summaryrefslogtreecommitdiffstats
path: root/hw
Commit message (Collapse)AuthorAgeFilesLines
* arm/trace: Fix hex printingDr. David Alan Gilbert2020-10-271-1/+1
| | | | | | | | | | Use of 0x%d - make up our mind as 0x%x Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Eric Auger <eric.auger@redhat.com> Message-id: 20201014193355.53074-1-dgilbert@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/raspi: Add the Raspberry Pi 3 model A+Philippe Mathieu-Daudé2020-10-271-0/+13
| | | | | | | | | | | | | The Pi 3A+ is a stripped down version of the 3B: - 512 MiB of RAM instead of 1 GiB - no on-board ethernet chipset Add it as it is a closer match to what we model. Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201024170127.3592182-10-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/raspi: Add the Raspberry Pi Zero machinePhilippe Mathieu-Daudé2020-10-271-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Similarly to the Pi A, the Pi Zero uses a BCM2835 SoC (ARMv6Z core). The only difference between the revision 1.2 and 1.3 is the latter exposes a CSI camera connector. As we do not implement the Unicam peripheral, there is no point in exposing a camera connector :) Therefore we choose to model the 1.2 revision. Example booting the machine using content from [*]: $ qemu-system-arm -M raspi0 -serial stdio \ -kernel raspberrypi/firmware/boot/kernel.img \ -dtb raspberrypi/firmware/boot/bcm2708-rpi-zero.dtb \ -append 'printk.time=0 earlycon=pl011,0x20201000 console=ttyAMA0' [ 0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Linux version 4.19.118+ (dom@buildbot) (gcc version 4.9.3 (crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1311 Mon Apr 27 14:16:15 BST 2020 [ 0.000000] CPU: ARMv6-compatible processor [410fb767] revision 7 (ARMv7), cr=00c5387d [ 0.000000] CPU: VIPT aliasing data cache, unknown instruction cache [ 0.000000] OF: fdt: Machine model: Raspberry Pi Zero ... [*] http://archive.raspberrypi.org/debian/pool/main/r/raspberrypi-firmware/raspberrypi-kernel_1.20200512-2_armhf.deb Reviewed-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201024170127.3592182-9-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/raspi: Add the Raspberry Pi A+ machinePhilippe Mathieu-Daudé2020-10-271-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | The Pi A is almost the first machine released. It uses a BCM2835 SoC which includes a ARMv6Z core. Example booting the machine using content from [*] (we use the device tree from the B model): $ qemu-system-arm -M raspi1ap -serial stdio \ -kernel raspberrypi/firmware/boot/kernel.img \ -dtb raspberrypi/firmware/boot/bcm2708-rpi-b-plus.dtb \ -append 'earlycon=pl011,0x20201000 console=ttyAMA0' [ 0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Linux version 4.19.118+ (dom@buildbot) (gcc version 4.9.3 (crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1311 Mon Apr 27 14:16:15 BST 2020 [ 0.000000] CPU: ARMv6-compatible processor [410fb767] revision 7 (ARMv7), cr=00c5387d [ 0.000000] CPU: VIPT aliasing data cache, unknown instruction cache [ 0.000000] OF: fdt: Machine model: Raspberry Pi Model B+ ... [*] http://archive.raspberrypi.org/debian/pool/main/r/raspberrypi-firmware/raspberrypi-kernel_1.20200512-2_armhf.deb Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201024170127.3592182-8-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/bcm2836: Introduce the BCM2835 SoCPhilippe Mathieu-Daudé2020-10-272-0/+36
| | | | | | | Reviewed-by: Luc Michel <luc.michel@greensocs.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201024170127.3592182-7-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/bcm2836: Split out common realize() codePhilippe Mathieu-Daudé2020-10-271-4/+18
| | | | | | | | | | | | | | | | | | | | | The realize() function is clearly composed of two parts, each described by a comment: void realize() { /* common peripherals from bcm2835 */ ... /* bcm2836 interrupt controller (and mailboxes, etc.) */ ... } Split the two part, so we can reuse the common part with other SoCs from this family. Reviewed-by: Luc Michel <luc.michel@greensocs.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201024170127.3592182-6-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/bcm2836: Only provide "enabled-cpus" property to multicore SoCsPhilippe Mathieu-Daudé2020-10-271-8/+7Star
| | | | | | | | | It makes no sense to set enabled-cpus=0 on single core SoCs. Reviewed-by: Luc Michel <luc.michel@greensocs.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201024170127.3592182-5-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/bcm2836: Introduce BCM283XClass::core_countPhilippe Mathieu-Daudé2020-10-271-1/+4
| | | | | | | | | | The BCM2835 has only one core. Introduce the core_count field to be able to use values different than BCM283X_NCPUS (4). Reviewed-by: Luc Michel <luc.michel@greensocs.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201024170127.3592182-4-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/bcm2836: QOM'ify more by adding class_init() to each SoC typePhilippe Mathieu-Daudé2020-10-271-58/+52Star
