aboutsummaryrefslogtreecommitdiff
path: root/hw/misc
AgeCommit message (Collapse)AuthorFilesLines
5 dayshw/misc/aspeed_hace: Fix buffer overflow in has_padding functionJamin Lin1-0/+5
The maximum padding size is either 64 or 128 bytes and should always be smaller than "req_len". If "padding_size" exceeds "req_len", then "req_len - padding_size" underflows due to "uint32_t" data type, leading to a large incorrect value (e.g., `0xFFXXXXXX`). This causes an out-of-bounds memory access, potentially leading to a buffer overflow. Added a check to ensure "padding_size" does not exceed "req_len" before computing "pad_offset". This prevents "req_len - padding_size" from underflowing and avoids accessing invalid memory. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Fixes: 5cd7d8564a8b563da724b9e6264c967f0a091afa ("aspeed/hace: Support AST2600 HACE ") Link: https://lore.kernel.org/qemu-devel/20250321092623.2097234-3-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
11 dayshw/misc: use extract64 instead of 1 << iTigran Sogomonian1-1/+1
1 << i is casted to uint64_t while bitwise and with val. So this value may become 0xffffffff80000000 but only 31th "start" bit is required. Use the bitfield extract() API instead. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Tigran Sogomonian <tsogomonian@astralinux.ru> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Link: https://lore.kernel.org/r/20241227104618.2526-1-tsogomonian@astralinux.ru Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-03-09hw/misc/aspeed_scu: Add Support for AST2700/AST2750 A1 Silicon RevisionsJamin Lin1-0/+2
Added new definitions for AST2700_A1_SILICON_REV and AST2750_A1_SILICON_REV to identify the A1 silicon revisions. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250307035945.3698802-19-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-03-09hw/misc/aspeed_scu: Fix the hw-strap1 cannot be set in the SOC layer for AST2700Jamin Lin1-2/+1
There is one hw_strap1 register in the SCU (CPU DIE) and another hw_strap1 register in the SCUIO (IO DIE). In the "ast2700_a0_resets" function, the hardcoded value "0x00000800" is set in SCU hw-strap1 (CPU DIE), and in "ast2700_a0_resets_io" the hardcoded value "0x00000504" is set in SCUIO hw-strap1 (IO DIE). Both values cannot be set via the SOC layer. The value of "s->hw_strap1" is set by the SOC layer via the "hw-strap1" property. Update the "aspeed_ast2700_scu_reset" function to set the value of "s->hw_strap1" in both the SCU and SCUIO hw-strap1 registers. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Nabih Estefan <nabihestefan@google.com> Link: https://lore.kernel.org/qemu-devel/20250304064710.2128993-5-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-03-09hw/misc/aspeed_scu: Fix the revision ID cannot be set in the SOC layer for ↵Jamin Lin1-2/+1
AST2700 According to the design of the AST2600, it has a Silicon Revision ID Register, specifically SCU004 and SCU014, to set the Revision ID for the AST2600. For the AST2600 A3, SCU004 is set to 0x05030303 and SCU014 is set to 0x05030303. In the "aspeed_ast2600_scu_reset" function, the hardcoded value "AST2600_A3_SILICON_REV" is set in SCU004, and "s->silicon_rev" is set in SCU014. The value of "s->silicon_rev" is set by the SOC layer via the "silicon-rev" property. However, the design of the AST2700 is different. There are two SCU controllers: SCU0 (CPU Die) and SCU1 (IO Die). In the AST2700, the firmware reads the SCU Silicon Revision ID register (SCU0_000) and the SCUIO Silicon Revision ID register (SCU1_000), combining them into a single 64-bit value. The upper 32 bits represent the SCUIO, while the lower 32 bits correspond to the SCU. For example, the AST2700-A1 revision is represented as 0x0601010306010103. SCUIO_000 occupies bits [63:32] with a value of 0x06010103 and SCU_000 occupies bits [31:0] with a value of 0x06010103. Reference: https://github.com/AspeedTech-BMC/u-boot/blob/aspeed-master-v2023.10/arch/arm/mach-aspeed/ast2700/cpu-info.c Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Tested-by: Nabih Estefan <nabihestefan@google.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250304064710.2128993-3-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-03-09hw/misc/aspeed_scu: Skipping dram_init in u-bootJamin Lin1-0/+2
