aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2022-07-06scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216)Mauro Matteo Cascella1-1/+2
Set current_req->req to NULL to prevent reusing a free'd buffer in case of repeated SCSI cancel requests. Thanks to Thomas Huth for suggesting the patch. Fixes: CVE-2022-0216 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20220705200543.2366809-1-mcascell@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-07-06e1000: set RX descriptor status in a separate operationDing Hui1-1/+4
The code of setting RX descriptor status field maybe work fine in previously, however with the update of glibc version, it shows two issues when guest using dpdk receive packets: 1. The dpdk has a certain probability getting wrong buffer_addr this impact may be not obvious, such as lost a packet once in a while 2. The dpdk may consume a packet twice when scan the RX desc queue over again this impact will lead a infinite wait in Qemu, since the RDT (tail pointer) be inscreased to equal to RDH by unexpected, which regard as the RX desc queue is full Write a whole of RX desc with DD flag on is not quite correct, because when the underlying implementation of memcpy using XMM registers to copy e1000_rx_desc (when AVX or something else CPU feature is usable), the bytes order of desc writing to memory is indeterminacy We can use full-scale test case to reproduce the issue-2 by https://github.com/BASM/qemu_dpdk_e1000_test (thanks to Leonid Myravjev) I also write a POC test case at https://github.com/cdkey/e1000_poc which can reproduce both of them, and easy to verify the patch effect. The hw watchpoint also shows that, when Qemu using XMM related instructions writing 16 bytes e1000_rx_desc, concurrent with DPDK using movb writing 1 byte status, the final result of writing to memory will be one of them, if it made by Qemu which DD flag is on, DPDK will consume it again. Setting DD status in a separate operation, can prevent the impact of disorder memory writing by memcpy, also avoid unexpected data when concurrent writing status by qemu and guest dpdk. Links: https://lore.kernel.org/qemu-devel/20200102110504.GG121208@stefanha-x1.localdomain/T/ Reported-by: Leonid Myravjev <asm@asm.pp.ru> Cc: Stefan Hajnoczi <stefanha@gmail.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: qemu-stable@nongnu.org Tested-by: Jing Zhang <zhangjing@sangfor.com.cn> Reviewed-by: Frank Lee <lifan38153@sangfor.com.cn> Signed-off-by: Ding Hui <dinghui@sangfor.com.cn> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-07-05xen/pass-through: don't create needless register groupChuck Zmudzinski1-5/+9
Currently we are creating a register group for the Intel IGD OpRegion for every device we pass through, but the XEN_PCI_INTEL_OPREGION register group is only valid for an Intel IGD. Add a check to make sure the device is an Intel IGD and a check that the administrator has enabled gfx_passthru in the xl domain configuration. Require both checks to be true before creating the register group. Use the existing is_igd_vga_passthrough() function to check for a graphics device from any vendor and that the administrator enabled gfx_passthru in the xl domain configuration, but further require that the vendor be Intel, because only Intel IGD devices have an Intel OpRegion. These are the same checks hvmloader and libxl do to determine if the Intel OpRegion needs to be mapped into the guest's memory. Also, move the comment about trapping 0xfc for the Intel OpRegion where it belongs after applying this patch. Signed-off-by: Chuck Zmudzinski <brchuckz@aol.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Message-Id: <c76dff6369ccf2256bd9eed5141da1db767293d2.1656480662.git.brchuckz@aol.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2022-07-05xen/pass-through: merge emulated bits correctlyChuck Zmudzinski1-5/+6
