aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2024-01-11hw/intc/arm_gicv3_cpuif: handle LPIs in in the list registersPeter Maydell
The hypervisor can deliver (virtual) LPIs to a guest by setting up a list register to have an intid which is an LPI. The GIC has to treat these a little differently to standard interrupt IDs, because LPIs have no Active state, and so the guest will only EOI them, it will not also deactivate them. So icv_eoir_write() must do two things: * if the LPI ID is not in any list register, we drop the priority but do not increment the EOI count * if the LPI ID is in a list register, we immediately deactivate it, regardless of the split-drop-and-deactivate control This can be seen in the VirtualWriteEOIR0() and VirtualWriteEOIR1() pseudocode in the GICv3 architecture specification. Without this fix, potentially a hypervisor guest might stall because LPIs get stuck in a bogus Active+Pending state. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Miguel Luis <miguel.luis@oracle.com> (cherry picked from commit 82a65e3188abebb509510b391726711606aca642) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08hw/vfio: fix iteration over global VFIODevice listVolker Rümelin
Commit 3d779abafe ("vfio/common: Introduce a global VFIODevice list") introduced a global VFIODevice list, but forgot to update the list element field name when iterating over the new list. Change the code to use the correct list element field. Fixes: 3d779abafe ("vfio/common: Introduce a global VFIODevice list") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2061 Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> (cherry picked from commit 9353b6da430f90e47f352dbf6dc31120c8914da6) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08vfio/container: Replace basename with g_path_get_basenameCédric Le Goater
g_path_get_basename() is a portable utility function that has the advantage of not modifing the string argument. It also fixes a compile breakage with the Musl C library reported in [1]. [1] https://lore.kernel.org/all/20231212010228.2701544-1-raj.khem@gmail.com/ Reported-by: Khem Raj <raj.khem@gmail.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Signed-off-by: Cédric Le Goater <clg@redhat.com> (cherry picked from commit 213ae3ffda463c0503e39e0cf827511b5298c314) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08edu: fix DMA range upper bound checkMax Erenberg
The edu_check_range function checks that start <= end1 < end2, where end1 is the upper bound (exclusive) of the guest-supplied DMA range and end2 is the upper bound (exclusive) of the device's allowed DMA range. When the guest tries to transfer exactly DMA_SIZE (4096) bytes, end1 will be equal to end2, so the check fails and QEMU aborts with this puzzling error message (newlines added for formatting): qemu: hardware error: EDU: DMA range 0x0000000000040000-0x0000000000040fff out of bounds (0x0000000000040000-0x0000000000040fff)! By checking end1 <= end2 instead, guests will be allowed to transfer exactly 4096 bytes. It is not necessary to explicitly check for start <= end1 because the previous two checks (within(addr, start, end2) and end1 > addr) imply start < end1. Fixes: b30934cb52a7 ("hw: misc, add educational driver", 2015-01-21) Signed-off-by: Max Erenberg <merenber@uwaterloo.ca> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 2c5107e1b455d4a157124f021826ead4e04b4aea) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08hw/net: cadence_gem: Fix MDIO_OP_xxx valuesBin Meng
Testing upstream U-Boot with 'sifive_u' machine we see: => dhcp ethernet@10090000: PHY present at 0 Could not get PHY for ethernet@10090000: addr 0 phy_connect failed This has been working till QEMU 8.1 but broken since QEMU 8.2. Fixes: 1b09eeb122aa ("hw/net/cadence_gem: use FIELD to describe PHYMNTNC register fields") Reported-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Bin Meng <bmeng@tinylab.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 0c7ffc977195c1f71c8132eb5616827e589d4a0f) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-05hw/net/can/sja1000: fix bug for single acceptance filter and standard framePavel Pisa
A CAN sja1000 standard frame filter mask has been computed and applied incorrectly for standard frames when single Acceptance Filter Mode (MOD_AFM = 1) has been selected. The problem has not been found by Linux kernel testing because it uses dual filter mode (MOD_AFM = 0) and leaves falters fully open. The problem has been noticed by Grant Ramsay when testing with Zephyr RTOS which uses single filter mode. Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Reported-by: Grant Ramsay <gramsay@enphaseenergy.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2028 Fixes: 733210e754 ("hw/net/can: SJA1000 chip register level emulation") Message-ID: <20240103231426.5685-1-pisa@fel.cvut.cz> (cherry picked from commit 25145a7d7735344a469551946fc2a7f19eb4aa3d) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-05target/i386: the sgx_epc_get_section stub is reachablePaolo Bonzini
