aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2023-06-13hw/riscv: qemu crash when NUMA nodes exceed available CPUsYin Wang
Command "qemu-system-riscv64 -machine virt -m 2G -smp 1 -numa node,mem=1G -numa node,mem=1G" would trigger this problem.Backtrace with: #0 0x0000555555b5b1a4 in riscv_numa_get_default_cpu_node_id at ../hw/riscv/numa.c:211 #1 0x00005555558ce510 in machine_numa_finish_cpu_init at ../hw/core/machine.c:1230 #2 0x00005555558ce9d3 in machine_run_board_init at ../hw/core/machine.c:1346 #3 0x0000555555aaedc3 in qemu_init_board at ../softmmu/vl.c:2513 #4 0x0000555555aaf064 in qmp_x_exit_preconfig at ../softmmu/vl.c:2609 #5 0x0000555555ab1916 in qemu_init at ../softmmu/vl.c:3617 #6 0x000055555585463b in main at ../softmmu/main.c:47 This commit fixes the issue by adding parameter checks. Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn> Signed-off-by: Yin Wang <yin.wang@intel.com> Message-Id: <20230519023758.1759434-1-yin.wang@intel.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2023-06-13hw/riscv/opentitan: Correct OpenTitanState parent type/sizePhilippe Mathieu-Daudé
OpenTitanState is the 'machine' (or 'board') state: it isn't a SysBus device, but inherits from the MachineState type. Correct the instance size. Doing so we avoid leaking an OpenTitanState pointer in opentitan_machine_init(). Fixes: fe0fe4735e ("riscv: Initial commit of OpenTitan machine") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-Id: <20230520054510.68822-6-philmd@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2023-06-13hw/riscv/opentitan: Explicit machine type definitionPhilippe Mathieu-Daudé
Expand the DEFINE_MACHINE() macro, converting the class_init() handler. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-Id: <20230520054510.68822-5-philmd@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2023-06-13hw/riscv/opentitan: Add TYPE_OPENTITAN_MACHINE definitionPhilippe Mathieu-Daudé
QOM type names are usually defined as TYPE_FOO. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-Id: <20230520054510.68822-4-philmd@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2023-06-13hw/riscv/opentitan: Declare QOM types using DEFINE_TYPES() macroPhilippe Mathieu-Daudé
When multiple QOM types are registered in the same file, it is simpler to use the the DEFINE_TYPES() macro. Replace the type_init() / type_register_static() combination. This is in preparation of adding the OpenTitan machine type to this array in a pair of commits. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-Id: <20230520054510.68822-3-philmd@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2023-06-13hw/riscv/opentitan: Rename machine_[class]_init() functionsPhilippe Mathieu-Daudé
Follow QOM style which declares FOO_init() as instance initializer and FOO_class_init() as class initializer: rename the OpenTitan machine class/instance init() accordingly. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-Id: <20230520054510.68822-2-philmd@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2023-06-10Merge tag 'pull-ppc-20230610' of https://gitlab.com/danielhb/qemu into stagingRichard Henderson
ppc patch queue for 2023-06-10: This queue includes several assorted fixes for target/ppc emulation and XIVE2. It also includes an openpic fix, an avocado fix for ppc64 binaries without slipr and a Kconfig change for MAC_NEWWORLD. # -----BEGIN PGP SIGNATURE----- # # iIwEABYKADQWIQQX6/+ZI9AYAK8oOBk82cqW3gMxZAUCZIR6uhYcZGFuaWVsaGI0 # MTNAZ21haWwuY29tAAoJEDzZypbeAzFksQsA/jucd+qsZ9mmJ9SYVd4umMnC/4bC # i4CHo/XcHb0DzyBXAQCLxMA+KSTkP+yKv3edra4I5K9qjTW1H+pEOWamh1lvDw== # =EezE # -----END PGP SIGNATURE----- # gpg: Signature made Sat 10 Jun 2023 06:29:30 AM PDT # gpg: using EDDSA key 17EBFF9923D01800AF2838193CD9CA96DE033164 # gpg: issuer "danielhb413@gmail.com" # gpg: Good signature from "Daniel Henrique Barboza <danielhb413@gmail.