In xen_pt_config_reg_init(), there is an error in the merging of the emulated data with the host value. With the current Qemu, instead of merging the emulated bits with the host bits as defined by emu_mask, the emulated bits are merged with the host bits as defined by the inverse of emu_mask. In some cases, depending on the data in the registers on the host, the way the registers are setup, and the initial values of the emulated bits, the end result will be that the register is initialized with the wrong value. To correct this error, use the XEN_PT_MERGE_VALUE macro to help ensure the merge is done correctly. This correction is needed to resolve Qemu project issue #1061, which describes the failure of Xen HVM Linux guests to boot in certain configurations with passed through PCI devices, that is, when this error disables instead of enables the PCI_STATUS_CAP_LIST bit of the PCI_STATUS register of a passed through PCI device, which in turn disables the MSI-X capability of the device in Linux guests with the end result being that the Linux guest never completes the boot process. Fixes: 2e87512eccf3 ("xen/pt: Sync up the dev.config and data values") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1061 Buglink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988333 Signed-off-by: Chuck Zmudzinski <brchuckz@aol.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Message-Id: <e4392535d8e5266063dc5461d0f1d301e3dd5951.1656522217.git.brchuckz@aol.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2022-07-05hw/intc/loongarch_ipi: Fix mail send and any send functionXiaojuan Yang1-23/+31
By the document of ipi mailsend device, byte is written only when the mask bit is 0. The original code discards mask bit and overwrite the data always, this patch fixes the issue. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Message-Id: <20220705064901.2353349-3-yangxiaojuan@loongson.cn> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-07-05hw/intc/loongarch_ipi: Fix ipi device access of 64bitsXiaojuan Yang2-8/+35
In general loongarch ipi device, 32bit registers is emulated, however for anysend/mailsend device only 64bit register access is supported. So separate the ipi memory region into two regions, including 32 bits and 64 bits. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Message-Id: <20220705064901.2353349-2-yangxiaojuan@loongson.cn> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-07-05hw/rtc/ls7a_rtc: Drop unused inline functionsRichard Henderson1-21/+6
Remove toy_val_to_time_mon and toy_val_to_time_year as unused, to avoid a build failure with clang. Remove all of the other inline markers too so that this does not creep back in. Reviewed-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-07-04Merge tag 'pull-la-20220704' of https://gitlab.com/rth7680/qemu into stagingRichard Henderson3-80/+74
LoongArch patch queue: Support linux-user. Fixes for CSR BADV. Fix ASRT{LE,GT} exception. Fixes for LS7A RTC. Fix for interrupt vector spacing. # -----BEGIN PGP SIGNATURE----- # # iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmLCs4gdHHJpY2hhcmQu # aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV89IQgAsgGM117dgDlI48wP # zRVRE9rmK9EE/YR8b4rejh5iFlH0kZTELWAaXmjxWSv9uyXwsApNdnxnthUH1CRD # RbT8AOIUphH6MBMb2joy+zFyBkGBnJQbSxJWN0jDT/ie67I/O0qOIemXU9tETssn # OLNCn+GuNFLiS8EytczkZHDmQjjt00PGZLsnCm+ZY+/ejNci0FV0NItBo6iWxDdj # 8MPJU8pDkXyi+djJpExPc0hTxJ2qmH0FZtpjKwWnU8dbLSRD9IfYhFK5Tsh1oxYJ # 9Er9ZS0RI2CqK3o2k7keYsJHMaIZbNZKhcoA3XiGs15T9YHe1Rc9FeYDasrQw4wQ # 60FwkA== # =i2CR # -----END PGP SIGNATURE----- # gpg: Signature made Mon 04 Jul 2022 03:01:52 PM +0530 # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [ultimate] * tag 'pull-la-20220704' of https://gitlab.com/rth7680/qemu: (23 commits) target/loongarch: Add lock when writing timer clear reg target/loongarch: Fix the meaning of ECFG reg's VS field hw/rtc/ls7a_rtc: Fix 'calculate' spelling errors hw/rtc/ls7a_rtc: Use tm struct pointer as arguments in toy_time_to_val() hw/rtc/ls7a_rtc: Fix rtc enable and disable function hw/rtc/ls7a_rtc: Add reset function hw/rtc/ls7a_rtc: Remove unimplemented device in realized function hw/rtc/ls7a_rtc: Fix timer call back function hw/rtc/ls7a_rtc: Fix uninitialied bugs and toymatch writing function hw/intc/loongarch_pch_msi: Fix msi vector convertion target/loongarch: Update README default-configs: Add loongarch linux-user support target/loongarch: Adjust functions and structure to support user-mode target/loongarch: remove unused include hw/loader.h target/loongarch: Fix helper_asrtle_d/asrtgt_d raise wrong exception target/loongarch: Fix missing update CSR_BADV target/loongarch: remove badaddr from CPULoongArch scripts: add loongarch64 binfmt config linux-user: Add LoongArch cpu_loop support linux-user: Add LoongArch syscall support ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-07-04Merge tag 'kraxel-20220704-pull-request' of https://gitlab.com/kraxel/qemu ↵Richard Henderson1-5/+26