The sgx_epc_get_section stub is reachable from cpu_x86_cpuid. It should not assert, instead it should just return true just like the "real" sgx_epc_get_section does when SGX is disabled. Reported-by: Vladimír Beneš <vbenes@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-ID: <20220201190941.106001-1-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 219615740425d9683588207b40a365e6741691a6) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-12-05hw/ufs: avoid generating the same ID string for different LU devicesAkinobu Mita
QEMU would not start when trying to create two UFS host controllers and a UFS logical unit for each with the following options: -device ufs,id=bus0 \ -device ufs-lu,drive=drive1,bus=bus0,lun=0 \ -device ufs,id=bus1 \ -device ufs-lu,drive=drive2,bus=bus1,lun=0 \ This is because the same ID string ("0:0:0/scsi-disk") is generated for both UFS logical units. To fix this issue, prepend the parent pci device's path to make the ID string unique. ("0000:00:03.0/0:0:0/scsi-disk" and "0000:00:04.0/0:0:0/scsi-disk") Resolves: #2018 Fixes: 096434fea13a ("hw/ufs: Modify lu.c to share codes with SCSI subsystem") Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Reviewed-by: Jeuk Kim <jeuk20.kim@samsung.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20231204150543.48252-1-akinobu.mita@gmail.com> Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
2023-12-04Merge tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu into ↵Stefan Hajnoczi
staging ui/audio fixes for 8.2 # -----BEGIN PGP SIGNATURE----- # # iQJQBAABCAA6FiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmVtiO0cHG1hcmNhbmRy # ZS5sdXJlYXVAcmVkaGF0LmNvbQAKCRDa6OEJdZac5UDeEACvbixo8MuxOpBf9DK2 # JTCQeHYeVW7QtwDh9xUUnbcM77+lWgkr9OeCJ7FKxF1J7UHkQ7jIzISs/P0zuCw0 # JRkoOcfOnxV/Pn8XAq79F6Yq55EUdCdvsj0XgsVx+K096VHvjlK3fzNwNebJrkos # NpwQnnqI37TYBUFSivjKkEkPf1Kp4R4abeNs3eEzsIMUzEmEZQwwi5zZAMxxZ41o # fyItvdaEEDJxzupS6e0x4O4B5KkTo9RFwsJgstOAbkCxuJk67grV9dm3S3wFiUR3 # iFR2P/EyzctT9QOkU7oEIi87CiociKaYWgw/tDU4lFjXwbkt0a59b783Rha1RlN8 # ICFQ3B0NX+CNlc5PPsF1yp3+DNJRKz8Rap4PmU5IIVXTlPHm+YrWRw6vklw5kq7y # nAvdcfIJ+UQGVCgqQiLkuZslz4ATFOypnUvSL+eds1jHMS6UQcGd3zD1QCEPhDSP # jhFirqDQYWU/18ZU3b6VuDe5Ko3erd4V7hDikeQnjLjYfBFX1/Mts+6GmaGdfbqk # JLOHYa7CUP7akTB7fQF1/4B6cSf3hOsXYlmDHQPZgi1OYEy/BdPuwM5pN4jAikwO # b2z6TrXS3hQK61bUtU+XnhOOW98+gfz77UwluXDl22KHGV+c/SadyMFJWm8VYX4k # DuNTQ78vApqCuAhjFcKSXPSt7A== # =fpz/ # -----END PGP SIGNATURE----- # gpg: Signature made Mon 04 Dec 2023 03:08:13 EST # gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5 # gpg: issuer "marcandre.lureau@redhat.com" # gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full] # gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full] # Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5 * tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu: hw/audio/virtio-sound: mark the device as unmigratable ui/vnc-clipboard: fix inflate_buffer ui/gtk-egl: move function calls back to regular code path Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-12-04Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Stefan Hajnoczi
into staging virtio,pc,pci: features, cleanups, fixes misc fixes, cleanups Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmVrmhwPHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRp/XsH/05hHtQqO+EnKSAW5SEwZnlLfzDcajVVPIkT # h6Yf6ahHNf4hG1qqa2CICqJtDAOQYamO128QjZdQxsnYejwBmZ/oG//neWh6qLPV # Hp4AaKV2MjKRQZPNblnrGUirxkSWSTqIONXp4FsVVpKOKW9IX5f9tH6nyFAqXWX7 # KzNY/3KD1CVSwAV1+hY2c6OzWVdTSJykPRocfB0jTYY1RygI0t57Hiq7v8AliGAx # 7ktSJFD9MBr+4Un7CQZWp24eyrL77j8U+YQRlPVYupkmQyuXHPdBr4RruHcGupIy # GeIvbkX1mTCEfOd/HFQ1X41hpf8AEyZjjq2SOEBncIRWY6EhSio= # =opjy # -----END PGP SIGNATURE----- # gpg: Signature made Sat 02 Dec 2023 15:57:00 EST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: vhost-user-scsi: free the inflight area when reset vhost-user: fix the reconnect error msix: unset PCIDevice::msix_vector_poll_notifier in rollback virtio-iommu: Remove useless !sdev check in virtio_iommu_probe() hw/i386: fix short-circuit logic with non-optimizing builds hw/acpi/erst: Do not ignore Error* in realize handler pcie_sriov: Remove g_new assertion virtio-sound: add realize() error cleanup path virtio-snd: check AUD_register_card return value hw/audio/hda-codec: reenable the audio mixer hw/audio/hda-codec: fix multiplication overflow hw/audio/virtio-snd-pci: fix the PCI class code tests/acpi/bios-tables-test: do not write new blobs unless there are changes netdev: set timeout depending on loadavg osdep: add getloadavg Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-12-04hw/audio/virtio-sound: mark the device as unmigratableVolker Rümelin
The virtio-sound device is currently not migratable. QEMU crashes on the source machine at some point during the migration with a segmentation fault. Even with this bug fixed, the virtio-sound device doesn't migrate the state of the audio streams. For example, running streams leave the device on the destination machine in a broken condition. Mark the device as unmigratable until these issues have been fixed. Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20231204072837.6058-1-vr_qemu@t-online.de>
2023-12-02vhost-user-scsi: free the inflight area when resetLi Feng
Keep it the same to vhost-user-blk. At the same time, fix the vhost_reset_device. Signed-off-by: Li Feng <fengli@smartx.com> Message-Id: <20231123055431.217792-3-fengli@smartx.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02vhost-user: fix the reconnect errorLi Feng
