aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2021-07-09hw/arm/virt: Make PL061 GPIO lines pulled low, not highPeter Maydell1-0/+3
For the virt board we have two PL061 devices -- one for NonSecure which is inputs only, and one for Secure which is outputs only. For the former, we don't care whether its outputs are pulled low or high when the line is configured as an input, because we don't connect them. For the latter, we do care, because we wire the lines up to the gpio-pwr device, which assumes that level 1 means "do the action" and 1 means "do nothing". For consistency in case we add more outputs in future, configure both PL061s to pull GPIO lines down to 0. Reported-by: Maxim Uvarov <maxim.uvarov@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2021-07-09hw/gpio/pl061: Make pullup/pulldown of outputs configurablePeter Maydell1-4/+47
The PL061 GPIO does not itself include pullup or pulldown resistors to set the value of a GPIO line treated as an output when it is configured as an input (ie when the PL061 itself is not driving it). In real hardware it is up to the board to add suitable pullups or pulldowns. Currently our implementation hardwires this to "outputs pulled high", which is correct for some boards (eg the realview ones: see figure 3-29 in the "RealView Platform Baseboard for ARM926EJ-S User Guide" DUI0224I), but wrong for others. In particular, the wiring in the 'virt' board and the gpio-pwr device assumes that wires should be pulled low, because otherwise the pull-to-high will trigger a shutdown or reset action. (The only reason this doesn't happen immediately on startup is due to another bug in the PL061, where we don't assert the GPIOs to the correct value on reset, but will do so as soon as the guest touches a register and pl061_update() gets called.) Add properties to the pl061 so the board can configure whether it wants GPIO lines to have pullup, pulldown, or neither. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2021-07-09hw/gpio/pl061: Honour Luminary PL061 PUR and PDR registersPeter Maydell2-7/+57
The Luminary variant of the PL061 has registers GPIOPUR and GPIOPDR which lets the guest configure whether the GPIO lines are pull-up, pull-down, or truly floating. Instead of assuming all lines are pulled high, honour the PUR and PDR registers. For the plain PL061, continue to assume that lines have an external pull-up resistor, as we did before. The stellaris board actually relies on this behaviour -- the CD line of the ssd0323 display device is connected to GPIO output C7, and it is only because of a different bug which we're about to fix that we weren't incorrectly driving this line high on reset and putting the ssd0323 into data mode. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2021-07-09hw/gpio/pl061: Document the interface of this devicePeter Maydell1-0/+7
Add a comment documenting the "QEMU interface" of this device: which MMIO regions, IRQ lines, GPIO lines, etc it exposes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2021-07-09hw/gpio/pl061: Add tracepoints for register read and writePeter Maydell2-22/+50
Add tracepoints for reads and writes to the PL061 registers. This requires restructuring pl061_read() to only return after the tracepoint, rather than having lots of early-returns. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2021-07-09hw/gpio/pl061: Clean up read/write offset handling logicPeter Maydell1-25/+79
Currently the pl061_read() and pl061_write() functions handle offsets using a combination of three if() statements and a switch(). Clean this up to use just a switch, using case ranges. This requires that instead of catching accesses to the luminary-only registers on a stock PL061 via a check on s->rsvd_start we use an "is this luminary?" check in the cases for each luminary-only register. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2021-07-09hw/gpio/pl061: Convert DPRINTF to tracepointsPeter Maydell2-18/+15
Convert the use of the DPRINTF debug macro in the PL061 model to use tracepoints. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2021-07-09hw/intc/arm_gicv3_cpuif: Fix virtual irq number check in icv_[dir|eoir]_writeRicardo Koller1-2/+2
