aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2018-06-18Revert "bus: do not unref the added child bus on realize"Marc-André Lureau
This is wrong. object_finalize_child_property()'s unref balances the ref in object_property_add_child(). qbus_realize's unref balances the ref that was initially placed by object_new/object_initialize. This reverts commit f3d58385a6d3d82f65db602c5506e2d3d8c82394. Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180613172815.32738-4-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-06-18Revert "usb: release the created buses"Marc-André Lureau
The USB device don't hold the bus. There is no ASAN related reports anymore. This reverts commit cd7bc87868d534f95e928cad98e2a52df7695771. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180613172815.32738-3-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-06-18Revert "usb-ccid: fix bus leak"Marc-André Lureau
The bus is not owned by the device. This reverts commit 410a096adf991ce437d4d7dabc59b6557e6d488d. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180613172815.32738-2-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-06-18spapr: fix xics_system_init() error pathGreg Kurz
Commit 3d85885a1b1f3 tried to fix error handling, but it actually went into the wrong direction by dropping the local Error *. In the default KVM case, the rationale is to try the in-kernel XICS first, and if not possible, to fallback to userland XICS. Passing errp everywhere makes this fallback impossible if errp is &error_fatal (which happens to be the case). And anyway, if the caller would pass a regular &local_err, things would be worse: we could possibly pass an already set *errp to error_setg() and crash, or return an error even in case of success. So we definitely need a local Error * and only propagate it when we're done with the fallback logic. This is what this patch does. Signed-off-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-17hw/sparc/sun4m: Fix problems with device introspectionThomas Huth
Several devices of the sun4m machines are using &error_fatal in their instance_init function and thus can cause QEMU to abort unexpectedly: $ echo "{'execute':'qmp_capabilities'}"\ "{'execute':'device-list-properties',"\ " 'arguments':{'typename':'openprom'}}" \ | sparc-softmmu/qemu-system-sparc -M SS-10 -S -qmp stdio {"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2}, "package": "build-all"}, "capabilities": []}} {"return": {}} RAMBlock "sun4m.prom" already registered, abort! Aborted (core dumped) $ echo "{'execute':'qmp_capabilities'}"\ "{'execute':'device-list-properties',"\ " 'arguments':{'typename':'macio_idreg'}}" \ | sparc-softmmu/qemu-system-sparc -M SS-10 -S -qmp stdio {"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2}, "package": "build-all"}, "capabilities": []}} {"return": {}} RAMBlock "sun4m.idreg" already registered, abort! Aborted (core dumped) $ echo "{'execute':'qmp_capabilities'}"\ "{'execute':'device-list-properties',"\ " 'arguments':{'typename':'tcx_afx'}}" \ | sparc-softmmu/qemu-system-sparc -M SS-5 -S -qmp stdio {"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2}, "package": "build-all"}, "capabilities": []}} {"return": {}} RAMBlock "sun4m.afx" already registered, abort! Aborted (core dumped) Fix the issues by converting the instance_init functions into realize() functions instead, which are allowed to fail (and not called during device introspection). Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2018-06-17hw/sparc64/sun4u: Fix introspection by converting prom instance_init to realizeThomas Huth
The instance_init function of devices should always succeed to be able to introspect the device. However, the instance_init function of the "openprom" device can currently fail, for example like this: $ echo "{'execute':'qmp_capabilities'}"\ "{'execute':'device-list-properties',"\ " 'arguments':{'typename':'openprom'}}" \ | sparc64-softmmu/qemu-system-sparc64 -M sun4v,accel=qtest -qmp stdio {"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2}, "package": "build-all"}, "capabilities": []}} {"return": {}} RAMBlock "sun4u.prom" already registered, abort! Aborted (core dumped) This should not happen. Fix this problem by moving the affected code from instance_init into a realize function instead. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2018-06-16hw/isa/smc37c669: Change the parallel I/O base to 378HPhilippe Mathieu-Daudé
