aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2020-10-09monitor: Use getter/setter functions for cur_monKevin Wolf
cur_mon really needs to be coroutine-local as soon as we move monitor command handlers to coroutines and let them yield. As a first step, just remove all direct accesses to cur_mon so that we can implement this in the getter function later. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20201005155855.256490-4-kwolf@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2020-10-09monitor: Add Monitor parameter to monitor_get_cpu_index()Kevin Wolf
Most callers actually don't have to rely on cur_mon, but already know for which monitor they call monitor_get_cpu_index(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20201005155855.256490-3-kwolf@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2020-10-08Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20201008-1' into staging target-arm queue: * hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer * hw/arm/fsl-imx25: Fix a typo * hw/arm/sbsa-ref : Fix SMMUv3 Initialisation * hw/arm/sbsa-ref : allocate IRQs for SMMUv3 * hw/char/bcm2835_aux: Allow less than 32-bit accesses * hw/arm/virt: Implement kvm-steal-time * target/arm: Make '-cpu max' have a 48-bit PA # gpg: Signature made Thu 08 Oct 2020 21:40:31 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20201008-1: target/arm: Make '-cpu max' have a 48-bit PA hw/arm/virt: Implement kvm-steal-time tests/qtest: Restore aarch64 arm-cpu-features test hw/arm/virt: Move kvm pmu setup to virt_cpu_post_init hw/arm/virt: Move post cpu realize check into its own function target/arm/kvm: Make uncalled stubs explicitly unreachable linux headers: sync to 5.9-rc7 hw/char/bcm2835_aux: Allow less than 32-bit accesses hw/arm/sbsa-ref : allocate IRQs for SMMUv3 hw/arm/sbsa-ref : Fix SMMUv3 Initialisation hw/arm/fsl-imx25: Fix a typo hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-08hw/arm/virt: Implement kvm-steal-timeAndrew Jones
We add the kvm-steal-time CPU property and implement it for machvirt. A tiny bit of refactoring was also done to allow pmu and pvtime to use the same vcpu device helper functions. Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Andrew Jones <drjones@redhat.com> Message-id: 20201001061718.101915-7-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-08hw/arm/virt: Move kvm pmu setup to virt_cpu_post_initAndrew Jones
Move the KVM PMU setup part of fdt_add_pmu_nodes() to virt_cpu_post_init(), which is a more appropriate location. Now fdt_add_pmu_nodes() is also named more appropriately, because it no longer does anything but fdt node creation. No functional change intended. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Andrew Jones <drjones@redhat.com> Message-id: 20201001061718.101915-5-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-08hw/arm/virt: Move post cpu realize check into its own functionAndrew Jones
We'll add more to this new function in coming patches so we also state the gic must be created and call it below create_gic(). No functional change intended. Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andrew Jones <drjones@redhat.com> Message-id: 20201001061718.101915-4-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-08hw/char/bcm2835_aux: Allow less than 32-bit accessesPhilippe Mathieu-Daudé
The "BCM2835 ARM Peripherals" datasheet [*] chapter 2 ("Auxiliaries: UART1 & SPI1, SPI2"), list the register sizes as 3/8/16/32 bits. We assume this means this peripheral allows 8-bit accesses. This was not an issue until commit 5d971f9e67 which reverted ("memory: accept mismatching sizes in memory_region_access_valid"). The model is implemented as 32-bit accesses (see commit 97398d900c, all registers are 32-bit) so replace MemoryRegionOps.valid as MemoryRegionOps.impl, and re-introduce MemoryRegionOps.valid with a 8/32-bit range. [*] https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf Fixes: 97398d900c ("bcm2835_aux: add emulation of BCM2835 AUX (aka UART1) block") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201002181032.1899463-1-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-08hw/arm/sbsa-ref : allocate IRQs for SMMUv3Graeme Gregory
Original commit did not allocate IRQs for the SMMUv3 in the irqmap effectively using irq 0->3 (shared with other devices). Assuming original intent was to allocate unique IRQs then add an allocation to the irqmap. Fixes: e9fdf453240 ("hw/arm: Add arm SBSA reference machine, devices part") Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Graeme Gregory <graeme@nuviainc.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-id: 20201007100732.4103790-3-graeme@nuviainc.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-08hw/arm/sbsa-ref : Fix SMMUv3 InitialisationGraeme Gregory
