summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * tests/qtest: Add npcm7xx timer testHavard Skinnemoen2020-10-202-0/+563
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This test exercises the various modes of the npcm7xx timer. In particular, it triggers the bug found by the fuzzer, as reported here: https://lists.gnu.org/archive/html/qemu-devel/2020-09/msg02992.html It also found several other bugs, especially related to interrupt handling. The test exercises all the timers in all the timer modules, which expands to 180 test cases in total. Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com> Message-id: 20201008232154.94221-2-hskinnemoen@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/arm: Use tlb_flush_page_bits_by_mmuidx*Richard Henderson2020-10-201-7/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When TBI is enabled in a given regime, 56 bits of the address are significant and we need to clear out any other matching virtual addresses with differing tags. The other uses of tlb_flush_page (without mmuidx) in this file are only used by aarch32 mode. Fixes: 38d931687fa1 Reported-by: Jordan Frank <jordanfrank@fb.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201016210754.818257-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * accel/tcg: Add tlb_flush_page_bits_by_mmuidx*Richard Henderson2020-10-202-9/+302
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On ARM, the Top Byte Ignore feature means that only 56 bits of the address are significant in the virtual address. We are required to give the entire 64-bit address to FAR_ELx on fault, which means that we do not "clean" the top byte early in TCG. This new interface allows us to flush all 256 possible aliases for a given page, currently missed by tlb_flush_page*. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20201016210754.818257-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/arm/bcm2835_peripherals: Correctly wire the SYS_timer IRQsPhilippe Mathieu-Daudé2020-10-201-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | The SYS_timer is not directly wired to the ARM core, but to the SoC (peripheral) interrupt controller. Fixes: 0e5bbd74064 ("hw/arm/bcm2835_peripherals: Use the SYS_timer") Reviewed-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201010203709.3116542-5-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/timer/bcm2835: Support the timer COMPARE registersPhilippe Mathieu-Daudé2020-10-203-21/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This peripheral has 1 free-running timer and 4 compare registers. Only the free-running timer is implemented. Add support the COMPARE registers (each register is wired to an IRQ). Reference: "BCM2835 ARM Peripherals" datasheet [*] chapter 12 "System Timer": The System Timer peripheral provides four 32-bit timer channels and a single 64-bit free running counter. Each channel has an output compare register, which is compared against the 32 least significant bits of the free running counter values. When the two values match, the system timer peripheral generates a signal to indicate a match for the appropriate channel. The match signal is then fed into the interrupt controller. This peripheral is used since Linux 3.7, commit ee4af5696720 ("ARM: bcm2835: add system timer"). [*] https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Luc Michel <luc@lmichel.fr> Message-id: 20201010203709.3116542-4-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/timer/bcm2835: Rename variable holding CTRL_STATUS registerPhilippe Mathieu-Daudé2020-10-202-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | The variable holding the CTRL_STATUS register is misnamed 'status'. Rename it 'ctrl_status' to make it more obvious this register is also used to control the peripheral. Reviewed-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201010203709.3116542-3-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/timer/bcm2835: Introduce BCM2835_SYSTIMER_COUNT definitionPhilippe Mathieu-Daudé2020-10-202-2/+5
| | | | | | | | | | | | | | | | | | | | | | Use the BCM2835_SYSTIMER_COUNT definition instead of the magic '4' value. Reviewed-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201010203709.3116542-2-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/arm: Restrict APEI tables generation to the 'virt' machinePhilippe Mathieu-Daudé2020-10-202-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While APEI is a generic ACPI feature (usable by X86 and ARM64), only the 'virt' machine uses it, by enabling the RAS Virtualization. See commit 2afa8c8519: "hw/arm/virt: Introduce a RAS machine option"). Restrict the APEI tables generation code to the single user: the virt machine. If another machine wants to use it, it simply has to 'select ACPI_APEI' in its Kconfig. Fixes: aa16508f1d ("ACPI: Build related register address fields via hardware error fw_cfg blob") Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dongjiu Geng <gengdongjiu@huawei.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201008161414.2672569-1-philmd@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/arm/strongarm: Fix 'time to transmit a char' unit commentPhilippe Mathieu-Daudé2020-10-201-1/+1
