aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2021-03-16memory: add a sparse memory device for fuzzingAlexander Bulekov2-0/+152
For testing, it can be useful to simulate an enormous amount of memory (e.g. 2^64 RAM). This adds an MMIO device that acts as sparse memory. When something writes a nonzero value to a sparse-mem address, we allocate a block of memory. For now, since the only user of this device is the fuzzer, we do not track and free zeroed blocks. The device has a very low priority (so it can be mapped beneath actual RAM, and virtual device MMIO regions). Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-16Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell17-42/+63
staging # gpg: Signature made Mon 15 Mar 2021 08:42:25 GMT # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: net: Do not fill legacy info_str for backends hmp: Use QAPI NetdevInfo in hmp_info_network net: Move NetClientState.info_str to dynamic allocations tests: Add tests for query-netdev command qapi: net: Add query-netdev command pvrdma: wean code off pvrdma_ring.h kernel header lan9118: switch to use qemu_receive_packet() for loopback cadence_gem: switch to use qemu_receive_packet() for loopback pcnet: switch to use qemu_receive_packet() for loopback rtl8139: switch to use qemu_receive_packet() for loopback tx_pkt: switch to use qemu_receive_packet_iov() for loopback sungem: switch to use qemu_receive_packet() for loopback msf2-mac: switch to use qemu_receive_packet() for loopback dp8393x: switch to use qemu_receive_packet() for loopback packet e1000: switch to use qemu_receive_packet() for loopback net: introduce qemu_receive_packet() e1000: fail early for evil descriptor net: validate that ids are well formed net: Fix build error when DEBUG_NET is on virtio-net: calculating proper msix vectors on init Signed-off-by: Peter Maydell <peter.maydell@linaro.org> # Conflicts: # hw/core/machine.c
2021-03-15Merge remote-tracking branch ↵Peter Maydell2-1/+8
'remotes/stefanha-gitlab/tags/block-pull-request' into staging Pull request # gpg: Signature made Mon 15 Mar 2021 09:50:58 GMT # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha-gitlab/tags/block-pull-request: virtio-blk: Respect discard granularity Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-15Merge remote-tracking branch 'remotes/philmd/tags/avr-20210315' into stagingPeter Maydell2-4/+17
AVR patches queue - Only reset 'interrupt_request' mask once all interrupts executed - Documentation and typo fixes # gpg: Signature made Sun 14 Mar 2021 23:45:34 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/avr-20210315: target/avr: Fix interrupt execution target/avr: Fix some comment spelling errors hw/avr/arduino: List board schematic links hw/misc/led: Add yellow LED Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-15Merge remote-tracking branch ↵Peter Maydell4-0/+354
'remotes/bkoppelmann2/tags/pull-tricore-20210314' into staging - Added triboard with tc27x_soc - Cleaned up get_physical_address() - Fixed corner case bugs in OPC2_32_RRPW_IMASK and OPC2_32_RRPW_IMASK insns # gpg: Signature made Sun 14 Mar 2021 13:53:11 GMT # gpg: using RSA key 6E636A7E83F2DD0CFA6E6E370AD2C6396B69CA14 # gpg: issuer "kbastian@mail.uni-paderborn.de" # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>" [full] # Primary key fingerprint: 6E63 6A7E 83F2 DD0C FA6E 6E37 0AD2 C639 6B69 CA14 * remotes/bkoppelmann2/tags/pull-tricore-20210314: target/tricore: Fix OPC2_32_RRPW_EXTR for width=0 target/tricore: Fix imask OPC2_32_RRPW_IMASK for r3+1 == r2 tricore: fixed faulty conditions for extr and imask target/tricore: Remove unused definitions target/tricore: Pass MMUAccessType to get_physical_address() target/tricore: Replace magic value by MMU_DATA_LOAD definition tricore: added triboard with tc27x_soc Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-15virtio-blk: Respect discard granularityAkihiko Odaki2-1/+8
Report the configured granularity for discard operation to the guest. If this is not set use the block size. Since until now we have ignored the configured discard granularity and always reported the block size, let's add 'report-discard-granularity' property and disable it for older machine types to avoid migration issues. Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210225001239.47046-1-akihiko.odaki@gmail.com>