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 17EB FF99 23D0 1800 AF28 3819 3CD9 CA96 DE03 3164 * tag 'pull-ppc-20230610' of https://gitlab.com/danielhb/qemu: (29 commits) hw/ppc/Kconfig: MAC_NEWWORLD should always select USB_OHCI_PCI target/ppc: Implement gathering irq statistics tests/avocado/tuxrun_baselines: Fix ppc64 tests for binaries without slirp hw/ppc/openpic: Do not open-code ROUND_UP() macro target/ppc: Decrementer fix BookE semantics target/ppc: Fix decrementer time underflow and infinite timer loop target/ppc: Rework store conditional to avoid branch target/ppc: Remove larx/stcx. memory barrier semantics target/ppc: Ensure stcx size matches larx target/ppc: Fix lqarx to set cpu_reserve target/ppc: Eliminate goto in mmubooke_check_tlb() target/ppc: Change ppcemb_tlb_check() to return bool target/ppc: Simplify ppcemb_tlb_search() target/ppc: Remove some unneded line breaks target/ppc: Move ppcemb_tlb_search() to mmu_common.c target/ppc: Remove "ext" parameter of ppcemb_tlb_check() target/ppc: Remove single use function target/ppc: PMU implement PERFM interrupts target/ppc: Support directed privileged doorbell interrupt (SDOOR) target/ppc: Fix msgclrp interrupt type ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-06-10hw/ppc/Kconfig: MAC_NEWWORLD should always select USB_OHCI_PCIThomas Huth
The PowerMacs have an OHCI controller soldered on the motherboard, so this should always be enabled for the "mac99" machine. This fixes the problem that QEMU aborts when the user tries to run the "mac99" machine with a build that has been compiled with the "--without-default-devices" configure switch. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20230530102041.55527-1-thuth@redhat.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-06-10target/ppc: Decrementer fix BookE semanticsNicholas Piggin
The decrementer store function has logic that short-cuts the timer if a very small value is stored (0, 1, or 2) and raises an interrupt directly. There are two problem with this on BookE. First is that BookE says a decrementer interrupt should not be raised on a store of 0, only of a decrement from 1. Second is that raising the irq directly will bypass the auto-reload logic in the booke decr timer function, breaking autoreload when 1 or 2 is stored. Fix this by removing that small-value special case. It makes this tricky logic even more difficult to reason about, and it hardly matters for performance. Cc: sdicaro@DDCI.com Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20230530131214.373524-2-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-06-10target/ppc: Fix decrementer time underflow and infinite timer loopNicholas Piggin
It is possible to store a very large value to the decrementer that it does not raise the decrementer exception so the timer is scheduled, but the next time value wraps and is treated as in the past. This can occur if (u64)-1 is stored on a zero-triggered exception, or (u64)-1 is stored twice on an underflow-triggered exception, for example. If such a value is set in DECAR, it gets stored to the decrementer by the timer function, which then immediately causes another timer, which hangs QEMU. Clamp the decrementer to the implemented width, and use that as the value for the timer calculation, effectively preventing this overflow. Reported-by: sdicaro@DDCI.com Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20230530131214.373524-1-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-06-10pnv/xive2: Quiet down some error messagesFrederic Barrat
When dumping the END and NVP tables ("info pic" from the HMP) on the P10 model, we're likely to be flooded with error messages such as: XIVE[0] - VST: invalid NVPT entry f33800 !? The error is printed when finding an empty VSD in an indirect table (thus END and NVP tables with skiboot), which is going to happen when dumping the xive state. So let's tune down those messages. They can be re-enabled easily with a macro if needed. Those errors were already hidden on xive/P9, for the same reason. Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20230531150537.369350-1-fbarrat@linux.ibm.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-06-10pnv/xive2: Handle TIMA access through all portsFrederic Barrat