If the error occurs in vhost_dev_init, the value of s->connected is set to true in advance, and there is no chance to enter this function execution again in the future. Signed-off-by: Li Feng <fengli@smartx.com> Message-Id: <20231123055431.217792-2-fengli@smartx.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02msix: unset PCIDevice::msix_vector_poll_notifier in rollbackRobert Hoo
In the rollback in msix_set_vector_notifiers(), original patch forgot to undo msix_vector_poll_notifier pointer. Fixes: bbef882cc193 ("msi: add API to get notified about pending bit poll") Signed-off-by: Robert Hoo <robert.hoo.linux@gmail.com> Message-Id: <20231113081349.1307-1-robert.hoo.linux@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02virtio-iommu: Remove useless !sdev check in virtio_iommu_probe()Eric Auger
The code already checks iommu_mr is not NULL so there is no need to check container_of() is not NULL. Remove the check. Fixes: CID 1523901 Fixes: 09b4c3d6a2 ("virtio-iommu: Record whether a probe request has been issued") Signed-off-by: Eric Auger <eric.auger@redhat.com> Reported-by: Coverity (CID 1523901) Message-Id: <20231109170715.259520-1-eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02hw/i386: fix short-circuit logic with non-optimizing buildsDaniel Hoffman
`kvm_enabled()` is compiled down to `0` and short-circuit logic is used to remove references to undefined symbols at the compile stage. Some build configurations with some compilers don't attempt to simplify this logic down in some cases (the pattern appears to be that the literal false must be the first term) and this was causing some builds to emit references to undefined symbols. An example of such a configuration is clang 16.0.6 with the following configure: ./configure --enable-debug --without-default-features --target-list=x86_64-softmmu --enable-tcg-interpreter Signed-off-by: Daniel Hoffman <dhoff749@gmail.com> Message-Id: <20231119203116.3027230-1-dhoff749@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02hw/acpi/erst: Do not ignore Error* in realize handlerPhilippe Mathieu-Daudé
erst_realizefn() passes @errp to functions without checking for failure. If it runs into another failure, it trips error_setv()'s assertion. Use the ERRP_GUARD() macro and check *errp, as suggested in commit ae7c80a7bd ("error: New macro ERRP_GUARD()"). Cc: qemu-stable@nongnu.org Fixes: f7e26ffa59 ("ACPI ERST: support for ACPI ERST feature") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20231120130017.81286-1-philmd@linaro.org> Reviewed-by: Ani Sinha <anisinha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02pcie_sriov: Remove g_new assertionAkihiko Odaki
g_new() aborts if the allocation fails so it returns NULL only if the requested allocation size is zero. register_vfs() makes such an allocation if NumVFs is zero so it should not assert that g_new() returns a non-NULL value. Fixes: 7c0fa8dff8 ("pcie: Add support for Single Root I/O Virtualization (SR/IOV)") Buglink: https://issues.redhat.com/browse/RHEL-17209 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20231123075630.12057-1-akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Yanghang Liu<yanghliu@redhat.com> Reviewed-by: Cédric Le Goater &lt;<a href="mailto:clg@redhat.com" target="_blank">clg@redhat.com</a>&gt;<br> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02virtio-sound: add realize() error cleanup pathManos Pitsidianakis
QEMU crashes on exit when a virtio-sound device has failed to realise. Its vmstate field was not cleaned up properly with qemu_del_vm_change_state_handler(). This patch changes the realize() order as 1. Validate the given configuration values (no resources allocated by us either on success or failure) 2. Try AUD_register_card() and return on failure (no resources allocated by us on failure) 3. Initialize vmstate, virtio device, heap allocations and stream parameters at once. If error occurs, goto error_cleanup label which calls virtio_snd_unrealize(). This cleans up all resources made in steps 1-3. Reported-by: Volker Rümelin <vr_qemu@t-online.de> Fixes: 2880e676c000 ("Add virtio-sound device stub") Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Message-Id: <20231116072046.4002957-1-manos.pitsidianakis@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-12-02virtio-snd: check AUD_register_card return valueManos Pitsidianakis
AUD_register_card might fail. Even though errp was passed as an argument, the call's return value was not checked for failure. Fixes: Coverity CID 1523899 Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Message-Id: <20231109162034.2108018-1-manos.pitsidianakis@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02hw/audio/hda-codec: reenable the audio mixerVolker Rümelin
Commit b7639b7dd0 ("hw/audio: Simplify hda audio init") inverted the sense of hda codec property mixer during initialization. Change the code so that mixer=on enables the hda mixer emulation and mixer=off disables the hda mixer emulation. With this change audio playback and recording streams don't start muted by default. Fixes: b7639b7dd0 ("hw/audio: Simplify hda audio init") Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20231105172552.8405-2-vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02hw/audio/hda-codec: fix multiplication overflowVolker Rümelin