| | | | | | | | | | | | | | | | | | The time to transmit a char is expressed in nanoseconds, not in ticks. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201014213601.205222-1-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/arm: AArch32 VCVT fixed-point to float is always round-to-nearestPeter Maydell2020-10-203-13/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For AArch32, unlike the VCVT of integer to float, which honours the rounding mode specified by the FPSCR, VCVT of fixed-point to float is always round-to-nearest. (AArch64 fixed-point-to-float conversions always honour the FPCR rounding mode.) Implement this by providing _round_to_nearest versions of the relevant helpers which set the rounding mode temporarily when making the call to the underlying softfloat function. We only need to change the VFP VCVT instructions, because the standard- FPSCR value used by the Neon VCVT is always set to round-to-nearest, so we don't need to do the extra work of saving and restoring the rounding mode. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20201013103532.13391-1-peter.maydell@linaro.org
| * target/arm: Fix SMLAD incorrect setting of Q bitPeter Maydell2020-10-201-11/+49
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The SMLAD instruction is supposed to: * signed multiply Rn[15:0] * Rm[15:0] * signed multiply Rn[31:16] * Rm[31:16] * perform a signed addition of the products and Ra * set Rd to the low 32 bits of the theoretical infinite-precision result * set the Q flag if the sign-extension of Rd would differ from the infinite-precision result (ie on overflow) Our current implementation doesn't quite do this, though: it performs an addition of the products setting Q on overflow, and then it adds Ra, again possibly setting Q. This sometimes incorrectly sets Q when the architecturally mandated only-check-for-overflow-once algorithm does not. For instance: r1 = 0x80008000; r2 = 0x80008000; r3 = 0xffffffff smlad r0, r1, r2, r3 This is (-32768 * -32768) + (-32768 * -32768) - 1 The products are both 0x4000_0000, so when added together as 32-bit signed numbers they overflow (and QEMU sets Q), but because the addition of Ra == -1 brings the total back down to 0x7fff_ffff there is no overflow for the complete operation and setting Q is incorrect. Fix this edge case by resorting to 64-bit arithmetic for the case where we need to add three values together. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20201009144712.11187-1-peter.maydell@linaro.org
* Merge remote-tracking branch 'remotes/aperard/tags/pull-xen-20201020' into ↵Peter Maydell2020-10-208-16/+51
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging Xen queue * cleanup patches. * improve xen backend setup performance when other xen guests are running/booting. * improve xen guest migration when running in a stubdomain. # gpg: Signature made Tue 20 Oct 2020 10:55:11 BST # gpg: using RSA key F80C006308E22CFD8A92E7980CF5572FD7FB55AF # gpg: issuer "anthony.perard@citrix.com" # gpg: Good signature from "Anthony PERARD <anthony.perard@gmail.com>" [marginal] # gpg: aka "Anthony PERARD <anthony.perard@citrix.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 5379 2F71 024C 600F 778A 7161 D8D5 7199 DF83 42C8 # Subkey fingerprint: F80C 0063 08E2 2CFD 8A92 E798 0CF5 572F D7FB 55AF * remotes/aperard/tags/pull-xen-20201020: hw/xen: Set suppress-vmdesc for Xen machines xen-bus: reduce scope of backend watch xen: Rename XENBACKEND_DEVICE to XENBACKEND xen: xenguest is not used so is not needed Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/xen: Set suppress-vmdesc for Xen machinesJason Andryuk2020-10-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | xen-save-devices-state doesn't currently generate a vmdesc, so restore always triggers "Expected vmdescription section, but got 0". This is not a problem when restore comes from a file. However, when QEMU runs in a linux stubdom and comes over a console, EOF is not received. This causes a delay restoring - though it does restore. Setting suppress-vmdesc skips looking for the vmdesc during restore and avoids the wait. The other approach would be generate a vmdesc in qemu_save_device_state. Since COLO shared that function, and the vmdesc is just discarded on restore, we choose to skip it. Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Signed-off-by: Jason Andryuk <jandryuk@gmail.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com> Message-Id: <20201013190506.3325-1-jandryuk@gmail.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
