summary refs log tree commit diff stats
Commit message (Collapse)AuthorAgeFilesLines
...
| * hw/intc: ibex_plic: Convert the PLIC to use RISC-V CPU GPIO linesAlistair Francis2021-09-213-11/+16
| | | | | | | | | | | | | | | | | | | | Instead of using riscv_cpu_update_mip() let's instead use the new RISC-V CPU GPIO lines to set the external MIP bits. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 0a76946981852f5bd15f0c37ab35b253371027a8.1630301632.git.alistair.francis@wdc.com
| * hw/intc: sifive_clint: Use RISC-V CPU GPIO linesAlistair Francis2021-09-212-20/+50
| | | | | | | | | | | | | | | | | | | | | | Instead of using riscv_cpu_update_mip() let's instead use the new RISC-V CPU GPIO lines to set the timer and soft MIP bits. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Tested-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@c-sky.com> Message-id: 946e1ef5e268b24084c7ddad84c146de62a56736.1630301632.git.alistair.francis@wdc.com
| * target/riscv: Expose interrupt pending bits as GPIO linesAlistair Francis2021-09-211-0/+30
| | | | | | | | | | | | | | | | | | | | | | Expose the 12 interrupt pending bits in MIP as GPIO lines. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Tested-by: Bin Meng <bmeng.cn@gmail.com> Message-id: 069d6162f0bc2f4a4f5a44e73f6442b11c703c53.1630301632.git.alistair.francis@wdc.com
| * target/riscv: Fix satp writeLIU Zhiwei2021-09-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | These variables should be target_ulong. If truncated to int, the bool conditions they indicate will be wrong. As satp is very important for Linux, this bug almost fails every boot. Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210901124539.222868-1-zhiwei_liu@c-sky.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * target/riscv: Update the ePMP CSR addressAlistair Francis2021-09-212-2/+3
| | | | | | | | | | | | | | | | | | Update the ePMP CSRs to match the 0.9.3 ePMP spec https://github.com/riscv/riscv-tee/blob/61455747230a26002d741f64879dd78cc9689323/Smepmp/Smepmp.pdf Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-id: 28c908de60b9b04fa20e63d113885c98586053f3.1630543194.git.alistair.francis@wdc.com
* | Merge remote-tracking branch ↵Peter Maydell2021-09-2124-168/+1825
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/pmaydell/tags/pull-target-arm-20210921' into staging target-arm queue: * Optimize codegen for MVE when predication not active * hvf: Add Apple Silicon support * hw/intc: Set GIC maintenance interrupt level to only 0 or 1 * Fix mishandling of MVE FPSCR.LTPSIZE reset for usermode emulator * elf2dmp: Fix coverity nits # gpg: Signature made Tue 21 Sep 2021 16:31:17 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210921: (27 commits) target/arm: Optimize MVE 1op-immediate insns target/arm: Optimize MVE VSLI and VSRI target/arm: Optimize MVE VSHLL and VMOVL target/arm: Optimize MVE VSHL, VSHR immediate forms target/arm: Optimize MVE VMVN target/arm: Optimize MVE VDUP target/arm: Optimize MVE VNEG, VABS target/arm: Optimize MVE arithmetic ops target/arm: Optimize MVE logic ops target/arm: Add TB flag for "MVE insns not predicated" target/arm: Enforce that FPDSCR.LTPSIZE is 4 on inbound migration target/arm: Avoid goto_tb if we're trying to exit to the main loop hvf: arm: Add rudimentary PMC support arm: Add Hypervisor.framework build target hvf: arm: Implement PSCI handling hvf: arm: Implement -cpu host arm/hvf: Add a WFI handler hvf: Add Apple Silicon support hvf: Introduce hvf_arch_init() callback hvf: Add execute to dirty log permission bitmap ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | target/arm: Optimize MVE 1op-immediate insnsPeter Maydell2021-09-211-5/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | Optimize the MVE 1op-immediate insns (VORR, VBIC, VMOV) to use TCG vector ops when possible. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210913095440.13462-13-peter.maydell@linaro.org
| * | target/arm: Optimize MVE VSLI and VSRIPeter Maydell2021-09-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Optimize the MVE shift-and-insert insns by using TCG vector ops when possible. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210913095440.13462-12-peter.maydell@linaro.org
| * | target/arm: Optimize MVE VSHLL and VMOVLPeter Maydell2021-09-211-8/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Optimize the MVE VSHLL insns by using TCG vector ops when possible. This includes the VMOVL insn, which we handle in mve.decode as "VSHLL with zero shift count". Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210913095440.13462-11-peter.maydell@linaro.org
| * | target/arm: Optimize MVE VSHL, VSHR immediate formsPeter Maydell2021-09-211-20/+63