icv_eoir_write() and icv_dir_write() ignore invalid virtual IRQ numbers (like LPIs). The issue is that these functions check against the number of implemented IRQs (QEMU's default is num_irq=288) which can be lower than the maximum virtual IRQ number (1020 - 1). The consequence is that if a hypervisor creates an LR for an IRQ between 288 and 1020, then the guest is unable to deactivate the resulting IRQ. Note that other functions that deal with large IRQ numbers, like icv_iar_read, check against 1020 and not against num_irq. Fix the checks by using GICV3_MAXIRQ (1020) instead of the number of implemented IRQs. Signed-off-by: Ricardo Koller <ricarkol@google.com> Message-id: 20210702233701.3369-1-ricarkol@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-09stm32vldiscovery: Add the STM32VLDISCOVERY MachineAlexandre Iooss3-0/+71
This is a Cortex-M3 based machine. Information can be found at: https://www.st.com/en/evaluation-tools/stm32vldiscovery.html Signed-off-by: Alexandre Iooss <erdnaxe@crans.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210617165647.2575955-3-erdnaxe@crans.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-09stm32f100: Add the stm32f100 SoCAlexandre Iooss3-0/+189
This SoC is similar to stm32f205 SoC. This will be used by the STM32VLDISCOVERY to create a machine. Signed-off-by: Alexandre Iooss <erdnaxe@crans.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210617165647.2575955-2-erdnaxe@crans.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-09Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell10-5/+103
pc,pci,virtio: bugfixes, improvements vhost-user-rng support. Fixes all over the place. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 07 Jul 2021 14:29:30 BST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: MAINTAINERS: Add maintainer for vhost-user RNG implementation docs: add slot when adding new PCIe root port acpi/ged: fix reset cause tests: acpi: pc: update expected DSDT blobs acpi: pc: revert back to v5.2 PCI slot enumeration tests: acpi: prepare for changing DSDT tables migration: failover: reset partially_hotplugged virtio-pci: Changed return values for "notify", "device" and "isr" read. virtio-pci: Added check for virtio device in PCI config cbs. virtio-pci: Added check for virtio device presence in mm callbacks. hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field virtio: Clarify MR transaction optimization virtio: disable ioeventfd for record/replay Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-08Merge remote-tracking branch ↵Peter Maydell1-4/+38
'remotes/stefanha-gitlab/tags/block-pull-request' into staging Pull request # gpg: Signature made Thu 08 Jul 2021 14:11:37 BST # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha-gitlab/tags/block-pull-request: block/io: Merge discard request alignments block: Add backend_defaults property block/file-posix: Optimize for macOS util/async: print leaked BH name when AioContext finalizes util/async: add a human-readable name to BHs for debugging Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-06block: Add backend_defaults propertyAkihiko Odaki1-4/+38
backend_defaults property allow users to control if default block properties should be decided with backend information. If it is off, any backend information will be discarded, which is suitable if you plan to perform live migration to a different disk backend. If it is on, a block device may utilize backend information more aggressively. By default, it is auto, which uses backend information for block sizes and ignores the others, which is consistent with the older versions. Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Message-id: 20210705130458.97642-2-akihiko.odaki@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-07-06Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into ↵Peter Maydell2-53/+61
