aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2021-01-19Revert "ppc4xx: Move common dependency on serial to common option"BALATON Zoltan
This reverts commit e6d5106786 which was added mistakenly. While this change works it was suggested during review that keeping dependencies explicit for each board may be better than listing them in a common option so keep the previous version and revert this change. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <8c65807fc7dc1c4c4f6320f2fd6409a3091c88ff.1610143658.git.balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-01-19Revert "sam460ex: Remove FDT_PPC dependency from KConfig"BALATON Zoltan
This reverts commit 038da2adf that was mistakenly added, this dependency is still needed to get libfdt dependencies even if fdt.o is not needed by sam460ex. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <15a9fa72eed4f02bdbeaef206803d5e22260e2de.1610143658.git.balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-01-19hw/ppc: Remove unused ppcuic_init()Peter Maydell
Now we've converted all the callsites to directly create the QOM UIC device themselves, the ppcuic_init() function is unused and can be removed. The enum defining PPCUIC symbolic constants can be moved to the ppc-uic.h header where it more naturally belongs. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-Id: <20210108171212.16500-5-peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-01-19hw/ppc/ppc405_uc: Drop use of ppcuic_init()Peter Maydell
Switch the ppc405_uc boards to directly creating and configuring the UIC, rather than doing it via the old ppcuic_init() helper function. We retain the API feature of ppc405ep_init() where it passes back something allowing the callers to wire up devices to the UIC if they need to, even though neither of the callsites currently makes use of this ability -- instead of passing back the qemu_irq array we pass back the UIC DeviceState. This fixes a trivial Coverity-detected memory leak where we were leaking the array of IRQs returned by ppcuic_init(). Fixes: Coverity CID 1421922 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210108171212.16500-4-peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-01-19hw/intc/ppc-uic: Make default dcr-base 0xc0, not 0x30Peter Maydell
In commit 34d0831f38fd8 the ppc-uic device was added, with a dcr-base property. The intention was that the default value of dcr-base should be the one that most of our boards need, so that in the common case they don't need to specify a property value. All QEMU boards with a UIC use a dcr-base of 0xc0, with the exception of sam460ex which has four UICs and so puts them at 0xc0, 0xd0, 0xe0, 0xf0. So 0xc0 is the obvious right choice for the default dcr-base. The board code conversions in commits 0270d74ef88623505 (bamboo) and c5ac9dc64fa552a6 (virtex_ml507) assumed that default was 0xc0. Unfortunately the actual default in 34d0831f38fd8 was 0x30, by mistake, so the bamboo and virtex_ml507 boards were broken as they were converted away from ppcuic_init() (which always specifies the dcr_base property value explicitly). Set the default dcr-base to 0xc0 as was intended, fixing bamboo and virtex_ml507. Fixes: 34d0831f38fd8 Reported-by: Nathan Chancellor <natechancellor@gmail.com> Suggested-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210111213007.7381-1-peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-01-19hw/ppc: Delete unused ppc405cr_init() codePeter Maydell
The function ppc405cr_init() has apparently been unused since it was added in commit 8ecc7913525ecb in 2007. Remove this dead code, so we don't have to convert it away from using ppcuic_init(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210108171212.16500-3-peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-01-19hw/ppc/sam460ex: Drop use of ppcuic_init()Peter Maydell
Switch the sam460ex board to directly creating and configuring the UIC, rather than doing it via the old ppcuic_init() helper function. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210108171212.16500-2-peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-01-18Merge remote-tracking branch ↵Peter Maydell
'remotes/vivier2/tags/trivial-branch-for-6.0-pull-request' into staging Trivial patches 20210118 Fix memory leaks Use qemu_log_mask(GUEST_ERROR) rather than error_report(). # gpg: Signature made Mon 18 Jan 2021 11:31:10 GMT # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/trivial-branch-for-6.0-pull-request: hw/ide/ahci: Replace fprintf() by qemu_log_mask(GUEST_ERROR) misc/mos6522: Use timer_free() in the finalize function to avoid memleak pl031: Use timer_free() in the finalize function to avoid memleaks hw/virtio-pci: Replace error_report() by qemu_log_mask(GUEST_ERROR) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-01-18Merge remote-tracking branch ↵Peter Maydell