The Thread Interrupt Management Area (TIMA) can be accessed through 4 ports, targeted by the address. The base address of a TIMA is using port 0 and the other ports are 0x80 apart. Using one port or another can be useful to balance the load on the snoop buses. With skiboot and linux, we currently use port 0, but as it tends to be busy, another hypervisor is using port 1 for TIMA access. The port address bits fall in between the special op indication bits (the 2 MSBs) and the register offset bits (the 6 LSBs). They are "don't care" for the hardware when processing a TIMA operation. This patch filters out those port address bits so that a TIMA operation can be triggered using any port. It is also true for indirect access (through the IC BAR) and it's actually nothing new, it was already the case on P9. Which helps here, as the TIMA handling code is common between P9 (xive) and P10 (xive2). Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20230601121331.487207-6-fbarrat@linux.ibm.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-06-10pnv/xive2: Introduce macros to manipulate TIMA addressesFrederic Barrat
TIMA addresses are somewhat special and are split in several bit fields with different meanings. This patch describes it and introduce macros to more easily access the various fields. Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20230601121331.487207-5-fbarrat@linux.ibm.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-06-10pnv/xive2: Allow writes to the Physical Thread Enable registersFrederic Barrat
Fix what was probably a silly mistake and allow to write the Physical Thread enable registers 0 and 1. Skiboot prefers to use the ENx_SET variant so it went unnoticed, but there's no reason to discard a write to the full register, it is Read-Write. Fixes: da71b7e3ed45 ("ppc/pnv: Add a XIVE2 controller to the POWER10 chip") Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20230601121331.487207-4-fbarrat@linux.ibm.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-06-10pnv/xive2: Add definition for the ESB cache configuration registerFrederic Barrat
Add basic read/write support for the ESB cache configuration register on P10. We don't model the ESB cache in qemu so reading/writing the register won't do anything, but it avoids logging a guest error when skiboot configures it: qemu-system-ppc64 -machine powernv10 ... -d guest_errors ... XIVE[0] - VC: invalid read @240 XIVE[0] - VC: invalid write @240 Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20230601121331.487207-3-fbarrat@linux.ibm.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-06-10pnv/xive2: Add definition for TCTXT Config registerFrederic Barrat
Add basic read/write support for the TCTXT Config register on P10. qemu doesn't do anything with it yet, but it avoids logging a guest error when skiboot configures the fused-core state: qemu-system-ppc64 -machine powernv10 ... -d guest_errors ... [ 0.131670000,5] XIVE: [ IC 00 ] Initializing XIVE block ID 0... XIVE[0] - TCTXT: invalid read @140 XIVE[0] - TCTXT: invalid write @140 Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20230601121331.487207-2-fbarrat@linux.ibm.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-06-09hw/usb/hcd-ehci-pci: Simplify using DEVICE_GET_CLASS() macroPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-06-09hw/pci/pci: Simplify pci_bar_address() using MACHINE_GET_CLASS() macroPhilippe Mathieu-Daudé
Remove unnecessary intermediate variables. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-06-09hw/i386/microvm: Simplify using object_dynamic_cast()Philippe Mathieu-Daudé
Use object_dynamic_cast() to determine if 'dev' is a TYPE_VIRTIO_MMIO. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Sergio Lopez <slp@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-06-09hw/core/cpu: Simplify realize() using MACHINE_GET_CLASS() macroPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-06-09hw/remote: Fix vfu_cfg trace offset formatMattias Nissler
The printed offset value is prefixed with 0x, but was actually printed in decimal. To spare others the confusion, adjust the format specifier to hexadecimal. Signed-off-by: Mattias Nissler <mnissler@rivosinc.com> Reviewed-by: Jagannathan Raman <jag.raman@oracle.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-06-09hw/virtio/virtio-qmp.c: spelling: suppotedMichael Tokarev
Fixes: f3034ad71fcd0a6a58bc37830f182b307f089159 Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Stefan Weil <sw@weilnetz.de>
2023-06-089pfs: prevent opening special files (CVE-2023-2861)Christian Schoenebeck