On the Alpha DP264 machine, the Cirrus VGA is I/O mapped in the 3C0H-3CFH range, thus I/O base used by the parallel device clashes, and since a4cb773928e the VGA is not working: (qemu) info mtree address-space: memory 0000000000000000-ffffffffffffffff (prio 0, i/o): system 00000801fc000000-00000801fdffffff (prio 0, i/o): pci0-io ... 00000801fc0003b4-00000801fc0003b5 (prio 0, i/o): vga 00000801fc0003ba-00000801fc0003ba (prio 0, i/o): vga 00000801fc0003bc-00000801fc0003c3 (prio 0, i/o): parallel ^^^ ^^^^^^^^ 00000801fc0003c0-00000801fc0003cf (prio 0, i/o): vga ^^^ 00000801fc0003d4-00000801fc0003d5 (prio 0, i/o): vga 00000801fc0003da-00000801fc0003da (prio 0, i/o): vga ... As there is no particular reason to use this base address (introduced in 7bea0dd434e), change to 378H which is the default on PC machines. Reported-by: Emilio G. Cota <cota@braap.org> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20180614233935.26585-1-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2018-06-16target/ppc, spapr: Move VPA information to machine_dataDavid Gibson
CPUPPCState currently contains a number of fields containing the state of the VPA. The VPA is a PAPR specific concept covering several guest/host shared memory areas used to communicate some information with the hypervisor. As a PAPR concept this is really machine specific information, although it is per-cpu, so it doesn't really belong in the core CPU state structure. There's also other information that's per-cpu, but platform/machine specific. So create a (void *)machine_data in PowerPCCPU which can be used by the machine to locate per-cpu data. Intialization, lifetime and cleanup of machine_data is entirely up to the machine type. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Greg Kurz <groug@kaod.org> Tested-by: Greg Kurz <groug@kaod.org>
2018-06-16ppc/pnv: introduce a pnv_chip_core_realize() routineCédric Le Goater
This extracts from the PvChip realize routine the part creating the cores. On Power9, we will need to create the cores after the Xive interrupt controller is created. Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16spapr_cpu_core: introduce spapr_create_vcpu()Greg Kurz
This moves some code out from spapr_cpu_core_realize() for clarity. No functional change. Signed-off-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16spapr_cpu_core: add missing rollback on realization pathGreg Kurz
The spapr_realize_vcpu() function doesn't rollback in case of error. This isn't a problem with coldplugged CPUs because the machine won't start and QEMU will exit. Hotplug is a different story though: the CPU thread is started under object_property_set_bool() and it assumes it can access the CPU object. If icp_create() fails, we return an error without unregistering the reset handler for this CPU, and we let the underlying QEMU thread for this CPU alive. Since spapr_cpu_core_realize() doesn't care to unrealize already realized CPUs either, but happily frees all of them anyway, the CPU thread crashes instantly: (qemu) device_add host-spapr-cpu-core,core-id=1,id=gku GKU: failing icp_create (cpu 0x11497fd0) ^^^^^^^^^^ Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffee3feaa0 (LWP 24725)] 0x00000000104c8374 in object_dynamic_cast_assert (obj=0x11497fd0, ^^^^^^^^^^^^^^ pointer to the CPU object 623 trace_object_dynamic_cast_assert(obj ? obj->class->type->name (gdb) p obj->class->type $1 = (Type) 0x0 (gdb) p * obj $2 = {class = 0x10ea9c10, free = 0x11244620, ^^^^^^^^^^ should be g_free (gdb) p g_free $3 = {<text variable, no debug info>} 0x7ffff282bef0 <g_free> obj is a dangling pointer to the CPU that was just destroyed in spapr_cpu_core_realize(). This patch adds proper rollback to both spapr_realize_vcpu() and spapr_cpu_core_realize(). Signed-off-by: Greg Kurz <groug@kaod.org> [dwg: Fixed a conflict due to a change in my tree] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16spapr_cpu_core: fix potential leak in spapr_cpu_core_realize()Greg Kurz
Commit 94ad93bd97684 (QEMU 2.12) switched to instantiate CPUs separately but it missed to adapt the error path accordingly. If something fails in the CPU creation loop, then the CPU object that was just created is leaked. The error paths in this function are a bit obfuscated, and adding yet another label to free this CPU object makes it worse. We should move the block of the loop to a separate function, with a proper rollback path, but this is a bigger cleanup. For now, let's just fix the bug by adding the missing calls to object_unref(). This will allow easier backport to older QEMU versions. Signed-off-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16spapr_cpu_core: convert last snprintf() to g_strdup_printf()Greg Kurz