| * xen-bus: reduce scope of backend watchPaul Durrant2020-10-194-9/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently a single watch on /local/domain/X/backend is registered by each QEMU process running in service domain X (where X is usually 0). The purpose of this watch is to ensure that QEMU is notified when the Xen toolstack creates a new device backend area. Such a backend area is specific to a single frontend area created for a specific guest domain and, since each QEMU process is also created to service a specfic guest domain, it is unnecessary and inefficient to notify all QEMU processes. Only the QEMU process associated with the same guest domain need receive the notification. This patch re-factors the watch registration code such that notifications are targetted appropriately. Reported-by: Jerome Leseinne <jerome.leseinne@gmail.com> Signed-off-by: Paul Durrant <pdurrant@amazon.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Message-Id: <20201001081500.1026-1-paul@xen.org> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
| * xen: Rename XENBACKEND_DEVICE to XENBACKENDEduardo Habkost2020-10-191-1/+1
| | | | | | | | | | | | | | | | | | | | Make the type checking macro name consistent with the TYPE_* constant. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com> Message-Id: <20200902224311.1321159-58-ehabkost@redhat.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
| * xen: xenguest is not used so is not neededMichael Tokarev2020-10-192-4/+2Star
|/ | | | | | | | | | | | There's no references in only file which includes xenguest.h to any xen definitions. And there's no references to -lxenguest in qemu, either. Drop it. Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Message-Id: <20200727140048.19779-1-mjt@msgid.tls.msk.ru> [perard: rebased] Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
* Merge remote-tracking branch 'remotes/cschoenebeck/tags/pull-9p-20201019' ↵Peter Maydell2020-10-195-23/+292
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging 9pfs: add tests using local fs driver The currently existing 9pfs test cases are all solely using the 9pfs 'synth' fileystem driver, which is a very simple and purely simulated (in RAM only) filesystem. There are issues though where the 'synth' fs driver is not sufficient. For example the following two bugs need test cases running the 9pfs 'local' fs driver: https://bugs.launchpad.net/qemu/+bug/1336794 https://bugs.launchpad.net/qemu/+bug/1877384 This patch set for that reason introduces 9pfs test cases using the 9pfs 'local' filesystem driver along to the already existing tests on 'synth'. # gpg: Signature made Mon 19 Oct 2020 13:39:08 BST # gpg: using RSA key 96D8D110CF7AF8084F88590134C2B58765A47395 # gpg: issuer "qemu_oss@crudebyte.com" # gpg: Good signature from "Christian Schoenebeck <qemu_oss@crudebyte.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: ECAB 1A45 4014 1413 BA38 4926 30DB 47C3 A012 D5F4 # Subkey fingerprint: 96D8 D110 CF7A F808 4F88 5901 34C2 B587 65A4 7395 * remotes/cschoenebeck/tags/pull-9p-20201019: tests/9pfs: add local Tmkdir test tests/9pfs: add virtio_9p_test_path() tests/9pfs: wipe local 9pfs test directory tests/9pfs: introduce local tests tests/9pfs: change qtest name prefix to synth 9pfs: suppress performance warnings on qtest runs Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * tests/9pfs: add local Tmkdir testChristian Schoenebeck2020-10-191-0/+139
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This test case uses the 9pfs 'local' driver to create a directory and then checks if the expected directory was actually created (as real directory) on host side. This patch introduces a custom split() implementation, because the test code requires non empty array elements as result. For that reason g_strsplit() would not be a good alternative, as it would require additional filter code for reshuffling the array, and the resulting code would be even more complex than this split() function. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <be342f236842272275f65dbe05587f0a5409ad77.1602182956.git.qemu_oss@crudebyte.com> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
| * tests/9pfs: add virtio_9p_test_path()Christian Schoenebeck2020-10-192-0/+11
| | | | | | | | | | | | | | | | | | | | | | This new public function virtio_9p_test_path() allows 9pfs 'local' tests to translate a path from guest scope to host scope. For instance by passing an empty string it would return the root path on host of the exported 9pfs tree. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <b563d3c73c6391ec927a2622c9f65c09ca56bd83.1602182956.git.qemu_oss@crudebyte.com> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
| * tests/9pfs: wipe local 9pfs test directoryChristian Schoenebeck2020-10-191-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before running the first 9pfs test case, make sure the test directory for running the 9pfs 'local' tests on is entirely empty. For that reason simply delete the test directory (if any) before (re)creating it on test suite startup. Note: The preferable precise behaviour would be the test directory only being wiped once *before* a test suite run. Right now the test directory is also wiped at the *end* of a test suite run because libqos is calling the virtio_9p_register_nodes() callback for some reason also when a test suite completed. This is suboptimal as developers cannot immediately see what files and directories the 9pfs local tests created precisely after the test suite completed. But fortunately the test directory is not wiped if some test failed. So it is probably not worth it drilling another hole into libqos for this issue. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <b30776ea3289dc40dabc7d0063d825d21d9a65bf.1602182956.git.qemu_oss@crudebyte.com> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