After a relatively short time, there is an multiplication overflow when multiplying (now - buft_start) with hda_bytes_per_second(). While the uptime now - buft_start only overflows after 2**63 ns = 292.27 years, this happens hda_bytes_per_second() times faster with the multiplication. At 44100 samples/s * 2 channels * 2 bytes/channel = 176400 bytes/s that is 14.52 hours. After the multiplication overflow the affected audio stream stalls. Replace the multiplication and following division with muldiv64() to prevent a multiplication overflow. Fixes: 280c1e1cdb ("audio/hda: create millisecond timers that handle IO") Reported-by: M_O_Bz <m_o_bz@163.com> Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20231105172552.8405-1-vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02hw/audio/virtio-snd-pci: fix the PCI class codeVolker Rümelin
The virtio sound device is currently an unclassified PCI device. ~> sudo lspci -s '00:02.0' -v -nn | head -n 2 00:02.0 Unclassified device [00ff]: Red Hat, Inc. Device [1af4:1059] (rev 01) Subsystem: Red Hat, Inc. Device [1af4:1100] Set the correct PCI class code to change the device to a multimedia audio controller. ~> sudo lspci -s '00:02.0' -v -nn | head -n 2 00:02.0 Multimedia audio controller [0401]: Red Hat, Inc. Device [1af4:1059] (rev 01) Subsystem: Red Hat, Inc. Device [1af4:1100] Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20231107185034.6434-1-vr_qemu@t-online.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-11-30ppc/amigaone: Allow running AmigaOS without firmware imageBALATON Zoltan
The machine uses a modified U-Boot under GPL license but the sources of it are lost with only a binary available so it cannot be included in QEMU. Allow running without the firmware image which can be used when calling a boot loader directly and thus simplifying booting guests. We need a small routine that AmigaOS calls from ROM which is added in this case to allow booting AmigaOS without external firmware image. Fixes: d9656f860a38 ("hw/ppc: Add emulation of AmigaOne XE board") Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
2023-11-28Merge tag 'misc-next-20231128' of https://github.com/philmd/qemu into stagingStefan Hajnoczi
Misc fixes for 8.2 * buildsys: Invoke bash via 'env' (Samuel) * doc: Fix example in s390-cpu-topology.rst (Zhao) * HW: Fix AVR ATMega reset stack (Gihun) and VT82C686 IRQ routing (Zoltan) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmVl7MUACgkQ4+MsLN6t # wN4nsQ//U7/GGrMaNJF369pC0UfC0dfD39RoD9jmmrWUQB17baMvXo+BMBcELX0Q # BtgRjIYwnywnVZlB11JL5Ql9ykSRqd7VeqnZfH//GqQO+ySF7jl6ekNT6YNjUbWu # iF9bU3o0/LAVl/3pe9LQ4q/yOjzERA5o4JKYviHZYcWE811/5lBNgER4iPyCz6a8 # aGI3S5PGmq6a9x5266jkY2WWldDy7D1ujkuvxxc4tgnmbBjL21soJ/oRLOBjGTNl # hCRfDTEiFZm7OxjV7oB03Nr3EGGStGdy0aPhhtFwzZxQ9yV7d2DLsbYGgwzZYkKQ # 9v4DtGqYyvDA7LBmfxOrnzL0WXgN4xO3qekLqHDtChDzFFEYwtHvH0duPUiQv1Yu # qHyOsfB58rKzWHeo0ACEjMWGdD1opCXCeoJlEf/saiQ5EgyBwph/z2mWYN4yak5H # Zu3xF15BcnyavC6sVeuE+rT574dhCzOtH8Vf3WVwqfL5D5cyCjHlmPSAXXMqBkmh # BMOD8O210n6IdzuuOQ038t3yGvIc0YysOmQgfLjRYlZa884q3wExgrufH+NYbGMj # bFthPjLKgHm+q4k2mH65G98xwXQFT6rdHanw2iEJcPJbhhk9SNWYgaQ0r0Oi2Pfd # zCQ22F1j9UqGcqKh+8tzAfjayRyQUJtgizPXEWanADkpIDYxrRk= # =323/ # -----END PGP SIGNATURE----- # gpg: Signature made Tue 28 Nov 2023 08:36:05 EST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'misc-next-20231128' of https://github.com/philmd/qemu: docs/s390: Fix wrong command example in s390-cpu-topology.rst hw/avr/atmega: Fix wrong initial value of stack pointer hw/audio/via-ac97: Route interrupts using via_isa_set_irq() hw/isa/vt82c686: Route PIRQ inputs using via_isa_set_irq() hw/usb/vt82c686-uhci-pci: Use ISA instead of PCI interrupts hw/isa/vt82c686: Bring back via_isa_set_irq() target/hexagon/idef-parser/prepare: use env to invoke bash Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-11-28Merge tag 'pull-target-arm-20231127' of ↵Stefan Hajnoczi
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * Set IL bit for pauth, SVE access, BTI trap syndromes * Handle overflow in calculation of next timer tick * hw/net/can/xlnx-zynqmp: Avoid underflow when popping FIFOs * Various devices: Free array property memory on device finalize * hw/ssi/xilinx_spips: fix an out of bound access * hw/misc, hw/ssi: Fix some URLs for AMD / Xilinx models * hw/dma/xlnx_csu_dma: don't throw guest errors when stopping the SRC DMA # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmVkzLAZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3o79D/0Yh7Q7N4+fc4xdBK5hb1GN # 31rBWZ3z0XzBzXrN80g6ig5i+CvTq7+120yx4Kl5bdyAMGdXpryTeNSoa4ewmNtC # +c6pqV8IUIHA3axepuHtwjs4wRzWoFz13gy+X/1spfhcrtFpWyRt0f3cc1fElhzX # 2K/4H9TD2d5yZBvaKLoJ6GzdK2wtWfucvWQDOUigRF7rvSST3awZ6gkumm+/6EM5 # vbIVOqi+0JcnWKJj0i4S1vRUPg0+CuaZN8glXcGkq2BaMfOohpjFGTMY0KsAK1Cv # Ow1guxxy2mcLixQ8pX7ii5WHVDCuPqTVcwHUQJqN5Ln6CFEre38jM1ZwgHpWhb8G # CoVOu2B96QwPoICD7QomaKCJYHkAczC4KETsTz/Mc+zcU6+cQiv0swc2sDhwBlmT # weHQAmZg5dPRl3DQ/8F3llhdYyvOGnUpaaBauJiuH2I5n/qhqbvcgu9G7pGwd2gm # lk8LuzjbVEtBu2jFlPCMpvuSuJJciR/3/QdHMGlN6L0ooY6dFL9puW51wFKSh+Kx # JqetuUJXVWLTiL9ekLnNPQkuQQwP3WQsIvQO8tjEiuojw1utk/50JPmXg/xHEahx # rN8aiLstR4olh1i+CrIee3QR6IwhqZmvEVHROIw0ExJ1L04FCCtPlvJ/G2gD1ta2 # oLvqWLlc752+nND72lIJZg== # =X700 # -----END PGP SIGNATURE----- # gpg: Signature made Mon 27 Nov 2023 12:06:56 EST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20231127' of