Setting BIT6 in VGA0 SCRATCH register will indicate that the ddr traning is done, therefore skipping the u-boot-spl dram_init() process. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Nabih Estefan <nabihestefan@google.com> Link: https://lore.kernel.org/qemu-devel/20250304064710.2128993-2-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-03-09hw/misc/aspeed_hace: Fix boot issue in the Crypto Manager Self TestJamin Lin1-0/+23
Currently, it does not support the CRYPT command. Instead, it only sends an interrupt to notify the firmware that the crypt command has completed. It is a temporary workaround to resolve the boot issue in the Crypto Manager Self Test. Introduce a new "use_crypt_workaround" class attribute and set it to true in the AST2700 HACE model to enable this workaround by default for AST2700. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250225075622.305515-5-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-03-09hw/misc/aspeed_hace: Add AST2700 supportJamin Lin1-0/+20
Introduce a new ast2700 class to support AST2700. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au> Link: https://lore.kernel.org/qemu-devel/20250225075622.305515-3-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-03-09hw/misc/aspeed_hace: Fix coding styleJamin Lin1-4/+8
Fix coding style issues from checkpatch.pl. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250225075622.305515-2-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-03-06qdev: Change values of PropertyInfo member @type to be QAPI typesMarkus Armbruster1-1/+1
PropertyInfo member @type is externally visible via QMP device-list-properties and qom-list-properies. Its meaning is not documented at its definition. It gets passed as @type argument to object_property_add() and object_class_property_add(). This argument's documentation isn't of much help, either: * @type: the type name of the property. This namespace is pretty loosely * defined. Sub namespaces are constructed by using a prefix and then * to angle brackets. For instance, the type 'virtio-net-pci' in the * 'link' namespace would be 'link<virtio-net-pci>'. The two QMP commands document it as # @type: the type of the property. This will typically come in one of # four forms: # # 1) A primitive type such as 'u8', 'u16', 'bool', 'str', or # 'double'. These types are mapped to the appropriate JSON # type. # # 2) A child type in the form 'child<subtype>' where subtype is a # qdev device type name. Child properties create the # composition tree. # # 3) A link type in the form 'link<subtype>' where subtype is a # qdev device type name. Link properties form the device model # graph. "Typically come in one of four forms" followed by three items inspires the level of trust that is appropriate here. Clean up a bunch of funnies: * qdev_prop_fdc_drive_type.type is "FdcDriveType". Its .enum_table refers to QAPI type "FloppyDriveType". So use that. * qdev_prop_reserved_region is "reserved_region". Its only user is an array property called "reserved-regions". Its .set() visits str. So change @type to "str". * trng_prop_fault_event_set.type is "uint32:bits". Its .set() visits uint32, so change @type to "uint32". If we believe mentioning it's actually bits is useful, the proper place would be .description. * ccw_loadparm.type is "ccw_loadparm". It's users are properties called "loadparm". Its .set() visits str. So change @type to "str". * qdev_prop_nv_gpudirect_clique.type is "uint4". Its set() visits uint8, so change @type to "uint8". If we believe mentioning the range is useful, the proper place would be .description. * s390_pci_fid_propinfo.type is "zpci_fid". Its .set() visits uint32. So change type to that, and move the "zpci_fid" to .description. This is admittedly a lousy description, but it's still an improvement; for instance, output of -device zpci,help changes from fid=<zpci_fid> to fid=<uint32> - zpci_fid * Similarly for a raft of PropertyInfo in target/riscv/cpu.c. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20250227085601.4140852-5-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> [Commit message typo fixed]
2025-03-06qdev: Rename PropertyInfo member @name to @typeMarkus Armbruster1-1/+1