| | | | | | | | | | | | | | | | | | | | | | | | | | | Optimize the MVE VSHL and VSHR immediate forms by using TCG vector ops when possible. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210913095440.13462-10-peter.maydell@linaro.org
| * | target/arm: Optimize MVE VMVNPeter Maydell2021-09-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Optimize the MVE VMVN insn by using TCG vector ops when possible. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210913095440.13462-9-peter.maydell@linaro.org
| * | target/arm: Optimize MVE VDUPPeter Maydell2021-09-211-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | Optimize the MVE VDUP insns by using TCG vector ops when possible. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210913095440.13462-8-peter.maydell@linaro.org
| * | target/arm: Optimize MVE VNEG, VABSPeter Maydell2021-09-211-10/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Optimize the MVE VNEG and VABS insns by using TCG vector ops when possible. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210913095440.13462-7-peter.maydell@linaro.org
| * | target/arm: Optimize MVE arithmetic opsPeter Maydell2021-09-211-9/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Optimize MVE arithmetic ops when we have a TCG vector operation we can use. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210913095440.13462-6-peter.maydell@linaro.org
| * | target/arm: Optimize MVE logic opsPeter Maydell2021-09-211-15/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When not predicating, implement the MVE bitwise logical insns directly using TCG vector operations. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210913095440.13462-5-peter.maydell@linaro.org
| * | target/arm: Add TB flag for "MVE insns not predicated"Peter Maydell2021-09-217-9/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Our current codegen for MVE always calls out to helper functions, because some byte lanes might be predicated. The common case is that in fact there is no predication active and all lanes should be updated together, so we can produce better code by detecting that and using the TCG generic vector infrastructure. Add a TB flag that is set when we can guarantee that there is no active MVE predication, and a bool in the DisasContext. Subsequent patches will use this flag to generate improved code for some instructions. In most cases when the predication state changes we simply end the TB after that instruction. For the code called from vfp_access_check() that handles lazy state preservation and creating a new FP context, we can usually avoid having to try to end the TB because luckily the new value of the flag following the register changes in those sequences doesn't depend on any runtime decisions. We do have to end the TB if the guest has enabled lazy FP state preservation but not automatic state preservation, but this is an odd corner case that is not going to be common in real-world code. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210913095440.13462-4-peter.maydell@linaro.org
| * | target/arm: Enforce that FPDSCR.LTPSIZE is 4 on inbound migrationPeter Maydell2021-09-211-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Architecturally, for an M-profile CPU with the LOB feature the LTPSIZE field in FPDSCR is always constant 4. QEMU's implementation enforces this everywhere, except that we don't check that it is true in incoming migration data. We're going to add come in gen_update_fp_context() which relies on the "always 4" property. Since this is TCG-only, we don't actually need to be robust to bogus incoming migration data, and the effect of it being wrong would be wrong code generation rather than a QEMU crash; but if it did ever happen somehow it would be very difficult to track down the cause. Add a check so that we fail the inbound migration if the FPDSCR.LTPSIZE value is incorrect. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210913095440.13462-3-peter.maydell@linaro.org
| * | target/arm: Avoid goto_tb if we're trying to exit to the main loopPeter Maydell2021-09-211-1/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently gen_jmp_tb() assumes that if it is called then the jump it is handling is the only reason that we might be trying to end the TB, so it will use goto_tb if it can. This is usually the case: mostly "we did something that means we must end the TB" happens on a non-branch instruction. However, there are cases where we decide early in handling an instruction that we need to end the TB and return to the main loop, and then the insn is a complex one that involves gen_jmp_tb(). For instance, for M-profile FP instructions, in gen_preserve_fp_state() which is called from vfp_access_check() we want to force an exit to the main loop if lazy state preservation is active and we are in icount mode. Make gen_jmp_tb() look at the current value of is_jmp, and only use goto_tb if the previous is_jmp was DISAS_NEXT or DISAS_TOO_MANY. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210913095440.13462-2-peter.maydell@linaro.org