https://git.linaro.org/people/pmaydell/qemu-arm: hw/dma/xlnx_csu_dma: don't throw guest errors when stopping the SRC DMA hw/misc, hw/ssi: Fix some URLs for AMD / Xilinx models hw/ssi/xilinx_spips: fix an out of bound access hw/input/stellaris_gamepad: Free StellarisGamepad::keycodes[] array hw/nvram/xlnx-efuse-ctrl: Free XlnxVersalEFuseCtrl[] "pg0-lock" array hw/nvram/xlnx-efuse: Free XlnxEFuse::ro_bits[] array on finalize() hw/misc/mps2-scc: Free MPS2SCC::oscclk[] array on finalize() hw/virtio: Free VirtIOIOMMUPCI::vdev.reserved_regions[] on finalize() hw/virtio: Add VirtioPCIDeviceTypeInfo::instance_finalize field hw/net/can/xlnx-zynqmp: Avoid underflow while popping RX FIFO hw/net/can/xlnx-zynqmp: Avoid underflow while popping TX FIFOs target/arm: Handle overflow in calculation of next timer tick target/arm: Set IL bit for pauth, SVE access, BTI trap syndromes Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-11-28Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into stagingStefan Hajnoczi
Block layer patches - ide/via: Fix BAR4 value in legacy mode - export/vhost-user-blk: Fix consecutive drains - vmdk: Don't corrupt desc file in vmdk_write_cid - iotests: fix default machine type detection # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmVl9GARHGt3b2xmQHJl # ZGhhdC5jb20ACgkQfwmycsiPL9Y9KRAAx3ryUIdaVZX5RZbVC4ZmkgGIpSv+8dS+ # e98H+accyyVTVXlMNYWy0s7tP6sxhhlmGqfGLx/hDynvjJRxyS8VSOXXNIqYcHqN # wGXcgLEgb+qxu7+Y8g3UhMeSmDyRhanOE/MxhMqGOKd/5nxfY1XdD7nkRwCsPAAi # Tud/Jd7t0CSV0wUDfvMtBsQZCBSQyoSu3S3TjZ8I2CPjBaoYojj3XM+LKrlJu+B5 # zwgB5IURac1dOfsjYsX0M0zXxr6pTVNtkdNNwFoiNP+omoRjCXV3W9iTtyU+/zc3 # cnVzQQRE6XufQ/Q7IWHNE3/U5LvM3m+sjB+YryrMTRVItjpGUCgYGsrgodjZp7aj # 4hmwxyZ8PN3+o96d5RWqhRXnY9fy5hzJZOhUMQV6lV/Z14wt8YYsJoqgi4wryoYf # 7VdyZP2Szt2Sgl4+n0uSfPBoR+qMEwni1AxO8iK9OZbpewv7aBO3In4tOAvP/eB8 # VAoCZOfrILSXaR5aorlAPr6IOXanPvgOotmzNs0NaaqYnpfYr6KAH9FjyAm3DZqp # b+/Ep+hrekq9XqnZGMblQsjlTFAc9mRWtqsHUrftl9FhRvSah4R+TyKov8lD23VZ # bvw1etcc0p55Ws4RkUkGn8G5kRyhec3nkHdr4MODCR0s0uo0cBaITnoV0Ra9p7of # K78WSodwZKQ= # =ktlF # -----END PGP SIGNATURE----- # gpg: Signature made Tue 28 Nov 2023 09:08:32 EST # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * tag 'for-upstream' of https://repo.or.cz/qemu/kevin: ide/via: Fix BAR4 value in legacy mode export/vhost-user-blk: Fix consecutive drains vmdk: Don't corrupt desc file in vmdk_write_cid iotests: fix default machine type detection Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-11-28ide/via: Fix BAR4 value in legacy modeBALATON Zoltan
Return default value in legacy mode for BAR4 when unset. This can't be set in reset method because BARs are cleared on reset so we return it instead when BARs are read in legacy mode. This fixes UDMA on amigaone with AmigaOS. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-ID: <20231125140135.AF6A075A4C3@zero.eik.bme.hu> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2023-11-28hw/avr/atmega: Fix wrong initial value of stack pointerGihun Nam
The current implementation initializes the stack pointer of AVR devices to 0. Although older AVR devices used to be like that, newer ones set it to RAMEND. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1525 Signed-off-by: Gihun Nam <gihun.nam@outlook.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <PH0P222MB0010877445B594724D40C924DEBDA@PH0P222MB0010.NAMP222.PROD.OUTLOOK.COM> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-11-28hw/audio/via-ac97: Route interrupts using via_isa_set_irq()BALATON Zoltan
This device is a function of VIA south bridge and should allow setting interrupt routing within that chip. This is implemented in via_isa_set_irq(). Fixes: eb604411a78b82c468e2b8d81a9401eb8b9c7658 Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-ID: <5329840e4be6dd8ae143d07cbfe61d8d2d106654.1701035944.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-11-28hw/isa/vt82c686: Route PIRQ inputs using via_isa_set_irq()BALATON Zoltan
The chip has 4 pins (called PIRQA-D in VT82C686B and PINTA-D in VT8231) that are meant to be connected to PCI IRQ lines and allow routing PCI interrupts to the ISA PIC. Route these in via_isa_set_irq() to make it possible to share them with internal functions that can also be routed to the same ISA IRQs. Fixes: 2fdadd02e675caca4aba4ae26317701fe2c4c901 Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-ID: <8c4513d8b78fac40e6d4e65a0a4b3a7f2f278a4b.1701035944.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-11-28hw/usb/vt82c686-uhci-pci: Use ISA instead of PCI interruptsBALATON Zoltan
This device is part of a superio/ISA bridge chip and IRQs from it are routed to an ISA interrupt. Use via_isa_set_irq() function to implement this in a vt82c686-uhci-pci specific irq handler. This reverts commit 422a6e8075752bc5342afd3eace23a4990dd7d98. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-ID: <ed5cdeaba7cf01eebdaa35f84c63427f4d8876b1.1701035944.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-11-28hw/isa/vt82c686: Bring back via_isa_set_irq()BALATON Zoltan
