summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* fuzz: Add fuzzer callbacks to DMA-read functionsAlexander Bulekov2020-10-265-0/+11
| | | | | | | | | | We should be careful to not call any functions besides fuzz_dma_read_cb. Without --enable-fuzzing, fuzz_dma_read_cb is an empty inlined function. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <20201023150746.107063-7-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
* fuzz: Declare DMA Read callback functionAlexander Bulekov2020-10-262-0/+21
| | | | | | | | | | | | | | | | | | | | | This patch declares the fuzz_dma_read_cb function and uses the preprocessor and linker(weak symbols) to handle these cases: When we build softmmu/all with --enable-fuzzing, there should be no strong symbol defined for fuzz_dma_read_cb, and we link against a weak stub function. When we build softmmu/fuzz with --enable-fuzzing, we link against the strong symbol in generic_fuzz.c When we build softmmu/all without --enable-fuzzing, fuzz_dma_read_cb is an empty, inlined function. As long as we don't call any other functions when building the arguments, there should be no overhead. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <20201023150746.107063-6-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
* fuzz: Add DMA support to the generic-fuzzerAlexander Bulekov2020-10-262-0/+237
| | | | | | | | | | | | | | When a virtual-device tries to access some buffer in memory over DMA, we add call-backs into the fuzzer(next commit). The fuzzer checks verifies that the DMA request maps to a physical RAM address and fills the memory with fuzzer-provided data. The patterns that we use to fill this memory are specified using add_dma_pattern and clear_dma_patterns operations. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <20201023150746.107063-5-alxndr@bu.edu> [thuth: Reformatted one comment according to the QEMU coding style] Signed-off-by: Thomas Huth <thuth@redhat.com>
* fuzz: Add PCI features to the generic fuzzerAlexander Bulekov2020-10-241-0/+81
| | | | | | | | | | | | | This patch compares TYPE_PCI_DEVICE objects against the user-provided matching pattern. If there is a match, we use some hacks and leverage QOS to map each possible BAR for that device. Now fuzzed inputs might be converted to pci_read/write commands which target specific. This means that we can fuzz a particular device's PCI configuration space, Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <20201023150746.107063-4-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
* fuzz: Add generic virtual-device fuzzerAlexander Bulekov2020-10-242-0/+517
| | | | | | | | | | | | | | | This is a generic fuzzer designed to fuzz a virtual device's MemoryRegions, as long as they exist within the Memory or Port IO (if it exists) AddressSpaces. The fuzzer's input is interpreted into a sequence of qtest commands (outb, readw, etc). The interpreted commands are separated by a magic seaparator, which should be easy for the fuzzer to guess. Without ASan, the separator can be specified as a "dictionary value" using the -dict argument (see libFuzzer documentation). Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201023150746.107063-3-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
* memory: Add FlatView foreach functionAlexander Bulekov2020-10-242-0/+18
| | | | | | | | Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201023150746.107063-2-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
* libqtest: fix memory leak in the qtest_qmp_event_refMaxim Levitsky2020-10-241-7/+4Star
| | | | | | | | | | | | | The g_list_remove_link doesn't free the link element, opposed to what I thought. Switch to g_list_delete_link that does free it. Also refactor the code a bit. Thanks for Max Reitz for helping me with this. Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Message-Id: <20201019163702.471239-4-mlevitsk@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* libqtest: fix the order of buffered eventsMaxim Levitsky2020-10-241-1/+1
| | | | | | | | | By a mistake I added the pending events in a wrong order. Fix this by using g_list_append. Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Message-Id: <20201019163702.471239-3-mlevitsk@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests/qtest: Make npcm7xx_timer-test conditional on CONFIG_NPCM7XXHavard Skinnemoen2020-10-241-1/+2
| | | | | | | | | This test won't work if qemu was compiled without CONFIG_NPCM7XX, as pointed out by Thomas Huth on a different patch. Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com> Message-Id: <20201023210637.351238-2-hskinnemoen@google.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* accel: Add xen CpusAccel using dummy-cpusJason Andryuk2020-10-242-0/+9