into staging usb: canokey fixes. ui: better tab labels, cocoa fix, docs: convert fw_cfg to rst. # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmLCndwACgkQTLbY7tPo # cTjNHA/+MT56crVXnjMTdgBRLOuq0cxYnIUptN0JPKx9DTJzdlXEyT+zYD7iIzUt # W0xbOrTLVzU9hfJVh9/5V2HuFmc1eAhfl0BDTzd1TT0kdH6LyUkz5RWgotzo3nvH # 7tnl/sBy48a7diSyQn6K2s8r35ubrX1GNJiJcCLWdVEqvzKKWDEqebs02PxbN/OJ # 9UG9xtkM/QQ1+h74jq5BGKXf08xOhOZIjO274Sn5zievBC9JU6RVkCOlUXiBdk51 # +vNTfKt3c864cstryXSTknYWyVv7zKzCqr7xR7c+fgbt3cN/HmLkM9LGytDMEDl/ # IC0CtKiRN316GgVHHMDT8v8X2dVHNH9ZEEoXRKIbc5jD/tetJw7IIEO7blJphdpV # WE4/bRpJwYVW9UHzig9rPRxsHLs3NSZbNCQEbGUvAbZzS2kq9hnDa/BBtFSYaf+X # RIwR7rY7WhENfSrus1jR5rfWRU7n+q+fcNIFZetUakH1V6Idb0xQir3eM/yM6sBC # nzQSzzLsd3Mwh2ahbnLZ1HkyybZV692usVylKsFLVwcUhCvk+VHccOF31QfrxO/j # ogVzTYYtfrGM5kaknueIMg7XAhjQ04Av70+0b886kZawB3ZE5Ccare2TztHq1jcG # dMdEm7DLaDRm2RXa9NtcbxsIrS0DT2EuFcBnQ1mHMCGql4MidzE= # =Bhbw # -----END PGP SIGNATURE----- # gpg: Signature made Mon 04 Jul 2022 01:29:24 PM +0530 # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [undefined] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [undefined] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * tag 'kraxel-20220704-pull-request' of https://gitlab.com/kraxel/qemu: hw: canokey: Remove HS support as not compliant to the spec docs/system/devices/usb/canokey: remove limitations on qemu-xhci hw/usb/canokey: fix compatibility of qemu-xhci hw/usb/canokey: Fix CCID ZLP ui/cocoa: Fix clipboard text release ui/console: allow display device to be labeled with given id Convert fw_cfg.rst to reStructuredText syntax Rename docs/specs/fw_cfg.txt to .rst Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-07-04hw/rtc/ls7a_rtc: Fix 'calculate' spelling errorsXiaojuan Yang1-6/+6
Fix 'calculate' spelling errors. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220701093407.2150607-8-yangxiaojuan@loongson.cn> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-07-04hw/rtc/ls7a_rtc: Use tm struct pointer as arguments in toy_time_to_val()Xiaojuan Yang1-7/+7
Use pointer as arguments in toy_time_to_val() instead of struct tm. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220701093407.2150607-7-yangxiaojuan@loongson.cn> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-07-04hw/rtc/ls7a_rtc: Fix rtc enable and disable functionXiaojuan Yang1-53/+7
Fix ls7a rtc enable and disable function. When rtc disabled, it do not support to read or write, but the real time is still continue, so we need not neither save the time nor update the rtc offset. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220701093407.2150607-6-yangxiaojuan@loongson.cn> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-07-04hw/rtc/ls7a_rtc: Add reset functionXiaojuan Yang1-0/+20
Add ls7a rtc reset function to delete timers and clear regs when rtc reset. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Message-Id: <20220701093407.2150607-5-yangxiaojuan@loongson.cn> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-07-04hw/rtc/ls7a_rtc: Remove unimplemented device in realized functionXiaojuan Yang1-1/+0
Remove the unimplemented device when realized ls7a RTC, as it is not uesd. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220701093407.2150607-4-yangxiaojuan@loongson.cn> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-07-04hw/rtc/ls7a_rtc: Fix timer call back functionXiaojuan Yang1-2/+2
Replace qemu_irq_pulse with qemu_irq_raise in ls7a_timer_cb function to keep consistent with hardware behavior when raise irq. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220701093407.2150607-3-yangxiaojuan@loongson.cn> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-07-04hw/rtc/ls7a_rtc: Fix uninitialied bugs and toymatch writing functionXiaojuan Yang1-9/+11
1. Initialize the tm struct in toymatch_write() and ls7a_toy_start() to fix uninitialized bugs. 2. Fix toymatch_val_to_time function. By the document, when we calculate the expiration year, we should first get current year, and replace the 0-5 bits with toymatch's 26-31 bits. Fixes: Coverity CID 1489766, 1489763 Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220701093407.2150607-2-yangxiaojuan@loongson.cn> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-07-04hw/intc/loongarch_pch_msi: Fix msi vector convertionMao Bibo2-2/+21
Loongarch pch msi intc connects to extioi controller, the range of irq number is 64-255. Add a property for irqbase, so that we can compute the irq offset from the view of pch_msi controller with the method: msi vector (from view of upper extioi intc) - irqbase Signed-off-by: Mao Bibo <maobibo@loongson.cn> Message-Id: <20220701030740.2469162-1-maobibo@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-07-03hw/riscv: boot: Reduce FDT address alignment constraintsAlistair Francis1-2/+2