Because this is the preferred practice in QEMU. Signed-off-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16pnv: Add cpu unrealize pathDavid Gibson
Currently we don't have any unrealize path for pnv cpu cores. We get away with this because we don't yet support cpu hotplug for pnv. However, we're going to want it eventually, and in the meantime, it makes it non-obvious why there are a bunch of allocations on the realize() path that don't have matching frees. So, implement the missing unrealize path. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org>
2018-06-16pnv: Clean up cpu realize pathDavid Gibson
pnv_cpu_init() is only called from the the pnv cpu core realize path, and really only can be called from there. So fold it into its caller, which we also rename for brevity. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org>
2018-06-16pnv_core: Allocate cpu thread objects individuallyDavid Gibson
Currently, we allocate space for all the cpu objects within a single core in one big block. This was copied from an older version of the spapr code and requires some ugly pointer manipulation to extract the individual objects. This design was due to a misunderstanding of qemu lifetime conventions and has already been changed in spapr (in 94ad93bd "spapr_cpu_core: instantiate CPUs separately". Make an equivalent change in pnv_core to get rid of the nasty pointer arithmetic. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org>
2018-06-16pnv: Fix some error handling cpu realize()David Gibson
In pnv_core_realize() we call two functions with an Error * parameter in succession, which will go badly if they both cause errors. In fact, a failure in either of them indicates a qemu internal error, so we can just use &error_abort in both cases. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org>
2018-06-16spapr: Clean up cpu realize/unrealize pathsDavid Gibson
spapr_cpu_init() and spapr_cpu_destroy() are only called from the spapr cpu core realize/unrealize paths, and really can only be called from there. Those are all short functions, so fold the pairs together for simplicity. While we're there rename some functions and change some parameter types for brevity and clarity. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org>
2018-06-16sm501: Do not clear read only bits when writing registersBALATON Zoltan
When writing registers that have read only bits we have to avoid changing these bits as they may have non zero values. Make sure we use the correct masks to mask out read only and reserved bits when changing registers. Also remove extra spaces from dram_control and arbitration_control assignments. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16mos6522: expose mos6522_update_irq() through MOS6522DeviceClassMark Cave-Ayland
In the case where we have an interrupt generated externally from inputs to bits 1 and 2 of port A and/or port B, it is necessary to expose mos6522_update_irq() so it can be called by the interrupt source. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16mos6522: remove additional interrupt flag filter from mos6522_update_irq()Mark Cave-Ayland
The datasheet indicates that the interrupt is generated by ANDing the interrupt flags register (IFR) with the interrupt enable register (IER) but currently there is an extra filter for the SR and timer interrupts. Remove this extra filter to allow interrupts to be generated by external inputs on bits 1 and 2 of ports A and B. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16mos6522: only clear the shift register interrupt upon writeMark Cave-Ayland
According to the 6522 datasheet the shift register (SR) interrupt flag is cleared upon write with no mention of any other interrupt flags. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16xics_kvm: fix a build breakCédric Le Goater
On CentOS 7.5, gcc-4.8.5-28.el7_5.1.ppc64le fails to build QEMU due to : hw/intc/xics_kvm.c: In function ‘ics_set_kvm_state’: hw/intc/xics_kvm.c:281:13: error: ‘ret’ may be used uninitialized in this function [-Werror=maybe-uninitialized] return ret; Fix the breakage and also remove the extra error reporting as kvm_device_access() already provides a substantial error message. Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16mac_newworld: add PMU deviceMark Cave-Ayland