2021-03-15net: Move NetClientState.info_str to dynamic allocationsAlexey Kirillov1-3/+2
The info_str field of the NetClientState structure is static and has a size of 256 bytes. This amount is often unclaimed, and the field itself is used exclusively for HMP "info network". The patch translates info_str to dynamic memory allocation. This action is also allows us to painlessly discard usage of this field for backend devices. Signed-off-by: Alexey Kirillov <lekiravi@yandex-team.ru> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15pvrdma: wean code off pvrdma_ring.h kernel headerCornelia Huck5-28/+37
The pvrdma code relies on the pvrdma_ring.h kernel header for some basic ring buffer handling. The content of that header isn't very exciting, but contains some (q)atomic_*() invocations that (a) cause manual massaging when doing a headers update, and (b) are an indication that we probably should not be importing that header at all. Let's reimplement the ring buffer handling directly in the pvrdma code instead. This arguably also improves readability of the code. Importing the header can now be dropped. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Tested-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15lan9118: switch to use qemu_receive_packet() for loopbackAlexander Bulekov1-1/+1
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15cadence_gem: switch to use qemu_receive_packet() for loopbackAlexander Bulekov1-2/+2
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15pcnet: switch to use qemu_receive_packet() for loopbackAlexander Bulekov1-1/+1
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Buglink: https://bugs.launchpad.net/qemu/+bug/1917085 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15rtl8139: switch to use qemu_receive_packet() for loopbackAlexander Bulekov1-1/+1
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Buglink: https://bugs.launchpad.net/qemu/+bug/1910826 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15tx_pkt: switch to use qemu_receive_packet_iov() for loopbackJason Wang1-1/+1
This patch switches to use qemu_receive_receive_iov() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15sungem: switch to use qemu_receive_packet() for loopbackJason Wang1-1/+1
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15msf2-mac: switch to use qemu_receive_packet() for loopbackJason Wang1-1/+1
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15dp8393x: switch to use qemu_receive_packet() for loopback packetJason Wang1-1/+1
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15e1000: switch to use qemu_receive_packet() for loopbackJason Wang1-1/+1
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15e1000: fail early for evil descriptorJason Wang1-0/+4
During procss_tx_desc(), driver can try to chain data descriptor with legacy descriptor, when will lead underflow for the following calculation in process_tx_desc() for bytes: if (tp->size + bytes > msh) bytes = msh - tp->size; This will lead a infinite loop. So check and fail early if tp->size if greater or equal to msh. Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> Reported-by: Ruhr-University Bochum <bugs-syssec@rub.de> Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15virtio-net: calculating proper msix vectors on initJason Wang2-1/+10
Currently, the default msix vectors for virtio-net-pci is 3 which is obvious not suitable for multiqueue guest, so we depends on the user or management tools to pass a correct vectors parameter. In fact, we can simplifying this by calculating the number of vectors on realize. Consider we have N queues, the number of vectors needed is 2*N + 2 (#queue pairs + plus one config interrupt and control vq). We didn't check whether or not host support control vq because it was added unconditionally by qemu to avoid breaking legacy guests such as Minix. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15hw/avr/arduino: List board schematic linksPhilippe Mathieu-Daudé1-4/+16
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Michael Rolnik <mrolnik@gmail.com> Message-Id: <20210313165445.2113938-3-f4bug@amsat.org>
2021-03-15hw/misc/led: Add yellow LEDPhilippe Mathieu-Daudé1-0/+1