'remotes/stsquad/tags/pull-testing-and-misc-180121-2' into staging Testing, gdbstub and semihosting patches: - clean-ups to docker images - drop duplicate jobs from shippable - prettier tag generation (+gtags) - generate browsable source tree - more Travis->GitLab migrations - fix checkpatch to deal with commits - gate gdbstub tests on 8.3.1, expand tests - support Xfer:auxv:read gdb packet - better gdbstub cleanup - use GDB's SVE register layout - make arm-compat-semihosting common - add riscv semihosting support - add HEAPINFO, ELAPSED, TICKFREQ, TMPNAM and ISERROR to semihosting # gpg: Signature made Mon 18 Jan 2021 10:09:11 GMT # gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44 # gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [full] # Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44 * remotes/stsquad/tags/pull-testing-and-misc-180121-2: (30 commits) semihosting: Implement SYS_ISERROR semihosting: Implement SYS_TMPNAM semihosting: Implement SYS_ELAPSED and SYS_TICKFREQ riscv: Add semihosting support for user mode riscv: Add semihosting support semihosting: Support SYS_HEAPINFO when env->boot_info is not set semihosting: Change internal common-semi interfaces to use CPUState * semihosting: Change common-semi API to be architecture-independent semihosting: Move ARM semihosting code to shared directories target/arm: use official org.gnu.gdb.aarch64.sve layout for registers gdbstub: ensure we clean-up when terminated gdbstub: drop gdbserver_cleanup in favour of gdb_exit gdbstub: drop CPUEnv from gdb_exit() gdbstub: add support to Xfer:auxv:read: packet gdbstub: implement a softmmu based test Revert "tests/tcg/multiarch/Makefile.target: Disable run-gdbstub-sha1 test" configure: gate our use of GDB to 8.3.1 or above test/guest-debug: echo QEMU command as well scripts/checkpatch.pl: fix git-show invocation to include diffstat gitlab: migrate the minimal tools and unit tests from Travis ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org> # Conflicts: # default-configs/targets/riscv32-linux-user.mak # default-configs/targets/riscv64-linux-user.mak
2021-01-18hw/ide/ahci: Replace fprintf() by qemu_log_mask(GUEST_ERROR)Philippe Mathieu-Daudé
Replace fprintf() calls by qemu_log_mask(LOG_GUEST_ERROR). Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210112112955.1849212-1-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-01-18misc/mos6522: Use timer_free() in the finalize function to avoid memleakGan Qixin
When running device-introspect-test, a memory leak occurred in the mos6522_init function, this patch use timer_free() in the finalize function to fix it. ASAN shows memory leak stack: Direct leak of 96 byte(s) in 2 object(s) allocated from: #0 0xfffd5fe9e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0) #1 0xfffd5f7b6800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800) #2 0xaaae50303d0c in timer_new_full qemu/include/qemu/timer.h:523 #3 0xaaae50303d0c in timer_new qemu/include/qemu/timer.h:544 #4 0xaaae50303d0c in timer_new_ns qemu/include/qemu/timer.h:562 #5 0xaaae50303d0c in mos6522_init qemu/hw/misc/mos6522.c:490 #6 0xaaae50b77d70 in object_init_with_type qemu/qom/object.c:371 #7 0xaaae50b7ae84 in object_initialize_with_type qemu/qom/object.c:515 #8 0xaaae50b7b0f8 in object_new_with_type qemu/qom/object.c:729 #9 0xaaae50bb6d58 in qmp_device_list_properties qemu/qom/qom-qmp-cmds.c:153 #10 0xaaae50d7e1dc in qmp_marshal_device_list_properties qemu/qapi/qapi-commands-qdev.c:59 #11 0xaaae50dc87a0 in do_qmp_dispatch_bh qemu/qapi/qmp-dispatch.c:110 #12 0xaaae50d931a0 in aio_bh_call qemu/util/async.c:136 Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Gan Qixin <ganqixin@huawei.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210112112705.380534-3-ganqixin@huawei.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-01-18pl031: Use timer_free() in the finalize function to avoid memleaksGan Qixin