PropertyInfo member @name becomes ObjectProperty member @type, while Property member @name becomes ObjectProperty member @name. Rename the former. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20250227085601.4140852-4-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> [One missed instance of @type fixed]
2025-03-05hw/misc/macio/gpio: Add constants for register bitsBALATON Zoltan1-7/+12
Add named constants for register bit values that should make it easier to understand what these mean. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-ID: <20250224141026.3B36C4E6010@zero.eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-03-05hw/misc/macio: Improve trace logsBALATON Zoltan2-2/+3
Add macio_gpio_read trace event and use that in macio_gpio_read() instead of macio_gpio_write. Also change log message to match macio_timer_{read,write}. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250222122850.9D8B84E603D@zero.eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-03-04hw/misc/pvpanic: Add MMIO interfaceAlexander Graf3-0/+65
In addition to the ISA and PCI variants of pvpanic, let's add an MMIO platform device that we can use in embedded arm environments. Signed-off-by: Alexander Graf <graf@amazon.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Tested-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-ID: <20241223221645.29911-8-phil@philjordan.eu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-02-25hw/arm/fsl-imx8mp: Implement clock treeBernhard Beschow4-0/+343
Fixes quite a few stack traces during the Linux boot process. Also provides the clocks for devices added later, e.g. enet1. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-id: 20250223114708.1780-6-shentey@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-02-25hw/gpio/pca955*: Move Kconfig switches next to implementationsBernhard Beschow1-8/+0
The move of the Kconfig bits to hw/gpio is fixing a bug in 6328d8ffa6cb9d ("misc/pca955*: Move models under hw/gpio"), which moved the code but forgot to move the Kconfig sections. Fixes: 6328d8ffa6cb9d "misc/pca955*: Move models under hw/gpio" Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-id: 20250223114708.1780-4-shentey@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-02-25hw/misc/npcm_clk: fix buffer-overflowPierrick Bouvier1-2/+3
Regression introduced by cf76c4 (hw/misc: Add nr_regs and cold_reset_values to NPCM CLK) cold_reset_values has a different size, depending on device used (NPCM7xx vs NPCM8xx). However, s->regs has a fixed size, which matches NPCM8xx. Thus, when initializing a NPCM7xx, we go past cold_reset_values ending. Report by asan: ==2066==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55d68a3e97f0 at pc 0x7fcaf2b2d14b bp 0x7ffff0cc3890 sp 0x7ffff0cc3040 READ of size 196 at 0x55d68a3e97f0 thread T0 #0 0x7fcaf2b2d14a in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 #1 0x55d688447e0d in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29 #2 0x55d688447e0d in npcm_clk_enter_reset ../hw/misc/npcm_clk.c:968 #3 0x55d6899b7213 in resettable_phase_enter ../hw/core/resettable.c:136 #4 0x55d6899a1ef7 in bus_reset_child_foreach ../hw/core/bus.c:97 #5 0x55d6899b717d in resettable_child_foreach ../hw/core/resettable.c:92 #6 0x55d6899b717d in resettable_phase_enter ../hw/core/resettable.c:129 #7 0x55d6899b4ead in resettable_container_child_foreach ../hw/core/resetcontainer.c:54 #8 0x55d6899b717d in resettable_child_foreach ../hw/core/resettable.c:92 #9 0x55d6899b717d in resettable_phase_enter ../hw/core/resettable.c:129 #10 0x55d6899b7bfa in resettable_assert_reset ../hw/core/resettable.c:55 #11 0x55d6899b8666 in resettable_reset ../hw/core/resettable.c:45 #12 0x55d688d15cd2 in qemu_system_reset ../system/runstate.c:527 #13 0x55d687fc5edd in qdev_machine_creation_done ../hw/core/machine.c:1738 #14 0x55d688d209bd in qemu_machine_creation_done ../system/vl.c:2779 #15 0x55d688d209bd in qmp_x_exit_preconfig ../system/vl.c:2807 #16 0x55d688d281fb in qemu_init ../system/vl.c:3838 #17 0x55d687ceab12 in main ../system/main.c:68 #18 0x7fcaef006249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) #19 0x7fcaef006304 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x27304) #20 0x55d687cf0010 in _start (/home/runner/work/qemu-ci/qemu-ci/build/qemu-system-arm+0x371c010) 0x55d68a3e97f0 is located 0 bytes to the right of global variable 'npcm7xx_cold_reset_values' defined in '../hw/misc/npcm_clk.c:134:23' (0x55d68a3e9780) of