The 9p protocol does not specifically define how server shall behave when client tries to open a special file, however from security POV it does make sense for 9p server to prohibit opening any special file on host side in general. A sane Linux 9p client for instance would never attempt to open a special file on host side, it would always handle those exclusively on its guest side. A malicious client however could potentially escape from the exported 9p tree by creating and opening a device file on host side. With QEMU this could only be exploited in the following unsafe setups: - Running QEMU binary as root AND 9p 'local' fs driver AND 'passthrough' security model. or - Using 9p 'proxy' fs driver (which is running its helper daemon as root). These setups were already discouraged for safety reasons before, however for obvious reasons we are now tightening behaviour on this. Fixes: CVE-2023-2861 Reported-by: Yanwu Shen <ywsPlz@gmail.com> Reported-by: Jietao Xiao <shawtao1125@gmail.com> Reported-by: Jinku Li <jkli@xidian.edu.cn> Reported-by: Wenbo Shen <shenwenbo@zju.edu.cn> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Message-Id: <E1q6w7r-0000Q0-NM@lizzy.crudebyte.com>
2023-06-07Merge tag 'pull-xen-20230607' of ↵Richard Henderson
https://xenbits.xen.org/git-http/people/aperard/qemu-dm into staging Xen queue - fix for xen-block segv - Resolve TYPE_PIIX3_XEN_DEVICE - Xen emulation build/Coverity fixes # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEE+AwAYwjiLP2KkueYDPVXL9f7Va8FAmSAkU0ACgkQDPVXL9f7 # Va/mMQf9Hs8pFGz7qRMc8RbuBvwVNGcdqOKZN+sbBKPb2pp9X8gkP5EV5SMLF/eu # CjaoZU+SsZcVLZ0HZ/TevAEuMrflZeeRfneJzEcl58cwOxo5l18puRwy9iDxfh6m # goqGGxQA2OmUa5eVZ7WX2JXo0wG/RQqqc/pChKbPAsTT9/QE23irOQBdUDf7sbGP # WFI/LoLR0c6NNbQyZNWSP0e/+es8ztq+Is7Bl6d1fdG/6YeXK2yVaro1gyMmxKAm # EKuvI9qva2ilV5RJEc/gB/x4PuIVCPizkrbB8XClQ81Szo49x55ChPdnpT5i7Sqd # qjFWO2plgV/gXri1/RTCzyBujeuCOA== # =E1Qb # -----END PGP SIGNATURE----- # gpg: Signature made Wed 07 Jun 2023 07:16:45 AM PDT # gpg: using RSA key F80C006308E22CFD8A92E7980CF5572FD7FB55AF # gpg: Good signature from "Anthony PERARD <anthony.perard@gmail.com>" [unknown] # gpg: aka "Anthony PERARD <anthony.perard@citrix.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 5379 2F71 024C 600F 778A 7161 D8D5 7199 DF83 42C8 # Subkey fingerprint: F80C 0063 08E2 2CFD 8A92 E798 0CF5 572F D7FB 55AF * tag 'pull-xen-20230607' of https://xenbits.xen.org/git-http/people/aperard/qemu-dm: xen-block: fix segv on unrealize hw/isa/piix3: Resolve redundant TYPE_PIIX3_XEN_DEVICE hw/isa/piix3: Resolve redundant k->config_write assignments hw/isa/piix3: Avoid Xen-specific variant of piix3_write_config() hw/isa/piix3: Wire up Xen PCI IRQ handling outside of PIIX3 hw/isa/piix3: Reuse piix3_realize() in piix3_xen_realize() hw/pci/pci.c: Don't leak PCIBus::irq_count[] in pci_bus_irqs() include/hw/xen/xen: Rename xen_piix3_set_irq() to xen_intx_set_irq() hw/xen: Fix broken check for invalid state in xs_be_open() xen: Drop support for Xen versions below 4.7.1 hw/xen: Fix memory leak in libxenstore_open() for Xen hw/xen: Simplify emulated Xen platform init Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-06-07vfio-user: update commentsJagannathan Raman
Clarify the behavior of TYPE_VFU_OBJECT when TYPE_REMOTE_MACHINE enables the auto-shutdown property. Also, add notes to VFU_OBJECT_ERROR. Signed-off-by: Jagannathan Raman <jag.raman@oracle.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-06-07xen-block: fix segv on unrealizeAnthony PERARD
Backtrace: qemu_lockcnt_lock (lockcnt=0xb4) at ../util/lockcnt.c:238 aio_set_fd_handler (ctx=0x0, fd=51, is_external=true, io_read=0x0, io_write=0x0, io_poll=0x0, io_poll_ready=0x0, opaque=0x0) at ../util/aio-posix.c:119 xen_device_unbind_event_channel (xendev=0x55c6da5b5000, channel=0x55c6da6c4c80, errp=0x7fff641ac608) at ../hw/xen/xen-bus.c:926 xen_block_dataplane_stop (dataplane=0x55c6da6ddbe0) at ../hw/block/dataplane/xen-block.c:719 xen_block_disconnect (xendev=0x55c6da5b5000, errp=0x0) at ../hw/block/xen-block.c:48 xen_block_unrealize (xendev=0x55c6da5b5000) at ../hw/block/xen-block.c:154 xen_device_unrealize (dev=0x55c6da5b5000) at ../hw/xen/xen-bus.c:956 xen_device_exit (n=0x55c6da5b50d0, data=0x0) at ../hw/xen/xen-bus.c:985 notifier_list_notify (list=0x55c6d91f9820 <exit_notifiers>, data=0x0) at ../util/notify.c:39 qemu_run_exit_notifiers () at ../softmmu/runstate.c:760 Fixes: f6eac904f682 ("xen-block: implement BlockDevOps->drained_begin()") Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20230606131605.55596-1-anthony.perard@citrix.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2023-06-07hw/isa/piix3: Resolve redundant TYPE_PIIX3_XEN_DEVICEBernhard Beschow