| | | | | | | | | | | | | | | | | Xen was broken by commit 1583a3898853 ("cpus: extract out qtest-specific code to accel/qtest"). Xen relied on qemu_init_vcpu() calling qemu_dummy_start_vcpu() in the default case, but that was replaced by g_assert_not_reached(). Add a minimal "CpusAccel" for Xen using the dummy-cpus implementation used by qtest. Signed-off-by: Jason Andryuk <jandryuk@gmail.com> Message-Id: <20201013140511.5681-4-jandryuk@gmail.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Claudio Fontana <cfontana@suse.de> Acked-by: Anthony PERARD <anthony.perard@citrix.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* accel: move qtest CpusAccel functions to a common locationJason Andryuk2020-10-246-37/+18Star
| | | | | | | | | | | Move and rename accel/qtest/qtest-cpus.c files to accel/dummy-cpus.c so it can be re-used by Xen. Signed-off-by: Jason Andryuk <jandryuk@gmail.com> Message-Id: <20201013140511.5681-3-jandryuk@gmail.com> Reviewed-by: Claudio Fontana <cfontana@suse.de> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* accel: Remove _WIN32 ifdef from qtest-cpus.cJason Andryuk2020-10-241-5/+0Star
| | | | | | | | | | | | dummy-cpus.c is only compiled with CONFIG_POSIX, so the _WIN32 condition will never evaluate true. Remove it. Signed-off-by: Jason Andryuk <jandryuk@gmail.com> Message-Id: <20201013140511.5681-2-jandryuk@gmail.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests/qtest/libqtest: Fix detection of architecture for binaries without pathThomas Huth2020-10-241-2/+7
| | | | | | | | | | | | | | | | | The qtests can be run directly by specifying the QEMU binary with the QTEST_QEMU_BINARY environment variable, for example: $ QTEST_QEMU_BINARY=x86_64-softmmu/qemu-system-x86_64 tests/qtest/test-hmp However, if you specify a binary without a path, for example with QTEST_QEMU_BINARY=qemu-system-x86_64 if the QEMU binary is in your $PATH, then the test currently simply crashes. Let's try a little bit smarter here by looking for the final '-' instead of the slash. Message-Id: <20201012114816.43546-1-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests/migration: fix memleak in wait_command/wait_command_fdChen Qun2020-10-241-4/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Properly free each command resp to avoid memory leak. ASAN shows memory leak stack: Indirect leak of 2352520 byte(s) in 571 object(s) allocated from: #0 0x7f6ca3308d4e in __interceptor_calloc (/lib64/libasan.so.5+0x112d4e) #1 0x7f6ca3127a50 in g_malloc0 (/lib64/libglib-2.0.so.0+0x55a50) #2 0x557bf3c71d2b in qdict_new ../qobject/qdict.c:29 #3 0x557bf3c9caba in parse_object ../qobject/json-parser.c:318 #4 0x557bf3c9ce75 in json_parser_parse ../qobject/json-parser.c:580 #5 0x557bf3c8c8cf in json_message_process_token ../qobject/json-streamer.c:92 #6 0x557bf3c9ea59 in json_lexer_feed_char ../qobject/json-lexer.c:313 #7 0x557bf3c9eeb5 in json_lexer_feed ../qobject/json-lexer.c:350 #8 0x557bf3c4793a in qmp_fd_receive ../tests/qtest/libqtest.c:608 #9 0x557bf3c47b58 in qtest_qmp_receive ../tests/qtest/libqtest.c:618 #10 0x557bf3c44245 in wait_command ../tests/qtest/migration-helpers.c:59 #11 0x557bf3c445cb in migrate_query_status ../tests/qtest/migration-helpers.c:108 #12 0x557bf3c44642 in check_migration_status ../tests/qtest/migration-helpers.c:124 #13 0x557bf3c447e7 in wait_for_migration_status ../tests/qtest/migration-helpers.c:148 #14 0x557bf3c43b8f in test_migrate_auto_converge ../tests/qtest/migration-test.c:1243 ...... Fix: 5e34005571af5 Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Message-Id: <20201023061218.2080844-2-kuhn.chenqun@huawei.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* Merge remote-tracking branch ↵Peter Maydell2020-10-2212-72/+232
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/kraxel/tags/modules-20201022-pull-request' into staging modules: build spice and opengl as module. # gpg: Signature made Thu 22 Oct 2020 06:12:03 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/modules-20201022-pull-request: opengl: build opengl helper code modular opengl: build egl-headless display modular spice: flip modules switch modules: add spice dependencies modules: dependencies infrastructure spice: load module when enabled on the cmdline spice: wire up monitor in QemuSpiceOps. spice: move display_add_client() to QemuSpiceOps. spice: move auth functions to QemuSpiceOps. spice: move add_interface() to QemuSpiceOps. spice: move display_init() to QemuSpiceOps. spice: move qemu_spice_init() to QemuSpiceOps. spice: add QemuSpiceOps, move migrate_info spice: add module helpers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * opengl: build opengl helper code modularGerd Hoffmann2020-10-212-1/+14