| | | | | | | | | | | | | | Remove usage of TypeInfo::class_data. Instead fill the fields in the corresponding class_init(). So far all children use the same values for almost all fields, but we are going to add the BCM2711/BCM2838 SoC for the raspi4 machine which use different fields. Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201024170127.3592182-3-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/bcm2836: Restrict BCM283XInfo declaration to C sourcePhilippe Mathieu-Daudé2020-10-271-0/+14
| | | | | | | | | | No code out of bcm2836.c uses (or requires) the BCM283XInfo declarations. Move it locally to the C source file. Reviewed-by: Luc Michel <luc.michel@greensocs.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201024170127.3592182-2-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/smmuv3: Set the restoration priority of the vSMMUv3 explicitlyZenghui Yu2020-10-271-0/+1
| | | | | | | | | | Ensure the vSMMUv3 will be restored before all PCIe devices so that DMA translation can work properly during migration. Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> Message-id: 20201019091508.197-1-yuzenghui@huawei.com Acked-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/gpio: Add GPIO model for Nuvoton NPCM7xxHavard Skinnemoen2020-10-274-0/+512
| | | | | | | | | | | | | | | | The NPCM7xx chips have multiple GPIO controllers that are mostly identical except for some minor differences like the reset values of some registers. Each controller controls up to 32 pins. Each individual pin is modeled as a pair of unnamed GPIOs -- one for emitting the actual pin state, and one for driving the pin externally. Like the nRF51 GPIO controller, a gpio level may be negative, which means the pin is not driven, or floating. Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/npcm7xx: Add EHCI and OHCI controllersHavard Skinnemoen2020-10-273-2/+45
| | | | | | | | | | | | | | | | | | | | | | | | The NPCM730 and NPCM750 chips have a single USB host port shared between a USB 2.0 EHCI host controller and a USB 1.1 OHCI host controller. This adds support for both of them. Testing notes: * With -device usb-kbd, qemu will automatically insert a full-speed hub, and the keyboard becomes controlled by the OHCI controller. * With -device usb-kbd,bus=usb-bus.0,port=1, the keyboard is directly attached to the port without any hubs, and the device becomes controlled by the EHCI controller since it's high speed capable. * With -device usb-kbd,bus=usb-bus.0,port=1,usb_version=1, the keyboard is directly attached to the port, but it only advertises itself as full-speed capable, so it becomes controlled by the OHCI controller. In all cases, the keyboard device enumerates correctly. Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/misc: Add npcm7xx random number generatorHavard Skinnemoen2020-10-274-1/+191
| | | | | | | | | | | | | | | | The RNG module returns a byte of randomness when the Data Valid bit is set. This implementation ignores the prescaler setting, and loads a new value into RNGD every time RNGCS is read while the RNG is enabled and random data is available. A qtest featuring some simple randomness tests is included. Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/timer: Adding watchdog for NPCM7XX Timer.Hao Wu2020-10-273-46/+260
| | | | | | | | | | | | | | | The watchdog is part of NPCM7XX's timer module. Its behavior is controlled by the WTCR register in the timer. When enabled, the watchdog issues an interrupt signal after a pre-set amount of cycles, and issues a reset signal shortly after that. Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Signed-off-by: Hao Wu <wuhaotsh@google.com> Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: deleted blank line at end of npcm_watchdog_timer-test.c] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Move npcm7xx_timer_reached_zero call out of npcm7xx_timer_pauseHavard Skinnemoen2020-10-271-3/+3
| | | | | | | | This allows us to reuse npcm7xx_timer_pause for the watchdog timer. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm: fix min_cpus for xlnx-versal-virt platformPavel Dovgalyuk2020-10-271-0/+1
| | | | | | | | | | | | This patch sets min_cpus field for xlnx-versal-virt platform, because it always creates XLNX_VERSAL_NR_ACPUS cpus even with -smp 1 command line option. Signed-off-by: Pavel Dovgalyuk <pavel.dovgalyuk@ispras.ru> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 160343854912.8460.17915238517799132371.stgit@pasha-ThinkPad-X280 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/highbank: Silence warnings about missing fallthrough statementsThomas Huth2020-10-271-0/+2