size 112 Impacted tests: Summary of Failures: check: 2/747 qemu:qtest+qtest-aarch64 / qtest-aarch64/qom-test ERROR 9.28s killed by signal 6 SIGABRT 4/747 qemu:qtest+qtest-arm / qtest-arm/qom-test ERROR 7.82s killed by signal 6 SIGABRT 32/747 qemu:qtest+qtest-aarch64 / qtest-aarch64/device-introspect-test ERROR 10.91s killed by signal 6 SIGABRT 35/747 qemu:qtest+qtest-arm / qtest-arm/device-introspect-test ERROR 11.33s killed by signal 6 SIGABRT 114/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_pwm-test ERROR 0.98s killed by signal 6 SIGABRT 115/747 qemu:qtest+qtest-aarch64 / qtest-aarch64/test-hmp ERROR 2.95s killed by signal 6 SIGABRT 117/747 qemu:qtest+qtest-arm / qtest-arm/test-hmp ERROR 2.54s killed by signal 6 SIGABRT 151/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_watchdog_timer-test ERROR 0.96s killed by signal 6 SIGABRT 247/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_adc-test ERROR 0.96s killed by signal 6 SIGABRT 248/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_gpio-test ERROR 1.05s killed by signal 6 SIGABRT 249/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_rng-test ERROR 0.97s killed by signal 6 SIGABRT 250/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_sdhci-test ERROR 0.97s killed by signal 6 SIGABRT 251/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_smbus-test ERROR 0.89s killed by signal 6 SIGABRT 252/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_timer-test ERROR 1.09s killed by signal 6 SIGABRT 253/747 qemu:qtest+qtest-arm / qtest-arm/npcm_gmac-test ERROR 1.12s killed by signal 6 SIGABRT 255/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_emc-test ERROR 1.05s killed by signal 6 SIGABRT check-functional: 22/203 qemu:func-thorough+func-arm-thorough+thorough / func-arm-arm_quanta_gsj ERROR 0.79s exit status 1 38/203 qemu:func-quick+func-aarch64 / func-aarch64-migration ERROR 1.97s exit status 1 45/203 qemu:func-quick+func-arm / func-arm-migration ERROR 1.90s exit status 1 Fixes: cf76c4e174e1 ("hw/misc: Add nr_regs and cold_reset_values to NPCM CLK") Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Hao Wu <wuhaotsh@google.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-02-20hw/misc: Support NPCM8XX CLK Module RegistersHao Wu1-6/+111
NPCM8XX adds a few new registers and have a different set of reset values to the CLK modules. This patch supports them. This patch doesn't support the new clock values generated by these registers. Currently no modules use these new clock values so they are not necessary at this point. Implementation of these clocks might be required when implementing these modules. Reviewed-by: Titus Rwantare <titusr@google.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Hao Wu <wuhaotsh@google.com> Message-id: 20250219184609.1839281-14-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-02-20hw/misc: Add nr_regs and cold_reset_values to NPCM CLKHao Wu2-6/+14
These 2 values are different between NPCM7XX and NPCM8XX CLKs. So we add them to the class and assign different values to them. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Hao Wu <wuhaotsh@google.com> Message-id: 20250219184609.1839281-13-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-02-20hw/misc: Move NPCM7XX CLK to NPCM CLKHao Wu2-49/+63
A lot of NPCM7XX and NPCM8XX CLK modules share the same code, this commit moves the NPCM7XX CLK to NPCM CLK for these properties. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Hao Wu <wuhaotsh@google.com> Message-id: 20250219184609.1839281-12-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-02-20hw/misc: Rename npcm7xx_clk to npcm_clkHao Wu2-2/+2
NPCM7XX and NPCM8XX have a different set of CLK registers. This commit changes the name of the clk files to be used by both NPCM7XX and NPCM8XX CLK modules. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Hao Wu <wuhaotsh@google.com> Message-id: 20250219184609.1839281-11-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-02-20hw/misc: Support 8-bytes memop in NPCM GCR moduleHao Wu2-24/+74
The NPCM8xx GCR device can be accessed with 64-bit memory operations. This patch supports that. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Philippe Mathieu-Daude <philmd@linaro.org> Message-id: 20250219184609.1839281-10-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-02-20hw/misc: Store DRAM size in NPCM8XX GCR ModuleHao Wu1-0/+24