| * | hvf: arm: Add rudimentary PMC supportAlexander Graf2021-09-211-0/+179
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We can expose cycle counters on the PMU easily. To be as compatible as possible, let's do so, but make sure we don't expose any other architectural counters that we can not model yet. This allows OSs to work that require PMU support. Signed-off-by: Alexander Graf <agraf@csgraf.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210916155404.86958-10-agraf@csgraf.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | arm: Add Hypervisor.framework build targetAlexander Graf2021-09-213-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that we have all logic in place that we need to handle Hypervisor.framework on Apple Silicon systems, let's add CONFIG_HVF for aarch64 as well so that we can build it. Signed-off-by: Alexander Graf <agraf@csgraf.de> Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com> Tested-by: Roman Bolshakov <r.bolshakov@yadro.com> (x86 only) Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Sergio Lopez <slp@redhat.com> Message-id: 20210916155404.86958-9-agraf@csgraf.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hvf: arm: Implement PSCI handlingAlexander Graf2021-09-213-7/+139
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We need to handle PSCI calls. Most of the TCG code works for us, but we can simplify it to only handle aa64 mode and we need to handle SUSPEND differently. This patch takes the TCG code as template and duplicates it in HVF. To tell the guest that we support PSCI 0.2 now, update the check in arm_cpu_initfn() as well. Signed-off-by: Alexander Graf <agraf@csgraf.de> Reviewed-by: Sergio Lopez <slp@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210916155404.86958-8-agraf@csgraf.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hvf: arm: Implement -cpu hostPeter Maydell2021-09-215-6/+124
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that we have working system register sync, we push more target CPU properties into the virtual machine. That might be useful in some situations, but is not the typical case that users want. So let's add a -cpu host option that allows them to explicitly pass all CPU capabilities of their host CPU into the guest. Signed-off-by: Alexander Graf <agraf@csgraf.de> Acked-by: Roman Bolshakov <r.bolshakov@yadro.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210916155404.86958-7-agraf@csgraf.de [PMM: drop unnecessary #include line from .h file] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | arm/hvf: Add a WFI handlerPeter Collingbourne2021-09-213-3/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sleep on WFI until the VTIMER is due but allow ourselves to be woken up on IPI. In this implementation IPI is blocked on the CPU thread at startup and pselect() is used to atomically unblock the signal and begin sleeping. The signal is sent unconditionally so there's no need to worry about races between actually sleeping and the "we think we're sleeping" state. It may lead to an extra wakeup but that's better than missing it entirely. Signed-off-by: Peter Collingbourne <pcc@google.com> Signed-off-by: Alexander Graf <agraf@csgraf.de> Acked-by: Roman Bolshakov <r.bolshakov@yadro.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Message-id: 20210916155404.86958-6-agraf@csgraf.de [agraf: Remove unused 'set' variable, always advance PC on WFX trap, support vm stop / continue operations and cntv offsets] Signed-off-by: Alexander Graf <agraf@csgraf.de> Acked-by: Roman Bolshakov <r.bolshakov@yadro.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hvf: Add Apple Silicon supportAlexander Graf2021-09-207-1/+834
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With Apple Silicon available to the masses, it's a good time to add support for driving its virtualization extensions from QEMU. This patch adds all necessary architecture specific code to get basic VMs working, including save/restore. Known limitations: - WFI handling is missing (follows in later patch) - No watchpoint/breakpoint support Signed-off-by: Alexander Graf <agraf@csgraf.de> Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210916155404.86958-5-agraf@csgraf.de [PMM: added missing #include] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hvf: Introduce hvf_arch_init() callbackAlexander Graf2021-09-203-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We will need to install a migration helper for the ARM hvf backend. Let's introduce an arch callback for the overall hvf init chain to do so. Signed-off-by: Alexander Graf <agraf@csgraf.