summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* mac_via: fix 60Hz VIA1 timer intervalMark Cave-Ayland2021-03-161-2/+9
| | | | | | | | | | | | | | | The 60Hz timer is initialised using timer_new_ns() meaning that the timer interval should be measured in ns, and therefore its period is a thousand times too short. Use a define for the 60Hz timer period taking the more precise value as documented in the Guide To The Macintosh Family Hardware. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20210311100505.22596-7-mark.cave-ayland@ilande.co.uk> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* mac_via: rename VBL timer to 60Hz timerMark Cave-Ayland2021-03-162-24/+25
| | | | | | | | | | | | | | | | According to the "Guide To The Macintosh Family Hardware", the 60Hz VIA1 timer on newer Macs such as the Quadra only exists for compatibility with old software and is no longer synced to the VBL interval. Rename the VBL timer to 60Hz timer to emphasise this and to prevent confusion when the real VBL interrupt (now handled as a NuBus slot interrupt) is added in future. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20210311100505.22596-6-mark.cave-ayland@ilande.co.uk> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* mac_via: don't re-inject ADB response when switching to IDLE stateMark Cave-Ayland2021-03-161-51/+27Star
| | | | | | | | | | | | | | | | | | | The current workaround for the Linux ADB state machine in kernels < 5.6 switching the VIA back to IDLE state between send and receive modes is to re-inject the first byte of the response in the IDLE state, and then force the state machine into generating an autopoll reply. In fact what is happening is much simpler: analysis of traces from a real Quadra suggest that the existing data is returned as the first autopoll response rather than generating an immediate response starting whilst still in IDLE state. Update the ADB receive code to work in the same way, which allows the re-injection code to be completely removed from adb_via_receive() and for adb_via_poll() to be simplified accordingly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20210311100505.22596-5-mark.cave-ayland@ilande.co.uk> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* mac_via: allow long accesses to VIA registersMark Cave-Ayland2021-03-161-2/+2
| | | | | | | | | | The MacOS SCSI driver uses a long access to read the VIA registers rather than just a single byte during the message out phase. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210311100505.22596-4-mark.cave-ayland@ilande.co.uk> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* mac_via: fix up adb_via_receive() trace eventsMark Cave-Ayland2021-03-161-17/+24
| | | | | | | | | | | The use of the post-increment operator on adb_data_in_index meant that the trace-event was accidentally displaying the next byte in the incoming ADB data buffer rather than the current byte. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210311100505.22596-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* mac_via: switch rtc pram trace-events to use hex rather than decimal for ↵Mark Cave-Ayland2021-03-161-2/+2
| | | | | | | | | | | | addresses Since all the documentation uses the hex offsets, this makes it much easier to see what is going on. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210311100505.22596-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell2021-03-1638-224/+990
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging # gpg: Signature made Mon 15 Mar 2021 08:42:25 GMT # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: net: Do not fill legacy info_str for backends hmp: Use QAPI NetdevInfo in hmp_info_network net: Move NetClientState.info_str to dynamic allocations tests: Add tests for query-netdev command qapi: net: Add query-netdev command pvrdma: wean code off pvrdma_ring.h kernel header lan9118: switch to use qemu_receive_packet() for loopback cadence_gem: switch to use qemu_receive_packet() for loopback pcnet: switch to use qemu_receive_packet() for loopback rtl8139: switch to use qemu_receive_packet() for loopback tx_pkt: switch to use qemu_receive_packet_iov() for loopback sungem: switch to use qemu_receive_packet() for loopback msf2-mac: switch to use qemu_receive_packet() for loopback dp8393x: switch to use qemu_receive_packet() for loopback packet e1000: switch to use qemu_receive_packet() for loopback net: introduce qemu_receive_packet() e1000: fail early for evil descriptor net: validate that ids are well formed net: Fix build error when DEBUG_NET is on virtio-net: calculating proper msix vectors on init Signed-off-by: Peter Maydell <peter.maydell@linaro.org> # Conflicts: # hw/core/machine.c
| * net: Do not fill legacy info_str for backendsAlexey Kirillov2021-03-158-48/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | As we use QAPI NetClientState->stored_config to store and get information about backend network devices, we can drop fill of legacy field info_str for them. We still use info_str field for NIC and hubports, so we can not completely remove it. Signed-off-by: Alexey Kirillov <lekiravi@yandex-team.ru> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * hmp: Use QAPI NetdevInfo in hmp_info_networkAlexey Kirillov2021-03-154-1/+254