NPCM8XX boot block stores the DRAM size in SCRPAD_B register in GCR module. Since we don't simulate a detailed memory controller, we need to store this information directly similar to the NPCM7XX's INCTR3 register. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Hao Wu <wuhaotsh@google.com> Message-id: 20250219184609.1839281-9-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-02-20hw/misc: Add support for NPCM8XX GCRHao Wu1-3/+130
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Hao Wu <wuhaotsh@google.com> Message-id: 20250219184609.1839281-8-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-02-20hw/misc: Add nr_regs and cold_reset_values to NPCM GCRHao Wu1-11/+16
These 2 values are different between NPCM7XX and NPCM8XX GCRs. So we add them to the class and assign different values to them. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Hao Wu <wuhaotsh@google.com> Message-id: 20250219184609.1839281-7-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-02-20hw/misc: Move NPCM7XX GCR to NPCM GCRHao Wu2-44/+54
A lot of NPCM7XX and NPCM8XX GCR modules share the same code, this commit moves the NPCM7XX GCR to NPCM GCR for these properties. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Hao Wu <wuhaotsh@google.com> Message-id: 20250219184609.1839281-6-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-02-20hw/misc: Rename npcm7xx_gcr to npcm_gcrHao Wu2-2/+2
NPCM7XX and NPCM8XX have a different set of GCRs and the GCR module needs to fit both. This commit changes the name of the GCR module. Future commits will add the support for NPCM8XX GCRs. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Hao Wu <wuhaotsh@google.com> Message-id: 20250219184609.1839281-5-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-02-16hw/arm: Mark Allwinner Technology devices as little-endianPhilippe Mathieu-Daudé10-16/+16
These devices are only used by the ARM targets, which are only built as little-endian. Therefore the DEVICE_NATIVE_ENDIAN definition expand to DEVICE_LITTLE_ENDIAN (besides, the DEVICE_BIG_ENDIAN case isn't tested). Simplify directly using DEVICE_LITTLE_ENDIAN. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250212113938.38692-2-philmd@linaro.org>
2025-02-02Merge tag 'hw-misc-20250131' of https://github.com/philmd/qemu into stagingStefan Hajnoczi2-0/+13
Misc HW patches - Remove uses of &first_cpu in rx-gdbsim and loongson3_virt machines (Philippe) - Convert few legacy qemu_allocate_irqs to qemu_init_irqs (Philippe) - Add tracing events in i2c-echo device (Titus) - Fix debug format string in USB EHCI (Zoltan) - Rework loader API to remove its target_words_bigendian() call (Philippe) - QOMify OMAP MMC device (Peter) - Remove legacy SD Card APIs (Peter) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmedOmkACgkQ4+MsLN6t # wN4qHhAAtL3vmk6hQgKD76bSaB3CDEdHsnS7qqeRVVmbr7pQL9D6yyXzkjJBzZtk # nG7ubhoS5WFeKswzD8tY/mgP25hntnq38TNrRxDrpRNdFYF+a2cncpRGfgzk0z/9 # nme/BuUx6fNowV8MVGLNOLvaDCeDHl9biTLJmcQyqwlHy9l9Wi6DSa6Xi9ZQWlHi # fxYVeuQ7HYlKwhiu3mqpfNeauIgMSWz8V48ETCrFnjMWmiF1k1L0GccWDS8zpPDk # QkdOxHC4eVMxk0d2458eUXeqo/izfzoc7Z9hW6W8cyI69y4m011xqANd/udTS03E # HMcG9Ks0E+Yw8NGoErOP7zu8yFVEzCn2BKhH/wrUHBC2UfP99vNR/b8LNkg25y19 # IItOkMban0Oyr9KaNb1Ga+3pZIsyyil+shSYNHpWkfqk+TUpZkMUSaVHA9r1oB3V # u/dOO/lPLaWMvftKVXRl3K/Lfz4WF5cWjza5RratnzbBqqwr03CwjjBEuZIX/5ww # ATj/fV10OSHScxCqauYp8uuNSgEOKaJCJe2uEMaLvxn/O9ka0FQZ5CLUJ0yIKs/t # Tg4sS0QLgmpaXwSnscKoVE7aHWNFT1WomHI4SjWbwUQhmm0DmPizBZ2yX8dnSR24 # ubtzmxNYFWScrUTGQvbMhkU6I+Sc0Ca8APmPxErNV2mzF4p3CPE= # =Jvwi # -----END PGP SIGNATURE----- # gpg: Signature made Fri 31 Jan 2025 16:02:33 EST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'hw-misc-20250131' of https://github.com/philmd/qemu: (36 commits) hw/sd: Remove unused SDState::enable hw/sd: Remove unused legacy functions, stop killing mammoths hw/sd: Remove unused 'enable' method from SDCardClass hw/sd/omap_mmc: Untabify hw/sd/omap_mmc: Remove unused coverswitch qemu_irq hw/arm/omap1: Inline creation of MMC hw/sd/omap_mmc: Use similar API for "wire up omap_clk" to other OMAP devices hw/sd/omap_mmc: Convert to SDBus API hw/sd/omap_mmc: Convert output qemu_irqs to gpio and sysbus IRQ APIs hw/sd/omap_mmc: Convert remaining 'struct omap_mmc_s' uses to