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210916155404.86958-4-agraf@csgraf.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hvf: Add execute to dirty log permission bitmapAlexander Graf2021-09-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hvf's permission bitmap during and after dirty logging does not include the HV_MEMORY_EXEC permission. At least on Apple Silicon, this leads to instruction faults once dirty logging was enabled. Add the bit to make it work properly. Signed-off-by: Alexander Graf <agraf@csgraf.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210916155404.86958-3-agraf@csgraf.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | arm: Move PMC register definitions to internals.hAlexander Graf2021-09-202-44/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We will need PMC register definitions in accel specific code later. Move all constant definitions to common arm headers so we can reuse them. Signed-off-by: Alexander Graf <agraf@csgraf.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210916155404.86958-2-agraf@csgraf.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/intc: Set GIC maintenance interrupt level to only 0 or 1Shashi Mallela2021-09-201-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During sbsa acs level 3 testing, it is seen that the GIC maintenance interrupts are not triggered and the related test cases fail. This is because we were incorrectly passing the value of the MISR register (from maintenance_interrupt_state()) to qemu_set_irq() as the level argument, whereas the device on the other end of this irq line expects a 0/1 value. Fix the logic to pass a 0/1 level indication, rather than a 0/not-0 value. Fixes: c5fc89b36c0 ("hw/intc/arm_gicv3: Implement gicv3_cpuif_virt_update()") Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210915205809.59068-1-shashi.mallela@linaro.org [PMM: tweaked commit message; collapsed nested if()s into one] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | target/arm: Consolidate ifdef blocks in resetPeter Maydell2021-09-201-12/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | Move an ifndef CONFIG_USER_ONLY code block up in arm_cpu_reset() so it can be merged with another earlier one. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210914120725.24992-4-peter.maydell@linaro.org
| * | target/arm: Always clear exclusive monitor on resetPeter Maydell2021-09-201-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There's no particular reason why the exclusive monitor should be only cleared on reset in system emulation mode. It doesn't hurt if it isn't cleared in user mode, but we might as well reduce the amount of code we have that's inside an ifdef. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210914120725.24992-3-peter.maydell@linaro.org
| * | target/arm: Don't skip M-profile reset entirely in user modePeter Maydell2021-09-201-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently all of the M-profile specific code in arm_cpu_reset() is inside a !defined(CONFIG_USER_ONLY) ifdef block. This is unintentional: it happened because originally the only M-profile-specific handling was the setup of the initial SP and PC from the vector table, which is system-emulation only. But then we added a lot of other M-profile setup to the same "if (ARM_FEATURE_M)" code block without noticing that it was all inside a not-user-mode ifdef. This has generally been harmless, but with the addition of v8.1M low-overhead-loop support we ran into a problem: the reset of FPSCR.LTPSIZE to 4 was only being done for system emulation mode, so if a user-mode guest tried to execute the LE instruction it would incorrectly take a UsageFault. Adjust the ifdefs so only the really system-emulation specific parts are covered. Because this means we now run some reset code that sets up initial values in the FPCCR and similar FPU related registers, explicitly set up the registers controlling FPU context handling in user-emulation mode so that the FPU works by design and not by chance. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/613 Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210914120725.24992-2-peter.maydell@linaro.org
| * | elf2dmp: Fail cleanly if PDB file specifies zero block_sizePeter Maydell2021-09-201-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Coverity points out that if the PDB file we're trying to read has a header specifying a block_size of zero then we will end up trying to divide by zero in pdb_ds_read_file(). Check for this and fail cleanly instead. Fixes: Coverity CID 1458869 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu> Message-id: 20210910170656.366592-3-philmd@redhat.com Message-Id: <20210901143910.17112-3-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