We previously stored the device tree at a 16MB alignment from the end of memory (or 3GB). This means we need at least 16MB of memory to be able to do this. We don't actually need the FDT to be 16MB aligned, so let's drop it down to 2MB so that we can support systems with less memory, while also allowing FDT size expansion. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/992 Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Atish Patra <atishp@rivosinc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Tested-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20220608062015.317894-1-alistair.francis@opensource.wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-07-01hw: canokey: Remove HS support as not compliant to the specMkfsSion1-1/+0
Canokey core currently using 16 bytes as maximum packet size for control endpoint, but to run the device in high-speed a 64 bytes maximum packet size is required according to USB 2.0 specification. Since we don't acutally need to run the device in high-speed, simply don't assign high member in USBDesc. When canokey-qemu is used with xhci, xhci would drive canokey in high speed mode, since the bcdUSB in canokey-core is 2.1, yet canokey-core set bMaxPacketSize0 to be 16, this is out of the spec as the spec said that ``The allowable maximum control transfer data payload sizes...for high-speed devices, it is 64 bytes''. In this case, usb device validation in Windows 10 LTSC 2021 as the guest would fail. It would complain USB\DEVICE_DESCRIPTOR_VALIDATION_FAILURE. Note that bcdUSB only identifies the spec version the device complies, but it has no indication of its speed. So it is allowed for the device to run in FS but comply the 2.1 spec. To solve the issue we decided to just drop the high speed support. This only affects usb-ehci as usb-ehci would complain speed mismatch when FS device is attached to a HS port. That's why the .high member was initialized in the first place. Meanwhile, xhci is not affected as it works well with FS device. Since everyone is now using xhci, it does no harm to most users. Suggested-by: Hongren (Zenithal) Zheng <i@zenithal.me> Signed-off-by: YuanYang Meng <mkfssion@mkfssion.com> Reviewed-by: Hongren (Zenithal) Zheng <i@zenithal.me> Message-Id: <20220625142138.19363-1-mkfssion@mkfssion.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-07-01hw/usb/canokey: fix compatibility of qemu-xhciHongren (Zenithal) Zheng1-0/+23
XHCI wont poll interrupt IN endpoint if NAKed, and needs wakeup Suggested-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Hongren (Zenithal) Zheng <i@zenithal.me> Message-Id: <YqcqSHNpI7sXRNpZ@Sun> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-07-01hw/usb/canokey: Fix CCID ZLPHongren (Zenithal) Zheng1-4/+3
CCID could send zero-length packet (ZLP) if we invoke two data_in, two packets would be concated and we could not distinguish them. The CANOKEY_EMU_EP_CTAPHID is imported from canokey-qemu.h Reported-by: MkfsSion <myychina28759@gmail.com> Signed-off-by: Hongren (Zenithal) Zheng <i@zenithal.me> Message-Id: <YqcqGz0s3+LE42ms@Sun> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-30hw/misc/aspeed: Add PECI controllerPeter Delevoryas6-1/+199
This introduces a really basic PECI controller that responses to commands by always setting the response code to success and then raising an interrupt to indicate the command is done. This helps avoid getting hit with constant errors if the driver continuously attempts to send a command and keeps timing out. The AST2400 and AST2500 only included registers up to 0x5C, not 0xFC. They supported PECI 1.1, 2.0, and 3.0. The AST2600 and AST1030 support PECI 4.0, which includes more read/write buffer registers from 0x80 to 0xFC to support 64-byte mode. This patch doesn't attempt to handle that, or to create a different version of the controller for the different generations, since it's only implementing functionality that is common to all generations. The basic sequence of events is that the firmware will read and write to various registers and then trigger a command by setting the FIRE bit in the command register (similar to the I2C controller). Then the firmware waits for an interrupt from the PECI controller, expecting the interrupt status register to be filled in with info on what happened. If the command was transmitted and received successfully, then response codes from the host CPU will be found in the data buffer registers. Signed-off-by: Peter Delevoryas <pdel@fb.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220630045133.32251-12-me@pjd.dev> [ clg: s/sysbus_mmio_map/aspeed_mmio_map/ ] Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw/i2c/aspeed: Add new-registers DMA slave mode RX supportPeter Delevoryas1-12/+121