OMAPMMCState hw/sd/omap_mmc: Do a minimal conversion to QDev hw/loader: Pass ELFDATA endian order argument to load_elf() hw/loader: Pass ELFDATA endian order argument to load_elf_as() hw/loader: Pass ELFDATA endian order argument to load_elf_ram_sym() hw/loader: Clarify local variable name in load_elf_ram_sym() hw/loader: Remove unused load_elf_ram() hw/avr/boot: Replace load_elf_ram_sym() -> load_elf_as() hw/usb/hcd-ehci: Fix debug printf format string hw/misc/i2c-echo: add tracing hw/char/pci-multi: Convert legacy qemu_allocate_irqs to qemu_init_irq ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-01-31hw/misc/i2c-echo: add tracingTitus Rwantare2-0/+13
This has been useful when debugging and unsure if the guest is generating i2c traffic. Signed-off-by: Titus Rwantare <titusr@google.com> Reviewed-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250121105935.3069035-1-titusr@google.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-01-30licenses: Remove SPDX tags not being license identifier for LinaroPhilippe Mathieu-Daudé1-2/+3
Per [*]: "we're only interested in adopting SPDX for recording the licensing info, [not] any other SPDX metadata." Replace the 'SPDX-FileCopyrightText' and 'SPDX-FileContributor' tags added by Linaro by 'Copyright (c)' and 'Authors' words respectively. [*] https://lore.kernel.org/qemu-devel/20241007154548.1144961-4-berrange@redhat.com/ Inspired-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2025-01-13hw/misc/imx6_src: Convert DPRINTF() to trace eventsBernhard Beschow2-18/+11
Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250108092538.11474-14-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-01-13hw/misc/vmcoreinfo: Convert to three-phase reset interfacePhilippe Mathieu-Daudé1-3/+5
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20241219153857.57450-6-philmd@linaro.org>
2025-01-13hw/misc/vmcoreinfo: Rename VMCOREINFO_DEVICE -> TYPE_VMCOREINFOPhilippe Mathieu-Daudé1-3/+3
Follow the assumed QOM type definition style, prefixing with 'TYPE_', and dropping the '_DEVICE' suffix which doesn't add any value. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20250102132624.53443-1-philmd@linaro.org>
2025-01-13hw/misc: cast rpm to uint64_tTigran Sogomonian1-2/+3
The value of an arithmetic expression 'rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION' is a subject to overflow because its operands are not cast to a larger data type before performing arithmetic. Thus, need to cast rpm to uint64_t. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Tigran Sogomonian <tsogomonian@astralinux.ru> Reviewed-by: Patrick Leis <venture@google.com> Reviewed-by: Hao Wu <wuhaotsh@google.com> Message-id: 20241226130311.1349-1-tsogomonian@astralinux.ru Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-01-13hw/arm_sysctl: fix extracting 31th bit of valAnastasia Belova1-1/+1
1 << 31 is casted to uint64_t while bitwise and with val. So this value may become 0xffffffff80000000 but only 31th "start" bit is required. This is not possible in practice because the MemoryRegionOps uses the default max access size of 4 bytes and so none of the upper bytes of val will be set, but the bitfield extract API is clearer anyway. Use the bitfield extract() API instead. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Anastasia Belova <abelova@astralinux.ru> Message-id: 20241220125429.7552-1-abelova@astralinux.ru Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: add clarification to commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-12-31hw/misc/vmcoreinfo: Rename opaque pointer as 'opaque'Philippe Mathieu-Daudé1-5/+5
Both QEMUResetHandler and FWCfgWriteCallback take an opaque pointer argument, no need to cast. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20241219153857.57450-3-philmd@linaro.org>
2024-12-31hw/misc/vmcoreinfo: Declare QOM type using DEFINE_TYPES macroPhilippe Mathieu-Daudé1-11/+8
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20241219153857.57450-2-philmd@linaro.org>
2024-12-31hw/misc/ivshmem: Rename ivshmem to ivshmem-pciGustavo Romero2-1/+1
Because now there is also an MMIO ivshmem device (ivshmem-flat.c), and ivshmem.c is a PCI specific implementation, rename it to ivshmem-pci.c. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org> Message-ID: <20241216141818.111255-5-gustavo.romero@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-12-31hw/misc/ivshmem-flat: Add ivshmem-flat deviceGustavo Romero4-0/+482