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace usage of legacy field info_str of NetClientState for backend network devices with QAPI NetdevInfo stored_config that already used in QMP query-netdev. This change increases the detail of the "info network" output and takes a more general approach to composing the output. NIC and hubports still use legacy info_str field. Signed-off-by: Alexey Kirillov <lekiravi@yandex-team.ru> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * net: Move NetClientState.info_str to dynamic allocationsAlexey Kirillov2021-03-1511-49/+47Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The info_str field of the NetClientState structure is static and has a size of 256 bytes. This amount is often unclaimed, and the field itself is used exclusively for HMP "info network". The patch translates info_str to dynamic memory allocation. This action is also allows us to painlessly discard usage of this field for backend devices. Signed-off-by: Alexey Kirillov <lekiravi@yandex-team.ru> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * tests: Add tests for query-netdev commandAlexey Kirillov2021-03-152-0/+123
| | | | | | | | | | | | | | | | | | A simply qtest that checks for correct number of netdevs in the response of the query-netdev. Signed-off-by: Alexey Kirillov <lekiravi@yandex-team.ru> Acked-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * qapi: net: Add query-netdev commandAlexey Kirillov2021-03-1512-9/+477
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The query-netdev command is used to get the configuration of the current network device backends (netdevs). This is the QMP analog of the HMP command "info network" but only for netdevs (i.e. excluding NIC and hubports). The query-netdev command returns an array of objects of the NetdevInfo type, which are an extension of Netdev type. It means that response can be used for netdev-add after small modification. This can be useful for recreate the same netdev configuration. Information about the network device is filled in when it is created or modified and is available through the NetClientState->stored_config. Signed-off-by: Alexey Kirillov <lekiravi@yandex-team.ru> Acked-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * pvrdma: wean code off pvrdma_ring.h kernel headerCornelia Huck2021-03-157-144/+38Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pvrdma code relies on the pvrdma_ring.h kernel header for some basic ring buffer handling. The content of that header isn't very exciting, but contains some (q)atomic_*() invocations that (a) cause manual massaging when doing a headers update, and (b) are an indication that we probably should not be importing that header at all. Let's reimplement the ring buffer handling directly in the pvrdma code instead. This arguably also improves readability of the code. Importing the header can now be dropped. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Tested-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * lan9118: switch to use qemu_receive_packet() for loopbackAlexander Bulekov2021-03-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * cadence_gem: switch to use qemu_receive_packet() for loopbackAlexander Bulekov2021-03-151-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * pcnet: switch to use qemu_receive_packet() for loopbackAlexander Bulekov2021-03-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Buglink: https://bugs.launchpad.net/qemu/+bug/1917085 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * rtl8139: switch to use qemu_receive_packet() for loopbackAlexander Bulekov2021-03-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Buglink: https://bugs.launchpad.net/qemu/+bug/1910826 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * tx_pkt: switch to use qemu_receive_packet_iov() for loopbackJason Wang2021-03-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | This patch switches to use qemu_receive_receive_iov() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * sungem: switch to use qemu_receive_packet() for loopbackJason Wang2021-03-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * msf2-mac: switch to use qemu_receive_packet() for loopbackJason Wang2021-03-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * dp8393x: switch to use qemu_receive_packet() for loopback packetJason Wang2021-03-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000: switch to use qemu_receive_packet() for loopbackJason Wang2021-03-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * net: introduce qemu_receive_packet()Jason Wang2021-03-154-7/+66