When running device-introspect-test, a memory leak occurred in the pl031_init function, this patch use timer_free() in the finalize function to fix it. ASAN shows memory leak stack: Direct leak of 48 byte(s) in 1 object(s) allocated from: #0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0) #1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800) #2 0xaaabf5621cfc in timer_new_full qemu/include/qemu/timer.h:523 #3 0xaaabf5621cfc in timer_new qemu/include/qemu/timer.h:544 #4 0xaaabf5621cfc in timer_new_ns qemu/include/qemu/timer.h:562 #5 0xaaabf5621cfc in pl031_init qemu/hw/rtc/pl031.c:194 #6 0xaaabf6339f6c in object_initialize_with_type qemu/qom/object.c:515 #7 0xaaabf633a1e0 in object_new_with_type qemu/qom/object.c:729 #8 0xaaabf6375e40 in qmp_device_list_properties qemu/qom/qom-qmp-cmds.c:153 #9 0xaaabf5a95540 in qdev_device_help qemu/softmmu/qdev-monitor.c:283 #10 0xaaabf5a96940 in qmp_device_add qemu/softmmu/qdev-monitor.c:801 #11 0xaaabf5a96e70 in hmp_device_add qemu/softmmu/qdev-monitor.c:916 #12 0xaaabf5ac0a2c in handle_hmp_command qemu/monitor/hmp.c:1100 Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Gan Qixin <ganqixin@huawei.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210112112705.380534-2-ganqixin@huawei.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-01-18hw/virtio-pci: Replace error_report() by qemu_log_mask(GUEST_ERROR)Philippe Mathieu-Daudé
Replace I/O write error reported with error_report() by qemu_log_mask(GUEST_ERROR) which allow filtering. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20201210172834.178052-1-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-01-18Merge remote-tracking branch ↵Peter Maydell
'remotes/alistair/tags/pull-riscv-to-apply-20210117-3' into staging First RISC-V PR for 6.0 This PR: - Fixes some issues with the m25p80 - Improves GDB support for RISC-V - Fixes some Linux boot issues, specifiaclly 32-bit boot failures - Enforces PMP exceptions correctly - Fixes some Coverity issues # gpg: Signature made Sun 17 Jan 2021 21:53:19 GMT # gpg: using RSA key F6C4AC46D4934868D3B8CE8F21E10D29DF977054 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [full] # Primary key fingerprint: F6C4 AC46 D493 4868 D3B8 CE8F 21E1 0D29 DF97 7054 * remotes/alistair/tags/pull-riscv-to-apply-20210117-3: riscv: Pass RISCVHartArrayState by pointer target/riscv: Remove built-in GDB XML files for CSRs target/riscv: Generate the GDB XML file for CSR registers dynamically target/riscv: Add CSR name in the CSR function table target/riscv: Make csr_ops[CSR_TABLE_SIZE] external hw/misc/sifive_u_otp: handling the fails of blk_pread and blk_pwrite hw/riscv: sifive_u: Use SIFIVE_U_CPU for mc->default_cpu_type target/riscv/pmp: Raise exception if no PMP entry is configured RISC-V: Place DTB at 3GB boundary instead of 4GB gdb: riscv: Add target description hw/block: m25p80: Implement AAI-WP command support for SST flashes hw/block: m25p80: Don't write to flash if write is disabled Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-01-18semihosting: Implement SYS_ISERRORKeith Packard
Part of Semihosting for AArch32 and AArch64 Release 2.0 Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210107170717.2098982-10-keithp@keithp.com> Message-Id: <20210108224256.2321-21-alex.bennee@linaro.org>
2021-01-18semihosting: Implement SYS_TMPNAMKeith Packard
Part of Semihosting for AArch32 and AArch64 Release 2.0 Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210107170717.2098982-9-keithp@keithp.com> Message-Id: <20210108224256.2321-20-alex.bennee@linaro.org>
2021-01-18semihosting: Implement SYS_ELAPSED and SYS_TICKFREQKeith Packard
These are part of Semihosting for AArch32 and AArch64 Release 2.0 Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210107170717.2098982-8-keithp@keithp.com> Message-Id: <20210108224256.2321-19-alex.bennee@linaro.org>
2021-01-18riscv: Add semihosting supportKeith Packard
Adapt the arm semihosting support code for RISCV. This implementation is based on the standard for RISC-V semihosting version 0.2 as documented in https://github.com/riscv/riscv-semihosting-spec/releases/tag/0.2 Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20210107170717.2098982-6-keithp@keithp.com> Message-Id: <20210108224256.2321-17-alex.bennee@linaro.org>
2021-01-18semihosting: Support SYS_HEAPINFO when env->boot_info is not setKeith Packard
env->boot_info is only set in some ARM startup paths, so we cannot rely on it to support the SYS_HEAPINFO semihosting function. When not available, fallback to finding a RAM memory region containing the current stack and use the base of that. Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210107170717.2098982-5-keithp@keithp.com> Message-Id: <20210108224256.2321-16-alex.bennee@linaro.org>
2021-01-18semihosting: Change internal common-semi interfaces to use CPUState *Keith Packard