| | | | | | | | | | | | | | | | | | Removes opengl dependency from core qemu. The number of shared libraries for qemu-system-x86_64 goes down from 66 to 60 on my system. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20201019075224.14803-15-kraxel@redhat.com
| * opengl: build egl-headless display modularGerd Hoffmann2020-10-211-1/+7
| | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20201019075224.14803-14-kraxel@redhat.com
| * spice: flip modules switchGerd Hoffmann2020-10-211-1/+10
| | | | | | | | | | | | | | | | | | | | Build spice core code as module. This removes libspice-server and a handful of indirect dependencies from core qemu. The number of shared libraries for qemu-system-x86_64 goes down from 73 to 66 on my system. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20201019075224.14803-13-kraxel@redhat.com
| * modules: add spice dependenciesGerd Hoffmann2020-10-211-0/+5
| | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20201019075224.14803-12-kraxel@redhat.com
| * modules: dependencies infrastructureGerd Hoffmann2020-10-211-5/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow modules depending on other modules. module_load_file() gets the option to export symbols (by not adding the G_MODULE_BIND_LOCAL flag). module_load_one() will check the module dependency list to figure (a) whenever are other modules must be loaded first, or (b) the module should export the symbols. The dependencies are specificed as static list in the source code for now as I expect the list will stay small. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20201019075224.14803-11-kraxel@redhat.com
| * spice: load module when enabled on the cmdlineGerd Hoffmann2020-10-211-1/+5
| | | | | | | | | | | | | | | | In case the spice opts are not registered, try loading the spice module. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20201019075224.14803-10-kraxel@redhat.com
| * spice: wire up monitor in QemuSpiceOps.Gerd Hoffmann2020-10-213-1/+22
| | | | | | | | | | | | | | | | | | | | | | Rename qmp_query_spice() to qmp_query_spice_real(), add to QemuSpiceOps. Add new qmp_query_spice() function which calls the real function via QemuSpiceOps if available, otherwise return SpiceInfo.enabled = false. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20201019075224.14803-9-kraxel@redhat.com
| * spice: move display_add_client() to QemuSpiceOps.Gerd Hoffmann2020-10-215-8/+11
| | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20201019075224.14803-8-kraxel@redhat.com
| * spice: move auth functions to QemuSpiceOps.Gerd Hoffmann2020-10-215-20/+25
| | | | | | | | | | | | | | | | | | Move qemu_spice_set_passwd() and qemu_spice_set_pw_expire() functions to QemuSpiceOps. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20201019075224.14803-7-kraxel@redhat.com
| * spice: move add_interface() to QemuSpiceOps.Gerd Hoffmann2020-10-216-9/+16
| | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20201019075224.14803-6-kraxel@redhat.com
| * spice: move display_init() to QemuSpiceOps.Gerd Hoffmann2020-10-215-8/+12
| | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20201019075224.14803-5-kraxel@redhat.com
| * spice: move qemu_spice_init() to QemuSpiceOps.Gerd Hoffmann2020-10-215-7/+9
| | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20201019075224.14803-4-kraxel@redhat.com
| * spice: add QemuSpiceOps, move migrate_infoGerd Hoffmann2020-10-215-6/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add QemuSpiceOps struct. This struct holds function pointers to the spice functions. It will be initialized with pointers to the stub functions. When spice gets initialized the function pointers will be re-written to the real functions. The spice stubs will move from qemu-spice.h to spice-module.c for that, because they will be needed for both "CONFIG_SPICE=n" and "CONFIG_SPICE=y but spice module not loaded" cases. This patch adds the infrastructure and starts with moving qemu_spice_migrate_info() to QemuSpiceOps. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20201019075224.14803-3-kraxel@redhat.com
| * spice: add module helpersGerd Hoffmann2020-10-215-4/+48
| | | | | | | | | | | | | | | | | | | | Add new spice-module.c + qemu-spice-module.h files. The code needed to support modular spice will be there. For starters this will be only the using_spice variable, more will follow ... Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20201019075224.14803-2-kraxel@redhat.com
* | Merge remote-tracking branch 'remotes/philmd-gitlab/tags/sd-next-20201021' ↵Peter Maydell2020-10-223-15/+58