SMMUv3 has an error in a previous patch where an i was transposed to a 1 meaning interrupts would not have been correctly assigned to the SMMUv3 instance. Fixes: 48ba18e6d3f3 ("hw/arm/sbsa-ref: Simplify by moving the gic in the machine state") Signed-off-by: Graeme Gregory <graeme@nuviainc.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-id: 20201007100732.4103790-2-graeme@nuviainc.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-08hw/ssi/npcm7xx_fiu: Fix handling of unsigned integerPhilippe Mathieu-Daudé
Fix integer handling issues handling issue reported by Coverity: hw/ssi/npcm7xx_fiu.c: 162 in npcm7xx_fiu_flash_read() >>> CID 1432730: Integer handling issues (NEGATIVE_RETURNS) >>> "npcm7xx_fiu_cs_index(fiu, f)" is passed to a parameter that cannot be negative. 162 npcm7xx_fiu_select(fiu, npcm7xx_fiu_cs_index(fiu, f)); hw/ssi/npcm7xx_fiu.c: 221 in npcm7xx_fiu_flash_write() 218 cs_id = npcm7xx_fiu_cs_index(fiu, f); 219 trace_npcm7xx_fiu_flash_write(DEVICE(fiu)->canonical_path, cs_id, addr, 220 size, v); >>> CID 1432729: Integer handling issues (NEGATIVE_RETURNS) >>> "cs_id" is passed to a parameter that cannot be negative. 221 npcm7xx_fiu_select(fiu, cs_id); Since the index of the flash can not be negative, return an unsigned type. Reported-by: Coverity (CID 1432729 & 1432730: NEGATIVE_RETURNS) Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com> Message-id: 20200919132435.310527-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-08Merge remote-tracking branch ↵Peter Maydell
'remotes/ehabkost/tags/machine-next-pull-request' into staging machine + QOM queue, 2020-10-06 * QOM documentation fixes and cleanups (Eduardo Habkost) * user-mode: Prune build dependencies (Philippe Mathieu-Daudé) * qom: Improve error message (Philippe Mathieu-Daudé) * numa: hmat: require parent cache description before the next level one (Igor Mammedov) # gpg: Signature made Tue 06 Oct 2020 23:09:03 BST # gpg: using RSA key 5A322FD5ABC4D3DBACCFD1AA2807936F984DC5A6 # gpg: issuer "ehabkost@redhat.com" # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" [full] # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/machine-next-pull-request: (21 commits) numa: hmat: require parent cache description before the next level one kernel-doc: Remove $decl_type='type name' hack memory: Explicitly tag doc comments for structs qom: Explicitly tag doc comments for typedefs and structs kernel-doc: Handle function typedefs without asterisks kernel-doc: Handle function typedefs that return pointers docs/devel/qom: Avoid long lines docs/devel/qom: Remove usage of <code> docs/devel/qom: Use *emphasis* for emphasis docs/devel/qom: Fix indentation of code blocks docs/devel/qom: Fix indentation of bulleted list qom: Fix DECLARE_*CHECKER documentation qom: Improve error message displayed with missing object properties hw/core/cpu: Add missing 'exec/cpu-common.h' include hw/core/qdev-properties: Extract system-mode specific properties hw/core/qdev-properties: Export some integer-related functions hw/core/qdev-properties: Export qdev_prop_enum hw/core/qdev-properties: Export enum-related functions hw/core/qdev-properties: Fix code style hw/core/qdev-properties: Use qemu_strtoul() in set_pci_host_devaddr() ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-06numa: hmat: require parent cache description before the next level oneIgor Mammedov
Spec[1] defines 0 - 3 level memory side cache, however QEMU CLI allows to specify an intermediate cache level without specifying previous level. Such option(s) silently ignored when building HMAT table, which leads to incomplete cache information. Make sure that previous level exists and error out if it hasn't been provided. 1) ACPI 6.2A 5.2.27.5 Memory Side Cache Information Structure Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1842877 Signed-off-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20201006150002.1601845-1-imammedo@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-10-06hw/core/cpu: Add missing 'exec/cpu-common.h' includePhilippe Mathieu-Daudé