This commit adds support for DMA RX in slave mode while using the new register set in the AST2600 and AST1030. This patch also pretty much assumes packet mode is enabled, I'm not sure if this will work in DMA step mode. This is particularly useful for testing IPMB exchanges between Zephyr and external devices, which requires multi-master I2C support and DMA in the new register mode, because the Zephyr drivers from Aspeed use DMA in the new mode by default. The Zephyr drivers are also using packet mode. The typical sequence of events for receiving data in DMA slave + packet mode is that the Zephyr firmware will configure the slave address register with an address to receive on and configure the bus's function control register to enable master mode and slave mode simultaneously at startup, before any transfers are initiated. RX DMA is enabled in the slave mode command register, and the slave RX DMA buffer address and slave RX DMA buffer length are set. TX DMA is not covered in this patch. When the Aspeed I2C controller receives data from some other I2C master, it will reset the I2CS_DMA_LEN RX_LEN value to zero, then buffer incoming data in the RX DMA buffer while incrementing the I2CC_DMA_ADDR address counter and decrementing the I2CC_DMA_LEN counter. It will also update the I2CS_DMA_LEN RX_LEN value along the way. Once all the data has been received, the bus controller will raise an interrupt indicating a packet command was completed, the slave address matched, a normal stop condition was seen, and the transfer was an RX operation. If the master sent a NACK instead of a normal stop condition, or the transfer timed out, then a slightly different set of interrupt status values would be set. Those conditions are not handled in this commit. The Zephyr firmware then collects data from the RX DMA buffer and clears the status register by writing the PKT_MODE_EN bit to the status register. In packet mode, clearing the packet mode interrupt enable bit also clears most of the other interrupt bits automatically (except for a few bits above it). Note: if the master transmit or receive functions were in use simultaneously with the slave mode receive functionality, then the master mode functions may have raised the interrupt line for the bus before the DMA slave transfer is complete. It's important to have the slave's interrupt status register clear throughout the receive operation, and if the slave attempts to raise the interrupt before the master interrupt status is cleared, then it needs to re-raise the interrupt once the master interrupt status is cleared. (And vice-versa). That's why in this commit, when the master interrupt status is cleared and the interrupt line is lowered, we call the slave interrupt _raise_ function, to see if the interrupt was pending. (And again, vice-versa). Signed-off-by: Peter Delevoryas <pdel@fb.com> Message-Id: <20220630045133.32251-8-me@pjd.dev> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw/i2c/aspeed: add slave device in old register modeKlaus Jensen1-9/+80
Add slave mode functionality for the Aspeed I2C controller in old register mode. This is implemented by realizing an I2C slave device owned by the I2C controller and attached to its own bus. The I2C slave device only implements asynchronous sends on the bus, so slaves not supporting that will not be able to communicate with it. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> [ clg: checkpatch fixes ] Message-Id: <20220601210831.67259-6-its@irrelevant.dk> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220630045133.32251-7-me@pjd.dev> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw/i2c: add asynchronous sendKlaus Jensen8-1/+51
Add an asynchronous version of i2c_send() that requires the slave to explicitly acknowledge on the bus with i2c_ack(). The current master must use the new i2c_start_send_async() to indicate that it wants to do an asynchronous transfer. This allows the i2c core to check if the target slave supports this or not. This approach relies on adding a new enum i2c_event member, which is why a bunch of other devices needs changes in their event handling switches. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Message-Id: <20220601210831.67259-5-its@irrelevant.dk> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220630045133.32251-6-me@pjd.dev> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw/i2c: support multiple mastersKlaus Jensen1-1/+33