This makes all of the internal interfaces architecture-independent and renames the internal functions to use the 'common_semi' prefix instead of 'arm' or 'arm_semi'. To do this, some new architecture-specific internal helper functions were created: static inline target_ulong common_semi_arg(CPUState *cs, int argno) Returns the argno'th semihosting argument, where argno can be either 0 or 1. static inline void common_semi_set_ret(CPUState *cs, target_ulong ret) Sets the semihosting return value. static inline bool common_semi_sys_exit_extended(CPUState *cs, int nr) This detects whether the specified semihosting call, which is either TARGET_SYS_EXIT or TARGET_SYS_EXIT_EXTENDED should be executed using the TARGET_SYS_EXIT_EXTENDED semantics. static inline target_ulong common_semi_rambase(CPUState *cs) Returns the base of RAM region used for heap and stack. This is used to construct plausible values for the SYS_HEAPINFO call. In addition, several existing functions have been changed to flag areas of code which are architecture specific: static target_ulong common_semi_flen_buf(CPUState *cs) Returns the current stack pointer minus 64, which is where a stat structure will be placed on the stack #define GET_ARG(n) This fetches arguments from the semihosting command's argument block. The address of this is available implicitly through the local 'args' variable. This is *mostly* architecture independent, but does depend on the current ABI's notion of the size of a 'long' parameter, which may need run-time checks (as it does on AARCH64) #define SET_ARG(n, val) This mirrors GET_ARG and stores data back into the argument block. Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20210107170717.2098982-4-keithp@keithp.com> Message-Id: <20210108224256.2321-15-alex.bennee@linaro.org>
2021-01-18semihosting: Change common-semi API to be architecture-independentKeith Packard
The public API is now defined in hw/semihosting/common-semi.h. do_common_semihosting takes CPUState * instead of CPUARMState *. All internal functions have been renamed common_semi_ instead of arm_semi_ or arm_. Aside from the API change, there are no functional changes in this patch. Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20210107170717.2098982-3-keithp@keithp.com> Message-Id: <20210108224256.2321-14-alex.bennee@linaro.org>
2021-01-18semihosting: Move ARM semihosting code to shared directoriesKeith Packard
This commit renames two files which provide ARM semihosting support so that they can be shared by other architectures: 1. target/arm/arm-semi.c -> hw/semihosting/common-semi.c 2. linux-user/arm/semihost.c -> linux-user/semihost.c The build system was modified use a new config variable, CONFIG_ARM_COMPATIBLE_SEMIHOSTING, which has been added to the ARM softmmu and linux-user default configs. The contents of the source files has not been changed in this patch. Signed-off-by: Keith Packard <keithp@keithp.com> [AJB: rename arm-compat-semi, select SEMIHOSTING] Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210107170717.2098982-2-keithp@keithp.com> Message-Id: <20210108224256.2321-13-alex.bennee@linaro.org>
2021-01-17Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pc,pci,virtio: fixes, features Fixes all over the place. PXB support for ARM. boot index for vhost-user-fs. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Sun 17 Jan 2021 11:44:55 GMT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: acpi: Update _DSM method in expected files acpi: Enable pxb unit-test for ARM virt machine Kconfig: Compile PXB for ARM_VIRT acpi/gpex: Exclude pxb's resources from PCI0 acpi/gpex: Inform os to keep firmware resource map acpi: Add addr offset in build_crs acpi: Fix unmatched expected DSDT.pxb file acpi: Allow DSDT acpi table changes vhost-user-fs: add the "bootindex" property pci/shpc: don't push attention button when ejecting powered-off device Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-01-17Kconfig: Compile PXB for ARM_VIRTJiahui Cen
PXB is now supported on ARM, so let's compile for arm_virt machine. Acked-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Jiahui Cen <cenjiahui@huawei.com> Message-Id: <20210114100643.10617-7-cenjiahui@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-01-17acpi/gpex: Exclude pxb's resources from PCI0Jiahui Cen
Exclude the resources of extra root bridges from PCI0's _CRS. Otherwise, the resource windows would overlap in guest, and the IO resource window would fail to be registered. Acked-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Jiahui Cen <cenjiahui@huawei.com> Message-Id: <20210114100643.10617-6-cenjiahui@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-01-17acpi/gpex: Inform os to keep firmware resource mapJiahui Cen