staging * More Meson test conversions and configure cleanups * Generalize XSAVE area offset so that it matches AMD processors on KVM * Improvements for -display and deprecation of -no-quit * Enable SMP configuration as a compound machine property ("-M smp.cpus=...") * Haiku compilation fix * Add icon on Darwin # gpg: Signature made Tue 06 Jul 2021 08:35:23 BST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini-gitlab/tags/for-upstream: (40 commits) config-host.mak: remove unused compiler-related lines Set icon for QEMU binary on Mac OS qemu-option: remove now-dead code machine: add smp compound property vl: switch -M parsing to keyval keyval: introduce keyval_parse_into keyval: introduce keyval_merge qom: export more functions for use with non-UserCreatable objects configure: convert compiler tests to meson, part 6 configure: convert compiler tests to meson, part 5 configure: convert compiler tests to meson, part 4 configure: convert compiler tests to meson, part 3 configure: convert compiler tests to meson, part 2 configure: convert compiler tests to meson, part 1 configure: convert HAVE_BROKEN_SIZE_MAX to meson configure, meson: move CONFIG_IVSHMEM to meson meson: store dependency('threads') in a variable meson: sort existing compiler tests configure, meson: convert libxml2 detection to meson configure, meson: convert liburing detection to meson ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-06machine: add smp compound propertyPaolo Bonzini1-50/+58
Make -smp syntactic sugar for a compound property "-machine smp.{cores,threads,cpu,...}". machine_smp_parse is replaced by the setter for the property. numa-test will now cover the new syntax, while other tests still use -smp. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-06configure, meson: convert virgl detection to mesonPaolo Bonzini1-3/+3
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-05Merge remote-tracking branch 'remotes/cschoenebeck/tags/pull-9p-20210705' ↵Peter Maydell16-48/+166
into staging 9pfs: misc patches * Add link to 9p developer docs. * Fix runtime check whether client supplied relative path is the export root. * Performance optimization of Twalk requests. * Code cleanup. # gpg: Signature made Mon 05 Jul 2021 12:13:34 BST # gpg: using RSA key 96D8D110CF7AF8084F88590134C2B58765A47395 # gpg: issuer "qemu_oss@crudebyte.com" # gpg: Good signature from "Christian Schoenebeck <qemu_oss@crudebyte.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: ECAB 1A45 4014 1413 BA38 4926 30DB 47C3 A012 D5F4 # Subkey fingerprint: 96D8 D110 CF7A F808 4F88 5901 34C2 B587 65A4 7395 * remotes/cschoenebeck/tags/pull-9p-20210705: 9pfs: reduce latency of Twalk 9pfs: drop root_qid 9pfs: replace not_same_qid() by same_stat_id() 9pfs: drop fid_to_qid() 9pfs: capture root stat 9pfs: fix not_same_qid() 9pfs: simplify v9fs_walk() 9pfs: add link to 9p developer docs Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-059pfs: reduce latency of TwalkChristian Schoenebeck1-19/+70
As with previous performance optimization on Treaddir handling; reduce the overall latency, i.e. overall time spent on processing a Twalk request by reducing the amount of thread hops between the 9p server's main thread and fs worker thread(s). In fact this patch even reduces the thread hops for Twalk handling to its theoritical minimum of exactly 2 thread hops: main thread -> fs worker thread -> main thread This is achieved by doing all the required fs driver tasks altogether in a single v9fs_co_run_in_worker({ ... }); code block. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <1a6701674afc4f08d40396e3aa2631e18a4dbb33.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: drop root_qidChristian Schoenebeck2-2/+0
There is no longer a user of root_qid, so drop it. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <6896dd161d3257db6b0513842a14f87ca191fdf6.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: replace not_same_qid() by same_stat_id()Christian Schoenebeck1-3/+3
As we are actually only comparing the filesystem ID (i.e. device number and inode number pair) let's use the POSIX stat buffer instead of QIDs, because resolving QIDs requires to be done on 9p server's main thread only as it might mutate the server state if inode remapping is enabled. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <26aa465ff9cc9c07e053331554a02fdae3994417.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: drop fid_to_qid()Christian Schoenebeck1-18/+5
There is only one user of fid_to_qid() which is v9fs_walk(). Let's open-code fid_to_qid() directly within v9fs_walk(), because fid_to_qid() hides the POSIX stat buffer which we are going to need in the subsequent patch. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <e9a4c9c7a0792ed4db6578d105a0823ea05bc324.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: capture root statChristian Schoenebeck2-1/+10