| * | elf2dmp: Check curl_easy_setopt() return valuePeter Maydell2021-09-201-12/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Coverity points out that we aren't checking the return value from curl_easy_setopt(). Fixes: Coverity CID 1458895 Inspired-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu> Tested-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu> Message-id: 20210910170656.366592-2-philmd@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | | Merge remote-tracking branch 'remotes/legoater/tags/pull-aspeed-20210920' ↵Peter Maydell2021-09-2115-76/+529
|\ \ \ | |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging Aspeed patches : * MAC enablement fixes (Guenter) * Watchdog and pca9552 fixes (Andrew) * GPIO fixes (Joel) * AST2600A3 SoC and DPS310 models (Joel) * New Fuji BMC machine (Peter) # gpg: Signature made Mon 20 Sep 2021 07:51:23 BST # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@kaod.org>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * remotes/legoater/tags/pull-aspeed-20210920: hw/arm/aspeed: Add Fuji machine type hw/arm/aspeed: Allow machine to set UART default hw/arm/aspeed: Initialize AST2600 UART clock selection registers arm/aspeed: Add DPS310 to Witherspoon and Rainier hw/misc: Add Infineon DPS310 sensor model aspeed: Emulate the AST2600A3 arm/aspeed: rainier: Add i2c eeproms and muxes misc/pca9552: Fix LED status register indexing in pca955x_get_led() hw: aspeed_gpio: Clarify GPIO controller name hw: aspeed_gpio: Simplify 1.8V defines watchdog: aspeed: Fix sequential control writes watchdog: aspeed: Sanitize control register values hw: arm: aspeed: Enable mac0/1 instead of mac1/2 for g220a hw: arm: aspeed: Enable eth0 interface for aspeed-ast2600-evb Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/arm/aspeed: Add Fuji machine typePeter Delevoryas2021-09-201-0/+120
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds a new machine type "fuji-bmc" based on the following device tree: https://github.com/torvalds/linux/blob/40cb6373b46/arch/arm/boot/dts/aspeed-bmc-facebook-fuji.dts Most of the i2c devices are not there, they're added here: https://github.com/facebook/openbmc/blob/fb2ed12002fb/meta-facebook/meta-fuji/recipes-utils/openbmc-utils/files/setup_i2c.sh I tested this by building a Fuji image from Facebook's OpenBMC repo, booting, and ssh'ing from host-to-guest. Signed-off-by: Peter Delevoryas <pdel@fb.com> Reviewed-by: Joel Stanley <joel@jms.id.au> [ clg: On 32-bit hosts, lower RAM to 1G because of 2047 MB limit ] Message-Id: <20210906133124.3674661-1-pdel@fb.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
| * | hw/arm/aspeed: Allow machine to set UART defaultPeter Delevoryas2021-09-205-7/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When you run QEMU with an Aspeed machine and a single serial device using stdio like this: qemu -machine ast2600-evb -drive ... -serial stdio The guest OS can read and write to the UART5 registers at 0x1E784000 and it will receive from stdin and write to stdout. The Aspeed SoC's have a lot more UART's though (AST2500 has 5, AST2600 has 13) and depending on the board design, may be using any of them as the serial console. (See "stdout-path" in a DTS to check which one is chosen). Most boards, including all of those currently defined in hw/arm/aspeed.c, just use UART5, but some use UART1. This change adds some flexibility for different boards without requiring users to change their command-line invocation of QEMU. I tested this doesn't break existing code by booting an AST2500 OpenBMC image and an AST2600 OpenBMC image, each using UART5 as the console. Then I tested switching the default to UART1 and booting an AST2600 OpenBMC image that uses UART1, and that worked too. Signed-off-by: Peter Delevoryas <pdel@fb.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210901153615.2746885-2-pdel@fb.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