| * tests/9pfs: introduce local testsChristian Schoenebeck2020-10-193-14/+116
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces 9pfs test cases using the 9pfs 'local' filesystem driver which reads/writes/creates/deletes real files and directories. In this initial version, there is only one local test which actually only checks if the 9pfs 'local' device was created successfully. Before the 9pfs 'local' tests are run, a test directory 'qtest-9p-local' is created (with world rwx permissions) under the current working directory. At this point that test directory is not auto deleted yet. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <81fc4b3b6b6c9bf7999e79f5e7cbc364a5f09ddb.1602182956.git.qemu_oss@crudebyte.com> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
| * tests/9pfs: change qtest name prefix to synthChristian Schoenebeck2020-10-191-14/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All existing 9pfs test cases are using the 'synth' fs driver so far, which means they are not accessing real files, but a purely simulated (in RAM only) file system. Let's make this clear by changing the prefix of the individual qtest case names from 'fs/' to 'synth/'. That way they'll be easily distinguishable from upcoming new 9pfs test cases supposed to be using a different fs driver. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <e04e75acb849b085c6d6320b2433a15fa935bcff.1602182956.git.qemu_oss@crudebyte.com> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
| * 9pfs: suppress performance warnings on qtest runsChristian Schoenebeck2020-10-192-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | Don't trigger any performance warning if we're just running test cases, because tests intentionally run for edge cases. So far performance warnings were suppressed for the 'synth' fs driver backend only. This patch suppresses them for all 9p fs driver backends. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <a2d2ff2163f8853ea782a7a1d4e6f2afd7c29ffe.1603106145.git.qemu_oss@crudebyte.com> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
* | Merge remote-tracking branch 'remotes/kraxel/tags/usb-20201019-pull-request' ↵Peter Maydell2020-10-192-36/+105
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging usb: fixes for dwc2 + ehci. # gpg: Signature made Mon 19 Oct 2020 13:33:16 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/usb-20201019-pull-request: hw/usb/hcd-dwc2: fix divide-by-zero in dwc2_handle_packet() usb/hcd-ehci: Fix error handling on missing device for iTD usb: hcd-dwc2: change assert()s to qemu_log_mask(LOG_GUEST_ERROR...) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/usb/hcd-dwc2: fix divide-by-zero in dwc2_handle_packet()Mauro Matteo Cascella2020-10-191-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | Check the value of mps to avoid potential divide-by-zero later in the function. Since HCCHAR_MPS is guest controllable, this prevents a malicious/buggy guest from crashing the QEMU process on the host. Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Paul Zimmerman <pauldzim@gmail.com> Reported-by: Gaoning Pan <gaoning.pgn@antgroup.com> Reported-by: Xingwei Lin <linyi.lxw@antfin.com> Message-id: 20201015075957.268823-1-mcascell@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * usb/hcd-ehci: Fix error handling on missing device for iTDAnthony PERARD2020-10-191-17/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The EHCI Host Controller emulation attempt to locate the device associated with a periodic isochronous transfer description (iTD) and when this fail the host controller is reset. But according the EHCI spec 1.0 section 5.15.2.4 Host System Error, the host controller is supposed to reset itself only when it failed to communicate with the Host (Operating System), like when there's an error on the PCI bus. If a transaction fails, there's nothing in the spec that say to reset the host controller. This patch rework the error path so that the host controller can keep working when the OS setup a bogus transaction, it also revert to the behavior of the EHCI emulation to before commits: e94682f1fe ("ehci: check device is not NULL before calling usb_ep_get()") 7011baece2 ("usb: remove unnecessary NULL device check from usb_ep_get()") The issue has been found while trying to passthrough a USB device to a Windows Server 2012 Xen guest via "usb-ehci", which prevent the USB device from working in Windows. ("usb-ehci" alone works, windows only setup this weird periodic iTD to device 127 endpoint 15 when the USB device is passthrough.) Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Message-id: 20201014104106.2962640-1-anthony.perard@citrix.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * usb: hcd-dwc2: change assert()s to qemu_log_mask(LOG_GUEST_ERROR...)Paul Zimmerman2020-10-191-19/+81