We already capture the QID of the exported 9p root path, i.e. to prevent client access outside the defined, exported filesystem's tree. This is currently checked by comparing the root QID with another FID's QID. The problem with the latter is that resolving a QID of any given 9p path can only be done on 9p server's main thread, that's because it might mutate the server's state if inode remapping is enabled. For that reason also capture the POSIX stat info of the root path for being able to identify on any (e.g. worker) thread whether an arbitrary given path is identical to the export root. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <eb07d6c2e9925788454cfe33d3802e4ffb23ea9a.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: fix not_same_qid()Christian Schoenebeck1-4/+1
There is only one user of not_same_qid() which is v9fs_walk() and the latter is using it for comparing a client supplied path with the 9p export root path, for the sole purpose to prevent a Twalk request from escaping from the exported 9p tree via "..". However for that specific purpose the implementation of not_same_qid() is wrong; if mtime of the 9p export root path changed between Tattach and Twalk then not_same_qid() returns true when actually comparing against the export root path. To fix for the actual semantic being used, only compare QID path members, but do not compare version or type members. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <ca0abae4a899d81c6e87f683732d6c1f56915232.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: simplify v9fs_walk()Christian Schoenebeck1-4/+5
There is only one comparison between nwnames and P9_MAXWELEM required. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <E1liKiz-0006BC-Ja@lizzy.crudebyte.com>
2021-07-059pfs: add link to 9p developer docsChristian Schoenebeck15-0/+75
To lower the entry level for new developers, add a link to the 9p developer docs (i.e. qemu wiki) to MAINTAINERS and to the beginning of 9p source files, that is to: https://wiki.qemu.org/Documentation/9p Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Acked-by: Greg Kurz <groug@kaod.org> Message-Id: <E1leeDf-0008GZ-9q@lizzy.crudebyte.com>
2021-07-05Merge remote-tracking branch 'remotes/marcel/tags/pvrdma-04-07-2021-v2' into ↵Peter Maydell3-1/+13
staging PVRDMA queue Several CVE fixes for the PVRDMA device. # gpg: Signature made Sun 04 Jul 2021 20:56:05 BST # gpg: using RSA key 36D4C0F0CF2FE46D # gpg: Good signature from "Marcel Apfelbaum <marcel.apfelbaum@zoho.com>" [marginal] # gpg: aka "Marcel Apfelbaum <marcel@redhat.com>" [marginal] # gpg: aka "Marcel Apfelbaum <marcel.apfelbaum@gmail.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: B1C6 3A57 F92E 08F2 640F 31F5 36D4 C0F0 CF2F E46D * remotes/marcel/tags/pvrdma-04-07-2021-v2: pvrdma: Fix the ring init error flow (CVE-2021-3608) pvrdma: Ensure correct input on ring init (CVE-2021-3607) hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-04pvrdma: Fix the ring init error flow (CVE-2021-3608)Marcel Apfelbaum1-1/+1
Do not unmap uninitialized dma addresses. Fixes: CVE-2021-3608 Reviewed-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Tested-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Message-Id: <20210630115246.2178219-1-marcel@redhat.com> Tested-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2021-07-04pvrdma: Ensure correct input on ring init (CVE-2021-3607)Marcel Apfelbaum1-0/+5
Check the guest passed a non zero page count for pvrdma device ring buffers. Fixes: CVE-2021-3607 Reported-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Reviewed-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Message-Id: <20210630114634.2168872-1-marcel@redhat.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Tested-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2021-07-04hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582)Marcel Apfelbaum1-0/+7