During the last patches, TYPE_PIIX3_XEN_DEVICE turned into a clone of TYPE_PIIX3_DEVICE. Remove this redundancy. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Tested-by: Chuck Zmudzinski <brchuckz@aol.com> Message-Id: <20230312120221.99183-7-shentey@gmail.com> Message-Id: <20230403074124.3925-8-shentey@gmail.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2023-06-07hw/isa/piix3: Resolve redundant k->config_write assignmentsBernhard Beschow
The previous patch unified handling of piix3_write_config() accross the PIIX3 device models which allows for assigning k->config_write once in the base class. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Tested-by: Chuck Zmudzinski <brchuckz@aol.com> Message-Id: <20230312120221.99183-6-shentey@gmail.com> Message-Id: <20230403074124.3925-7-shentey@gmail.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2023-06-07hw/isa/piix3: Avoid Xen-specific variant of piix3_write_config()Bernhard Beschow
Subscribe to pci_bus_fire_intx_routing_notifier() instead which allows for having a common piix3_write_config() for the PIIX3 device models. While at it, move the subscription into machine code to facilitate resolving TYPE_PIIX3_XEN_DEVICE. In a possible future followup, pci_bus_fire_intx_routing_notifier() could be adjusted in such a way that subscribing to it doesn't require knowledge of the device firing it. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Tested-by: Chuck Zmudzinski <brchuckz@aol.com> Message-Id: <20230312120221.99183-5-shentey@gmail.com> Message-Id: <20230403074124.3925-6-shentey@gmail.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2023-06-07hw/isa/piix3: Wire up Xen PCI IRQ handling outside of PIIX3Bernhard Beschow
xen_intx_set_irq() doesn't depend on PIIX3State. In order to resolve TYPE_PIIX3_XEN_DEVICE and in order to make Xen agnostic about the precise south bridge being used, set up Xen's PCI IRQ handling of PIIX3 in the board. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Tested-by: Chuck Zmudzinski <brchuckz@aol.com> Message-Id: <20230312120221.99183-4-shentey@gmail.com> Message-Id: <20230403074124.3925-5-shentey@gmail.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2023-06-07hw/isa/piix3: Reuse piix3_realize() in piix3_xen_realize()Bernhard Beschow
This is a preparational patch for the next one to make the following more obvious: First, pci_bus_irqs() is now called twice in case of Xen where the second call overrides the pci_set_irq_fn with the Xen variant. Second, pci_bus_set_route_irq_fn() is now also called in Xen mode. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Tested-by: Chuck Zmudzinski <brchuckz@aol.com> Message-Id: <20230312120221.99183-3-shentey@gmail.com> Message-Id: <20230403074124.3925-4-shentey@gmail.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2023-06-07hw/pci/pci.c: Don't leak PCIBus::irq_count[] in pci_bus_irqs()Bernhard Beschow
When calling pci_bus_irqs() multiple times on the same object without calling pci_bus_irqs_cleanup() in between PCIBus::irq_count[] is currently leaked. Let's fix this because Xen will do just that in a few commits, and because calling pci_bus_irqs_cleanup() in between seems fragile and cumbersome. Note that pci_bus_irqs_cleanup() now has to NULL irq_count such that pci_bus_irqs() doesn't do a double free. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Chuck Zmudzinski <brchuckz@aol.com> Message-Id: <20230403074124.3925-3-shentey@gmail.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2023-06-07include/hw/xen/xen: Rename xen_piix3_set_irq() to xen_intx_set_irq()Bernhard Beschow