Allow slaves to master the bus by registering a bottom halve. If the bus is busy, the bottom half is queued up. When a slave has succesfully mastered the bus, the bottom half is scheduled. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> [ clg : - fixed typos in commit log ] Message-Id: <20220601210831.67259-4-its@irrelevant.dk> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220630045133.32251-5-me@pjd.dev> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw/i2c/aspeed: Fix MASTER_EN missing error messagePeter Delevoryas1-2/+2
aspeed_i2c_bus_is_master is checking if master mode is enabled in the I2C bus controller's function-control register, not that slave mode is enabled or something. The error here is that the guest is trying to trigger an I2C master mode command while master mode is not enabled. Fixes: ba2cccd64e90f342 ("aspeed: i2c: Add new mode support") Signed-off-by: Peter Delevoryas <pdel@fb.com> Message-Id: <20220630045133.32251-4-me@pjd.dev> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw/i2c/aspeed: Fix DMA len write-enable bit handlingPeter Delevoryas1-4/+4
I noticed i2c rx transfers were getting shortened to "1" on Zephyr. It seems to be because the Zephyr i2c driver sets the RX DMA len with the RX field write-enable bit set (bit 31) to avoid a read-modify-write. [1] /* 0x1C : I2CM Master DMA Transfer Length Register */ I think we should be checking the write-enable bits on the incoming value, not checking the register array. I'm not sure we're even writing the write-enable bits to the register array, actually. [1] https://github.com/AspeedTech-BMC/zephyr/blob/db3dbcc9c52e67a47180890ac938ed380b33f91c/drivers/i2c/i2c_aspeed.c#L145-L148 Fixes: ba2cccd64e90f34 ("aspeed: i2c: Add new mode support") Signed-off-by: Peter Delevoryas <pdel@fb.com> Message-Id: <20220630045133.32251-3-me@pjd.dev> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw/i2c/aspeed: Fix R_I2CD_FUN_CTRL referencePeter Delevoryas1-1/+1
Very minor, doesn't effect functionality, but this is supposed to be R_I2CC_FUN_CTRL (new-mode, not old-mode). Fixes: ba2cccd64e9 ("aspeed: i2c: Add new mode support") Signed-off-by: Peter Delevoryas <pdel@fb.com> Message-Id: <20220630045133.32251-2-me@pjd.dev> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw/arm/aspeed: firework: add I2C MUXes for VR channelsJae Hyun Yoo1-1/+9
Add 2-level cascaded I2C MUXes for SOC VR channels into the Firework machine. Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220627154703.148943-8-quic_jaehyoo@quicinc.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw/arm/aspeed: firework: Add Thermal DiodesMaheswara Kurapati1-0/+10
Add Thermal Diodes for Firework machine. Signed-off-by: Maheswara Kurapati <quic_mkurapat@quicinc.com> Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220627154703.148943-7-quic_jaehyoo@quicinc.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw/arm/aspeed: Add MAX31785 Fan controllersMaheswara Kurapati2-2/+8
Add MAX31785 fan controllers in machines so that the Linux driver populates the sysfs interface. Firework has two MAX31785 Fan controllers at 0x52, and 0x54 on bus 9. Witherspoon has one at 0x52 on bus 3. Rainier has one at 0x52 on bus 7. Signed-off-by: Maheswara Kurapati <quic_mkurapat@quicinc.com> Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220627154703.148943-6-quic_jaehyoo@quicinc.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw/sensor: add Maxim MAX31785 deviceMaheswara Kurapati3-0/+578
MAX31785 is a PMBus compliant 6-Channel fan controller. It supports 6 fan channels, 11 temperature sensors, and 6-Channel ADC to measure the remote voltages. Datasheet can be found here: https://datasheets.maximintegrated.com/en/ds/MAX31785.pdf This initial version of the driver has skeleton and support for the fan channels. Requests for temperature sensors, and ADC Channels the are serviced with the default values as per the datasheet. No additional instrumentation is done. NV Log feature is not supported. Signed-off-by: Maheswara Kurapati <quic_mkurapat@quicinc.com> Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220627154703.148943-5-quic_jaehyoo@quicinc.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw/i2c: pmbus: Page #255 is valid page for read requests.Maheswara Kurapati1-5/+1