The VIA integrated south bridge chips combine several functions and allow routing their interrupts to any of the ISA IRQs also allowing multiple sources to share the same ISA IRQ. E.g. pegasos2 firmware configures everything to use IRQ 9 but amigaone routes them to separate ISA IRQs so the current simplified routing does not work. Bring back via_isa_set_irq() and change it to take the component that wants to change an IRQ and keep track of interrupt status of each source separately and do the mapping to ISA IRQ within the ISA bridge. This may not handle cases when an ISA IRQ is controlled by devices directly, not going through via_isa_set_irq() such as serial, parallel or keyboard but these IRQs being conventionally fixed are not likely to be change by guests or share with other devices so this does not cause a problem in practice. This reverts commit 4e5a20b6da9b1f6d2e9621ed7eb8b239560104ae. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-ID: <1c3902d4166234bef0a476026441eaac3dd6cda5.1701035944.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-11-28qdev: Fix crash in array property getterKevin Wolf
Passing an uninitialised list to visit_start_list() happens to work for the QObject output visitor because it treats the pointer as an opaque value and never dereferences it, but the string output visitor expects a valid list to check if it has more than one element. The existing code crashes with the string output visitor if the uninitialised value is non-NULL. Passing an explicit NULL would fix the crash, but still result in wrong output. Rework get_prop_array() so that it conforms to the expectations that the string output visitor has. This includes building a real list first and using visit_next_list() to iterate it. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1993 Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Tested-by: Dan Hoffman <dhoff749@gmail.com> Tested-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20231121173416.346610-2-kwolf@redhat.com>
2023-11-27hw/dma/xlnx_csu_dma: don't throw guest errors when stopping the SRC DMAFrederic Konrad
UG1087 states for the source channel that: if SIZE is programmed to 0, and the DMA is started, the interrupts DONE and MEM_DONE will be asserted. This implies that it is allowed for the guest to stop the source DMA by writing a size of 0 to the SIZE register, so remove the LOG_GUEST_ERROR in that case. While at it remove the comment marking the SIZE register as write-only. See: https://docs.xilinx.com/r/en-US/ug1087-zynq-ultrascale-registers/CSUDMA_SRC_SIZE-CSUDMA-Register Signed-off-by: Frederic Konrad <fkonrad@amd.com> Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com> Message-id: 20231124143505.1493184-4-fkonrad@amd.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-27hw/misc, hw/ssi: Fix some URLs for AMD / Xilinx modelsFrederic Konrad
It seems that the url changed a bit, and it triggers an error. Fix the URLs so the documentation can be reached again. Signed-off-by: Frederic Konrad <fkonrad@amd.com> Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com> Message-id: 20231124143505.1493184-3-fkonrad@amd.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-27hw/ssi/xilinx_spips: fix an out of bound accessFrederic Konrad
The spips, qspips, and zynqmp-qspips share the same realize function (xilinx_spips_realize) and initialize their io memory region with different mmio_ops passed through the class. The size of the memory region is set to the largest area (0x200 bytes for zynqmp-qspips) thus it is possible to write out of s->regs[addr] in xilinx_spips_write for spips and qspips. This fixes that wrong behavior. Reviewed-by: Luc Michel <luc.michel@amd.com> Signed-off-by: Frederic Konrad <fkonrad@amd.com> Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com> Message-id: 20231124143505.1493184-2-fkonrad@amd.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-27hw/input/stellaris_gamepad: Free StellarisGamepad::keycodes[] arrayPhilippe Mathieu-Daudé
Commit 0be6bfac62 ("qdev: Implement variable length array properties") added the DEFINE_PROP_ARRAY() macro with the following comment: * It is the responsibility of the device deinit code to free the * @_arrayfield memory. Commit a75f336b97 added: DEFINE_PROP_ARRAY("keycodes", StellarisGamepad, num_buttons, keycodes, qdev_prop_uint32, uint32_t), but forgot to free the 'keycodes' array. Do it in the instance_finalize handler. Fixes: a75f336b97 ("hw/input/stellaris_input: Convert to qdev") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20231121174051.63038-7-philmd@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-27hw/nvram/xlnx-efuse-ctrl: Free XlnxVersalEFuseCtrl[] "pg0-lock" arrayPhilippe Mathieu-Daudé
Commit 0be6bfac62 ("qdev: Implement variable length array properties") added the DEFINE_PROP_ARRAY() macro with the following comment: * It is the responsibility of the device deinit code to free the * @_arrayfield memory. Commit 9e4aa1fafe added: DEFINE_PROP_ARRAY("pg0-lock", XlnxVersalEFuseCtrl, extra_pg0_lock_n16, extra_pg0_lock_spec, qdev_prop_uint16, uint16_t), but forgot to free the 'extra_pg0_lock_spec' array. Do it in the instance_finalize() handler. Cc: qemu-stable@nongnu.org Fixes: 9e4aa1fafe ("hw/nvram: Xilinx Versal eFuse device") # v6.2.0+ Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20231121174051.63038-6-philmd@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-27hw/nvram/xlnx-efuse: Free XlnxEFuse::ro_bits[] array on finalize()Philippe Mathieu-Daudé