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging SD/MMC patches Fix two heap-overflow reported by Alexander Bulekov while fuzzing: - https://bugs.launchpad.net/qemu/+bug/1892960 - https://bugs.launchpad.net/qemu/+bug/1895310 CI jobs results: . https://cirrus-ci.com/build/6399328187056128 . https://gitlab.com/philmd/qemu/-/pipelines/205701966 . https://travis-ci.org/github/philmd/qemu/builds/737708930 # gpg: Signature made Wed 21 Oct 2020 18:33:08 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd-gitlab/tags/sd-next-20201021: hw/sd/sdcard: Assert if accessing an illegal group hw/sd/sdcard: Do not attempt to erase out of range addresses hw/sd/sdcard: Reset both start/end addresses on error hw/sd/sdcard: Do not use legal address '0' for INVALID_ADDRESS hw/sd/sdcard: Introduce the INVALID_ADDRESS definition hw/sd/sdcard: Add trace event for ERASE command (CMD38) hw/sd/sdhci: Yield if interrupt delivered during multiple transfer hw/sd/sdhci: Let sdhci_update_irq() return if IRQ was delivered hw/sd/sdhci: Resume pending DMA transfers on MMIO accesses hw/sd/sdhci: Stop multiple transfers when block count is cleared hw/sd/sdhci: Fix DMA Transfer Block Size field hw/sd/sdhci: Document the datasheet used hw/sd/sdhci: Fix qemu_log_mask() format string Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/sd/sdcard: Assert if accessing an illegal groupPhilippe Mathieu-Daudé2020-10-211-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | We can not have more group than 'wpgrps_size'. Assert if we are accessing a group above this limit. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201015063824.212980-7-f4bug@amsat.org>
| * | hw/sd/sdcard: Do not attempt to erase out of range addressesPhilippe Mathieu-Daudé2020-10-211-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While the Spec v3 is not very clear, v6 states: If the host provides an out of range address as an argument to CMD32 or CMD33, the card shall indicate OUT_OF_RANGE error in R1 (ERX) for CMD38. If an address is out of range, do not attempt to erase it: return R1 with the error bit set. Buglink: https://bugs.launchpad.net/qemu/+bug/1895310 Reported-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201015063824.212980-6-f4bug@amsat.org>
| * | hw/sd/sdcard: Reset both start/end addresses on errorPhilippe Mathieu-Daudé2020-10-211-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From the Spec "4.3.5 Erase": The host should adhere to the following command sequence: ERASE_WR_BLK_START, ERASE_WR_BLK_END and ERASE (CMD38). If an erase (CMD38) or address setting (CMD32, 33) command is received out of sequence, the card shall set the ERASE_SEQ_ERROR bit in the status register and reset the whole sequence. Reset both addresses if the ERASE command occured out of sequence (one of the start/end address is not set). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201015063824.212980-5-f4bug@amsat.org>
| * | hw/sd/sdcard: Do not use legal address '0' for INVALID_ADDRESSPhilippe Mathieu-Daudé2020-10-211-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As it is legal to WRITE/ERASE the address/block 0, change the value of this definition to an illegal address: UINT32_MAX. Unfortunately this break the migration stream, so bump the VMState version number. This affects some ARM boards and the SDHCI_PCI device (which is only used for testing). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201015063824.212980-4-f4bug@amsat.org>
| * | hw/sd/sdcard: Introduce the INVALID_ADDRESS definitionPhilippe Mathieu-Daudé2020-10-211-5/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | '0' is used as a value to indicate an invalid (or unset) address. Use a definition instead of a magic value. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201015063824.212980-3-f4bug@amsat.org>
| * | hw/sd/sdcard: Add trace event for ERASE command (CMD38)Philippe Mathieu-Daudé2020-10-212-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Trace addresses provided to the ERASE command. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201015063824.212980-2-f4bug@amsat.org>
| * | hw/sd/sdhci: Yield if interrupt delivered during multiple transferPhilippe Mathieu-Daudé2020-10-211-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Descriptor Table has a bit to allow the DMA to generates Interrupt when the operation of the descriptor line is completed (see "1.13.4. Descriptor Table" of 'SD Host Controller Simplified Specification Version 2.00'). If we have pending interrupt and the descriptor requires it to be generated as soon as it is completed, reschedule pending transfers and yield to the CPU. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200903172806.489710-5-f4bug@amsat.org>