Ensure mremap boundaries not trusting the guest kernel to pass the correct buffer length. Fixes: CVE-2021-3582 Reported-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Tested-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Message-Id: <20210616110600.20889-1-marcel.apfelbaum@gmail.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Tested-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2021-07-04Merge remote-tracking branch 'remotes/philmd/tags/mips-20210702' into stagingPeter Maydell7-192/+243
MIPS patches queue - Extract nanoMIPS, microMIPS, Code Compaction from translate.c - Allow PCI config accesses smaller than 32-bit on Bonito64 device - Fix migration of g364fb device on Jazz Magnum - Fix dp8393x PROM checksum on Jazz Magnum and Quadra 800 - Map the UART devices unconditionally on Jazz Magnum - Add functional test booting Linux on the Fuloong 2E # gpg: Signature made Fri 02 Jul 2021 16:36:19 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/mips-20210702: hw/mips/jazz: Map the UART devices unconditionally hw/mips/jazz: specify correct endian for dp8393x device hw/m68k/q800: fix PROM checksum and MAC address storage qemu/bitops.h: add bitrev8 implementation dp8393x: remove onboard PROM containing MAC address and checksum hw/m68k/q800: move PROM and checksum calculation from dp8393x device to board hw/mips/jazz: move PROM and checksum calculation from dp8393x device to board dp8393x: convert to trace-events dp8393x: checkpatch fixes g364fb: add VMStateDescription for G364SysBusState g364fb: use RAM memory region for framebuffer tests/acceptance: Test Linux on the Fuloong 2E machine hw/pci-host/bonito: Allow PCI config accesses smaller than 32-bit hw/pci-host/bonito: Trace PCI config accesses smaller than 32-bit target/mips: Extract nanoMIPS ISA translation routines target/mips: Extract the microMIPS ISA translation routines target/mips: Extract Code Compaction ASE translation routines target/mips: Add declarations for generic TCG helpers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-03Merge remote-tracking branch ↵Peter Maydell4-2/+174
'remotes/pmaydell/tags/pull-target-arm-20210702' into staging target-arm queue: * more MVE instructions * hw/gpio/gpio_pwr: use shutdown function for reboot * target/arm: Check NaN mode before silencing NaN * tests: Boot and halt a Linux guest on the Raspberry Pi 2 machine * hw/arm: Add basic power management to raspi. * docs/system/arm: Add quanta-gbs-bmc, quanta-q7l1-bmc # gpg: Signature made Fri 02 Jul 2021 13:59:19 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210702: (24 commits) target/arm: Implement MVE shifts by register target/arm: Implement MVE shifts by immediate target/arm: Implement MVE long shifts by register target/arm: Implement MVE long shifts by immediate target/arm: Implement MVE VADDLV target/arm: Implement MVE VSHLC target/arm: Implement MVE saturating narrowing shifts target/arm: Implement MVE VSHRN, VRSHRN target/arm: Implement MVE VSRI, VSLI target/arm: Implement MVE VSHLL target/arm: Implement MVE vector shift right by immediate insns target/arm: Implement MVE vector shift left by immediate insns target/arm: Implement MVE logical immediate insns target/arm: Use dup_const() instead of bitfield_replicate() target/arm: Use asimd_imm_const for A64 decode target/arm: Make asimd_imm_const() public target/arm: Fix bugs in MVE VRMLALDAVH, VRMLSLDAVH target/arm: Fix MVE widening/narrowing VLDR/VSTR offset calculation hw/gpio/gpio_pwr: use shutdown function for reboot target/arm: Check NaN mode before silencing NaN ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-03acpi/ged: fix reset causeGerd Hoffmann1-1/+1
Reset requests should use SHUTDOWN_CAUSE_GUEST_RESET not SHUTDOWN_CAUSE_GUEST_SHUTDOWN. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20210624110057.2398779-1-kraxel@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-03acpi: pc: revert back to v5.2 PCI slot enumerationIgor Mammedov1-2/+7