Commit 0be6bfac62 ("qdev: Implement variable length array properties") added the DEFINE_PROP_ARRAY() macro with the following comment: * It is the responsibility of the device deinit code to free the * @_arrayfield memory. Commit 68fbcc344e added: DEFINE_PROP_ARRAY("read-only", XlnxEFuse, ro_bits_cnt, ro_bits, qdev_prop_uint32, uint32_t), but forgot to free the 'ro_bits' array. Do it in the instance_finalize handler. Cc: qemu-stable@nongnu.org Fixes: 68fbcc344e ("hw/nvram: Introduce Xilinx eFuse QOM") # v6.2.0+ Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20231121174051.63038-5-philmd@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-27hw/misc/mps2-scc: Free MPS2SCC::oscclk[] array on finalize()Philippe Mathieu-Daudé
Commit 0be6bfac62 ("qdev: Implement variable length array properties") added the DEFINE_PROP_ARRAY() macro with the following comment: * It is the responsibility of the device deinit code to free the * @_arrayfield memory. Commit 4fb013afcc added: DEFINE_PROP_ARRAY("oscclk", MPS2SCC, num_oscclk, oscclk_reset, qdev_prop_uint32, uint32_t), but forgot to free the 'oscclk_reset' array. Do it in the instance_finalize() handler. Cc: qemu-stable@nongnu.org Fixes: 4fb013afcc ("hw/misc/mps2-scc: Support configurable number of OSCCLK values") # v6.0.0+ Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20231121174051.63038-4-philmd@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-27hw/virtio: Free VirtIOIOMMUPCI::vdev.reserved_regions[] on finalize()Philippe Mathieu-Daudé
Commit 0be6bfac62 ("qdev: Implement variable length array properties") added the DEFINE_PROP_ARRAY() macro with the following comment: * It is the responsibility of the device deinit code to free the * @_arrayfield memory. Commit 8077b8e549 added: DEFINE_PROP_ARRAY("reserved-regions", VirtIOIOMMUPCI, vdev.nb_reserved_regions, vdev.reserved_regions, qdev_prop_reserved_region, ReservedRegion), but forgot to free the 'vdev.reserved_regions' array. Do it in the instance_finalize() handler. Cc: qemu-stable@nongnu.org Fixes: 8077b8e549 ("virtio-iommu-pci: Add array of Interval properties") # v5.1.0+ Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-id: 20231121174051.63038-3-philmd@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-27hw/virtio: Add VirtioPCIDeviceTypeInfo::instance_finalize fieldPhilippe Mathieu-Daudé
The VirtioPCIDeviceTypeInfo structure, added in commit a4ee4c8baa ("virtio: Helper for registering virtio device types") got extended in commit 8ea90ee690 ("virtio: add class_size") with the @class_size field. Do similarly with the @instance_finalize field. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20231121174051.63038-2-philmd@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-27hw/net/can/xlnx-zynqmp: Avoid underflow while popping RX FIFOPhilippe Mathieu-Daudé
Per https://docs.xilinx.com/r/en-US/ug1085-zynq-ultrascale-trm/Message-Format Message Format The same message format is used for RXFIFO, TXFIFO, and TXHPB. Each message includes four words (16 bytes). Software must read and write all four words regardless of the actual number of data bytes and valid fields in the message. There is no mention in this reference manual about what the hardware does when not all four words are read. To fix the reported underflow behavior, I choose to fill the 4 frame data registers when the first register (ID) is accessed, which is how I expect hardware would do. Reported-by: Qiang Liu <cyruscyliu@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com> Reviewed-by: Vikram Garhwal <vikram.garhwal@amd.com> Message-id: 20231124183325.95392-3-philmd@linaro.org Fixes: 98e5d7a2b7 ("hw/net/can: Introduce Xilinx ZynqMP CAN controller") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1427 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com> Reviewed-by: Vikram Garhwal <vikram.garhwal@amd.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-27hw/net/can/xlnx-zynqmp: Avoid underflow while popping TX FIFOsPhilippe Mathieu-Daudé
Per https://docs.xilinx.com/r/en-US/ug1085-zynq-ultrascale-trm/Message-Format Message Format The same message format is used for RXFIFO, TXFIFO, and TXHPB. Each message includes four words (16 bytes). Software must read and write all four words regardless of the actual number of data bytes and valid fields in the message. There is no mention in this reference manual about what the hardware does when not all four words are written. To fix the reported underflow behavior when DATA2 register is written, I choose to fill the data with the previous content of the ID / DLC / DATA1 registers, which is how I expect hardware would do. Note there is no hardware flag raised under such condition. Reported-by: Qiang Liu <cyruscyliu@gmail.com> Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com> Reviewed-by: Vikram Garhwal <vikram.garhwal@amd.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20231124183325.95392-2-philmd@linaro.org Fixes: 98e5d7a2b7 ("hw/net/can: Introduce Xilinx ZynqMP CAN controller") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1425 Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com> Reviewed-by: Vikram Garhwal <vikram.garhwal@amd.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-23hw/core: skip loading debug on all failuresAlex Bennée