cpu_common_reset() uses tcg_flush_softmmu_tlb() which is declared in "exec/cpu-common.h". Add the missing header to avoid when refactoring other headers: hw/core/cpu.c: In function ‘cpu_common_reset’: hw/core/cpu.c:273:9: error: implicit declaration of function ‘tcg_flush_softmmu_tlb’ [-Werror=implicit-function-declaration] 273 | tcg_flush_softmmu_tlb(cpu); | ^~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200908123433.105706-1-philmd@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-10-06hw/core/qdev-properties: Extract system-mode specific propertiesPhilippe Mathieu-Daudé
Move properties specific to machines into a separate file. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200930164949.1425294-9-philmd@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-10-06hw/core/qdev-properties: Export some integer-related functionsPhilippe Mathieu-Daudé
We are going to split this file and reuse these static functions. Declare them in the local "qdev-prop-internal.h" header. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200930164949.1425294-8-philmd@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-10-06hw/core/qdev-properties: Export qdev_prop_enumPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200930164949.1425294-7-philmd@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-10-06hw/core/qdev-properties: Export enum-related functionsPhilippe Mathieu-Daudé
We are going to split this file and reuse these static functions. Add the local "qdev-prop-internal.h" header declaring them. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200930164949.1425294-6-philmd@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-10-06hw/core/qdev-properties: Fix code stylePhilippe Mathieu-Daudé
We will soon move this code, fix its style to avoid checkpatch.pl to complain. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200930164949.1425294-5-philmd@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-10-06hw/core/qdev-properties: Use qemu_strtoul() in set_pci_host_devaddr()Philippe Mathieu-Daudé
Replace strtoul() by qemu_strtoul() so checkpatch.pl won't complain if we move this code later. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200930164949.1425294-4-philmd@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-10-06hw/core/qdev-properties: Use qemu_strtol() in set_mac() handlerPhilippe Mathieu-Daudé
The MACAddr structure contains an array of uint8_t. Previously if a value was out of the [0..255] range, it was silently casted and no input validation was done. Replace strtol() by qemu_strtol() -- so checkpatch.pl won't complain if we move this code later -- and return EINVAL if the input is invalid. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200930164949.1425294-3-philmd@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-10-05cpus: add handle_interrupt to the CpusAccel interfaceClaudio Fontana
kvm: uses the generic handler qtest: uses the generic handler whpx: changed to use the generic handler (identical implementation) hax: changed to use the generic handler (identical implementation) hvf: changed to use the generic handler (identical implementation) tcg: adapt tcg-cpus to point to the tcg-specific handler Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-10-05cpus: prepare new CpusAccel cpu accelerator interfaceClaudio Fontana
The new interface starts unused, will start being used by the next patches. It provides methods for each accelerator to start a vcpu, kick a vcpu, synchronize state, get cpu virtual clock and elapsed ticks. In qemu_wait_io_event, make it clear that APC is used only for HAX on Windows. Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-10-05cpu-timers, icount: new modulesClaudio Fontana
refactoring of cpus.c continues with cpu timer state extraction. cpu-timers: responsible for the softmmu cpu timers state, including cpu clocks and ticks. icount: counts the TCG instructions executed. As such it is specific to the TCG accelerator. Therefore, it is built only under CONFIG_TCG. One complication is due to qtest, which uses an icount field to warp time as part of qtest (qtest_clock_warp). In order to solve this problem, provide a separate counter for qtest. This requires fixing assumptions scattered in the code that qtest_enabled() implies icount_enabled(), checking each specific case. Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [remove redundant initialization with qemu_spice_init] Reviewed-by: Alex Bennée <alex.bennee@linaro.org> [fix lingering calls to icount_get] Signed-off-by: Claudio Fontana <cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-10-02vfio-ccw: plug memory leak while getting region infoCornelia Huck