Commit [1] moved _SUN variable from only hot-pluggable to all devices. This made linux kernel enumerate extra slots that weren't present before. If extra slot happens to be be enumerated first and there is a device in th same slot but on other bridge, linux kernel will add -N suffix to slot name of the later, thus changing NIC name compared to QEMU 5.2. This in some case confuses systemd, if it is using SLOT NIC naming scheme and interface name becomes not the same as it was under QEMU-5.2. Reproducer QEMU CLI: -M pc-i440fx-5.2 -nodefaults \ -device pci-bridge,chassis_nr=1,id=pci.1,bus=pci.0,addr=0x3 \ -device virtio-net-pci,id=nic1,bus=pci.1,addr=0x1 \ -device virtio-net-pci,id=nic2,bus=pci.1,addr=0x2 \ -device virtio-net-pci,id=nic3,bus=pci.1,addr=0x3 with RHEL8 guest produces following results: v5.2: kernel: virtio_net virtio0 ens1: renamed from eth0 kernel: virtio_net virtio2 ens3: renamed from eth2 kernel: virtio_net virtio1 enp1s2: renamed from eth1 (slot 2 is assigned to empty bus 0 slot and virtio1 is assigned to 2-2 slot, and renaming falls back, for some reason, to path based naming scheme) v6.0: kernel: virtio_net virtio0 ens1: renamed from eth0 kernel: virtio_net virtio2 ens3: renamed from eth2 systemd-udevd[299]: Error changing net interface name 'eth1' to 'ens3': File exists systemd-udevd[299]: could not rename interface '3' from 'eth1' to 'ens3': File exists (with commit [1] kernel assigns virtio2 to 3-2 slot since bridge advertises _SUN=0x3 and kernel assigns slot 3 to bridge. Still it manages to rename virtio2 correctly to ens3, however systemd gets confused with virtio1 where slot allocation exactly the same (2-2) as in 5.2 case and tries to rename it to ens3 which is rightfully taken by virtio2) I'm not sure what breaks in systemd interface renaming (it probably should be investigated), but on QEMU side we can safely revert _SUN to 5.2 behavior (i.e. avoid cold-plugged bridges and non hot-pluggable device classes), without breaking acpi-index, which uses slot numbers but it doesn't have to use _SUN, it could use an arbitrary variable name that has the same slot value). It will help existing VMs to keep networking with non trivial configs in working order since systemd will do its interface renaming magic as it used to do. 1) Fixes: b7f23f62e40 (pci: acpi: add _DSM method to PCI devices) Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20210624204229.998824-3-imammedo@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: John Sucaet <john.sucaet@ekinops.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-03migration: failover: reset partially_hotpluggedLaurent Vivier1-0/+1
When the card is plugged back, reset the partially_hotplugged flag to false Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1787194 Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20210629152937.619193-1-lvivier@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-03virtio-pci: Changed return values for "notify", "device" and "isr" read.Andrew Melnychenko1-2/+7
At some point, after unplugging virtio-pci the virtio device may be unrealised, but the memory regions may be present in flatview. So, it's a possible situation when memory region's callbacks are called for "unplugged" device. Previous two patches made sure this case does not cause QEMU to crash. This patch adds check for "notify" memory region. Now reads will return "-1" if a virtio device is not present on a virtio bus. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1938042 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1743098 Signed-off-by: Andrew Melnychenko <andrew@daynix.com> Message-Id: <20210609095843.141378-4-andrew@daynix.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-03virtio-pci: Added check for virtio device in PCI config cbs.Andrew Melnychenko1-0/+10
Now, if virtio device is not present on virtio-bus - pci config callbacks will not lead to possible crush. The read will return "-1" which should be interpreted by a driver that pci device may be unplugged. Signed-off-by: Andrew Melnychenko <andrew@daynix.com> Message-Id: <20210609095843.141378-3-andrew@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-03virtio-pci: Added check for virtio device presence in mm callbacks.Andrew Melnychenko1-0/+8
During unplug the virtio device is unplugged from virtio-bus on pci. In some cases, requests to virtio-pci mm may acquire during/after unplug. Added check that virtio device is on the bus, for "common" memory region. Signed-off-by: Andrew Melnychenko <andrew@daynix.com> Message-Id: <20210609095843.141378-2-andrew@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-03hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH fieldPhilippe Mathieu-Daudé1-0/+3