| * | hw/arm/aspeed: Initialize AST2600 UART clock selection registersPeter Delevoryas2021-09-201-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | UART5 is typically used as the default debug UART on the AST2600, but UART1 is also designed to be a debug UART. All the AST2600 UART's have semi-configurable clock rates through registers in the System Control Unit (SCU), but only UART5 works out of the box with zero-initialized values. The rest of the UART's expect a few of the registers to be initialized to non-zero values, or else the clock rate calculation will yield zero or undefined (due to a divide-by-zero). For reference, the U-Boot clock rate driver here shows the calculation: https://github.com/facebook/openbmc-uboot/blob/15f7e0dc01d8/drivers/clk/aspeed/clk_ast2600.c#L357 To summarize, UART5 allows selection from 4 rates: 24 MHz, 192 MHz, 24 / 13 MHz, and 192 / 13 MHz. The other UART's allow selecting either the "low" rate (UARTCLK) or the "high" rate (HUARTCLK). UARTCLK and HUARTCLK are configurable themselves: UARTCLK = UXCLK * R / (N * 2) HUARTCLK = HUXCLK * HR / (HN * 2) UXCLK and HUXCLK are also configurable, and depend on the APLL and/or HPLL clock rates, which also derive from complicated calculations. Long story short, there's lots of multiplication and division from configurable registers, and most of these registers are zero-initialized in QEMU, which at best is unexpected and at worst causes this clock rate driver to hang from divide-by-zero's. This can also be difficult to diagnose, because it may cause U-Boot to hang before serial console initialization completes, requiring intervention from gdb. This change just initializes all of these registers with default values from the datasheet. To test this, I used Facebook's AST2600 OpenBMC image for "fuji", with the following diff applied (because fuji uses UART1 for console output, not UART5). @@ -323,8 +323,8 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp) } /* UART - attach an 8250 to the IO space as our UART5 */ - serial_mm_init(get_system_memory(), sc->memmap[ASPEED_DEV_UART5], 2, - aspeed_soc_get_irq(s, ASPEED_DEV_UART5), + serial_mm_init(get_system_memory(), sc->memmap[ASPEED_DEV_UART1], 2, + aspeed_soc_get_irq(s, ASPEED_DEV_UART1), 38400, serial_hd(0), DEVICE_LITTLE_ENDIAN); /* I2C */ Without these clock rate registers being initialized, U-Boot hangs in the clock rate driver from a divide-by-zero, because the UART1 clock rate register reads return zero, and there's no console output. After initializing them with default values, fuji boots successfully. Signed-off-by: Peter Delevoryas <pdel@fb.com> Reviewed-by: Joel Stanley <joel@jms.id.au> [ clg: Removed _PARAM suffix ] Message-Id: <20210906134023.3711031-2-pdel@fb.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
| * | arm/aspeed: Add DPS310 to Witherspoon and RainierJoel Stanley2021-09-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Witherspoon uses the DPS310 as a temperature sensor. Rainier uses it as a temperature and humidity sensor. Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210629142336.750058-5-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
| * | hw/misc: Add Infineon DPS310 sensor modelJoel Stanley2021-09-204-0/+231
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This contains some hardcoded register values that were obtained from the hardware after reading the temperature. It does enough to test the Linux kernel driver. The FIFO mode, IRQs and operation modes other than the default as used by Linux are not modelled. Signed-off-by: Joel Stanley <joel@jms.id.au> Message-Id: <20210616073358.750472-2-joel@jms.id.au> [ clg: - Fixed sequential reading - Reworked regs_reset_state array - Moved model under hw/sensor/ ] Message-Id: <20210629142336.750058-4-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
| * | aspeed: Emulate the AST2600A3Joel Stanley2021-09-204-13/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the latest revision of the ASPEED 2600 SoC. As there is no need to model multiple revisions of the same SoC for the moment, update the SCU AST2600 to model the A3 revision instead of the A1 and adapt the AST2600 SoC and machines. Reset values are taken from v8 of the datasheet. Signed-off-by: Joel Stanley <joel@jms.id.au> [ clg: - Introduced an Aspeed "ast2600-a3" SoC class - Commit log update ] Message-Id: <20210629142336.750058-3-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
| * | arm/aspeed: rainier: Add i2c eeproms and muxesJoel Stanley2021-09-201-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These are the devices documented by the Rainier device tree. With this we can see the guest discovering the multiplexers and probing the eeprom devices: i2c i2c-2: Added multiplexed i2c bus 16 i2c i2c-2: Added multiplexed i2c bus 17 i2c i2c-2: Added multiplexed i2c bus 18 i2c i2c-2: Added multiplexed i2c bus 19 i2c-mux-gpio i2cmux: 4 port mux on 1e78a180.i2c-bus adapter at24 20-0050: 8192 byte 24c64 EEPROM, writable, 1 bytes/write i2c i2c-4: Added multiplexed i2c bus 20 at24 21-0051: 8192 byte 24c64 EEPROM, writable, 1 bytes/write i2c i2c-4: Added multiplexed i2c bus 21 at24 22-0052: 8192 byte 24c64 EEPROM, writable, 1 bytes/write Signed-off-by: Joel Stanley <joel@jms.id.au> [ clg: Introduced aspeed_eeprom_init ] Message-Id: <20210629142336.750058-2-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