Add a new device, ivshmem-flat, which is similar to the ivshmem PCI but does not require a PCI bus. It's meant to be used on machines like those with Cortex-M MCUs, which usually lack a PCI/PCIe bus, e.g. lm3s6965evb and mps2-an385. The device currently only supports the sysbus bus. The new device, just like the ivshmem PCI device, supports both peer notification via hardware interrupts and shared memory. The device shared memory size can be set using the 'shmem-size' option and it defaults to 4 MiB, which is the default size of shmem allocated by the ivshmem server. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1134 Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org> [PMD: Rebased updating Property and using DEFINE_TYPES macro] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20241216141818.111255-2-gustavo.romero@linaro.org>
2024-12-21Merge tag 'exec-20241220' of https://github.com/philmd/qemu into stagingStefan Hajnoczi26-36/+36
Accel & Exec patch queue - Ignore writes to CNTP_CTL_EL0 on HVF ARM (Alexander) - Add '-d invalid_mem' logging option (Zoltan) - Create QOM containers explicitly (Peter) - Rename sysemu/ -> system/ (Philippe) - Re-orderning of include/exec/ headers (Philippe) Move a lot of declarations from these legacy mixed bag headers: . "exec/cpu-all.h" . "exec/cpu-common.h" . "exec/cpu-defs.h" . "exec/exec-all.h" . "exec/translate-all" to these more specific ones: . "exec/page-protection.h" . "exec/translation-block.h" . "user/cpu_loop.h" . "user/guest-host.h" . "user/page-protection.h" # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmdlnyAACgkQ4+MsLN6t # wN6mBw//QFWi7CrU+bb8KMM53kOU9C507tjn99LLGFb5or73/umDsw6eo/b8DHBt # KIwGLgATel42oojKfNKavtAzLK5rOrywpboPDpa3SNeF1onW+99NGJ52LQUqIX6K # A6bS0fPdGG9ZzEuPpbjDXlp++0yhDcdSgZsS42fEsT7Dyj5gzJYlqpqhiXGqpsn8 # 4Y0UMxSL21K3HEexlzw2hsoOBFA3tUm2ujNDhNkt8QASr85yQVLCypABJnuoe/// # 5Ojl5wTBeDwhANET0rhwHK8eIYaNboiM9fHopJYhvyw1bz6yAu9jQwzF/MrL3s/r # xa4OBHBy5mq2hQV9Shcl3UfCQdk/vDaYaWpgzJGX8stgMGYfnfej1SIl8haJIfcl # VMX8/jEFdYbjhO4AeGRYcBzWjEJymkDJZoiSWp2NuEDi6jqIW+7yW1q0Rnlg9lay # ShAqLK5Pv4zUw3t0Jy3qv9KSW8sbs6PQxtzXjk8p97rTf76BJ2pF8sv1tVzmsidP # 9L92Hv5O34IqzBu2oATOUZYJk89YGmTIUSLkpT7asJZpBLwNM2qLp5jO00WVU0Sd # +kAn324guYPkko/TVnjC/AY7CMu55EOtD9NU35k3mUAnxXT9oDUeL4NlYtfgrJx6 # x1Nzr2FkS68+wlPAFKNSSU5lTjsjNaFM0bIJ4LCNtenJVP+SnRo= # =cjz8 # -----END PGP SIGNATURE----- # gpg: Signature made Fri 20 Dec 2024 11:45:20 EST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'exec-20241220' of https://github.com/philmd/qemu: (59 commits) util/qemu-timer: fix indentation meson: Do not define CONFIG_DEVICES on user emulation system/accel-ops: Remove unnecessary 'exec/cpu-common.h' header system/numa: Remove unnecessary 'exec/cpu-common.h' header hw/xen: Remove unnecessary 'exec/cpu-common.h' header target/mips: Drop left-over comment about Jazz machine target/mips: Remove tswap() calls in semihosting uhi_fstat_cb() target/xtensa: Remove tswap() calls in semihosting simcall() helper accel/tcg: Un-inline translator_is_same_page() accel/tcg: Include missing 'exec/translation-block.h' header accel/tcg: Move tcg_cflags_has/set() to 'exec/translation-block.h' accel/tcg: Restrict curr_cflags() declaration to 'internal-common.h' qemu/coroutine: Include missing 'qemu/atomic.h' header exec/translation-block: Include missing 'qemu/atomic.h' header accel/tcg: Declare cpu_loop_exit_requested() in 'exec/cpu-common.h' exec/cpu-all: Include 'cpu.h' earlier so MMU_USER_IDX is always defined target/sparc: Move sparc_restore_state_to_opc() to cpu.c target/sparc: Uninline cpu_get_tb_cpu_state() target/loongarch: Declare loongarch_cpu_dump_state() locally user: Move various declarations out of 'exec/exec-all.h' ... Conflicts: hw/char/riscv_htif.c hw/intc/riscv_aplic.c target/s390x/cpu.c Apply sysemu header path changes to not in the pull request. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2024-12-20include: Rename sysemu/ -> system/Philippe Mathieu-Daudé26-36/+36
Headers in include/sysemu/ are not only related to system *emulation*, they are also used by virtualization. Rename as system/ which is clearer. Files renamed manually then mechanical change using sed tool. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Lei Yang <leiyang@redhat.com> Message-Id: <20241203172445.28576-1-philmd@linaro.org>