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some NIC supports loopback mode and this is done by calling nc->info->receive() directly which in fact suppresses the effort of reentrancy check that is done in qemu_net_queue_send(). Unfortunately we can't use qemu_net_queue_send() here since for loopback there's no sender as peer, so this patch introduce a qemu_receive_packet() which is used for implementing loopback mode for a NIC with this check. NIC that supports loopback mode will be converted to this helper. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000: fail early for evil descriptorJason Wang2021-03-151-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During procss_tx_desc(), driver can try to chain data descriptor with legacy descriptor, when will lead underflow for the following calculation in process_tx_desc() for bytes: if (tp->size + bytes > msh) bytes = msh - tp->size; This will lead a infinite loop. So check and fail early if tp->size if greater or equal to msh. Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> Reported-by: Ruhr-University Bochum <bugs-syssec@rub.de> Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com>
| * net: validate that ids are well formedPaolo Bonzini2021-03-151-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a network or network device is created from the command line or HMP, QemuOpts ensures that the id passes the id_wellformed check. However, QMP skips this: $ qemu-system-x86_64 -qmp stdio -S -nic user,id=123/456 qemu-system-x86_64: -nic user,id=123/456: Parameter id expects an identifier Identifiers consist of letters, digits, -, ., _, starting with a letter. $ qemu-system-x86_64 -qmp stdio -S {"execute":"qmp_capabilities"} {"return": {}} {"execute":"netdev_add", "arguments": {"type": "user", "id": "123/456"}} {"return": {}} After: $ qemu-system-x86_64 -qmp stdio -S {"execute":"qmp_capabilities"} {"return": {}} {"execute":"netdev_add", "arguments": {"type": "user", "id": "123/456"}} {"error": {"class": "GenericError", "desc": "Parameter "id" expects an identifier"}} Validity checks should be performed always at the bottom of the call chain, because QMP skips all the steps above. At the same time we know that every call chain should go through either QMP or (for legacy) through QemuOpts. Because the id for -net and -nic is automatically generated and not well-formed by design, just add the check to QMP. Cc: Jason Wang <jasowang@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * net: Fix build error when DEBUG_NET is onBin Meng2021-03-151-0/+1
| | | | | | | | | | | | | | | | | | "qemu-common.h" should be included to provide the forward declaration of qemu_hexdump() when DEBUG_NET is on. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * virtio-net: calculating proper msix vectors on initJason Wang2021-03-152-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, the default msix vectors for virtio-net-pci is 3 which is obvious not suitable for multiqueue guest, so we depends on the user or management tools to pass a correct vectors parameter. In fact, we can simplifying this by calculating the number of vectors on realize. Consider we have N queues, the number of vectors needed is 2*N + 2 (#queue pairs + plus one config interrupt and control vq). We didn't check whether or not host support control vq because it was added unconditionally by qemu to avoid breaking legacy guests such as Minix. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | Merge remote-tracking branch ↵Peter Maydell2021-03-153-1/+9
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/stefanha-gitlab/tags/block-pull-request' into staging Pull request # gpg: Signature made Mon 15 Mar 2021 09:50:58 GMT # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha-gitlab/tags/block-pull-request: virtio-blk: Respect discard granularity Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | virtio-blk: Respect discard granularityAkihiko Odaki2021-03-153-1/+9
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | Report the configured granularity for discard operation to the guest. If this is not set use the block size. Since until now we have ignored the configured discard granularity and always reported the block size, let's add 'report-discard-granularity' property and disable it for older machine types to avoid migration issues. Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210225001239.47046-1-akihiko.odaki@gmail.com>
* | Merge remote-tracking branch 'remotes/philmd/tags/avr-20210315' into stagingPeter Maydell2021-03-154-8/+24
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | AVR patches queue - Only reset 'interrupt_request' mask once all interrupts executed - Documentation and typo fixes # gpg: Signature made Sun 14 Mar 2021 23:45:34 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/avr-20210315: target/avr: Fix interrupt execution target/avr: Fix some comment spelling errors hw/avr/arduino: List board schematic links hw/misc/led: Add yellow LED Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | target/avr: Fix interrupt executionIvanov Arkasha2021-03-151-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Only one interrupt is in progress at the moment. It is only necessary to set to reset interrupt_request after all interrupts have been executed. Signed-off-by: Ivanov Arkasha <ivanovrkasha@gmail.com> Message-Id: <20210312164754.18437-1-arkaisp2021@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