Add the yellow "lime" LED. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Michael Rolnik <mrolnik@gmail.com> Message-Id: <20210313165445.2113938-2-f4bug@amsat.org>
2021-03-14Merge remote-tracking branch 'remotes/philmd/tags/mips-20210313' into stagingPeter Maydell2-26/+39
MIPS patches queue - Tidy up the GT64120 north bridge - Move XBurst Media eXtension Unit code to mxu_translate.c - Convert TX79 to decodetree # gpg: Signature made Sat 13 Mar 2021 22:44:44 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/mips-20210313: (27 commits) target/mips/tx79: Salvage instructions description comment target/mips: Remove 'C790 Multimedia Instructions' dead code target/mips/tx79: Move PCPYLD / PCPYUD opcodes to decodetree target/mips/tx79: Move PCPYH opcode to decodetree target/mips/translate: Simplify PCPYH using deposit_i64() target/mips/translate: Make gen_rdhwr() public target/mips/tx79: Move MTHI1 / MTLO1 opcodes to decodetree target/mips/tx79: Move MFHI1 / MFLO1 opcodes to decodetree target/mips: Use gen_load_gpr[_hi]() when possible target/mips: Extract MXU code to new mxu_translate.c file target/mips: Introduce mxu_translate_init() helper target/mips: Simplify decode_opc_mxu() ifdef'ry target/mips: Convert decode_ase_mxu() to decodetree prototype target/mips: Rename decode_opc_mxu() as decode_ase_mxu() target/mips: Move MUL opcode check from decode_mxu() to decode_legacy() target/mips: Use OPC_MUL instead of OPC__MXU_MUL target/mips: Pass instruction opcode to decode_opc_mxu() target/mips: Remove unused CPUMIPSState* from MXU functions target/mips: Remove XBurst Media eXtension Unit dead code target/mips: Rewrite complex ifdef'ry ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-14tricore: added triboard with tc27x_socAndreas Konopik4-0/+354
Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Andreas Konopik <andreas.konopik@efs-auto.de> Signed-off-by: David Brenken <david.brenken@efs-auto.de> Signed-off-by: Georg Hofstetter <georg.hofstetter@efs-auto.de> Signed-off-by: Robert Rasche <robert.rasche@efs-auto.de> Signed-off-by: Lars Biermanski <lars.biermanski@efs-auto.de> Message-Id: <20201109165055.10508-2-david.brenken@efs-auto.org> Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
2021-03-14Merge remote-tracking branch ↵Peter Maydell21-777/+1670
'remotes/pmaydell/tags/pull-target-arm-20210314' into staging target-arm queue: * versal: Support XRAMs and XRAM controller * smmu: Various minor bug fixes * SVE emulation: fix bugs handling odd vector lengths * allwinner-sun8i-emac: traverse transmit queue using TX_CUR_DESC register value * tests/acceptance: fix orangepi-pc acceptance tests * hw/timer/sse-timer: Propagate eventual error in sse_timer_realize() * hw/arm/virt: KVM: The IPA lower bound is 32 * npcm7xx: support MFT module * pl110, pxa2xx_lcd: tidy up template headers # gpg: Signature made Sun 14 Mar 2021 13:17:43 GMT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210314: (39 commits) hw/display/pxa2xx: Inline template header hw/display/pxa2xx: Apply whitespace-only coding style fixes to template header hw/display/pxa2xx: Apply brace-related coding style fixes to template header hw/display/pxa2xx: Remove use of BITS in pxa2xx_template.h hw/display/pxa2xx_lcd: Remove dest_width state field hw/display/pxa2xx_lcd: Remove dead code for non-32-bpp surfaces hw/display/pl110: Remove use of BITS from pl110_template.h hw/display/pl110: Pull included-once parts of template header into pl110.c hw/display/pl110: Remove dead code for non-32-bpp surfaces tests/qtest: Test PWM fan RPM using MFT in PWM test hw/arm: Connect PWM fans in NPCM7XX boards hw/arm: Add MFT device to NPCM7xx Soc hw/misc: Add NPCM7XX MFT Module hw/misc: Add GPIOs for duty in NPCM7xx PWM hw/arm/virt: KVM: The IPA lower bound is 32 accel: kvm: Fix kvm_type invocation hw/timer/sse-timer: Propagate eventual error in sse_timer_realize() tests/acceptance: drop ARMBIAN_ARTIFACTS_CACHED condition for orangepi-pc, cubieboard tests tests/acceptance: update sunxi kernel from armbian to 5.10.16 tests/acceptance/boot_linux_console: change URL for test_arm_orangepi_bionic_20_08 ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-14hw/display/pxa2xx: Inline template headerPeter Maydell2-436/+425