| | | | | | | | | | | | When compiling with -Werror=implicit-fallthrough, gcc complains about missing fallthrough annotations in this file. Looking at the code, the fallthrough is very likely intended here, so add some comments to silence the compiler warnings. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 20201020105938.23209-1-thuth@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge remote-tracking branch 'remotes/philmd-gitlab/tags/sd-next-20201026' ↵Peter Maydell2020-10-262-13/+16
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging SD/MMC patches - Fix a bug in CMD6/SWITCH_FUNCTION (Bin Meng) - Minor housekeeping patches CI jobs result: . https://cirrus-ci.com/build/5461987880599552 . https://gitlab.com/philmd/qemu/-/pipelines/207532287 . https://travis-ci.org/github/philmd/qemu/builds/738901111 . https://app.shippable.com/github/philmd/qemu/runs/888/summary/console # gpg: Signature made Mon 26 Oct 2020 11:02:22 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd-gitlab/tags/sd-next-20201026: hw/sd/sdcard: Zero out function selection fields before being populated hw/sd/sdcard: Make iolen unsigned hw/sd/sdcard: Constify sd_crc*()'s message argument hw/sd/sdcard: Simplify cmd_valid_while_locked() hw/sd/sdcard: Update the SDState documentation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/sd/sdcard: Zero out function selection fields before being populatedBin Meng2020-10-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The function selection fields (399:376) should be zeroed out to prevent leftover from being or'ed into the switch function status data structure. This fixes the boot failure as seen in the acceptance testing on the orangepi target. Fixes: b638627c723a ("hw/sd: Fix incorrect populated function switch status data structure") Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20201024014954.21330-1-bmeng.cn@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
| * hw/sd/sdcard: Make iolen unsignedPhilippe Mathieu-Daudé2020-10-262-2/+2
| | | | | | | | | | | | | | | | | | I/O request length can not be negative. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630133912.9428-15-f4bug@amsat.org>
| * hw/sd/sdcard: Constify sd_crc*()'s message argumentPhilippe Mathieu-Daudé2020-10-261-4/+4
| | | | | | | | | | | | | | | | | | | | CRC functions don't modify the buffer argument, make it const. Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200630133912.9428-14-f4bug@amsat.org>
| * hw/sd/sdcard: Simplify cmd_valid_while_locked()Philippe Mathieu-Daudé2020-10-261-6/+5Star
| | | | | | | | | | | | | | | | | | | | cmd_valid_while_locked() only needs to read SDRequest->cmd, pass it directly and make it const. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630133912.9428-13-f4bug@amsat.org>
| * hw/sd/sdcard: Update the SDState documentationPhilippe Mathieu-Daudé2020-10-261-1/+4
| | | | | | | | | | | | | | | | | | | | | | Add more descriptive comments to keep a clear separation between static property vs runtime changeable. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630133912.9428-12-f4bug@amsat.org>
* | Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into ↵Peter Maydell2020-10-262-24/+20Star
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging * fix --disable-tcg builds (Claudio) * Fixes for macOS --enable-modules build and OpenBSD curses/iconv detection (myself) * Start preparing for meson 0.56 (myself) * Move directory configuration to meson (myself) * Start untangling qemu_init (myself) * Windows fixes (Sunil) * Remove -no-kbm (Thomas) # gpg: Signature made Mon 26 Oct 2020 11:12:17 GMT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini-gitlab/tags/for-upstream: machine: move SMP initialization from vl.c machine: move UP defaults to class_base_init machine: remove deprecated -machine enforce-config-section option win32: boot broken when bind & data dir are the same WHPX: Fix WHPX build break configure: move install_blobs from configure to meson configure: remove unused variable from config-host.mak configure: move directory options from config-host.mak to meson configure: allow configuring localedir Makefile: separate meson rerun from the rest of the ninja invocation Remove deprecated -no-kvm option replay: do not build if TCG is not available qtest: unbreak non-TCG builds in bios-tables-test hw/core/qdev-clock: add a reference on aliased clocks do not use colons in test names meson: rewrite curses/iconv test build: fix macOS --enable-modules build Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | machine: move SMP initialization from vl.cPaolo Bonzini2020-10-261-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | Initialize the object's values from the class when the object is created, no need to have vl.c do it for us. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | machine: move UP defaults to class_base_initPaolo Bonzini2020-10-261-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | Clean up vl.c, default min/max/default_cpus to uniprocessor directly in the QOM class initialization code. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | machine: remove deprecated -machine enforce-config-section optionPaolo Bonzini2020-10-261-23/+0Star