libFuzzer triggered the following assertion: cat << EOF | qemu-system-i386 -M pc-q35-5.0 \ -nographic -monitor none -serial none \ -qtest stdio -d guest_errors -trace pci\* outl 0xcf8 0xf2000060 outl 0xcfc 0x8400056e EOF pci_cfg_write mch 00:0 @0x60 <- 0x8400056e Aborted (core dumped) This is because guest wrote MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD (reserved value) to the PCIE XBAR register. There is no indication on the datasheet about what occurs when this value is written. Simply ignore it on QEMU (and report an guest error): pci_cfg_write mch 00:0 @0x60 <- 0x8400056e Q35: Reserved PCIEXBAR LENGTH pci_cfg_read mch 00:0 @0x0 -> 0x8086 pci_cfg_read mch 00:0 @0x0 -> 0x29c08086 ... Cc: qemu-stable@nongnu.org Reported-by: Alexander Bulekov <alxndr@bu.edu> BugLink: https://bugs.launchpad.net/qemu/+bug/1878641 Fixes: df2d8b3ed4 ("q35: Introduce q35 pc based chipset emulator") Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210526142438.281477-1-f4bug@amsat.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-02hw/mips/jazz: Map the UART devices unconditionallyPhilippe Mathieu-Daudé1-10/+6
When using the Magnum ARC firmware we can see accesses to the UART1 being rejected, because the device is not mapped: $ qemu-system-mips64el -M magnum -d guest_errors,unimp -bios NTPROM.RAW Invalid access at addr 0x80007004, size 1, region '(null)', reason: rejected Invalid access at addr 0x80007001, size 1, region '(null)', reason: rejected Invalid access at addr 0x80007002, size 1, region '(null)', reason: rejected Invalid access at addr 0x80007003, size 1, region '(null)', reason: rejected Invalid access at addr 0x80007004, size 1, region '(null)', reason: rejected Since both UARTs are present (soldered on the board) regardless of whether there are character devices connected, map them unconditionally. (This code pre-dated commit 12051d82f004 which made it safe to pass NULL in as a chardev to serial devices.) Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210629053704.2584504-1-f4bug@amsat.org>
2021-07-02hw/mips/jazz: specify correct endian for dp8393x deviceMark Cave-Ayland1-1/+8
The MIPS magnum machines are available in both big endian (mips64) and little endian (mips64el) configurations. Ensure that the dp893x big_endian property is set accordingly using logic similar to that used for the MIPS malta machines. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625065401.30170-11-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02hw/m68k/q800: fix PROM checksum and MAC address storageMark Cave-Ayland1-5/+2
The checksum used by MacOS to validate the PROM content is an exclusive-OR rather than a sum over the corresponding bytes. In addition the MAC address must be stored in bit-reversed format as indicated in comments in Linux's macsonic.c. With the PROM contents fixed MacOS starts to probe the device registers when AppleTalk is enabled in the Control Panel. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210625065401.30170-8-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02dp8393x: remove onboard PROM containing MAC address and checksumMark Cave-Ayland1-24/+0
According to the datasheet the dp8393x chipset does not contain any NVRAM capable of storing a MAC address or checksum. Now that both the MIPS jazz and m68k q800 boards generate the PROM region and checksum themselves, remove the generated PROM from the dp8393x device itself. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625065401.30170-6-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02hw/m68k/q800: move PROM and checksum calculation from dp8393x device to boardMark Cave-Ayland1-2/+22
This is in preparation for each board to have its own separate bit storage format and checksum for storing the MAC address. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625065401.30170-5-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02hw/mips/jazz: move PROM and checksum calculation from dp8393x device to boardMark Cave-Ayland1-1/+22
This is in preparation for each board to have its own separate bit storage format and checksum for storing the MAC address. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625065401.30170-4-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02dp8393x: convert to trace-eventsMark Cave-Ayland2-35/+37