vfio_get_dev_region_info() unconditionally allocates memory for a passed-in vfio_region_info structure (and does not re-use an already allocated structure). Therefore, we have to free the structure we pass to that function in vfio_ccw_get_region() for every region we successfully obtained information for. Fixes: 8fadea24de4e ("vfio-ccw: support async command subregion") Fixes: 46ea3841edaf ("vfio-ccw: Add support for the schib region") Fixes: f030532f2ad6 ("vfio-ccw: Add support for the CRW region and IRQ") Reported-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200928101701.13540-1-cohuck@redhat.com>
2020-10-02s390: guest support for diagnose 0x318Collin Walling
DIAGNOSE 0x318 (diag318) is an s390 instruction that allows the storage of diagnostic information that is collected by the firmware in the case of hardware/firmware service events. QEMU handles the instruction by storing the info in the CPU state. A subsequent register sync will communicate the data to the hypervisor. QEMU handles the migration via a VM State Description. This feature depends on the Extended-Length SCCB (els) feature. If els is not present, then a warning will be printed and the SCLP bit that allows the Linux kernel to execute the instruction will not be set. Availability of this instruction is determined by byte 134 (aka fac134) bit 0 of the SCLP Read Info block. This coincidentally expands into the space used for CPU entries, which means VMs running with the diag318 capability may not be able to read information regarding all CPUs unless the guest kernel supports an extended-length SCCB. This feature is not supported in protected virtualization mode. Signed-off-by: Collin Walling <walling@linux.ibm.com> Acked-by: Janosch Frank <frankja@linux.ibm.com> Acked-by: Thomas Huth <thuth@redhat.com> Acked-by: David Hildenbrand <david@redhat.com> Acked-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-Id: <20200915194416.107460-9-walling@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-10-02s390/sclp: add extended-length sccb support for kvm guestCollin Walling
As more features and facilities are added to the Read SCP Info (RSCPI) response, more space is required to store them. The space used to store these new features intrudes on the space originally used to store CPU entries. This means as more features and facilities are added to the RSCPI response, less space can be used to store CPU entries. With the Extended-Length SCCB (ELS) facility, a KVM guest can execute the RSCPI command and determine if the SCCB is large enough to store a complete reponse. If it is not large enough, then the required length will be set in the SCCB header. The caller of the SCLP command is responsible for creating a large-enough SCCB to store a complete response. Proper checking should be in place, and the caller should execute the command once-more with the large-enough SCCB. This facility also enables an extended SCCB for the Read CPU Info (RCPUI) command. When this facility is enabled, the boundary violation response cannot be a result from the RSCPI, RSCPI Forced, or RCPUI commands. In order to tolerate kernels that do not yet have full support for this feature, a "fixed" offset to the start of the CPU Entries within the Read SCP Info struct is set to allow for the original 248 max entries when this feature is disabled. Additionally, this is introduced as a CPU feature to protect the guest from migrating to a machine that does not support storing an extended SCCB. This could otherwise hinder the VM from being able to read all available CPU entries after migration (such as during re-ipl). Signed-off-by: Collin Walling <walling@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Acked-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-Id: <20200915194416.107460-7-walling@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-10-02s390/sclp: use cpu offset to locate cpu entriesCollin Walling
The start of the CPU entry region in the Read SCP Info response data is denoted by the offset_cpu field. As such, QEMU needs to begin creating entries at this address. This is in preparation for when Read SCP Info inevitably introduces new bytes that push the start of the CPUEntry field further away. Read CPU Info is unlikely to ever change, so let's not bother accounting for the offset there. Signed-off-by: Collin Walling <walling@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-Id: <20200915194416.107460-6-walling@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-10-02s390/sclp: check sccb len before filling in dataCollin Walling