The template header is now included only once; just inline its contents in hw/display/pxa2xx_lcd.c. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-10-peter.maydell@linaro.org
2021-03-14hw/display/pxa2xx: Apply whitespace-only coding style fixes to template headerPeter Maydell1-34/+32
We're about to move code from the template header into pxa2xx_lcd.c. Before doing that, make coding style fixes so checkpatch doesn't complain about the patch which moves the code. This commit is whitespace changes only: * avoid hard-coded tabs * fix ident on function prototypes * no newline before open brace on array definitions Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-9-peter.maydell@linaro.org
2021-03-14hw/display/pxa2xx: Apply brace-related coding style fixes to template headerPeter Maydell1-19/+28
We're about to move code from the template header into pxa2xx_lcd.c. Before doing that, make coding style fixes so checkpatch doesn't complain about the patch which moves the code. This commit fixes missing braces in the SKIP_PIXEL() macro definition and in if() statements. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-8-peter.maydell@linaro.org
2021-03-14hw/display/pxa2xx: Remove use of BITS in pxa2xx_template.hPeter Maydell1-65/+45
Now that BITS is always 32, expand out all its uses in the template header, including removing now-useless uses of the glue() macro. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-7-peter.maydell@linaro.org
2021-03-14hw/display/pxa2xx_lcd: Remove dest_width state fieldPeter Maydell1-9/+11
Since the dest_width is now always 4 because the output surface is 32bpp, we can replace the dest_width state field with a constant. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-6-peter.maydell@linaro.org
2021-03-14hw/display/pxa2xx_lcd: Remove dead code for non-32-bpp surfacesPeter Maydell1-62/+17
For a long time now the UI layer has guaranteed that the console surface is always 32 bits per pixel. Remove the legacy dead code from the pxa2xx_lcd display device which was handling the possibility that the console surface was some other format. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-5-peter.maydell@linaro.org
2021-03-14hw/display/pl110: Remove use of BITS from pl110_template.hPeter Maydell2-68/+65
BITS is always 32, so remove all uses of it from the template header, by dropping the trailing '32' from the draw function names and not constructing the name of rgb_to_pixel32() via the glue() macro. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-4-peter.maydell@linaro.org
2021-03-14hw/display/pl110: Pull included-once parts of template header into pl110.cPeter Maydell2-99/+80
The pl110_template.h header has a doubly-nested multiple-include pattern: * pl110.c includes it once for each host bit depth (now always 32) * every time it is included, it includes itself 6 times, to account for multiple guest device pixel and byte orders Now we only have to deal with 32-bit host bit depths, we can move the code corresponding to the outer layer of this double-nesting to be directly in pl110.c and reduce the template header to a single layer of nesting. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-3-peter.maydell@linaro.org
2021-03-14hw/display/pl110: Remove dead code for non-32-bpp surfacesPeter Maydell1-45/+8
For a long time now the UI layer has guaranteed that the console surface is always 32 bits per pixel. Remove the legacy dead code from the pl110 display device which was handling the possibility that the console surface was some other format. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-2-peter.maydell@linaro.org
2021-03-13hw/mips/gt64xxx: Trace accesses to ISD registersPhilippe Mathieu-Daudé2-0/+4
Trace all accesses to Internal Space Decode (ISD) registers. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20210309142630.728014-6-f4bug@amsat.org>
2021-03-13hw/mips/gt64xxx: Rename trace events related to interrupt registersPhilippe Mathieu-Daudé2-10/+10
We want to trace all register accesses. First rename the current gt64120_read / gt64120_write events with '_intreg' suffix, as they are restricted to interrupt registers. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20210309142630.728014-5-f4bug@amsat.org>
2021-03-13hw/mips/gt64xxx: Fix typos in qemu_log_mask() formatsPhilippe Mathieu-Daudé1-10/+10