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210625065401.30170-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02dp8393x: checkpatch fixesMark Cave-Ayland1-109/+122
Also fix a simple comment typo of "constrainst" to "constraints". Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210625065401.30170-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02g364fb: add VMStateDescription for G364SysBusStateMark Cave-Ayland1-1/+11
Currently when QEMU attempts to migrate the MIPS magnum machine it crashes due to a mistake in the g364fb VMStateDescription configuration which expects a G364SysBusState and not a G364State. Resolve the issue by adding a new VMStateDescription for G364SysBusState and embedding the existing vmstate_g364fb VMStateDescription inside it using VMSTATE_STRUCT. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Fixes: 97a3f6ffbba ("g364fb: convert to qdev") Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625163554.14879-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02g364fb: use RAM memory region for framebufferMark Cave-Ayland1-11/+9
Since the migration stream is already broken, we can use this opportunity to change the framebuffer so that it is migrated as a RAM memory region rather than as an array of bytes. In particular this helps the output of the analyze-migration.py tool which no longer contains a huge array representing the framebuffer contents. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625163554.14879-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02hw/pci-host/bonito: Allow PCI config accesses smaller than 32-bitPhilippe Mathieu-Daudé1-2/+2
When running the official PMON firmware for the Fuloong 2E, we see 8-bit and 16-bit accesses to PCI config space: $ qemu-system-mips64el -M fuloong2e -bios pmon_2e.bin \ -trace -trace bonito\* -trace pci_cfg\* pci_cfg_write vt82c686b-pm 05:4 @0x90 <- 0xeee1 bonito_spciconf_small_access PCI config address is smaller then 32-bit, addr: 0x4d2, size: 2 pci_cfg_write vt82c686b-pm 05:4 @0xd2 <- 0x1 pci_cfg_write vt82c686b-pm 05:4 @0x4 <- 0x1 pci_cfg_write vt82c686b-isa 05:0 @0x4 <- 0x7 bonito_spciconf_small_access PCI config address is smaller then 32-bit, addr: 0x81, size: 1 pci_cfg_read vt82c686b-isa 05:0 @0x81 -> 0x0 bonito_spciconf_small_access PCI config address is smaller then 32-bit, addr: 0x81, size: 1 pci_cfg_write vt82c686b-isa 05:0 @0x81 <- 0x80 bonito_spciconf_small_access PCI config address is smaller then 32-bit, addr: 0x83, size: 1 pci_cfg_write vt82c686b-isa 05:0 @0x83 <- 0x89 bonito_spciconf_small_access PCI config address is smaller then 32-bit, addr: 0x85, size: 1 pci_cfg_write vt82c686b-isa 05:0 @0x85 <- 0x3 bonito_spciconf_small_access PCI config address is smaller then 32-bit, addr: 0x5a, size: 1 pci_cfg_write vt82c686b-isa 05:0 @0x5a <- 0x7 bonito_spciconf_small_access PCI config address is smaller then 32-bit, addr: 0x85, size: 1 pci_cfg_write vt82c686b-isa 05:0 @0x85 <- 0x1 Also this is what the Linux kernel does since it supports the Bonito north bridge: https://elixir.bootlin.com/linux/v2.6.15/source/arch/mips/pci/ops-bonito64.c#L85 So it seems safe to assume the datasheet is incomplete or outdated regarding the address constraints. This problem was exposed by commit 911629e6d3773a8adeab48b ("vt82c686: Fix SMBus IO base and configuration registers"). Reported-by: BALATON Zoltan <balaton@eik.bme.hu> Suggested-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210624202747.1433023-4-f4bug@amsat.org> Tested-by: BALATON Zoltan <balaton@eik.bme.hu>
2021-07-02virtio: Clarify MR transaction optimizationGreg Kurz3-0/+48
The device model batching its ioeventfds in a single MR transaction is an optimization. Clarify this in virtio-scsi, virtio-blk and generic virtio code. Also clarify that the transaction must commit before closing ioeventfds so that no one is tempted to merge the loops in the start functions error path and in the stop functions. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <162125799728.1394228.339855768563326832.stgit@bahia.lan> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
generated by cgit v1.1 at 2025-01-30 00:07:57 +0000