There may be some differences in pci resource assignment between guest os and firmware. Eg. A Bridge with Bus [d2] -+-[0000:d2]---01.0-[d3]----01.0 where [d2:01.00] is a pcie-pci-bridge with BAR0 (mem, 64-bit, non-pref) [size=256] [d3:01.00] is a PCI Device with BAR0 (mem, 64-bit, pref) [size=128K] BAR4 (mem, 64-bit, pref) [size=64M] In EDK2, the Resource Map would be: PciBus: Resource Map for Bridge [D2|01|00] Type = PMem64; Base = 0x8004000000; Length = 0x4100000; Alignment = 0x3FFFFFF Base = 0x8004000000; Length = 0x4000000; Alignment = 0x3FFFFFF; Owner = PCI [D3|01|00:20] Base = 0x8008000000; Length = 0x20000; Alignment = 0x1FFFF; Owner = PCI [D3|01|00:10] Type = Mem64; Base = 0x8008100000; Length = 0x100; Alignment = 0xFFF It would use 0x4100000 to calculate the root bus's PMem64 resource window. While in Linux, kernel will use 0x1FFFFFF as the alignment to calculate the PMem64 size, which would be 0x6000000. So kernel would try to allocate 0x6000000 from the PMem64 resource window, but since the window size is 0x4100000 as assigned by EDK2, the allocation would fail. The diffences could result in resource assignment failure. Using _DSM #5 method to inform guest os not to ignore the PCI configuration that firmware has done at boot time could handle the differences. Acked-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Jiahui Cen <cenjiahui@huawei.com> Message-Id: <20210114100643.10617-5-cenjiahui@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-01-17acpi: Add addr offset in build_crsJiahui Cen
AML needs Address Translation offset to describe how a bridge translates addresses accross the bridge when using an address descriptor, and especially on ARM, the translation offset of pio resource is usually non zero. Therefore, it's necessary to pass offset for pio, mmio32, mmio64 and bus number into build_crs. Acked-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Jiahui Cen <cenjiahui@huawei.com> Message-Id: <20210114100643.10617-4-cenjiahui@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-01-16riscv: Pass RISCVHartArrayState by pointerAlistair Francis
We were accidently passing RISCVHartArrayState by value instead of pointer. The type is 824 bytes long so let's correct that and pass it by pointer instead. Fixes: Coverity CID 1438099 Fixes: Coverity CID 1438100 Fixes: Coverity CID 1438101 Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Message-id: f3e04424723e0e222769991896cc82308fd23f76.1610751609.git.alistair.francis@wdc.com
2021-01-16hw/misc/sifive_u_otp: handling the fails of blk_pread and blk_pwriteGreen Wan
Fix code coverage issues by checking return value and handling fail case of blk_pread() and blk_pwrite(). Return default value 0xff if read fails. Fixes: Coverity CID 1435959 Fixes: Coverity CID 1435960 Fixes: Coverity CID 1435961 Signed-off-by: Green Wan <green.wan@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20201104092900.21214-1-green.wan@sifive.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2021-01-16hw/riscv: sifive_u: Use SIFIVE_U_CPU for mc->default_cpu_typeBin Meng
SIFIVE_U_CPU is conditionally set to SIFIVE_U34 or SIFIVE_U54, hence there is no need to use #idef to set the mc->default_cpu_type. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210109143637.29645-1-bmeng.cn@gmail.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2021-01-16RISC-V: Place DTB at 3GB boundary instead of 4GBAtish Patra
Currently, we place the DTB at 2MB from 4GB or end of DRAM which ever is lesser. However, Linux kernel can address only 1GB of memory for RV32. Thus, it can not map anything beyond 3GB (assuming 2GB is the starting address). As a result, it can not process DT and panic if opensbi dynamic firmware is used. While at it, place the DTB further away to avoid in memory placement issues in future. Fix this by placing the DTB at 16MB from 3GB or end of DRAM whichever is lower. Fixes: 66b1205bc5ab ("RISC-V: Copy the fdt in dram instead of ROM") Reviewed-by: Bin Meng <bin.meng@windriver.com> Tested-by: Bin Meng <bin.meng@windriver.com> Signed-off-by: Atish Patra <atish.patra@wdc.com> Message-id: 20210107091127.3407870-1-atish.patra@wdc.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2021-01-16hw/block: m25p80: Implement AAI-WP command support for SST flashesXuzhou Cheng
Auto Address Increment (AAI) Word-Program is a special command of SST flashes. AAI-WP allows multiple bytes of data to be programmed without re-issuing the next sequential address location. Signed-off-by: Xuzhou Cheng <xuzhou.cheng@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-id: 1608688825-81519-2-git-send-email-bmeng.cn@gmail.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2021-01-16hw/block: m25p80: Don't write to flash if write is disabledBin Meng
When write is disabled, the write to flash should be avoided in flash_write8(). Fixes: 82a2499011a7 ("m25p80: Initial implementation of SPI flash device") Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-id: 1608688825-81519-1-git-send-email-bmeng.cn@gmail.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2021-01-15Merge remote-tracking branch 'remotes/gkurz-gitlab/tags/9p-next-2021-01-15' ↵Peter Maydell