Current implementation of the pmbus core driver treats the read request for page 255 as invalid request and sets the invalid command bit (bit 7) in the STATUS_CML register. As per the PMBus specification it is a valid request. Refer to the PMBus specification, revision 1.3.1, section 11.10 PAGE, on the page 58: "Setting the PAGE to FFh means that all subsequent comands are to be applied to all outputs. Some commands, such as READ_TEMPERATURE, may use a common sensor but be available on all pages of a device. Such implementations are the decision of each device manufacturer or are specified in a PMBus Application Profile. Consult the manufacturer's documents or the Application Profile Specification as needed." For e.g., The VOUT_MODE is a valid command for page 255 for maxim 31785 device. refer to Table 1. PMBus Command Codes on page 14 in the datasheet. https://datasheets.maximintegrated.com/en/ds/MAX31785.pdf Fixes: 38870253f1d1 ("hw/i2c: pmbus: fix error returns and guard against out of range accesses") Signed-off-by: Maheswara Kurapati <quic_mkurapat@quicinc.com> Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com> Reviewed-by: Titus Rwantare <titusr@google.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220627154703.148943-4-quic_jaehyoo@quicinc.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw/arm/aspeed: add Qualcomm Firework BMC machineGraeme Gregory1-0/+34
Add base for Qualcomm Firework BMC machine. Signed-off-by: Graeme Gregory <quic_ggregory@quicinc.com> Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220627154703.148943-3-quic_jaehyoo@quicinc.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw/arm/aspeed: add support for the Qualcomm DC-SCM v1 boardJae Hyun Yoo1-0/+35
Add qcom-dc-scm-v1 board support. Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220627154703.148943-2-quic_jaehyoo@quicinc.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30aspeed: Remove use of qemu_get_cpuPeter Delevoryas1-1/+1
Signed-off-by: Peter Delevoryas <pdel@fb.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220624003701.1363500-6-pdel@fb.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30aspeed: Map unimplemented devices in SoC memoryPeter Delevoryas3-19/+47
Signed-off-by: Peter Delevoryas <pdel@fb.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220624003701.1363500-5-pdel@fb.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30aspeed: Remove usage of sysbus_mmio_mapPeter Delevoryas3-55/+68
sysbus_mmio_map maps devices into "get_system_memory()". With the new SoC memory attribute, we want to make sure that each device is mapped into the SoC memory. In single SoC machines, the SoC memory is the same as "get_system_memory()", but in multi SoC machines it will be different. Signed-off-by: Peter Delevoryas <pdel@fb.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220624003701.1363500-4-pdel@fb.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30aspeed: Add memory property to Aspeed SoCPeter Delevoryas4-10/+15
Multi-SoC machines can use this property to specify a memory container for each SoC. Single SoC machines will just specify get_system_memory(). Signed-off-by: Peter Delevoryas <pdel@fb.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220624003701.1363500-3-pdel@fb.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30aspeed: Set CPU memory property explicitlyPeter Delevoryas2-0/+4
Signed-off-by: Peter Delevoryas <pdel@fb.com> Message-Id: <20220624003701.1363500-2-pdel@fb.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30aspeed/smc: Fix potential overflowCédric Le Goater1-2/+2
Coverity warns that "ssi_transfer(s->spi, 0U) << 8 * i" might overflow because the expression is evaluated using 32-bit arithmetic and then used in a context expecting a uint64_t. Fixes: Coverity CID 1487244 Message-Id: <20220628165512.1133590-1-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30aspeed/hace: Accumulative mode supportedJoel Stanley1-3/+3
While the HMAC mode is not modelled, the accumulative mode is. Accumulative mode is enabled by setting one of the bits in the HMAC engine command mode part of the register, so fix the unimplemented check to only look at the upper of the two bits. Fixes: 5cd7d8564a8b ("aspeed/hace: Support AST2600 HACE") Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220627100816.125956-1-joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30aspeed/i2c: Change trace event for NORMAL_STOP statesCédric Le Goater1-1/+1