| | | | | | | | | | | | | | | | | | | | | | | | Change several assert()s to qemu_log_mask(LOG_GUEST_ERROR...), to prevent the guest from causing Qemu to assert. Also fix up several existing qemu_log_mask()s to include the function name in the message. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200920021449.830-1-pauldzim@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | Merge remote-tracking branch 'remotes/mcayland/tags/qemu-macppc-20201019' ↵Peter Maydell2020-10-1913-179/+118Star
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging qemu-macppc updates # gpg: Signature made Mon 19 Oct 2020 08:13:16 BST # gpg: using RSA key CC621AB98E82200D915CC9C45BC2C56FAE0F321F # gpg: issuer "mark.cave-ayland@ilande.co.uk" # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" [full] # Primary key fingerprint: CC62 1AB9 8E82 200D 915C C9C4 5BC2 C56F AE0F 321F * remotes/mcayland/tags/qemu-macppc-20201019: mac_oldworld: Change PCI address of macio to match real hardware mac_oldworld: Drop some variables mac_oldworld: Drop a variable, use get_system_memory() directly mac_newworld: Allow loading binary ROM image mac_oldworld: Allow loading binary ROM image m48t59: remove legacy m48t59_init() function ppc405_boards: use qdev properties instead of legacy m48t59_init() function sun4u: use qdev properties instead of legacy m48t59_init() function sun4m: use qdev properties instead of legacy m48t59_init() function m48t59-isa: remove legacy m48t59_init_isa() function uninorth: use qdev gpios for PCI IRQs grackle: use qdev gpios for PCI IRQs macio: don't reference serial_hd() directly within the device Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | mac_oldworld: Change PCI address of macio to match real hardwareBALATON Zoltan2020-10-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The board firmware expect these to be at fixed addresses and programs them without probing, this patch puts the macio device at the expected PCI address. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <f14bcaf3cf129500710ba5289980a134086bd949.1602805637.git.balaton@eik.bme.hu> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
| * | mac_oldworld: Drop some variablesBALATON Zoltan2020-10-191-18/+17Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Values not used frequently enough may not worth putting in a local variable, especially with names almost as long as the original value because that does not improve readability, to the contrary it makes it harder to see what value is used. Drop a few such variables. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <d67bc8d914a366ca6822b5190c1308d31af5c9b3.1602805637.git.balaton@eik.bme.hu> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
| * | mac_oldworld: Drop a variable, use get_system_memory() directlyBALATON Zoltan2020-10-191-3/+2Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Half of the occurances already use get_system_memory() directly instead of sysmem variable, convert the two other uses to get_system_memory() too which seems to be more common and drop the variable. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <b4c714e03690deb6f94f80f7a5b2af47d90550ae.1602805637.git.balaton@eik.bme.hu> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
| * | mac_newworld: Allow loading binary ROM imageBALATON Zoltan2020-10-192-10/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fall back to load binary ROM image if loading ELF fails. This also moves PROM_BASE and PROM_SIZE defines to board as these are matching the ROM size and address on this board and removes the now unused PROM_ADDR and BIOS_SIZE defines from common mac.h. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <4d58ffe7645a0c746c8fed6aa8775c0867b624e0.1602805637.git.balaton@eik.bme.hu> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
| * | mac_oldworld: Allow loading binary ROM imageBALATON Zoltan2020-10-191-9/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The beige G3 Power Macintosh has a 4MB firmware ROM. Fix the size of the rom region and fall back to loading a binary image with -bios if loading ELF image failed. This allows testing emulation with a ROM image from real hardware as well as using an ELF OpenBIOS image. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20201017155139.5A36A746331@zero.eik.bme.hu> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
| * | m48t59: remove legacy m48t59_init() functionMark Cave-Ayland2020-10-182-39/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that all of the callers of this function have been switched to use qdev properties, this legacy init function can now be removed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20201016182739.22875-6-mark.cave-ayland@ilande.co.uk> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