The SCCB must be checked for a sufficient length before it is filled with any data. If the length is insufficient, then the SCLP command is suppressed and the proper response code is set in the SCCB header. While we're at it, let's cleanup the length check by placing the calculation inside a macro. Fixes: 832be0d8a3bb ("s390x: sclp: Report insufficient SCCB length") Signed-off-by: Collin Walling <walling@linux.ibm.com> Reviewed-by: Janosch Frank <frankja@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-Id: <20200915194416.107460-5-walling@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-10-02s390/sclp: read sccb from mem based on provided lengthCollin Walling
The header contained within the SCCB passed to the SCLP service call contains the actual length of the SCCB. Instead of allocating a static 4K size for the work sccb, let's allow for a variable size determined by the value in the header. The proper checks are already in place to ensure the SCCB length is sufficent to store a full response and that the length does not cross any explicitly-set boundaries. Signed-off-by: Collin Walling <walling@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-Id: <20200915194416.107460-4-walling@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-10-02s390/sclp: rework sclp boundary checksCollin Walling
Rework the SCLP boundary check to account for different SCLP commands (eventually) allowing different boundary sizes. Signed-off-by: Collin Walling <walling@linux.ibm.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Acked-by: Janosch Frank <frankja@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-Id: <20200915194416.107460-3-walling@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-10-02s390/sclp: get machine once during read scp/cpu infoCollin Walling
Functions within read scp/cpu info will need access to the machine state. Let's make a call to retrieve the machine state once and pass the appropriate data to the respective functions. Signed-off-by: Collin Walling <walling@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Janosch Frank <frankja@linux.ibm.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-Id: <20200915194416.107460-2-walling@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-10-02hw/s390x/css: Remove double initializationPhilippe Mathieu-Daudé
Fix eventual copy/paste mistake introduced in commit bc994b74ea ("s390x/css: Use static initialization for channel_subsys fields"). Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20200907024020.854465-1-philmd@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-10-01Merge remote-tracking branch 'remotes/jsnow-gitlab/tags/ide-pull-request' ↵Peter Maydell
into staging Pull request # gpg: Signature made Thu 01 Oct 2020 18:41:05 BST # gpg: using RSA key F9B7ABDBBCACDF95BE76CBD07DEF8106AAFC390E # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" [full] # Primary key fingerprint: FAEB 9711 A12C F475 812F 18F2 88A9 064D 1835 61EB # Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76 CBD0 7DEF 8106 AAFC 390E * remotes/jsnow-gitlab/tags/ide-pull-request: ide: cancel pending callbacks on SRST ide: clear interrupt on command write ide: remove magic constants from the device register ide: reorder set/get sector functions ide: model HOB correctly ide: don't tamper with the device register ide: rename cmd_write to ctrl_write hw/ide/ahci: Do not dma_memory_unmap(NULL) MAINTAINERS: Update my git address Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-01ide: cancel pending callbacks on SRSTJohn Snow
The SRST implementation did not keep up with the rest of IDE; it is possible to perform a weak reset on an IDE device to remove the BSY/DRQ bits, and then issue writes to the control/device registers which can cause chaos with the state machine. Fix that by actually performing a real reset. Reported-by: Alexander Bulekov <alxndr@bu.edu> Fixes: https://bugs.launchpad.net/qemu/+bug/1878253 Fixes: https://bugs.launchpad.net/qemu/+bug/1887303 Fixes: https://bugs.launchpad.net/qemu/+bug/1887309 Signed-off-by: John Snow <jsnow@redhat.com>
2020-10-01ide: clear interrupt on command writeJohn Snow
Not known to fix any bug, but I couldn't help but notice that ATA specifies that writing to this register should clear an interrupt. ATA7: Section 5.3.3 (Command register - Effect) ATA6: Section 7.4.4 (Command register - Effect) ATA5: Section 7.4.4 (Command register - Effect) ATA4: Section 7.4.4 (Command register - Effect) ATA3: Section 5.2.2 (Command register) Other editions: try searching for the phrase "Writing this register". Signed-off-by: John Snow <jsnow@redhat.com>