| | | | | | | | | | | | | | | | | | | | | Deprecated since 3.1 and complicates the initialization sequence, remove it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | hw/core/qdev-clock: add a reference on aliased clocksLuc Michel2020-10-221-0/+8
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When aliasing a clock with the qdev_alias_clock() function, a new link property is created on the device aliasing the clock. The link points to the aliased clock and use the OBJ_PROP_LINK_STRONG flag. This property is read only since it does not provide a check callback for modifications. The object_property_add_link() documentation stats that with OBJ_PROP_LINK_STRONG properties, the linked object reference count get decremented when the property is deleted. But it is _not_ incremented on creation (object_property_add_link() does not actually know the link). This commit increments the reference count on the aliased clock to ensure the aliased clock stays alive during the property lifetime, and to avoid a double-free memory error when the property gets deleted. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Luc Michel <luc@lmichel.fr> Message-Id: <20201020091024.320381-1-luc@lmichel.fr> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20201026' into stagingPeter Maydell2020-10-262-5/+1Star
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | some s390x fixes # gpg: Signature made Mon 26 Oct 2020 10:46:50 GMT # gpg: using RSA key C3D0D66DC3624FF6A8C018CEDECF6B93C6F02FAF # gpg: issuer "cohuck@redhat.com" # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [unknown] # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full] # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full] # gpg: aka "Cornelia Huck <cohuck@kernel.org>" [unknown] # gpg: aka "Cornelia Huck <cohuck@redhat.com>" [unknown] # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20201026: s390x: pv: Fix diag318 PV fencing s390x: pv: Remove sclp boundary checks s390x/s390-virtio-ccw: Reset PCI devices during subsystem reset Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | s390x: pv: Remove sclp boundary checksJanosch Frank2020-10-221-5/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The SCLP boundary cross check is done by the Ultravisor for a protected guest, hence we don't need to do it. As QEMU doesn't get a valid SCCB address in protected mode this is even problematic and can lead to QEMU reporting a false boundary cross error. Fixes: db13387ca0 ("s390/sclp: rework sclp boundary checks") Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com> Signed-off-by: Janosch Frank <frankja@linux.ibm.com> Tested-by: Marc Hartmayer <mhartmay@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Collin Walling <walling@linux.ibm.com> Acked-by: Halil Pasic <pasic@linux.ibm.com> Acked-by: David Hildenbrand <david@redhat.com> Message-Id: <20201022103135.126033-2-frankja@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
| * | s390x/s390-virtio-ccw: Reset PCI devices during subsystem resetMatthew Rosato2020-10-221-0/+1
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, a subsystem reset event leaves PCI devices enabled, causing issues post-reset in the guest (an example would be after a kexec). These devices need to be reset during a subsystem reset, allowing them to be properly re-enabled afterwards. Add the S390 PCI host bridge to the list of qdevs to be reset during subsystem reset. Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Acked-by: Halil Pasic <pasic@linux.ibm.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Cc: qemu-stable@nongnu.org Message-Id: <1602767767-32713-1-git-send-email-mjrosato@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* | Merge remote-tracking branch ↵Peter Maydell2020-10-268-115/+175
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/alistair/tags/pull-riscv-to-apply-20201023' into staging A collection of RISC-V fixes for the next QEMU release. This includes: - Improvements to logging output - Hypervisor instruction fixups - The ability to load a noMMU kernel - SiFive OTP support # gpg: Signature made Fri 23 Oct 2020 16:13:57 BST # gpg: using RSA key F6C4AC46D4934868D3B8CE8F21E10D29DF977054 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [full] # Primary key fingerprint: F6C4 AC46 D493 4868 D3B8 CE8F 21E1 0D29 DF97 7054 * remotes/alistair/tags/pull-riscv-to-apply-20201023: hw/misc/sifive_u_otp: Add backend drive support hw/misc/sifive_u_otp: Add write function and write-once protection target/riscv: raise exception to HS-mode at get_physical_address