| * | ppc405_boards: use qdev properties instead of legacy m48t59_init() functionMark Cave-Ayland2020-10-181-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20201016182739.22875-5-mark.cave-ayland@ilande.co.uk> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
| * | sun4u: use qdev properties instead of legacy m48t59_init() functionMark Cave-Ayland2020-10-181-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20201016182739.22875-4-mark.cave-ayland@ilande.co.uk> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
| * | sun4m: use qdev properties instead of legacy m48t59_init() functionMark Cave-Ayland2020-10-181-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20201016182739.22875-3-mark.cave-ayland@ilande.co.uk> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
| * | m48t59-isa: remove legacy m48t59_init_isa() functionMark Cave-Ayland2020-10-182-27/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This function is no longer used within the codebase. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20201016182739.22875-2-mark.cave-ayland@ilande.co.uk> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
| * | uninorth: use qdev gpios for PCI IRQsMark Cave-Ayland2020-10-183-46/+25Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently an object link property is used to pass a reference to the OpenPIC into the PCI host bridge so that pci_unin_init_irqs() can connect the PCI IRQs to the PIC itself. This can be simplified by defining the PCI IRQs as qdev gpios and then wiring up the PCI IRQs to the PIC in the New World machine init function. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20201013114922.2946-4-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
| * | grackle: use qdev gpios for PCI IRQsMark Cave-Ayland2020-10-182-19/+7Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently an object link property is used to pass a reference to the Heathrow PIC into the PCI host bridge so that grackle_init_irqs() can connect the PCI IRQs to the PIC itself. This can be simplified by defining the PCI IRQs as qdev gpios and then wiring up the PCI IRQs to the PIC in the Old World machine init function. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20201013114922.2946-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
| * | macio: don't reference serial_hd() directly within the deviceMark Cave-Ayland2020-10-183-4/+12
| |/ | | | | | | | | | | | | | | | | | | | | | | Instead use qdev_prop_set_chr() to configure the ESCC serial chardevs at the Mac Old World and New World machine level. Also remove the now obsolete comment referring to the use of serial_hd() and the setting of user_creatable to false accordingly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20201013114922.2946-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
* | Merge remote-tracking branch 'remotes/philmd-gitlab/tags/mips-next-20201017' ↵Peter Maydell2020-10-1926-195/+1119
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging MIPS patches queue . Fix some comment spelling errors . Demacro some TCG helpers . Add loongson-ext lswc2/lsdc2 group of instructions . Log unimplemented cache opcode . Increase number of TLB entries on the 34Kf core . Allow the CPU to use dynamic frequencies . Calculate the CP0 timer period using the CPU frequency . Set CPU frequency for each machine . Fix Malta FPGA I/O region size . Allow running qtests when ROM is missing . Add record/replay acceptance tests . Update MIPS CPU documentation . MAINTAINERS updates CI jobs results: https://gitlab.com/philmd/qemu/-/pipelines/203931842 https://travis-ci.org/github/philmd/qemu/builds/736491461 https://cirrus-ci.com/build/6272264062631936 https://app.shippable.com/github/philmd/qemu/runs/886/summary/console # gpg: Signature made Sat 17 Oct 2020 14:59:53 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd-gitlab/tags/mips-next-20201017: (44 commits) target/mips: Increase number of TLB entries on the 34Kf core (16 -> 64) MAINTAINERS: Remove duplicated Malta test entries MAINTAINERS: Downgrade MIPS Boston to 'Odd Fixes', fix Paul Burton mail MAINTAINERS: Put myself forward for MIPS target MAINTAINERS: Remove myself docs/system: Update MIPS CPU documentation tests/acceptance: Add MIPS record/replay tests hw/mips: Remove exit(1) in case of missing ROM hw/mips: Rename TYPE_MIPS_BOSTON to TYPE_BOSTON hw/mips: Simplify code using ROUND_UP(INITRD_PAGE_SIZE) hw/mips: Simplify loading 64-bit ELF kernels hw/mips/malta: Use clearer qdev style hw/mips/malta: Move gt64120 related code together hw/mips/malta: Fix FPGA I/O region size target/mips/cpu: Display warning when CPU is used without input clock hw/mips/cps: Do not allow use without input clock hw/mips/malta: Set CPU frequency to 320 MHz hw/mips/boston: Set CPU frequency to 1 GHz hw/mips/cps: Expose input clock and connect it to CPU cores hw/mips/jazz: Correct CPU frequencies ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | target/mips: Increase number of TLB entries on the 34Kf core (16 -> 64)Philippe Mathieu-Daudé2020-10-171-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Per "MIPS32 34K Processor Core Family Software User's Manual, Revision 01.13" page 8 in "Joint TLB (JTLB)" section: "The JTLB is a fully associative TLB cache containing 16, 32, or 64-dual-entries mapping up to 128 virtual pages to their corresponding physical addresses." There is no particular reason to restrict the 34Kf core model to 16 TLB entries, so raise its config to 64. This is helpful for other projects, in particular the Yocto Project: Yocto Project uses qemu-system-mips 34Kf cpu model, to run 32bit MIPS CI loop. It was observed that in this case CI test execution time was almost twice longer than 64bit MIPS variant that runs under MIPS64R2-generic model. It was investigated and concluded that the difference in number of TLBs 16 in 34Kf case vs 64 in MIPS64R2-generic is responsible for most of CI real time execution difference. Because with 16 TLBs linux user-land trashes TLB more and it needs to execute more instructions in TLB refill handler calls, as result it runs much longer. (https://lists.gnu.org/archive/html/qemu-devel/2020-10/msg03428.html) Buglink: https://bugzilla.yoctoproject.org/show_bug.cgi?id=13992 Reported-by: Victor Kamensky <kamensky@cisco.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20201016133317.553068-1-f4bug@amsat.org>
| * | MAINTAINERS: Remove duplicated Malta test entriesPhilippe Mathieu-Daudé2020-10-171-2/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | The Malta tests are already covered in the Malta section. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20201013101659.3557154-3-f4bug@amsat.org>
| * | MAINTAINERS: Downgrade MIPS Boston to 'Odd Fixes', fix Paul Burton mailPhilippe Mathieu-Daudé2020-10-171-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Paul's Wavecomp email has been bouncing for months. He told us he "no longer has access to modern MIPS CPUs or Boston hardware, and wouldn't currently have time to spend on them if he did." [1] but "perhaps that might change in the future." [2]. Be fair and downgrade the status of the Boston board to "Odd Fixes" (has a maintainer but they don't have time to do much other). Similarly to commit 2b107c2c1c (".mailmap: Update Paul Burton email address"), update his email address here too. [1] https://www.mail-archive.com/qemu-devel@nongnu.org/msg718739.html [2] https://www.mail-archive.com/qemu-devel@nongnu.org/msg728605.html Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20201013101659.3557154-4-f4bug@amsat.org>
| * | MAINTAINERS: Put myself forward for MIPS targetPhilippe Mathieu-Daudé2020-10-171-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To avoid the MIPS target being orphan, volunteer to keep an eye on it and put together pull requests. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20201013101659.3557154-2-f4bug@amsat.org>
| * | MAINTAINERS: Remove myselfAleksandar Markovic2020-10-171-12/+5Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I have been working on project other than QEMU for some time, and would like to devote myself to that project. It is impossible for me to find enough time to perform maintainer's duties with needed meticulousness and patience. I wish prosperous future to QEMU and all colleagues in QEMU community. Signed-off-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Message-Id: <1602103041-32017-6-git-send-email-aleksandar.qemu.devel@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
| * | docs/system: Update MIPS CPU documentationHuacai Chen2020-10-171-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add Loongson-3A CPU models description. Signed-off-by: Huacai Chen <chenhc@lemote.com> Message-Id: <1602059975-10115-10-git-send-email-chenhc@lemote.com> [PMD: Split patch in 2: CPU / machine] Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
| * | tests/acceptance: Add MIPS record/replay testsPavel Dovgalyuk2020-10-171-1/+166
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds MIPS-targeted acceptance tests for record/replay functions. Signed-off-by: Pavel Dovgalyuk <pavel.dovgalyuk@ispras.ru> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <160276110297.2705.10918105269658307206.stgit@pasha-ThinkPad-X280> [PMD: Moved 'override timeout' comment from instance to class, moved nanomips tests to ReplayKernelSlow class, tagged ReplayKernelSlow class with AVOCADO_TIMEOUT_EXPECTED] Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
| * | hw/mips: Remove exit(1) in case of missing ROMPavel Dovgalyuk2020-10-174-24/+13Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch updates MIPS-based machines to allow starting them without ROM. In this case CPU starts to execute instructions from the empty memory, but QEMU allows introspecting the machine configuration. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <159531210571.24117.231100997794891819.stgit@pasha-ThinkPad-X280> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>