only calls to itc_reconfigure() out of hw/, we can reduce its scope and declare it statically. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240209090513.9401-3-philmd@linaro.org>
2024-02-15hw/misc/mps2-scc: Make changes needed for AN536 FPGA imagePeter Maydell
The MPS2 SCC device is broadly the same for all FPGA images, but has minor differences in the behaviour of the CFG registers depending on the image. In many cases we don't really care about the functionality controlled by these registers and a reads-as-written or similar behaviour is sufficient for the moment. For the AN536 the required behaviour is: * A_CFG0 has CPU reset and halt bits - implement as reads-as-written for the moment * A_CFG1 has flash or ATCM address 0 remap handling - QEMU doesn't model this; implement as reads-as-written * A_CFG2 has QSPI select (like AN524) - implemented (no behaviour, as with AN524) * A_CFG3 is MCC_MSB_ADDR "additional MCC addressing bits" - QEMU doesn't care about these, so use the existing RAZ behaviour for convenience * A_CFG4 is board rev (like all other images) - no change needed * A_CFG5 is ACLK frq in hz (like AN524) - implemented as reads-as-written, as for other boards * A_CFG6 is core 0 vector table base address - implemented as reads-as-written for the moment * A_CFG7 is core 1 vector table base address - implemented as reads-as-written for the moment Make the changes necessary for this; leave TODO comments where appropriate to indicate where we might want to come back and implement things like CPU reset. The other aspects of the device specific to this FPGA image (like the values of the board ID and similar registers) will be set via the device's qdev properties. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240206132931.38376-8-peter.maydell@linaro.org
2024-02-15hw/misc/mps2-scc: Factor out which-board conditionalsPeter Maydell
The MPS SCC device has a lot of different flavours for the various different MPS FPGA images, which look mostly similar but have differences in how particular registers are handled. Currently we deal with this with a lot of open-coded checks on scc_partno(), but as we add more board types this is getting a bit hard to read. Factor out the conditions into some functions which we can give more descriptive names to. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240206132931.38376-7-peter.maydell@linaro.org
2024-02-15hw/misc/mps2-scc: Fix condition for CFG3 registerPeter Maydell
We currently guard the CFG3 register read with (scc_partno(s) == 0x524 && scc_partno(s) == 0x547) which is clearly wrong as it is never true. This register is present on all board types except AN524 and AN527; correct the condition. Fixes: 6ac80818941829c0 ("hw/misc/mps2-scc: Implement changes for AN547") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240206132931.38376-6-peter.maydell@linaro.org
2024-02-11lasi: Add reset I/O ports for LASI audio and FDCHelge Deller
Linux writes zeroes at bootup into the default ports for LASI audio and LASI floppy controller to reset those devices. Allow writing to those registers to avoid HPMCs. Signed-off-by: Helge Deller <deller@gmx.de>
2024-02-11lasi: allow access to LAN MAC address registersHelge Deller
Firmware and qemu reads and writes the MAC address for the LASI LAN via registers in LASI. Allow those accesses and return zero even if LASI LAN isn't enabled to avoid HPMCs (=crashes). Signed-off-by: Helge Deller <deller@gmx.de>
2024-01-26hw/misc/xlnx-versal-crl: Build it only oncePhilippe Mathieu-Daudé
hw/misc/xlnx-versal-crl.c doesn't require "cpu.h" anymore. By removing it, the unit become target agnostic: we can build it once. Update meson. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-15-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26hw/misc/xlnx-versal-crl: Include generic 'cpu-qom.h' instead of 'cpu.h'Philippe Mathieu-Daudé
"target/arm/cpu.h" is target specific, any file including it becomes target specific too, thus this is the same for any file including "hw/misc/xlnx-versal-crl.h". "hw/misc/xlnx-versal-crl.h" doesn't require any target specific definition however, only the target-agnostic QOM definitions from "target/arm/cpu-qom.h". Include the latter header to avoid tainting unnecessary objects as target-specific. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-14-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26target/arm: Expose arm_cpu_mp_affinity() in 'multiprocessing.h' headerPhilippe Mathieu-Daudé
Declare arm_cpu_mp_affinity() prototype in the new "target/arm/multiprocessing.h" header so units in hw/arm/ can use it without having to include the huge target-specific "cpu.h". File list to include the new header generated using: $ git grep -lw arm_cpu_mp_affinity Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-11-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26target/arm: Create arm_cpu_mp_affinityRichard Henderson