2020-10-01ide: remove magic constants from the device registerJohn Snow
(In QEMU, we call this the "select" register.) My memory isn't good enough to memorize what these magic runes do. Label them to prevent mixups from happening in the future. Side note: I assume it's safe to always set 0xA0 even though ATA2 claims these bits are reserved, because ATA3 immediately reinstated that these bits should be always on. ATA4 and subsequent specs only claim that the fields are obsolete, so I assume it's safe to leave these set and that it should work with the widest array of guests. Signed-off-by: John Snow <jsnow@redhat.com>
2020-10-01ide: reorder set/get sector functionsJohn Snow
Reorder these just a pinch to make them more obvious at a glance what the addressing mode is. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-10-01ide: model HOB correctlyJohn Snow
I have been staring at this FIXME for years and I never knew what it meant. I finally stumbled across it! When writing to the command registers, the old value is shifted into a HOB copy of the register and the new value is written into the primary register. When reading registers, the value retrieved is dependent on the HOB bit in the CONTROL register. By setting bit 7 (0x80) in CONTROL, any register read will, if it has one, yield the HOB value for that register instead. Our code has a problem: We were using bit 7 of the DEVICE register to model this. We use bus->cmd roughly as the control register already, as it stores the value from ide_ctrl_write. Lastly, all command register writes reset the HOB, so fix that, too. Signed-off-by: John Snow <jsnow@redhat.com>
2020-10-01ide: don't tamper with the device registerJohn Snow
In real ISA operation, register writes go out to an entire bus channel and all listening devices receive the write. The devices do not toggle the DEV bit based on their own configuration, nor does the HBA intermediate or tamper with that value. The reality of the matter is that DEV0/DEV1 accordingly will react to command register writes based on whether or not the device was selected. This does not fix a known bug, but it makes the code slightly simpler and more obvious. Signed-off-by: John Snow <jsnow@redhat.com>
2020-10-01ide: rename cmd_write to ctrl_writeJohn Snow
It's the Control register, part of the Control block -- Command is misleading here. Rename all related functions and constants. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-10-01hw/ide/ahci: Do not dma_memory_unmap(NULL)Philippe Mathieu-Daudé
libFuzzer triggered the following assertion: cat << EOF | qemu-system-i386 -M pc-q35-5.0 \ -nographic -monitor none -serial none -qtest stdio outl 0xcf8 0x8000fa24 outl 0xcfc 0xe1068000 outl 0xcf8 0x8000fa04 outw 0xcfc 0x7 outl 0xcf8 0x8000fb20 write 0xe1068304 0x1 0x21 write 0xe1068318 0x1 0x21 write 0xe1068384 0x1 0x21 write 0xe1068398 0x2 0x21 EOF qemu-system-i386: exec.c:3621: address_space_unmap: Assertion `mr != NULL' failed. Aborted (core dumped) This is because we don't check the return value from dma_memory_map() which can return NULL, then we call dma_memory_unmap(NULL) which is illegal. Fix by only unmap if the value is not NULL (and the size is not the expected one). Cc: qemu-stable@nongnu.org Reported-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200718072854.7001-1-f4bug@amsat.org Fixes: f6ad2e32f8 ("ahci: add ahci emulation") BugLink: https://bugs.launchpad.net/qemu/+bug/1884693 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
2020-10-01Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20201001' into staging target-arm queue: * Make isar_feature_aa32_fp16_arith() handle M-profile * Fix SVE splice * Fix SVE LDR/STR * Remove ignore_memory_transaction_failures on the raspi2 * raspi: Various cleanup/refactoring # gpg: Signature made Thu 01 Oct 2020 15:46:47 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20201001: hw/arm/raspi: Remove use of the 'version' value in the board code hw/arm/raspi: Use RaspiProcessorId to set the firmware load address hw/arm/raspi: Introduce RaspiProcessorId enum hw/arm/raspi: Use more specific machine names hw/arm/raspi: Avoid using TypeInfo::class_data pointer hw/arm/raspi: Move arm_boot_info structure to RaspiMachineState hw/arm/raspi: Load the firmware on the first core hw/arm/raspi: Display the board revision in the machine description hw/arm/raspi: Remove ignore_memory_transaction_failures on the raspi2 hw/arm/bcm2835: Add more unimplemented peripherals hw/arm/raspi: Define various blocks base addresses target/arm: Fix SVE splice target/arm: Fix sve ldr/str target/arm: Make isar_feature_aa32_fp16_arith() handle M-profile target/arm: Add ID register values for Cortex-M0 hw/intc/armv7m_nvic: Only show ID register values for Main Extension CPUs target/arm: Move id_pfr0, id_pfr1 into ARMISARegisters target/arm: Replace ARM_FEATURE_PXN with ID_MMFR0.VMSA check Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-01hw/arm/raspi: Remove use of the 'version' value in the board codePhilippe Mathieu-Daudé