xen_piix3_set_irq() isn't PIIX specific: PIIX is a single PCI device while xen_piix3_set_irq() maps multiple PCI devices to their respective IRQs, which is board-specific. Rename xen_piix3_set_irq() to communicate this. Also rename XEN_PIIX_NUM_PIRQS to XEN_IOAPIC_NUM_PIRQS since the Xen's IOAPIC rather than PIIX has this many interrupt routes. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Tested-by: Chuck Zmudzinski <brchuckz@aol.com> Message-Id: <20230312120221.99183-2-shentey@gmail.com> Message-Id: <20230403074124.3925-2-shentey@gmail.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2023-06-07hw/xen: Fix broken check for invalid state in xs_be_open()David Woodhouse
Coverity points out that if (!s && !s->impl) isn't really what we intended to do here. CID 1508131. Fixes: 032475127225 ("hw/xen: Add emulated implementation of XenStore operations") Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Paul Durrant <paul@xen.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20230412185102.441523-6-dwmw2@infradead.org> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2023-06-07xen: Drop support for Xen versions below 4.7.1David Woodhouse
In restructuring to allow for internal emulation of Xen functionality, I broke compatibility for Xen 4.6 and earlier. Fix this by explicitly removing support for anything older than 4.7.1, which is also ancient but it does still build, and the compatibility support for it is fairly unintrusive. Fixes: 15e283c5b684 ("hw/xen: Add foreignmem operations to allow redirection to internal emulation") Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20230412185102.441523-4-dwmw2@infradead.org> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2023-06-07hw/xen: Fix memory leak in libxenstore_open() for XenDavid Woodhouse
There was a superfluous allocation of the XS handle, leading to it being leaked on both the error path and the success path (where it gets allocated again). Spotted by Coverity (CID 1508098). Fixes: ba2a92db1ff6 ("hw/xen: Add xenstore operations to allow redirection to internal emulation") Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20230412185102.441523-3-dwmw2@infradead.org> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2023-06-07hw/xen: Simplify emulated Xen platform initDavid Woodhouse
I initially put the basic platform init (overlay pages, grant tables, event channels) into mc->kvm_type because that was the earliest place that could sensibly test for xen_mode==XEN_EMULATE. The intent was to do this early enough that we could then initialise the XenBus and other parts which would have depended on them, from a generic location for both Xen and KVM/Xen in the PC-specific code, as seen in https://lore.kernel.org/qemu-devel/20230116221919.1124201-16-dwmw2@infradead.org/ However, then the Xen on Arm patches came along, and *they* wanted to do the XenBus init from a 'generic' Xen-specific location instead: https://lore.kernel.org/qemu-devel/20230210222729.957168-4-sstabellini@kernel.org/ Since there's no generic location that covers all three, I conceded to do it for XEN_EMULATE mode in pc_basic_devices_init(). And now there's absolutely no point in having some of the platform init done from pc_machine_kvm_type(); we can move it all up to live in a single place in pc_basic_devices_init(). This has the added benefit that we can drop the separate xen_evtchn_connect_gsis() function completely, and pass just the system GSIs in directly to xen_evtchn_create(). While I'm at it, it does no harm to explicitly pass in the *number* of said GSIs, because it does make me twitch a bit to pass an array of impicit size. During the lifetime of the KVM/Xen patchset, that had already changed (albeit just cosmetically) from GSI_NUM_PINS to IOAPIC_NUM_PINS. And document a bit better that this is for the *output* GSI for raising CPU0's events when the per-CPU vector isn't available. The fact that we create a whole set of them and then only waggle the one we're told to, instead of having a single output and only *connecting* it to the GSI that it should be connected to, is still non-intuitive for me. Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20230412185102.441523-2-dwmw2@infradead.org> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2023-06-06Merge tag 'pull-target-arm-20230606' of ↵Richard Henderson