The PMU device supercedes the CUDA device found on older New World Macs and is supported by a larger number of guest OSs from OS 9 to OS X 10.5. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16adb: add property to disable direct reg 3 writesMark Cave-Ayland
MacOS 9 has a bug in its PMU driver whereby after configuring the ADB bus devices it sends another write to reg 3 on both devices resetting them both back to the same address. Add a new disable_direct_reg3_writes property to ADBDevice to disable these direct writes which can enabled just for the upcoming pmu-adb support. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16adb: fix read reg 3 byte orderingMark Cave-Ayland
According to the Apple ADB documentation, register 3 is a 2-byte register with the device address in the first byte, and the handler ID in the second byte. This is currently the opposite away to which QEMU returns them so switch the order around. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16mac_newworld: wire up programmer switch to NMI handlerMark Cave-Ayland
The programmer switch is wired up via an external GPIO pin and can be used to aid debugging Mac guests. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16mac_newworld: add gpios to macio devices with PMU enabledMark Cave-Ayland
PMU-enabled New World Macs expose their GPIOs via a separate memory region within the macio device. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16mac_newworld: add via machine option to control mac99 VIA/ADB configurationMark Cave-Ayland
This option allows the VIA configuration to be controlled between 3 different possible setups: cuda, pmu-adb and pmu with USB rather than ADB keyboard/mouse. For the moment we don't do anything with the configuration except to pass it to the macio device (the via-cuda parent) and also to the firmware via the fw_cfg interface so that it can present the correct device tree. The default is cuda which is the current default and so will have no change in behaviour. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16ppc: introduce Core99MachinesState for the mac99 machineMark Cave-Ayland
This is in preparation for adding configuration controlled via machine options. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16spapr: fix leak in h_client_architecture_support()Greg Kurz
If the negotiated compat mode can't be set, but raw mode is supported, we decide to ignore the error. An so, we should free it to prevent a memory leak. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-16ppc/spapr_caps: Don't disable cap_cfpc on POWER8 by defaultSuraj Jitindar Singh
In default_caps_with_cpu() we set spapr_cap_cfpc to broken for POWER8 processors and before. Since we no longer require private l1d cache on POWER8 for this cap to be set to workaround change this to default to broken for POWER7 processors and before. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-15Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches: - Fix options that work only with -drive or -blockdev, but not with both, because of QDict type confusion - rbd: Add options 'auth-client-required' and 'key-secret' - Remove deprecated -drive options serial/addr/cyls/heads/secs/trans - rbd, iscsi: Remove deprecated 'filename' option - Fix 'qemu-img map' crash with unaligned image size - Improve QMP documentation for jobs # gpg: Signature made Fri 15 Jun 2018 15:20:03 BST # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: (26 commits) block: Remove dead deprecation warning code block: Remove deprecated -drive option serial block: Remove deprecated -drive option addr block: Remove deprecated -drive geometry options rbd: New parameter key-secret rbd: New parameter auth-client-required block: Fix -blockdev / blockdev-add for empty objects and arrays check-block-qdict: Cover flattening of empty lists and dictionaries check-block-qdict: Rename qdict_flatten()'s variables for clarity block-qdict: Simplify qdict_is_list() some block-qdict: Clean up qdict_crumple() a bit block-qdict: Tweak qdict_flatten_qdict(), qdict_flatten_qlist() block-qdict: Simplify qdict_flatten_qdict() block: Make remaining uses of qobject input visitor more robust block: Factor out qobject_input_visitor_new_flat_confused() block: Clean up a misuse of qobject_to() in .bdrv_co_create_opts() block: Fix -drive for certain non-string scalars block: Fix -blockdev for certain non-string scalars qobject: Move block-specific qdict code to block-qdict.c block: Add block-specific QDict header ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-06-15iommu: Add IOMMU index argument to translate methodPeter Maydell