| * | target/avr: Fix some comment spelling errorsLichang Zhao2021-03-151-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I found that there are many spelling errors in the comments of qemu/target/avr. I used spellcheck to check the spelling errors and found some errors in the folder. Signed-off-by: Lichang Zhao <zhaolichang@huawei.com> Reviewed-by: David Edmondson <david.edmondson@oracle.com> Reviewed-by: Philippe Mathieu-Daude<f4bug@amsat.org> Message-Id: <20201009064449.2336-12-zhaolichang@huawei.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
| * | hw/avr/arduino: List board schematic linksPhilippe Mathieu-Daudé2021-03-151-4/+16
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Michael Rolnik <mrolnik@gmail.com> Message-Id: <20210313165445.2113938-3-f4bug@amsat.org>
| * | hw/misc/led: Add yellow LEDPhilippe Mathieu-Daudé2021-03-152-0/+2
| |/ | | | | | | | | | | | | | | | | Add the yellow "lime" LED. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Michael Rolnik <mrolnik@gmail.com> Message-Id: <20210313165445.2113938-2-f4bug@amsat.org>
* | Merge remote-tracking branch ↵Peter Maydell2021-03-1510-23/+554
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/bkoppelmann2/tags/pull-tricore-20210314' into staging - Added triboard with tc27x_soc - Cleaned up get_physical_address() - Fixed corner case bugs in OPC2_32_RRPW_IMASK and OPC2_32_RRPW_IMASK insns # gpg: Signature made Sun 14 Mar 2021 13:53:11 GMT # gpg: using RSA key 6E636A7E83F2DD0CFA6E6E370AD2C6396B69CA14 # gpg: issuer "kbastian@mail.uni-paderborn.de" # gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>" [full] # Primary key fingerprint: 6E63 6A7E 83F2 DD0C FA6E 6E37 0AD2 C639 6B69 CA14 * remotes/bkoppelmann2/tags/pull-tricore-20210314: target/tricore: Fix OPC2_32_RRPW_EXTR for width=0 target/tricore: Fix imask OPC2_32_RRPW_IMASK for r3+1 == r2 tricore: fixed faulty conditions for extr and imask target/tricore: Remove unused definitions target/tricore: Pass MMUAccessType to get_physical_address() target/tricore: Replace magic value by MMU_DATA_LOAD definition tricore: added triboard with tc27x_soc Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | target/tricore: Fix OPC2_32_RRPW_EXTR for width=0Bastian Koppelmann2021-03-141-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | if width was 0 we would run into the assertion: qemu-system-tricore: tcg/tcg-op.c:217: tcg_gen_sari_i32: Assertion `arg2 >= 0 && arg2 < 32' failed.o The instruction manual specifies undefined behaviour for this case. So we bring this in line with the golden Infineon simlator 'tsim', which simply writes 0 to the result in case of width=0. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
| * | target/tricore: Fix imask OPC2_32_RRPW_IMASK for r3+1 == r2Bastian Koppelmann2021-03-141-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | if r3+1 and r2 are the same then we would overwrite r2 with our first move and use the wrong result for the shift. Thus we store the result from the mov in a temp. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
| * | tricore: fixed faulty conditions for extr and imaskAndreas Konopik2021-03-141-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to the TC 1.3.1. Architecture Manual [1; page 174], results are undefined, if pos + width > 32 and not 31 or if width = 0. We found this error because of a different behavior between qemu-tricore and the real tricore processor. For pos + width = 32, qemu-tricore did not generate any intermediate code and ran into a different state compared to the real hardware. [1] https://www.infineon.com/dgdl/tc_v131_instructionset_v138.pdf?fileId=db3a304412b407950112b409b6dd0352 [BK: Add the why to the commit message] Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Andreas Konopik <andreas.konopik@efs-auto.de> Signed-off-by: Georg Hofstetter <georg.hofstetter@efs-auto.de> Signed-off-by: David Brenken <david.brenken@efs-auto.de> Message-Id: <20210211115329.8984-2-david.brenken@efs-auto.org> Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
| * | target/tricore: Remove unused definitionsPhilippe Mathieu-Daudé2021-03-141-12/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | Remove these confusing and unused definitions. Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210127224255.3505711-4-f4bug@amsat.org> Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
| * | target/tricore: Pass MMUAccessType to get_physical_address()Philippe Mathieu-Daudé2021-03-141-4/+2Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'int access_type' and ACCESS_INT are unused, drop them. Provide the mmu_idx argument to match other targets. 'int rw' is actually the MMUAccessType, rename it. Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210127224255.3505711-3-f4bug@amsat.org> Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