Fix the following typos: - GT_PCI1_CFGDATA is not a timer register but a PCI one, - zero-padding flag is out of the format Fixes: 641ca2bfcd5 ("hw/mips/gt64xxx_pci: Use qemu_log_mask() instead of debug printf()") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20210309142630.728014-4-f4bug@amsat.org>
2021-03-13hw/mips/gt64xxx: Simplify ISD MemoryRegion read/write handlersPhilippe Mathieu-Daudé1-4/+6
The ISD MemoryRegion is implemented for 32-bit accesses. Simplify it by setting the MemoryRegionOps::impl min/max access size fields. Since the region is registered with a size of 0x1000 bytes, we can remove the hwaddr mask. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20210309142630.728014-3-f4bug@amsat.org>
2021-03-13hw/mips/gt64xxx: Initialize ISD I/O memory region in DeviceRealize()Philippe Mathieu-Daudé1-2/+9
The ISD I/O region belongs to the TYPE_GT64120_PCI_HOST_BRIDGE, so initialize it before it is realized, not after. Rename the region as 'gt64120-isd' so it is clearer to realize it belongs to the GT64120 in the memory tree view. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20210309142630.728014-2-f4bug@amsat.org>
2021-03-12hw/arm: Connect PWM fans in NPCM7XX boardsHao Wu1-0/+99
This patch adds fan_splitters (split IRQs) in NPCM7XX boards. Each fan splitter corresponds to 1 PWM output and can connect to multiple fan inputs (MFT devices). In NPCM7XX boards(NPCM750 EVB and Quanta GSJ boards), we initializes these splitters and connect them to their corresponding modules according their specific device trees. Reviewed-by: Doug Evans <dje@google.com> Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Signed-off-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210311180855.149764-5-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/arm: Add MFT device to NPCM7xx SocHao Wu1-8/+37
This patch adds the recently implemented MFT device to the NPCM7XX SoC file. Reviewed-by: Doug Evans <dje@google.com> Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Signed-off-by: Hao Wu <wuhaotsh@google.com> Message-id: 20210311180855.149764-4-wuhaotsh@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/misc: Add NPCM7XX MFT ModuleHao Wu3-0/+549
This patch implements Multi Function Timer (MFT) module for NPCM7XX. This module is mainly used to configure PWM fans. It has just enough functionality to make the PWM fan kernel module work. The module takes two input, the max_rpm of a fan (modifiable via QMP) and duty cycle (a GPIO from the PWM module.) The actual measured RPM is equal to max_rpm * duty_cycle / NPCM7XX_PWM_MAX_DUTY. The RPM is measured as a counter compared to a prescaled input clock. The kernel driver reads this counter and report to user space. Refs: https://github.com/torvalds/linux/blob/master/drivers/hwmon/npcm750-pwm-fan.c Reviewed-by: Doug Evans <dje@google.com> Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Signed-off-by: Hao Wu <wuhaotsh@google.com> Message-id: 20210311180855.149764-3-wuhaotsh@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/misc: Add GPIOs for duty in NPCM7xx PWMHao Wu1-0/+4
This patch adds GPIOs in NPCM7xx PWM module for its duty values. The purpose of this is to connect it to the MFT module to provide an input for measuring a PWM fan's RPM. Each PWM module has NPCM7XX_PWM_PER_MODULE of GPIOs, each one corresponds to one PWM instance and can connect to multiple fan instances in MFT. Reviewed-by: Doug Evans <dje@google.com> Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Signed-off-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210311180855.149764-2-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/arm/virt: KVM: The IPA lower bound is 32Andrew Jones1-7/+16
The virt machine already checks KVM_CAP_ARM_VM_IPA_SIZE to get the upper bound of the IPA size. If that bound is lower than the highest possible GPA for the machine, then QEMU will error out. However, the IPA is set to 40 when the highest GPA is less than or equal to 40, even when KVM may support an IPA limit as low as 32. This means KVM may fail the VM creation unnecessarily. Additionally, 40 is selected with the value 0, which means use the default, and that gets around a check in some versions of KVM, causing a difficult to debug fail. Always use the IPA size that corresponds to the highest possible GPA, unless it's lower than 32, in which case use 32. Also, we must still use 0 when KVM only supports the legacy fixed 40 bit IPA. Suggested-by: Marc Zyngier <maz@kernel.org> Signed-off-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Message-id: 20210310135218.255205-3-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/timer/sse-timer: Propagate eventual error in sse_timer_realize()Philippe Mathieu-Daudé1-0/+1