Add an IOMMU index argument to the translate method of IOMMUs. Since all of our current IOMMU implementations support only a single IOMMU index, this has no effect on the behaviour. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20180604152941.20374-4-peter.maydell@linaro.org
2018-06-15iommu: Add IOMMU index argument to notifier APIsPeter Maydell
Add support for multiple IOMMU indexes to the IOMMU notifier APIs. When initializing a notifier with iommu_notifier_init(), the caller must pass the IOMMU index that it is interested in. When a change happens, the IOMMU implementation must pass memory_region_notify_iommu() the IOMMU index that has changed and that notifiers must be called for. IOMMUs which support only a single index don't need to change. Callers which only really support working with IOMMUs with a single index can use the result of passing MEMTXATTRS_UNSPECIFIED to memory_region_iommu_attrs_to_index(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20180604152941.20374-3-peter.maydell@linaro.org
2018-06-15m25p80: add support for two bytes WRSR for Macronix chipsCédric Le Goater
On Macronix chips, two bytes can written to the WRSR. First byte will configure the status register and the second the configuration register. It is important to save the configuration value as it contains the dummy cycle setting when using dual or quad IO mode. Signed-off-by: Cédric Le Goater <clg@kaod.org> Acked-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-06-15aspeed_scu: Implement RNG registerJoel Stanley
The ASPEED SoCs contain a single register that returns random data when read. This models that register so that guests can use it. The random number data register has a corresponding control register, however it returns data regardless of the state of the enabled bit, so the model follows this behaviour. When the qcrypto call fails we exit as the guest uses the random number device to feed it's entropy pool, which is used for cryptographic purposes. Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Joel Stanley <joel@jms.id.au> Message-id: 20180613114836.9265-1-joel@jms.id.au Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-06-15hw/core/or-irq: Support more than 16 inputs to an OR gatePeter Maydell
For the IoTKit MPC support, we need to wire together the interrupt outputs of 17 MPCs; this exceeds the current value of MAX_OR_LINES. Increase MAX_OR_LINES to 32 (which should be enough for anyone). The tricky part is retaining the migration compatibility for existing OR gates; we add a subsection which is only used for larger OR gates, and define it such that we can freely increase MAX_OR_LINES in future (or even move to a dynamically allocated levels[] array without an upper size limit) without breaking compatibility. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20180604152941.20374-10-peter.maydell@linaro.org
2018-06-15arm: Don't crash if user tries to use a Cortex-M CPU without an NVICPeter Maydell
The Cortex-M CPU and its NVIC are two intimately intertwined parts of the same hardware; it is not possible to use one without the other. Unfortunately a lot of our board models don't do any sanity checking on the CPU type the user asks for, so a command line like qemu-system-arm -M versatilepb -cpu cortex-m3 will create an M3 without an NVIC, and coredump immediately. In the other direction, trying a non-M-profile CPU in an M-profile board won't blow up, but doesn't do anything useful either: qemu-system-arm -M lm3s6965evb -cpu arm926 Add some checking in the NVIC and CPU realize functions that the user isn't trying to use an NVIC without an M-profile CPU or an M-profile CPU without an NVIC, so we can produce a helpful error message rather than a core dump. Fixes: https://bugs.launchpad.net/qemu/+bug/1766896 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180601160355.15393-1-peter.maydell@linaro.org
2018-06-15hw/arm/armv7m: Remove unused armv7m_init() functionPeter Maydell