Wrapper to return the mp affinity bits from the cpu. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-10-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-15hw/misc: Implement STM32L4x5 SYSCFGInès Varhol
Acked-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Message-id: 20240109194438.70934-2-ines.varhol@telecom-paris.fr Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-15hw/misc: Implement STM32L4x5 EXTIInès Varhol
Although very similar to the STM32F4xx EXTI, STM32L4x5 EXTI generates more than 32 event/interrupt requests and thus uses more registers than STM32F4xx EXTI which generates 23 event/interrupt requests. Acked-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240109160658.311932-2-ines.varhol@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-08system/cpus: rename qemu_mutex_lock_iothread() to bql_lock()Stefan Hajnoczi
The Big QEMU Lock (BQL) has many names and they are confusing. The actual QemuMutex variable is called qemu_global_mutex but it's commonly referred to as the BQL in discussions and some code comments. The locking APIs, however, are called qemu_mutex_lock_iothread() and qemu_mutex_unlock_iothread(). The "iothread" name is historic and comes from when the main thread was split into into KVM vcpu threads and the "iothread" (now called the main loop thread). I have contributed to the confusion myself by introducing a separate --object iothread, a separate concept unrelated to the BQL. The "iothread" name is no longer appropriate for the BQL. Rename the locking APIs to: - void bql_lock(void) - void bql_unlock(void) - bool bql_locked(void) There are more APIs with "iothread" in their names. Subsequent patches will rename them. There are also comments and documentation that will be updated in later patches. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Paul Durrant <paul@xen.org> Acked-by: Fabiano Rosas <farosas@suse.de> Acked-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Cédric Le Goater <clg@kaod.org> Acked-by: Peter Xu <peterx@redhat.com> Acked-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com> Acked-by: Hyman Huang <yong.huang@smartx.com> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20240102153529.486531-2-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2024-01-05edu: fix DMA range upper bound checkMax Erenberg
The edu_check_range function checks that start <= end1 < end2, where end1 is the upper bound (exclusive) of the guest-supplied DMA range and end2 is the upper bound (exclusive) of the device's allowed DMA range. When the guest tries to transfer exactly DMA_SIZE (4096) bytes, end1 will be equal to end2, so the check fails and QEMU aborts with this puzzling error message (newlines added for formatting): qemu: hardware error: EDU: DMA range 0x0000000000040000-0x0000000000040fff out of bounds (0x0000000000040000-0x0000000000040fff)! By checking end1 <= end2 instead, guests will be allowed to transfer exactly 4096 bytes. It is not necessary to explicitly check for start <= end1 because the previous two checks (within(addr, start, end2) and end1 > addr) imply start < end1. Fixes: b30934cb52a7 ("hw: misc, add educational driver", 2015-01-21) Signed-off-by: Max Erenberg <merenber@uwaterloo.ca> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-05hw/misc: Simplify memory_region_init_ram_from_fd() callsPhilippe Mathieu-Daudé
Mechanical change using the following coccinelle script: @@ expression mr, owner, arg3, arg4, arg5, arg6, arg7, errp; @@ - memory_region_init_ram_from_fd(mr, owner, arg3, arg4, arg5, arg6, arg7, &errp); if ( - errp + !memory_region_init_ram_from_fd(mr, owner, arg3, arg4, arg5, arg6, arg7, &errp) ) { ... return; } and removing the local Error variable. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Gavin Shan <gshan@redhat.com> Message-Id: <20231120213301.24349-24-philmd@linaro.org>
2023-12-30hw/misc/macio: Constify VMStateRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231221031652.119827-63-richard.henderson@linaro.org>
2023-12-30hw/misc: Constify VMStateRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231221031652.119827-41-richard.henderson@linaro.org>
2023-12-20Merge tag 'pull-request-2023-12-20' of https://gitlab.com/thuth/qemu into ↵Stefan Hajnoczi
staging * Add compat machines for QEMU 9.0 * Some header clean-ups by Philippe * Restrict type names to alphanumerical range (and a few special characters) * Fix analyze-migration.py script on s390x * Clean up and improve some tests * Document handling of commas in CLI options parameters # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmWCtYsRHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbWLnw//cNJrxG0V+j0iakX+C7HRumVrLBDI4KYY # Cp2Hx92SyeQ0Kk8DJS6JueTV0SLjMsV77APu2YPH7ELmPlk+CB9gqmV7xVoYNvsm # QbRPlIjFw8MHLekadc2A+C+pn48tWACoOdBEDIfazKrxybnf0B57RC/fIfMKHjbs # 2ALCoFbbgphs7yWuzTHK8ayKaGMhUVkWfzHQwpnq899olHyZBhkl951uKJA6VmLx # KvggePkpszLjmmXA8MH1hDCcizki31cB0ZKTbQFCyE42s2S3Hvg0GueU90O7Y1cj # lS5tPVQxyEhUYMLL+/hudlf2OYqVn2BalB7ieUQIy6rG8yoc9zxfIKQi0ccl+2oA # s8HRq5S0bSjtilQogU1LQL/Gk6W1/N9MmnhKvCGB+BTK5KX7s4EQk02y9gGZm/8s # pMErMyaXTG4dLiTAK42VgMVDqCYvzBmE+Gj91OmoUR7fb+VMrsWxeBFxMPDn+VtL # TMJegIFsjw2QCSitcU4v+nP0qtKgXGbuZtrGXKabrxH5PmeQFJDSM7TwpTK4qvjK # QMIQKBbz8BfJnUzN8qAaaJEpp1T5tcMJClKtfcgxq/+VyaSaHLmD0cljqBC+g+y7 # FTo+fa7oYx44sAlqapdEXBSGn4T+J26iuCef13CCCiPfYBv/tk3b2E0AWHj4y58I # +VpInjUaPBQ= # =TA1/ # -----END PGP SIGNATURE----- # gpg: Signature made Wed 20 Dec 2023 04:36:11 EST # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2023-12-20' of https://gitlab.com/thuth/qemu: tests/unit/test-qmp-event: Replace fixture by global variables tests/unit/test-qmp-event: Simplify event emission check tests/unit/test-qmp-event: Drop superfluous mutex tests/qtest/npcm7xx_pwm-test: Only do full testing in slow mode qemu-options: Clarify handling of commas in options parameters tests/qtest/migration-test: Fix analyze-migration.py for s390x qom/object: Limit type names to alphanumerical and some few special characters tests/unit/test-io-task: Rename "qemu:dummy" to avoid colon in the name memory: Remove "qemu:" prefix from the "qemu:ram-discard-manager" type name hw: Replace anti-social QOM type names (again) docs/system/arm: Fix for rename of type "xlnx.bbram-ctrl" target: Restrict 'sysemu/reset.h' to system emulation hw/s390x/ipl: Remove unused 'exec/exec-all.h' included header hw/misc/mips_itu: Remove unnecessary 'exec/exec-all.h' header hw/ppc/spapr_hcall: Remove unused 'exec/exec-all.h' included header system/qtest: Restrict QTest API to system emulation system/qtest: Include missing 'hw/core/cpu.h' header MAINTAINERS: Add some more vmware-related files to the corresponding section hw: Add compat machines for 9.0 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-12-20hw/misc/mips_itu: Remove unnecessary 'exec/exec-all.h' headerPhilippe Mathieu-Daudé
mips_itu.c only requires declarations from "hw/core/cpu.h" and "cpu.h". Avoid including the huge "exec/exec-all.h" header. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20231212113640.30287-3-philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-12-19fsl-imx: add simple RTC emulation for i.MX6 and i.MX7 boardsNikita Ostrenkov
Signed-off-by: Nikita Ostrenkov <n.ostrenkov@gmail.com> Message-id: 20231216133408.2884-1-n.ostrenkov@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-27hw/misc/mps2-scc: Free MPS2SCC::oscclk[] array on finalize()Philippe Mathieu-Daudé
Commit 0be6bfac62 ("qdev: Implement variable length array properties") added the DEFINE_PROP_ARRAY() macro with the following comment: * It is the responsibility of the device deinit code to free the * @_arrayfield memory. Commit 4fb013afcc added: DEFINE_PROP_ARRAY("oscclk", MPS2SCC, num_oscclk, oscclk_reset, qdev_prop_uint32, uint32_t), but forgot to free the 'oscclk_reset' array. Do it in the instance_finalize() handler. Cc: qemu-stable@nongnu.org Fixes: 4fb013afcc ("hw/misc/mps2-scc: Support configurable number of OSCCLK values") # v6.0.0+ Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20231121174051.63038-4-philmd@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-02hw/misc: Introduce AMD/Xilix Versal TRNG deviceTong Ho
This adds a non-cryptographic grade implementation of the model for the True Random Number Generator (TRNG) component in AMD/Xilinx Versal device family. This implements all 3 modes defined by the actual hardware specs, all of which selectable by guest software at will at anytime: 1) PRNG mode, in which the generated sequence is required to be reproducible after reseeded by the same 384-bit value as supplied by guest software. 2) Test mode, in which the generated sequence is required to be reproducible ater reseeded by the same 128-bit test seed supplied by guest software. 3) TRNG mode, in which non-reproducible sequence is generated based on periodic reseed by a suitable entropy source. This model is only intended for non-real world testing of guest software, where cryptographically strong PRNG or TRNG is not needed. This model supports versions 1 & 2 of the device, with default to be version 2; the 'hw-version' uint32 property can be set to 0x0100 to override the default. Other implemented properties: - 'forced-prng', uint64 When set to non-zero, mode 3's entropy source is implemented as a deterministic sequence based on the given value and other deterministic parameters. This option allows the emulation to test guest software using mode 3 and to reproduce data-dependent defects. - 'fips-fault-events', uint32, bit-mask bit 3: Triggers the SP800-90B entropy health test fault irq bit 1: Triggers the FIPS 140-2 continuous test fault irq Signed-off-by: Tong Ho <tong.ho@amd.com> Message-id: 20231031184611.3029156-2-tong.ho@amd.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-02hw/misc/imx6_ccm: Convert DPRINTF to trace eventsBernhard Beschow
Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20231028122415.14869-5-shentey@gmail.com [PMM: Add "Hz" unit indicator to frequency traces] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2024-11-22 21:34:43 +0000