If the SSECounter link is absent, we set an error message in sse_timer_realize() but forgot to propagate this error. Add the missing 'return'. Fixes: CID 1450755 (Null pointer dereferences) Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210312001845.1562670-1-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/net/allwinner-sun8i-emac: traverse transmit queue using TX_CUR_DESC ↵Niek Linnenbank1-26/+32
register value Currently the emulated EMAC for sun8i always traverses the transmit queue from the head when transferring packets. It searches for a list of consecutive descriptors whichs are flagged as ready for processing and transmits their payloads accordingly. The controller stops processing once it finds a descriptor that is not marked ready. While the above behaviour works in most situations, it is not the same as the actual EMAC in hardware. Actual hardware uses the TX_CUR_DESC register value to keep track of the last position in the transmit queue and continues processing from that position when software triggers the start of DMA processing. The currently emulated behaviour can lead to packet loss on transmit when software fills the transmit queue with ready descriptors that overlap the tail of the circular list. This commit modifies the emulated EMAC for sun8i such that it processes the transmit queue using the TX_CUR_DESC register in the same way as hardware. Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210310195820.21950-2-nieklinnenbank@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/arm/smmuv3: Uniformize sid tracesEric Auger1-12/+12
Convert all sid printouts to sid=0x%x. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20210309102742.30442-8-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/arm/smmuv3: Fix SMMU_CMD_CFGI_STE_RANGE handlingEric Auger2-14/+25
If the whole SID range (32b) is invalidated (SMMU_CMD_CFGI_ALL), @end overflows and we fail to handle the command properly. Once this gets fixed, the current code really is awkward in the sense it loops over the whole range instead of removing the currently cached configs through a hash table lookup. Fix both the overflow and the lookup. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210309102742.30442-7-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/arm/smmuv3: Enforce invalidation on a power of two rangeEric Auger2-15/+37
As of today, the driver can invalidate a number of pages that is not a power of 2. However IOTLB unmap notifications and internal IOTLB invalidations work with masks leading to erroneous invalidations. In case the range is not a power of 2, split invalidations into power of 2 invalidations. When looking for a single page entry in the vSMMU internal IOTLB, let's make sure that if the entry is not found using a g_hash_table_remove() we iterate over all the entries to find a potential range that overlaps it. Signed-off-by: Eric Auger <eric.auger@redhat.com> Message-id: 20210309102742.30442-6-eric.auger@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/arm/smmu-common: Fix smmu_iotlb_inv_iova when asid is not setEric Auger1-1/+1
If the asid is not set, do not attempt to locate the key directly as all inserted keys have a valid asid. Use g_hash_table_foreach_remove instead. Signed-off-by: Eric Auger <eric.auger@redhat.com> Message-id: 20210309102742.30442-5-eric.auger@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12virtio-iommu: Handle non power of 2 range invalidationsEric Auger1-3/+16
Unmap notifiers work with an address mask assuming an invalidation range of a power of 2. Nothing mandates this in the VIRTIO-IOMMU spec. So in case the range is not a power of 2, split it into several invalidations. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Message-id: 20210309102742.30442-4-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.1 at 2024-11-03 04:28:48 +0000