| * | hw/sd/sdhci: Let sdhci_update_irq() return if IRQ was deliveredPhilippe Mathieu-Daudé2020-10-211-2/+7
| | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200903172806.489710-4-f4bug@amsat.org>
| * | hw/sd/sdhci: Resume pending DMA transfers on MMIO accessesPhilippe Mathieu-Daudé2020-10-211-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | If we have pending DMA requests scheduled, process them first. So far we don't need to implement a bottom half to process them. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200903172806.489710-3-f4bug@amsat.org>
| * | hw/sd/sdhci: Stop multiple transfers when block count is clearedPhilippe Mathieu-Daudé2020-10-211-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Clearing BlockCount stops multiple transfers. See "SD Host Controller Simplified Specification Version 2.00": - 2.2.3. Block Count Register (Offset 006h) - Table 2-8 : Determination of Transfer Type Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200903172806.489710-2-f4bug@amsat.org>
| * | hw/sd/sdhci: Fix DMA Transfer Block Size fieldPhilippe Mathieu-Daudé2020-10-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 'Transfer Block Size' field is 12-bit wide. See section '2.2.2. Block Size Register (Offset 004h)' in datasheet. Two different bug reproducer available: - https://bugs.launchpad.net/qemu/+bug/1892960 - https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Fsdhci_oob_write1 Cc: qemu-stable@nongnu.org Buglink: https://bugs.launchpad.net/qemu/+bug/1892960 Fixes: d7dfca0807a ("hw/sdhci: introduce standard SD host controller") Reported-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200901140411.112150-3-f4bug@amsat.org>
| * | hw/sd/sdhci: Document the datasheet usedPhilippe Mathieu-Daudé2020-10-211-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add datasheet name in the file header. We can not add the direct download link since there is a disclaimers to agree first on the SD Association website (www.sdcard.org). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200901140411.112150-3-f4bug@amsat.org>
| * | hw/sd/sdhci: Fix qemu_log_mask() format stringPhilippe Mathieu-Daudé2020-10-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add missing newline character in qemu_log_mask() format. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200901140411.112150-2-f4bug@amsat.org>
* | | Merge remote-tracking branch ↵Peter Maydell2020-10-2122-65/+154
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/kraxel/tags/microvm-20201021-pull-request' into staging microvm: fix PCIe IRQs in APIC table. microvm: add usb support. # gpg: Signature made Wed 21 Oct 2020 15:48:00 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/microvm-20201021-pull-request: tests/acpi: update expected data files tests/acpi: add microvm rtc test tests/acpi: add microvm usb test tests/acpi: add empty tests/data/acpi/microvm/DSDT.{usb, rtc} files tests/acpi: allow updates for expected data files microvm: add usb support usb/xhci: fixup xhci kconfig deps usb/xhci: add xhci_sysbus_build_aml() helper usb/xhci: add include/hw/usb/xhci.h header file acpi: add aml builder stubs tests/acpi: disallow changes for microvm/APIC.pcie tests/acpi: update expected data files apci: drop has_pci arg for acpi_build_madt microvm: set pci_irq_mask x86: make pci irqs runtime configurable tests/acpi: add empty microvm/APIC.pcie tests/acpi: allow changes for microvm/APIC.pcie Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | tests/acpi: update expected data filesGerd Hoffmann2020-10-213-2/+0Star
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20201020074844.5304-11-kraxel@redhat.com
| * | | tests/acpi: add microvm rtc testGerd Hoffmann2020-10-211-0/+12
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20201020074844.5304-10-kraxel@redhat.com
| * | | tests/acpi: add microvm usb testGerd Hoffmann2020-10-211-0/+12
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20201020074844.5304-9-kraxel@redhat.com
| * | | tests/acpi: add empty tests/data/acpi/microvm/DSDT.{usb, rtc} filesGerd Hoffmann2020-10-212-0/+0
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20201020074844.5304-8-kraxel@redhat.com
| * | | tests/acpi: allow updates for expected data filesGerd Hoffmann2020-10-211-0/+2
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20201020074844.5304-7-kraxel@redhat.com
| * | | microvm: add usb supportGerd Hoffmann2020-10-214-1/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Wire up "usb=on" machine option, when enabled add a sysbus xhci controller with 8 ports. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20201020074844.5304-6-kraxel@redhat.com
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-04-26 03:08:41 +0200