2024-12-19Constify all opaque Property pointersRichard Henderson1-1/+1
Via sed "s/ Property [*]/ const Property */". The opaque pointers passed to ObjectProperty callbacks are the last instances of non-const Property pointers in the tree. For the most part, these callbacks only use object_field_prop_ptr, which now takes a const pointer itself. This logically should have accompanied d36f165d952 which allowed const Property to be registered. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Lei Yang <leiyang@redhat.com> Link: https://lore.kernel.org/r/20241218134251.4724-25-richard.henderson@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-12-19include/hw/qdev-properties: Remove DEFINE_PROP_END_OF_LISTRichard Henderson53-58/+0
Now that all of the Property arrays are counted, we can remove the terminator object from each array. Update the assertions in device_class_set_props to match. With struct Property being 88 bytes, this was a rather large form of terminator. Saves 30k from qemu-system-aarch64. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Lei Yang <leiyang@redhat.com> Link: https://lore.kernel.org/r/20241218134251.4724-21-richard.henderson@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-12-15hw/misc: Constify all PropertyRichard Henderson52-56/+56
Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-12-15hw/misc/xlnx-versal-trng: Constify trng_propsRichard Henderson1-3/+3
Use DEFINE_PROP_UNSIGNED instead of DEFINE_PROP_UINT64 so that we can set the PropertyInfo during initialization, instead of updating within trng_class_init. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-11-18hw/misc/nrf51_rng: Don't use BIT_MASK() when we mean BIT()Peter Maydell1-5/+5
The BIT_MASK() macro from bitops.h provides the mask of a bit within a particular word of a multi-word bit array; it is intended to be used with its counterpart BIT_WORD() that gives the index of the word in the array. In nrf51_rng we are using it for cases where we have a bit number that we know is the index of a bit within a single word (in fact, it happens that all the bit numbers we pass to it are zero). This happens to give the right answer, but the macro that actually does the job we want here is BIT(). Use BIT() instead of BIT_MASK(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20241108135644.4007151-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-10-24hw/misc/aspeed_hace: Fix SG Accumulative hashingAlejandro Zeise1-45/+59
Make the Aspeed HACE module use the new qcrypto accumulative hashing functions when in scatter-gather accumulative mode. A hash context will maintain a "running-hash" as each scatter-gather chunk is received. Previously each scatter-gather "chunk" was cached so the hash could be computed once the final chunk was received. However, the cache was a shallow copy, so once the guest overwrote the memory provided to HACE the final hash would not be correct. Possibly related to: https://gitlab.com/qemu-project/qemu/-/issues/1121 Buglink: https://github.com/openbmc/qemu/issues/36 Signed-off-by: Alejandro Zeise <alejandro.zeise@seagate.com> [ clg: - Checkpatch fixes - Reworked qcrypto_hash*() error reports in do_hash_operation() ] Signed-off-by: Cédric Le Goater <clg@redhat.com> Acked-by: Andrew Jeffery <andrew@codeconstruct.com.au> Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Joel Stanley <joel@jms.id.au>
2024-10-15hw/block: Remove eccPeter Maydell1-1/+0
The ecc.c code was used only by the PXA2xx and OMAP2 SoC devices, which we have removed, so it is now completely unused. Note that hw/misc/eccmemctl.c does not in fact use any of the code frome ecc.c, so that KConfig dependency was incorrect. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20241003140010.1653808-6-peter.maydell@linaro.org
2024-10-15hw/misc: Create STM32L4x5 SYSCFG clockInès Varhol1-2/+17
This commit creates a clock in STM32L4x5 SYSCFG and wires it up to the corresponding clock from STM32L4x5 RCC. Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Luc Michel <luc@lmichel.fr> Message-id: 20241003081105.40836-2-ines.varhol@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.1 at 2025-03-28 19:03:57 +0000