Using a 'stop' string seems more appropriate than 'normal'. Reviewed-by: Peter Delevoryas <pdel@fb.com> Message-Id: <20220628154740.1117349-3-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30aspeed/scu: Add trace events for read opsCédric Le Goater2-0/+3
Reviewed-by: Peter Delevoryas <pdel@fb.com> Message-Id: <20220628154740.1117349-2-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30aspeed: Set the dram container at the SoC levelCédric Le Goater3-41/+54
Currently, the Aspeed machines allocate a ram container region in which the machine ram region is mapped. See commit ad1a9782186d ("aspeed: add a RAM memory region container"). An extra region is mapped after ram in the ram container to catch invalid access done by FW. That's how FW determines the size of ram. See commit ebe31c0a8ef7 ("aspeed: add a max_ram_size property to the memory controller"). Let's move all the logic under the SoC where it should be. It will also ease the work on multi SoC support. Reviewed-by: Peter Delevoryas <pdel@fb.com> Message-Id: <20220623202123.3972977-1-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30hw: m25p80: add WP# pin and SRWD bit for write protectionIris Chen1-15/+67
Signed-off-by: Iris Chen <irischenlj@gmail.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-Id: <20220621202427.2680413-1-irischenlj@fb.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-30Merge tag 'trivial-branch-for-7.1-pull-request' of ↵Richard Henderson14-36/+32
https://gitlab.com/laurent_vivier/qemu into staging trivial patches pull request 20220629 # -----BEGIN PGP SIGNATURE----- # # iQJGBAABCAAwFiEEzS913cjjpNwuT1Fz8ww4vT8vvjwFAmK8FmsSHGxhdXJlbnRA # dml2aWVyLmV1AAoJEPMMOL0/L7482EkP/19M/AAUkGqIdU9Dj7H46r+LEKtrT7Xu # jNRDDrkhVQvx42mklSB+fO/ptMKUDgxvLs4mnuZFxM7SrTOb4h5jfZzyYjk73ENQ # YZ/TLxRtxAfRCcGwso7NGyk85mwt+sBFKZXfW6qsfc9AjDphLUOblfSieeFegz69 # BUtzbMOPSMR7e54y6azJX3gCkxLytSXYgk4otSLTrL233sT7pnwPRdxKGzCTA5vs # fRxKb4p/R05lWepcjrL2d2lB1TabsV0kqmNkHDvubVWlgyoK3Vt/1dzD1UP7CrvF # WghlZWmxCHrmLlBb+VSDUa22kpfv5fi/feauuug+dya+s1Mlq8HZTL8VtjUJHwLL # 92xRPeP/RfEJdoQDuMKXP9DWAAYM03HGgR37cE5NMDCyHG0XRKOJ+i2P7DQLVDjW # QyWX6bX1WV6FovdwwMnZR9OclvKtsZnb1jlfj+G2DdKXpLliDH6DkFm8mPQTM1L7 # w53iMtK88erEc+NP6+fPbbZmySvDVUcLmcTiBceZK6Vjo4oTGNrAWP+VgjBTJaz+ # 71ulkJ6vo39ZnEQOUlWrL/yW+8sQNaeO1tO67HZZ8dgTvAnPwyvKq88jSMzGCNpz # Wpcf4yVAEvU+fP3KkEaqQqmQeK/Vc+H6044O00tcLVICkpCdN/FwRjgfZanX9CIJ # xQjxW5mkb1Z3 # =fgtJ # -----END PGP SIGNATURE----- # gpg: Signature made Wed 29 Jun 2022 02:37:55 PM +0530 # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [undefined] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [undefined] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * tag 'trivial-branch-for-7.1-pull-request' of https://gitlab.com/laurent_vivier/qemu: hw/i386/xen/xen-hvm: Inline xen_piix_pci_write_config_client() and remove it hw/i386/xen/xen-hvm: Allow for stubbing xen_set_pci_link_route() hw/ide/atapi.c: Correct typos (CD-CDROM -> CD-ROM) common-user: Only compile the common user code if have_user is set hw/pci-host/i440fx: Remove unused parameter from i440fx_init() MAINTAINERS: Add softmmu/runstate.c to "Main loop" trivial typos: namesapce Trivial: 3 char repeat typos util: Return void on iova_tree_remove qom/object: Remove circular include dependency vga: avoid crash if no default vga card Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-06-29hw/i386/xen/xen-hvm: Inline xen_piix_pci_write_config_client() and remove itBernhard Beschow2-19/+14
xen_piix_pci_write_config_client() is implemented in the xen sub tree and uses PIIX constants internally, thus creating a direct dependency on PIIX. Now that xen_set_pci_link_route() is stubbable, the logic of xen_piix_pci_write_config_client() can be moved to PIIX which resolves the dependency. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20220626094656.15673-3-shentey@gmail.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-06-29hw/i386/xen/xen-hvm: Allow for stubbing xen_set_pci_link_route()Bernhard Beschow1-1/+6
The only user of xen_set_pci_link_route() is xen_piix_pci_write_config_client() which implements PIIX-specific logic in the xen namespace. This makes xen-hvm depend on PIIX which could be avoided if xen_piix_pci_write_config_client() was implemented in PIIX. In order to do this, xen_set_pci_link_route() needs to be stubbable which this patch addresses. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20220626094656.15673-2-shentey@gmail.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
generated by cgit v1.1 at 2025-01-28 22:54:37 +0000