ELF_LOAD_FAILED is one of many negative return codes we can have. Lets treat any positive size_t as a success for loading. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20231120150833.2552739-10-alex.bennee@linaro.org>
2023-11-23target/nios2: Deprecate the Nios II architecturePhilippe Mathieu-Daudé
See commit 9ba1caf510 ("MAINTAINERS: Mark the Nios II CPU as orphan"), last contribution from Chris was in 2012 [1] and Marek in 2018 [2]. [1] https://lore.kernel.org/qemu-devel/1352607539-10455-2-git-send-email-crwulff@gmail.com/ [2] https://lore.kernel.org/qemu-devel/805fc7b5-03f0-56d4-abfd-ed010d4fa769@denx.de/ Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Marek Vasut <marex@denx.de> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20231117070250.32932-1-philmd@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20231120150833.2552739-6-alex.bennee@linaro.org>
2023-11-22riscv: Fix SiFive E CLINT clock frequencyRomán Cárdenas
If you check the manual of SiFive E310 (https://cdn.sparkfun.com/assets/7/f/0/2/7/fe310-g002-manual-v19p05.pdf), you can see in Figure 1 that the CLINT is connected to the real time clock, which also feeds the AON peripheral (they share the same clock). In page 43, the docs also say that the timer registers of the CLINT count ticks from the rtcclk. I am currently playing with bare metal applications both in QEMU and a physical SiFive E310 board and I confirm that the CLINT clock in the physical board runs at 32.768 kHz. In QEMU, the same app produces a completely different outcome, as sometimes a new CLINT interrupt is triggered before finishing other tasks. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1978 Signed-off-by: Rom\ufffd\ufffdn C\ufffd\ufffdrdenas <rcardenas.rod@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-ID: <20231117082840.55705-1-rcardenas.rod@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2023-11-22hw/riscv/virt.c: do create_fdt() earlier, add finalize_fdt()Daniel Henrique Barboza
Commit 49554856f0 fixed a problem, where TPM devices were not appearing in the FDT, by delaying the FDT creation up until virt_machine_done(). This create a side effect (see gitlab #1925) - devices that need access to the '/chosen' FDT node during realize() stopped working because, at that point, we don't have a FDT. This happens because our FDT creation is monolithic, but it doesn't need to be. We can add the needed FDT components for realize() time and, at the same time, do another FDT round where we account for dynamic sysbus devices. In other words, the problem fixed by 49554856f0 could also be fixed by postponing only create_fdt_sockets() and its dependencies, leaving everything else from create_fdt() to be done during init(). Split the FDT creation in two parts: - create_fdt(), now moved back to virt_machine_init(), will create FDT nodes that doesn't depend on additional (dynamic) devices from the sysbus; - a new finalize_fdt() step is added, where create_fdt_sockets() and friends is executed, accounting for the dynamic sysbus devices that were added during realize(). This will make both use cases happy: TPM devices are still working as intended, and devices such as 'guest-loader' have a FDT to work on during realize(). Fixes: 49554856f0 ("riscv: Generate devicetree only after machine initialization is complete") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1925 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20231110172559.73209-1-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2023-11-21Merge tag 'pull-xenfv-20231121' of git://git.infradead.org/users/dwmw2/qemu ↵Stefan Hajnoczi
into staging Xen fixes for 8.2-rc1 • Disable default serial when xen-console is used • Fix Coverity warning in xen-block # -----BEGIN PGP SIGNATURE----- # # iQJIBAABCAAyFiEEvgfZ/VSAmrLEsP9fY3Ys2mfi81kFAmVcmrAUHGR3bXcyQGlu # ZnJhZGVhZC5vcmcACgkQY3Ys2mfi81njqg/8DFr03kVfwRujIZXDROoq40vjgdOF # MoGgowDNapliXiecVcHzdvFXgRxwr9bhpX5eDEtfgROoH8mbPPd4YZJHdPNM0Yc3 # 0hoSWrIYocsYRAIoozXrtsNw8ep2vSEPNv5+CIVYkkie/mLs02cy43q09cJDzABx # DvmSfC5o5JCs/x3qPLM6ydhnTaUipuPt1wnG9xaJLWgm/U9pK6Ba9w1eNGn8EE7m # ekzpv9lYfCd/KbPogtXAEd7nkCOi/lKQVJmU7auXFi8FKwZNoKOYl3cTVln/EFmT # az3qLSHgOZwElNQEYn0mBa/RgAQ2K9X7n12TgxG30VSUmajxJnl/eKy4ISyaAmwY # vNVhdsXQICqM4OYaD2j8RiXX5YNtIC+MBb7nlUN7invKXE9ZylHbXvOstkUCjQ34 # x9CMVIibPoWk7XGUX+r7KUSwSQnpelVbqBWltkmgNjYuUIShDT6r5cOrYdM2orii # UYOqPJqchbEDNoGwJK45EOSn8Ss5geAWuM7dFL0AuwZAbcKAqGG6vihPnDJyhnWA # EPv2/5h2Vi24fqeWz3W+hckm8LXrc2Ow8A0rY3WAz7CvmBTgYCPx4d4kdTU6Gysn # i8DRoKMhZS9WvHPPxY1v8+ysG1UCCNFe4qH0Wgv+ubSbr5GaK2igWIBQ5bXnuYL8 # R4Ef5pPLpa2jiF4= # =cWon # -----END PGP SIGNATURE----- # gpg: Signature made Tue 21 Nov 2023 06:55:28 EST # gpg: using RSA key BE07D9FD54809AB2C4B0FF5F63762CDA67E2F359 # gpg: issuer "dwmw2@infradead.org" # gpg: Good signature from "David Woodhouse <dwmw2@infradead.org>" [unknown] # gpg: aka "David Woodhouse <dwmw2@exim.org>" [unknown] # gpg: aka "David Woodhouse <david@woodhou.se>" [unknown] # gpg: aka "David Woodhouse <dwmw2@kernel.org>" [unknown] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: BE07 D9FD 5480 9AB2 C4B0 FF5F 6376 2CDA 67E2 F359 * tag 'pull-xenfv-20231121' of git://git.infradead.org/users/dwmw2/qemu: hw/xen: clean up xen_block_find_free_vdev() to avoid Coverity false positive vl: disable default serial when xen-console is enabled Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>