| * | misc/pca9552: Fix LED status register indexing in pca955x_get_led()Andrew Jeffery2021-09-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There was a bit of a thinko in the state calculation where every odd pin in was reported in e.g. "pwm0" mode rather than "off". This was the result of an incorrect bit shift for the 2-bit field representing each LED state. Fixes: a90d8f84674d ("misc/pca9552: Add qom set and get") Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210723043624.348158-1-andrew@aj.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org>
| * | hw: aspeed_gpio: Clarify GPIO controller nameJoel Stanley2021-09-201-13/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are two GPIO controllers in the ast2600; one is 3.3V and the other is 1.8V. Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210713065854.134634-4-joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org>
| * | hw: aspeed_gpio: Simplify 1.8V definesJoel Stanley2021-09-201-37/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There's no need to define the registers relative to the 0x800 offset where the controller is mapped, as the device is instantiated as it's own model at the correct memory address. Simplify the defines and remove the offset to save future confusion. Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210713065854.134634-3-joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org>
| * | watchdog: aspeed: Fix sequential control writesAndrew Jeffery2021-09-201-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The logic in the handling for the control register required toggling the enable state for writes to stick. Rework the condition chain to allow sequential writes that do not update the enable state. Fixes: 854123bf8d4b ("wdt: Add Aspeed watchdog device model") Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210709053107.1829304-3-andrew@aj.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org>
| * | watchdog: aspeed: Sanitize control register valuesAndrew Jeffery2021-09-202-2/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While some of the critical fields remain the same, there is variation in the definition of the control register across the SoC generations. Reserved regions are adjusted, while in other cases the mutability or behaviour of fields change. Introduce a callback to sanitize the value on writes to ensure model behaviour reflects the hardware. Fixes: 854123bf8d4b ("wdt: Add Aspeed watchdog device model") Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210709053107.1829304-2-andrew@aj.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org>
| * | hw: arm: aspeed: Enable mac0/1 instead of mac1/2 for g220aGuenter Roeck2021-09-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to its dts file in the Linux kernel, we need mac0 and mac1 enabled instead of mac1 and mac2. Also, g220a is based on aspeed-g5 (ast2500) which doesn't even have the third interface. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210810035742.550391-1-linux@roeck-us.net> Signed-off-by: Cédric Le Goater <clg@kaod.org>
| * | hw: arm: aspeed: Enable eth0 interface for aspeed-ast2600-evbGuenter Roeck2021-09-201-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 7582591ae7 ("aspeed: Support AST2600A1 silicon revision") switched the silicon revision for AST2600 to revision A1. On revision A1, the first Ethernet interface is operational. Enable it. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210808200457.889955-1-linux@roeck-us.net> Signed-off-by: Cédric Le Goater <clg@kaod.org>
* | | Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell2021-09-202-8/+33
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging # gpg: Signature made Fri 17 Sep 2021 09:17:32 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: virtio-net: fix use after unmap/free for sg ebpf: only include in system emulators Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | virtio-net: fix use after unmap/free for sgJason Wang2021-09-171-7/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When mergeable buffer is enabled, we try to set the num_buffers after the virtqueue elem has been unmapped. This will lead several issues, E.g a use after free when the descriptor has an address which belongs to the non direct access region. In this case we use bounce buffer that is allocated during address_space_map() and freed during address_space_unmap(). Fixing this by storing the elems temporarily in an array and delay the unmap after we set the the num_buffers. This addresses CVE-2021-3748. Reported-by: Alexander Bulekov <alxndr@bu.edu> Fixes: fbe78f4f55c6 ("virtio-net support") Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com>