into staging Fix for CVE-2021-20181 # gpg: Signature made Fri 15 Jan 2021 08:52:19 GMT # gpg: using RSA key B4828BAF943140CEF2A3491071D4D5E5822F73D6 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" [full] # gpg: aka "Gregory Kurz <gregory.kurz@free.fr>" [full] # gpg: aka "[jpeg image of size 3330]" [full] # Primary key fingerprint: B482 8BAF 9431 40CE F2A3 4910 71D4 D5E5 822F 73D6 * remotes/gkurz-gitlab/tags/9p-next-2021-01-15: 9pfs: Fully restart unreclaim loop (CVE-2021-20181) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-01-159pfs: Fully restart unreclaim loop (CVE-2021-20181)Greg Kurz
Depending on the client activity, the server can be asked to open a huge number of file descriptors and eventually hit RLIMIT_NOFILE. This is currently mitigated using a reclaim logic : the server closes the file descriptors of idle fids, based on the assumption that it will be able to re-open them later. This assumption doesn't hold of course if the client requests the file to be unlinked. In this case, we loop on the entire fid list and mark all related fids as unreclaimable (the reclaim logic will just ignore them) and, of course, we open or re-open their file descriptors if needed since we're about to unlink the file. This is the purpose of v9fs_mark_fids_unreclaim(). Since the actual opening of a file can cause the coroutine to yield, another client request could possibly add a new fid that we may want to mark as non-reclaimable as well. The loop is thus restarted if the re-open request was actually transmitted to the backend. This is achieved by keeping a reference on the first fid (head) before traversing the list. This is wrong in several ways: - a potential clunk request from the client could tear the first fid down and cause the reference to be stale. This leads to a use-after-free error that can be detected with ASAN, using a custom 9p client - fids are added at the head of the list : restarting from the previous head will always miss fids added by a some other potential request All these problems could be avoided if fids were being added at the end of the list. This can be achieved with a QSIMPLEQ, but this is probably too much change for a bug fix. For now let's keep it simple and just restart the loop from the current head. Fixes: CVE-2021-20181 Buglink: https://bugs.launchpad.net/qemu/+bug/1911666 Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Message-Id: <161064025265.1838153.15185571283519390907.stgit@bahia.lan> Signed-off-by: Greg Kurz <groug@kaod.org>
2021-01-14docs/system: Remove deprecated 'fulong2e' machine aliasPhilippe Mathieu-Daudé
The 'fulong2e' machine alias has been marked as deprecated since QEMU v5.1 (commit c3a09ff68dd, the machine is renamed 'fuloong2e'). Time to remove it now. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Huacai Chen <chenhuacai@kernel.org> Reviewed-by: Thomas Huth <huth@tuxfamily.org> Message-Id: <20210106184602.3771551-1-f4bug@amsat.org>
2021-01-14hw/mips/boston: Check 64-bit support with cpu_type_is_64bit()Philippe Mathieu-Daudé
Directly check if the CPU supports 64-bit with the recently added cpu_type_is_64bit() helper (inlined). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210104221154.3127610-6-f4bug@amsat.org>
2021-01-13Merge remote-tracking branch 'remotes/mcayland/tags/qemu-macppc-20210113' ↵Peter Maydell
into staging qemu-macppc updates # gpg: Signature made Wed 13 Jan 2021 13:02:20 GMT # gpg: using RSA key CC621AB98E82200D915CC9C45BC2C56FAE0F321F # gpg: issuer "mark.cave-ayland@ilande.co.uk" # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" [full] # Primary key fingerprint: CC62 1AB9 8E82 200D 915C C9C4 5BC2 C56F AE0F 321F * remotes/mcayland/tags/qemu-macppc-20210113: macio: don't set user_creatable to false macio: wire macio GPIOs to OpenPIC using sysbus IRQs macio: move OpenPIC inside macio-newworld device mac_newworld: delay wiring of PCI IRQs in New World machine macio: move heathrow PIC inside macio-oldworld device mac_oldworld: move initialisation of grackle before heathrow mac_oldworld: remove duplicate bus check for PPC_INPUT(env) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-01-13vhost-user-fs: add the "bootindex" propertyLaszlo Ersek