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * Support gdbstub (guest debug) in HVF * xnlx-versal: Support CANFD controller * bpim2u: New board model: Banana Pi BPI-M2 Ultra * Emulate FEAT_LSE2 * allow DC CVA[D]P in user mode emulation * trap DCC access in user mode emulation # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmR/AKUZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3jzIEACNepQGY44yPhrEG+wD4WAB # fH670KI33HcsFd2rGsC369gcssQbRIW/29reOzNhRMuol+kHI6OFaONpuKSdO0Rz # TLVIsnT2Uq8KwbYfLtDQt5knj027amPy75d4re8wIK1eZB4dOIHysqAvQrJYeync # 9obKku8xXGLwZh/mYHoVgHcZU0cPJO9nri39n1tV3JUBsgmqEURjzbZrMcF+yMX7 # bUzOYQvC1Iedmo+aWfx43u82AlNQFz1lsqmnQj7Z5rvv0HT+BRF5WzVMP0qRh5+Z # njkqmBH9xb9kkgeHmeMvHpWox+J+obeSmVg/4gDNlJpThmpuU0Vr7EXUN3MBQlV9 # lhyy6zrTwC/BToiQqdT2dnpao9FzXy5exfnqi/py5IuqfjAzSO+p61LlPPZ4cJri # pCK4yq2gzQXYfrlZkUJipvRMH8Xa4IdQx+w7lXrQoJdduF4/+6aJW/GAWSu0e7eC # zgBwaJjI7ENce8ixJnuEFUxUnaBo8dl72a0PGA1UU8PL+cJNOIpyhPk4goWQprdn # iFF4ZnjhBRZ2gk/4HGD9u5Vo2lNqP93YS5QhkGkF+HJsBmcOZgidIUpfHhPQvvHO # Np196T2cAETCWGV1xG4CaTpxN2ndRReq3C0/mzfhIbwhXEACtvAiSlO4KB8t6pJj # MzinCABXHcovJbGbxZ9j6w== # =8SdN # -----END PGP SIGNATURE----- # gpg: Signature made Tue 06 Jun 2023 02:47:17 AM PDT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] * tag 'pull-target-arm-20230606' of https://git.linaro.org/people/pmaydell/qemu-arm: (42 commits) target/arm: trap DCC access in user mode emulation tests/tcg/aarch64: add DC CVA[D]P tests target/arm: allow DC CVA[D]P in user mode emulation target/arm: Enable FEAT_LSE2 for -cpu max tests/tcg/multiarch: Adjust sigbus.c tests/tcg/aarch64: Use stz2g in mte-7.c target/arm: Move mte check for store-exclusive target/arm: Relax ordered/atomic alignment checks for LSE2 target/arm: Add SCTLR.nAA to TBFLAG_A64 target/arm: Check alignment in helper_mte_check target/arm: Pass single_memop to gen_mte_checkN target/arm: Pass memop to gen_mte_check1* target/arm: Hoist finalize_memop out of do_fp_{ld, st} target/arm: Hoist finalize_memop out of do_gpr_{ld, st} target/arm: Load/store integer pair with one tcg operation target/arm: Sink gen_mte_check1 into load/store_exclusive target/arm: Use tcg_gen_qemu_{ld, st}_i128 in gen_sve_{ld, st}r target/arm: Use tcg_gen_qemu_st_i128 for STZG, STZ2G target/arm: Use tcg_gen_qemu_{st, ld}_i128 for do_fp_{st, ld} target/arm: Use tcg_gen_qemu_ld_i128 for LDXP ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-06-06Merge tag 'pull-request-2023-06-06' of https://gitlab.com/thuth/qemu into ↵Richard Henderson
staging * Fix emulated LCCB, LOCFHR, MXDB and MXDBR s390x instructions * Fix the malta machine on s390x (big endian) hosts * Emulate /proc/cpuinfo on s390x * Remove pointless QOM casts * Improve the inclusion logic for libkeyutils and ipmi-bt-test in meson.build # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmR+ycgRHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbWXXw//WPz3ng50KLS+M1t3/ULEjO6XkGfP2LQZ # RsZq3hf9THFPZgcREk+6SQvttOSTuvHNfakfujS6U1Ou5thReWqLe4itFW6+hB5j # kQ+Sm6YJ+fpezkBnSefcUoL5nA9VVKZ6KE6kxq5CUBZNoIk1sSsfrU8y8wjzW0yg # 2nraOcG10aLpO2BfvKHVEAhJtwl9pHJsFANmHC2/h2wC9BZIAzdxiytzdcJ909gN # AAa0hIrLK/oFgJjkSSxu+QTaVGPARXqkx5WV546F/zmDMFUWd9nrXaegwqxjgPBN # m9Ua0SXll5hX2Z57vjJWlbTYkD+JUB22L0N7p5/xzhYRpLVSq1pdveo9psrzIC3E # Bt7chZB58acQepJHxxa3UHDOHcnfdfaN+Dd9wD29wHr7nK8lOcsen7/7V+5YXomc # qenkCtkpjKTl07OBxe6MDGZtPZYA8fK1CjEyYwHCe8QvxEzsyg96Bm3j4N2VPxQU # +f/sFPX7SgogZI4mB4wdoxOF1RmQ+DXQ2tnB970txZRkmFq2jJHpW86jkkbq2Jl1 # KIjgdIXjVgy+MPtuQzO5cT+jfhGQL7FQynGXHjv/UidBid5XD3TDVNa9AthN3Mng # +rPT90VJ7j9soMqvmNT1COSIRD+M49dQKBIQuq/gWplaTOHaAcJrCwYScwqe0u0P # zmjCNeuPVw8= # =dfJr # -----END PGP SIGNATURE----- # gpg: Signature made Mon 05 Jun 2023 10:53:12 PM PDT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [unknown] # gpg: aka "Thomas Huth <thuth@redhat.com>" [unknown] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2023-06-06' of https://gitlab.com/thuth/qemu: linux-user: Emulate /proc/cpuinfo on s390x linux-user/elfload: Introduce elf_hwcap_str() on s390x linux-user/elfload: Expose get_elf_hwcap() on s390x s390x/tcg: Fix CPU address returned by STIDP bulk: Remove pointless QOM casts scripts: Add qom-cast-macro-clean-cocci-gen.py hw/mips/malta: Fix the malta machine on big endian hosts gitlab-ci: Remove unused Python package tests/qtest: Run ipmi-bt-test only if CONFIG_IPMI_EXTERN is set tests/tcg/s390x: Test MXDB and MXDBR target/s390x: Fix MXDB and MXDBR Add conditional dependency for libkeyutils tests/tcg/s390x: Test single-stepping SVC linux-user/s390x: Fix single-stepping SVC tests/tcg/s390x: Test LOCFHR target/s390x: Fix LOCFHR taking the wrong half of R2 tests/tcg/s390x: Test LCBB target/s390x: Fix LCBB overwriting the top 32 bits Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-06-06hw: arm: allwinner-sramc: Add SRAM Controller support for R40qianfan Zhao