| * | target/tricore: Replace magic value by MMU_DATA_LOAD definitionPhilippe Mathieu-Daudé2021-03-141-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | cpu_get_phys_page_debug() uses 'DATA LOAD' MMU access type. Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210127224255.3505711-2-f4bug@amsat.org> Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
| * | tricore: added triboard with tc27x_socAndreas Konopik2021-03-147-1/+534
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Andreas Konopik <andreas.konopik@efs-auto.de> Signed-off-by: David Brenken <david.brenken@efs-auto.de> Signed-off-by: Georg Hofstetter <georg.hofstetter@efs-auto.de> Signed-off-by: Robert Rasche <robert.rasche@efs-auto.de> Signed-off-by: Lars Biermanski <lars.biermanski@efs-auto.de> Message-Id: <20201109165055.10508-2-david.brenken@efs-auto.org> Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
* | | Merge remote-tracking branch 'remotes/philmd/tags/mips-20210313' into stagingPeter Maydell2021-03-149-3671/+2056Star
|\ \ \ | |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MIPS patches queue - Tidy up the GT64120 north bridge - Move XBurst Media eXtension Unit code to mxu_translate.c - Convert TX79 to decodetree # gpg: Signature made Sat 13 Mar 2021 22:44:44 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/mips-20210313: (27 commits) target/mips/tx79: Salvage instructions description comment target/mips: Remove 'C790 Multimedia Instructions' dead code target/mips/tx79: Move PCPYLD / PCPYUD opcodes to decodetree target/mips/tx79: Move PCPYH opcode to decodetree target/mips/translate: Simplify PCPYH using deposit_i64() target/mips/translate: Make gen_rdhwr() public target/mips/tx79: Move MTHI1 / MTLO1 opcodes to decodetree target/mips/tx79: Move MFHI1 / MFLO1 opcodes to decodetree target/mips: Use gen_load_gpr[_hi]() when possible target/mips: Extract MXU code to new mxu_translate.c file target/mips: Introduce mxu_translate_init() helper target/mips: Simplify decode_opc_mxu() ifdef'ry target/mips: Convert decode_ase_mxu() to decodetree prototype target/mips: Rename decode_opc_mxu() as decode_ase_mxu() target/mips: Move MUL opcode check from decode_mxu() to decode_legacy() target/mips: Use OPC_MUL instead of OPC__MXU_MUL target/mips: Pass instruction opcode to decode_opc_mxu() target/mips: Remove unused CPUMIPSState* from MXU functions target/mips: Remove XBurst Media eXtension Unit dead code target/mips: Rewrite complex ifdef'ry ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | target/mips/tx79: Salvage instructions description commentPhilippe Mathieu-Daudé2021-03-132-160/+188
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This comment describing the tx79 opcodes is helpful. As we will implement these instructions in tx79_translate.c, move the comment there. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210214175912.732946-15-f4bug@amsat.org>
| * | target/mips: Remove 'C790 Multimedia Instructions' dead codePhilippe Mathieu-Daudé2021-03-131-371/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We have almost 400 lines of code full of /* TODO */ comments which end calling gen_reserved_instruction(). As we are not going to implement them, and all the caller's switch() default cases already call gen_reserved_instruction(), we can remove this altogether. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210214175912.732946-14-f4bug@amsat.org>
| * | target/mips/tx79: Move PCPYLD / PCPYUD opcodes to decodetreePhilippe Mathieu-Daudé2021-03-133-80/+48Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move PCPYLD (Parallel Copy Lower Doubleword) and PCPYUD (Parallel Copy Upper Doubleword) to decodetree. Remove unnecessary code / comments. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210214175912.732946-13-f4bug@amsat.org>
| * | target/mips/tx79: Move PCPYH opcode to decodetreePhilippe Mathieu-Daudé2021-03-133-39/+27Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | Move the existing PCPYH opcode (Parallel Copy Halfword) to decodetree. Remove unnecessary code / comments. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210214175912.732946-12-f4bug@amsat.org>
| * | target/mips/translate: Simplify PCPYH using deposit_i64()Philippe Mathieu-Daudé2021-03-131-30/+4Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Simplify the PCPYH (Parallel Copy Halfword) instruction by using multiple calls to deposit_i64() which can be optimized by some TCG backends. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210214175912.732946-11-f4bug@amsat.org>
| * | target/mips/translate: Make gen_rdhwr() publicPhilippe Mathieu-Daudé2021-03-132-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | We will use gen_rdhwr() outside of translate.c, make it public. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210214175912.732946-28-f4bug@amsat.org>
| * | target/mips/tx79: Move MTHI1 / MTLO1 opcodes to decodetreePhilippe Mathieu-Daudé2021-03-133-25/+17Star
| | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210214175912.732946-10-f4bug@amsat.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-04-26 14:04:25 +0200