We expected the 'version' ID to match the board processor ID, but this is not always true (for example boards with revision id 0xa02042/0xa22042 are Raspberry Pi 2 with a BCM2837 SoC). This was not important because we were not modelling them, but since the recent refactor now allow to model these boards, it is safer to check the processor id directly. Remove the version check. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Luc Michel <luc.michel@greensocs.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200924111808.77168-9-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-01hw/arm/raspi: Use RaspiProcessorId to set the firmware load addressPhilippe Mathieu-Daudé
The firmware load address depends on the SoC ("processor id") used, not on the version of the board. Suggested-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Luc Michel <luc.michel@greensocs.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200924111808.77168-8-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-01hw/arm/raspi: Introduce RaspiProcessorId enumPhilippe Mathieu-Daudé
As we only support a reduced set of the REV_CODE_PROCESSOR id encoded in the board revision, define the PROCESSOR_ID values as an enum. We can simplify the board_soc_type and cores_count methods. Reviewed-by: Luc Michel <luc.michel@greensocs.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200924111808.77168-7-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-01hw/arm/raspi: Use more specific machine namesPhilippe Mathieu-Daudé
Now that we can instantiate different machines based on their board_rev register value, we can have various raspi2 and raspi3. In commit fc78a990ec103 we corrected the machine description. Correct the machine names too. For backward compatibility, add an alias to the previous generic name. Reviewed-by: Luc Michel <luc.michel@greensocs.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200924111808.77168-6-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-01hw/arm/raspi: Avoid using TypeInfo::class_data pointerPhilippe Mathieu-Daudé
Using class_data pointer to create a MachineClass is not the recommended way anymore. The correct way is to open-code the MachineClass::fields in the class_init() method. We can not use TYPE_RASPI_MACHINE::class_base_init() because it is called *before* each machine class_init(), therefore the board_rev field is not populated. We have to manually call raspi_machine_class_common_init() for each machine. This partly reverts commit a03bde3674e. Suggested-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200924111808.77168-5-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-01hw/arm/raspi: Move arm_boot_info structure to RaspiMachineStatePhilippe Mathieu-Daudé
The arm_boot_info structure belong to the machine, move it to RaspiMachineState. Reviewed-by: Luc Michel <luc.michel@greensocs.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200924111808.77168-4-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-01hw/arm/raspi: Load the firmware on the first corePhilippe Mathieu-Daudé
The 'first_cpu' is more a QEMU accelerator-related concept than a variable the machine requires to use. Since the machine is aware of its CPUs, directly use the first one to load the firmware. Reviewed-by: Luc Michel <luc.michel@greensocs.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200924111808.77168-3-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-10-01hw/arm/raspi: Display the board revision in the machine descriptionPhilippe Mathieu-Daudé
Display the board revision in the machine description. Before: $ qemu-system-aarch64 -M help | fgrep raspi raspi2 Raspberry Pi 2B raspi3 Raspberry Pi 3B After: raspi2 Raspberry Pi 2B (revision 1.1) raspi3 Raspberry Pi 3B (revision 1.2) Reviewed-by: Luc Michel <luc.michel@greensocs.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200924111808.77168-2-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-30 17:51:55 +0000