hw/riscv: Load the kernel after the firmware hw/riscv: Add a riscv_is_32_bit() function hw/riscv: Return the end address of the loaded firmware hw/riscv: sifive_u: Allow specifying the CPU target/riscv: Fix implementation of HLVX.WU instruction target/riscv: Fix update of hstatus.GVA in riscv_cpu_do_interrupt target/riscv: Fix update of hstatus.SPVP hw/intc: Move sifive_plic.h to the include directory riscv: Convert interrupt logs to use qemu_log_mask() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/misc/sifive_u_otp: Add backend drive supportGreen Wan2020-10-221-0/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add '-drive' support to OTP device. Allow users to assign a raw file as OTP image. test commands for 16k otp.img filled with zero: $ dd if=/dev/zero of=./otp.img bs=1k count=16 $ ./qemu-system-riscv64 -M sifive_u -m 256M -nographic -bios none \ -kernel ../opensbi/build/platform/sifive/fu540/firmware/fw_payload.elf \ -d guest_errors -drive if=none,format=raw,file=otp.img Signed-off-by: Green Wan <green.wan@sifive.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Tested-by: Bin Meng <bin.meng@windriver.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20201020033732.12921-3-green.wan@sifive.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * | hw/misc/sifive_u_otp: Add write function and write-once protectionGreen Wan2020-10-221-1/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Add write operation to update fuse data bit when PWE bit is on. - Add array, fuse_wo, to store the 'written' status for all bits of OTP to block the write operation. Signed-off-by: Green Wan <green.wan@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Tested-by: Bin Meng <bin.meng@windriver.com> Message-id: 20201020033732.12921-2-green.wan@sifive.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * | hw/riscv: Load the kernel after the firmwareAlistair Francis2020-10-226-15/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of loading the kernel at a hardcoded start address, let's load the kernel at the next aligned address after the end of the firmware. This should have no impact for current users of OpenSBI, but will allow loading a noMMU kernel at the start of memory. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Tested-by: Bin Meng <bin.meng@windriver.com> Message-id: 46c00c4f15b42feb792090e3d74359e180a6d954.1602634524.git.alistair.francis@wdc.com
| * | hw/riscv: Add a riscv_is_32_bit() functionAlistair Francis2020-10-221-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Tested-by: Bin Meng <bin.meng@windriver.com> Message-id: 4c6a85dfb6dd470aa79356ebc1b02f479c2758e0.1602634524.git.alistair.francis@wdc.com
| * | hw/riscv: Return the end address of the loaded firmwareAlistair Francis2020-10-221-11/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of returning the unused entry address from riscv_load_firmware() instead return the end address. Also return the end address from riscv_find_and_load_firmware(). This tells the caller if a firmware was loaded and how big it is. This can be used to determine the load address of the next image (usually the kernel). Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Tested-by: Bin Meng <bin.meng@windriver.com> Message-id: 558cf67162342d65a23262248b040563716628b2.1602634524.git.alistair.francis@wdc.com
| * | hw/riscv: sifive_u: Allow specifying the CPUAlistair Francis2020-10-221-5/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow the user to specify the main application CPU for the sifive_u machine. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Tested-by: Bin Meng <bin.meng@windriver.com> Message-id: b8412086c8aea0eff30fb7a17f0acf2943381b6a.1602634524.git.alistair.francis@wdc.com
| * | hw/intc: Move sifive_plic.h to the include directoryBin Meng2020-10-221-83/+0Star
| |/ | | | | | | | | | | | | | | | | | | | | | | Since sifive_plic.h is used by hw/intc/sifive_plic.c, it has to be in the public include directory. Move it. Fixes: 84fcf3c15111 ("hw/riscv: Move sifive_plic model to hw/intc") Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1602578033-68384-1-git-send-email-bmeng.cn@gmail.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* / block: move logical block size check function to a common utility functionCoiby Xu2020-10-231-26/+5Star
|/ | | | | | | | | | | | | Move the constants from hw/core/qdev-properties.c to util/block-helpers.h so that knowledge of the min/max values is Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Coiby Xu <coiby.xu@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Acked-by: Eduardo Habkost <ehabkost@redhat.com> Message-id: 20200918080912.321299-5-coiby.xu@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* Merge remote-tracking branch 'remotes/philmd-gitlab/tags/sd-next-20201021' ↵Peter Maydell2020-10-223-15/+58