virtio-fs qualifies as a bootable device minimally under OVMF, but currently the necessary "bootindex" property is missing. Add the property. Expose the property only in the PCI device, for now. There is no boot support for virtiofs on s390x (ccw) for the time being [1] [2], so leave the CCW device unchanged. Add the property to the base device still, because adding the alias to the CCW device later will be easier this way [3]. [1] https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg01745.html [2] https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg01870.html [3] https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg01751.html Example OpenFirmware device path for the "vhost-user-fs-pci" device in the "bootorder" fw_cfg file: /pci@i0cf8/pci-bridge@1,6/pci1af4,105a@0/filesystem@0 Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Ján Tomko <jtomko@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Cc: virtio-fs@redhat.com Signed-off-by: Laszlo Ersek <lersek@redhat.com> Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20210112131603.12686-1-lersek@redhat.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-01-13pci/shpc: don't push attention button when ejecting powered-off deviceRoman Kagan
When the slot is in steady powered-off state and the device is being removed, there's no need to press the attention button. Nor is it mandated by the Standard Hot-Plug Controller Specification, Rev. 1.0. Moreover it confuses the guest, Linux in particular, as it assumes that the attention button pressed in this state indicates that the device has been inserted and will need to be powered on. Therefore it transitions the slot into BLINKING_ON state for 5 seconds, and discovers at the end that no device is actually inserted: ... unplug request [12685.451329] shpchp 0000:01:00.0: Button pressed on Slot(2) [12685.455478] shpchp 0000:01:00.0: PCI slot #2 - powering off due to button press ... in 5 seconds OS powers off the slot, QEMU ejects the device [12690.632282] shpchp 0000:01:00.0: Latch open on Slot(2) ... excessive button press in steady powered-off state [12690.634267] shpchp 0000:01:00.0: Button pressed on Slot(2) [12690.636256] shpchp 0000:01:00.0: Card not present on Slot(2) ... the last button press spawns powering on the slot [12690.638909] shpchp 0000:01:00.0: PCI slot #2 - powering on due to button press ... in 5 more seconds attempt to power on discovers empty slot [12695.735986] shpchp 0000:01:00.0: No adapter on slot(2) Worse, if the real device insertion happens within 5 seconds from the apparent completion of the previous device removal (signaled via DEVICE_DELETED event), the new button press will be interpreted as the cancellation of that misguided powering on: [13448.965295] shpchp 0000:01:00.0: Button pressed on Slot(2) [13448.969430] shpchp 0000:01:00.0: PCI slot #2 - powering off due to button press [13454.025107] shpchp 0000:01:00.0: Latch open on Slot(2) [13454.027101] shpchp 0000:01:00.0: Button pressed on Slot(2) [13454.029165] shpchp 0000:01:00.0: Card not present on Slot(2) ... the excessive button press spawns powering on the slot ... device has already been ejected by QEMU [13454.031949] shpchp 0000:01:00.0: PCI slot #2 - powering on due to button press ... new device is inserted in the slot [13456.861545] shpchp 0000:01:00.0: Latch close on Slot(2) ... valid button press arrives before 5 s since the wrong one [13456.864894] shpchp 0000:01:00.0: Button pressed on Slot(2) [13456.869211] shpchp 0000:01:00.0: Card present on Slot(2) ... the valid button press is counted as cancellation of the wrong one [13456.873173] shpchp 0000:01:00.0: Button cancel on Slot(2) [13456.877101] shpchp 0000:01:00.0: PCI slot #2 - action canceled due to button press As a result, the newly inserted device isn't brought up by the guest. Avoid this situation by not pushing the attention button when the device in the slot is in powered-off state and is being ejected. FWIW pcie implementation doesn't suffer from this problem. Signed-off-by: Roman Kagan <rvkagan@yandex-team.ru> Message-Id: <20201102053750.2281818-1-rvkagan@yandex-team.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-01-13macio: don't set user_creatable to falseMark Cave-Ayland
Now that all of the object property links to the heathrow PIC and OpenPIC have been removed from the macio devices, it is safe to allow the macio-oldworld and macio-neworld devices to be marked as user_creatable. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20201229175619.6051-8-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-01-13macio: wire macio GPIOs to OpenPIC using sysbus IRQsMark Cave-Ayland
This both allows the wiring to be done as Ben suggested in his original comment in gpio.c and also enables the OpenPIC object property link to be removed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20201229175619.6051-7-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-01-13macio: move OpenPIC inside macio-newworld deviceMark Cave-Ayland