Only a few important registers are added, especially the SRAM_VER register. Signed-off-by: qianfan Zhao <qianfanguijin@163.com> Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-06-06hw: arm: allwinner-r40: Add emac and gmac supportqianfan Zhao
R40 has two ethernet controllers named as emac and gmac. The emac is compatibled with A10, and the GMAC is compatibled with H3. Signed-off-by: qianfan Zhao <qianfanguijin@163.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-06-06hw: sd: allwinner-sdhost: Add sun50i-a64 SoC supportqianfan Zhao
A64's sd register was similar to H3, and it introduced a new register named SAMP_DL_REG location at 0x144. The dma descriptor buffer size of mmc2 is only 8K and the other mmc controllers has 64K. Also fix allwinner-r40's mmc controller type. Signed-off-by: qianfan Zhao <qianfanguijin@163.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-06-06hw/arm/allwinner-r40: add SDRAM controller deviceqianfan Zhao
Types of memory that the SDRAM controller supports are DDR2/DDR3 and capacities of up to 2GiB. This commit adds emulation support of the Allwinner R40 SDRAM controller. This driver only support 256M, 512M and 1024M memory now. Signed-off-by: qianfan Zhao <qianfanguijin@163.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-06-06hw/misc: Rename axp209 to axp22x and add support AXP221 PMUqianfan Zhao
This patch adds minimal support for AXP-221 PMU and connect it to bananapi M2U board. Signed-off-by: qianfan Zhao <qianfanguijin@163.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-06-06hw: arm: allwinner-r40: Add i2c0 deviceqianfan Zhao
TWI(i2c) is designed to be used as an interface between CPU host and the serial 2-Wire bus. It can support all standard 2-Wire transfer, can be operated in standard mode(100kbit/s) or fast-mode, supporting data rate up to 400kbit/s. Signed-off-by: qianfan Zhao <qianfanguijin@163.com> Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-06-06hw: allwinner-r40: Complete uart devicesqianfan Zhao
R40 has eight UARTs, support both 16450 and 16550 compatible modes. Signed-off-by: qianfan Zhao <qianfanguijin@163.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-06-06hw/arm/allwinner-r40: add Clock Control Unitqianfan Zhao
The CCU provides the registers to program the PLLs and the controls most of the clock generation, division, distribution, synchronization and gating. This commit adds support for the Clock Control Unit which emulates a simple read/write register interface. Signed-off-by: qianfan Zhao <qianfanguijin@163.com> Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-06-06hw: arm: Add bananapi M2-Ultra and allwinner-r40 supportqianfan Zhao
Allwinner R40 (sun8i) SoC features a Quad-Core Cortex-A7 ARM CPU, and a Mali400 MP2 GPU from ARM. It's also known as the Allwinner T3 for In-Car Entertainment usage, A40i and A40pro are variants that differ in applicable temperatures range (industrial and military). Signed-off-by: qianfan Zhao <qianfanguijin@163.com> Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-06-06xlnx-versal: Connect Xilinx VERSAL CANFD controllersVikram Garhwal
Connect CANFD0 and CANFD1 on the Versal-virt machine and update xlnx-versal-virt document with CANFD command line examples. Signed-off-by: Vikram Garhwal <vikram.garhwal@amd.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-06-06hw/net/can: Introduce Xilinx Versal CANFD controllerVikram Garhwal
The Xilinx Versal CANFD controller is developed based on SocketCAN, QEMU CAN bus implementation. Bus connection and socketCAN connection for each CAN module can be set through command lines. Signed-off-by: Vikram Garhwal <vikram.garhwal@amd.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-02-24 22:17:06 +0000