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging SD/MMC patches Fix two heap-overflow reported by Alexander Bulekov while fuzzing: - https://bugs.launchpad.net/qemu/+bug/1892960 - https://bugs.launchpad.net/qemu/+bug/1895310 CI jobs results: . https://cirrus-ci.com/build/6399328187056128 . https://gitlab.com/philmd/qemu/-/pipelines/205701966 . https://travis-ci.org/github/philmd/qemu/builds/737708930 # gpg: Signature made Wed 21 Oct 2020 18:33:08 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd-gitlab/tags/sd-next-20201021: hw/sd/sdcard: Assert if accessing an illegal group hw/sd/sdcard: Do not attempt to erase out of range addresses hw/sd/sdcard: Reset both start/end addresses on error hw/sd/sdcard: Do not use legal address '0' for INVALID_ADDRESS hw/sd/sdcard: Introduce the INVALID_ADDRESS definition hw/sd/sdcard: Add trace event for ERASE command (CMD38) hw/sd/sdhci: Yield if interrupt delivered during multiple transfer hw/sd/sdhci: Let sdhci_update_irq() return if IRQ was delivered hw/sd/sdhci: Resume pending DMA transfers on MMIO accesses hw/sd/sdhci: Stop multiple transfers when block count is cleared hw/sd/sdhci: Fix DMA Transfer Block Size field hw/sd/sdhci: Document the datasheet used hw/sd/sdhci: Fix qemu_log_mask() format string Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/sd/sdcard: Assert if accessing an illegal groupPhilippe Mathieu-Daudé2020-10-211-0/+2
| | | | | | | | | | | | | | | | | | We can not have more group than 'wpgrps_size'. Assert if we are accessing a group above this limit. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201015063824.212980-7-f4bug@amsat.org>
| * hw/sd/sdcard: Do not attempt to erase out of range addressesPhilippe Mathieu-Daudé2020-10-211-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While the Spec v3 is not very clear, v6 states: If the host provides an out of range address as an argument to CMD32 or CMD33, the card shall indicate OUT_OF_RANGE error in R1 (ERX) for CMD38. If an address is out of range, do not attempt to erase it: return R1 with the error bit set. Buglink: https://bugs.launchpad.net/qemu/+bug/1895310 Reported-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201015063824.212980-6-f4bug@amsat.org>
| * hw/sd/sdcard: Reset both start/end addresses on errorPhilippe Mathieu-Daudé2020-10-211-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From the Spec "4.3.5 Erase": The host should adhere to the following command sequence: ERASE_WR_BLK_START, ERASE_WR_BLK_END and ERASE (CMD38). If an erase (CMD38) or address setting (CMD32, 33) command is received out of sequence, the card shall set the ERASE_SEQ_ERROR bit in the status register and reset the whole sequence. Reset both addresses if the ERASE command occured out of sequence (one of the start/end address is not set). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201015063824.212980-5-f4bug@amsat.org>
| * hw/sd/sdcard: Do not use legal address '0' for INVALID_ADDRESSPhilippe Mathieu-Daudé2020-10-211-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As it is legal to WRITE/ERASE the address/block 0, change the value of this definition to an illegal address: UINT32_MAX. Unfortunately this break the migration stream, so bump the VMState version number. This affects some ARM boards and the SDHCI_PCI device (which is only used for testing). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201015063824.212980-4-f4bug@amsat.org>
| * hw/sd/sdcard: Introduce the INVALID_ADDRESS definitionPhilippe Mathieu-Daudé2020-10-211-5/+8
| | | | | | | | | | | | | | | | | | '0' is used as a value to indicate an invalid (or unset) address. Use a definition instead of a magic value. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201015063824.212980-3-f4bug@amsat.org>
| * hw/sd/sdcard: Add trace event for ERASE command (CMD38)Philippe Mathieu-Daudé2020-10-212-2/+2
| | | | | | | | | | | | | | | | Trace addresses provided to the ERASE command. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201015063824.212980-2-f4bug@amsat.org>
| * hw/sd/sdhci: Yield if interrupt delivered during multiple transferPhilippe Mathieu-Daudé2020-10-211-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Descriptor Table has a bit to allow the DMA to generates Interrupt when the operation of the descriptor line is completed (see "1.13.4. Descriptor Table" of 'SD Host Controller Simplified Specification Version 2.00'). If we have pending interrupt and the descriptor requires it to be generated as soon as it is completed, reschedule pending transfers and yield to the CPU. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200903172806.489710-5-f4bug@amsat.org>
| * hw/sd/sdhci: Let sdhci_update_irq() return if IRQ was deliveredPhilippe Mathieu-Daudé2020-10-211-2/+7
| | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200903172806.489710-4-f4bug@amsat.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-01-15 17:53:58 +0100