The OpenPIC device is located within the macio device on real hardware so make it a child of the macio-newworld device. This also removes the need for setting and checking a separate PIC object property link on the macio-newworld device which currently causes the automated QOM introspection tests to fail. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20201229175619.6051-6-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-01-13mac_newworld: delay wiring of PCI IRQs in New World machineMark Cave-Ayland
In order to move the OpenPIC device to the macio device, the PCI bus needs to be initialised before the macio device and also before wiring the OpenPIC IRQs. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20201229175619.6051-5-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-01-13macio: move heathrow PIC inside macio-oldworld deviceMark Cave-Ayland
The heathrow PIC is located within the macio device on real hardware so make it a child of the macio-oldworld device. This also removes the need for setting and checking a separate PIC object property link on the macio-oldworld device which currently causes the automated QOM introspection tests to fail. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20201229175619.6051-4-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-01-13mac_oldworld: move initialisation of grackle before heathrowMark Cave-Ayland
In order to move the heathrow PIC to the macio device, the PCI bus needs to be initialised before the macio device and also before wiring the PIC IRQs. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20201229175619.6051-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-01-13mac_oldworld: remove duplicate bus check for PPC_INPUT(env)Mark Cave-Ayland
This condition will have already been caught when wiring the heathrow PIC IRQs to the CPU. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20201229175619.6051-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-01-12Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into ↵Peter Maydell
staging * UI configury cleanups and Meson conversion * scripts/gdb improvements * WHPX cleanups and fixes * cirrus win32 CI improvements * meson gnutls workaround # gpg: Signature made Tue 12 Jan 2021 16:05:19 GMT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini-gitlab/tags/for-upstream: target/i386: Use X86Seg enum for segment registers configure: quote command line arguments in config.status configure: move Cocoa incompatibility checks to Meson configure: move GTK+ detection to Meson configure: move X11 detection to Meson gtk: remove CONFIG_GTK_GL cocoa: do not enable coreaudio automatically virtio-scsi: trace events meson: Propagate gnutls dependency Docs/RCU: Correct sample code of qatomic_rcu_set scripts/gdb: implement 'qemu bt' scripts/gdb: fix 'qemu coroutine' when users selects a non topmost stack frame meson: fix Cocoa option in summary whpx: move whpx_lapic_state from header to c file maintainers: Add me as Windows Hosted Continuous Integration maintainer cirrus/msys2: Cache msys2 mingw in a better way. cirrus/msys2: Exit powershell with $LastExitCode whpx: move internal definitions to whpx-internal.h whpx: rename whp-dispatch to whpx-internal.h meson: do not use CONFIG_VIRTFS Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-01-12hw/*: Use type casting for SysBusDevice in NPCM7XXHao Wu
A device shouldn't access its parent object which is QOM internal. Instead it should use type cast for this purporse. This patch fixes this issue for all NPCM7XX Devices. Signed-off-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210108190945.949196-7-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-01-12hw/misc: Add a PWM module for NPCM7XXHao Wu
The PWM module is part of NPCM7XX module. Each NPCM7XX module has two identical PWM modules. Each module contains 4 PWM entries. Each PWM has two outputs: frequency and duty_cycle. Both are computed using inputs from software side. This module does not model detail pulse signals since it is expensive. It also does not model interrupts and watchdogs that are dependant on the detail models. The interfaces for these are left in the module so that anyone in need for these functionalities can implement on their own. The user can read the duty cycle and frequency using qom-get command. Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com> Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Signed-off-by: Hao Wu <wuhaotsh@google.com> Message-id: 20210108190945.949196-5-wuhaotsh@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-01 16:06:39 +0000