Remove the now-unused armv7m_init() function. This was a legacy from before we properly QOMified ARMv7M, and it has some flaws: * it combines work that needs to be done by an SoC object (creating and initializing the TYPE_ARMV7M object) with work that needs to be done by the board model (setting the system up to load the ELF file specified with -kernel) * TYPE_ARMV7M creation failure is fatal, but an SoC object wants to arrange to propagate the failure outward * it uses allocate-and-create via qdev_create() whereas the current preferred style for SoC objects is to do creation in-place Board and SoC models can instead do the two jobs this function was doing themselves, in the right places and with whatever their preferred style/error handling is. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20180601144328.23817-3-peter.maydell@linaro.org
2018-06-15stellaris: Stop using armv7m_init()Peter Maydell
The stellaris board is still using the legacy armv7m_init() function, which predates conversion of the ARMv7M into a proper QOM container object. Make the board code directly create the ARMv7M object instead. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20180601144328.23817-2-peter.maydell@linaro.org
2018-06-15hw/char/parallel: Convert away from old_mmioPeter Maydell
Convert the parallel device away from using the old_mmio field of MemoryRegionOps. This change only affects the memory-mapped variant, which is used by the MIPS Jazz boards 'magnum' and 'pica61'. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180601141223.26630-7-peter.maydell@linaro.org
2018-06-15hw/input/pckbd: Convert away from old_mmioPeter Maydell
Convert the pckbd device away from using the old_mmio field of MemoryRegionOps. This change only affects the memory-mapped variant of the i8042, which is used by the Unicore32 'puv3' board and the MIPS Jazz boards 'magnum' and 'pica61'. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180601141223.26630-6-peter.maydell@linaro.org
2018-06-15hw/watchdog/wdt_i6300esb: Convert away from old_mmioPeter Maydell
Convert the wdt_i6300esb device away from using the old_mmio field of MemoryRegionOps. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180601141223.26630-5-peter.maydell@linaro.org
2018-06-15hw/block/pflash_cfi02: Convert away from old_mmioPeter Maydell
Convert the pflash_cfi02 device away from using the old_mmio field of MemoryRegionOps. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Max Reitz <mreitz@redhat.com> Message-id: 20180601141223.26630-4-peter.maydell@linaro.org
2018-06-15hw/m68k/mcf5206: Convert away from old_mmioPeter Maydell
Convert the mcf5206 device away from using the old_mmio field of MemoryRegionOps. This device is used by the an5206 board. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Thomas Huth <huth@tuxfamily.org> Message-id: 20180601141223.26630-3-peter.maydell@linaro.org
2018-06-15hw/sh/sh7750: Convert away from old_mmioPeter Maydell
Convert the sh7750 device away from using the old_mmio field of MemoryRegionOps. This device is used by the sh4 r2d board. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180601141223.26630-2-peter.maydell@linaro.org
2018-06-15hw/arm/mps2-tz: Put ethernet controller behind PPCPeter Maydell
The ethernet controller in the AN505 MPC FPGA image is behind the same AHB Peripheral Protection Controller that handles the graphics and GPIOs. (In the documentation this is clear in the block diagram but the ethernet controller was omitted from the table listing devices connected to the PPC.) The ethernet sits behind AHB PPCEXP0 interface 5. We had incorrectly claimed that this was a "gpio4", but there are only 4 GPIOs in this image. Correct the QEMU model to match the hardware. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180515171446.10834-1-peter.maydell@linaro.org
2018-06-15arm_gicv3_kvm: kvm_dist_get/put_priority: skip the registers banked by ↵Shannon Zhao
GICR_IPRIORITYR While for_each_dist_irq_reg loop starts from GIC_INTERNAL, it forgot to offset the date array and index. This will overlap the GICR registers value and leave the last GIC_INTERNAL irq's registers out of update. Fixes: 367b9f527becdd20ddf116e17a3c0c2bbc486920 Cc: qemu-stable@nongnu.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-06-15block: Remove deprecated -drive option serialKevin Wolf
The -drive option serial was deprecated in QEMU 2.10. It's time to remove it. Tests need to be updated to set the serial number with -global instead of using the -drive option. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com>