summary refs log tree commit diff stats
path: root/hw (follow)
Commit message (Collapse)AuthorAgeFilesLines
* arm/aspeed: Drop aspeed_board_init_flashes() parameter @errpMarkus Armbruster2020-06-231-6/+6
| | | | | | | | | | | | | | | We always pass &error_abort. Drop the parameter, use &error_abort directly. Cc: Cédric Le Goater <clg@kaod.org> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Andrew Jeffery <andrew@aj.id.au> Cc: Joel Stanley <joel@jms.id.au> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200622094227.1271650-15-armbru@redhat.com>
* qdev: Make qdev_prop_set_drive() match the other helpersMarkus Armbruster2020-06-2331-56/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | qdev_prop_set_drive() can fail. None of the other qdev_prop_set_FOO() can; they abort on error. To clean up this inconsistency, rename qdev_prop_set_drive() to qdev_prop_set_drive_err(), and create a qdev_prop_set_drive() that aborts on error. Coccinelle script to update callers: @ depends on !(file in "hw/core/qdev-properties-system.c")@ expression dev, name, value; symbol error_abort; @@ - qdev_prop_set_drive(dev, name, value, &error_abort); + qdev_prop_set_drive(dev, name, value); @@ expression dev, name, value, errp; @@ - qdev_prop_set_drive(dev, name, value, errp); + qdev_prop_set_drive_err(dev, name, value, errp); Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200622094227.1271650-14-armbru@redhat.com>
* qdev: Reject chardev property overrideMarkus Armbruster2020-06-231-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | qdev_prop_set_chr() screws up when the property already has a non-null value: it neglects to release the old value. Both the old and the new backend become attached to the same device. Unlike for block devices (see previous commit), this can't be observed from the monitor (I think). Example: -serial null -chardev null,id=chr0 -global isa-serial.chardev=chr0 Special case: attempting to use the same backend both times crashes: $ qemu-system-x86_64 --nodefaults -serial null -global isa-serial.chardev=serial0 Unexpected error in qemu_chr_fe_init() at /work/armbru/qemu/chardev/char-fe.c:220: qemu-system-x86_64: Device 'serial0' is in use Aborted (core dumped) Yet another example: -device with multiple chardev=... (but not device_add, which silently drops all but the last duplicate property). Perhaps chardev property override could be made to work. Perhaps it should. I can't afford the time to figure this out now. What I can do reject usage that leaves backends in unhealthy states. For what it's worth, we've long done the same for netdev properties. Cc: Marc-André Lureau <marcandre.lureau@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200622094227.1271650-13-armbru@redhat.com>
* qdev: Reject drive property overrideMarkus Armbruster2020-06-231-0/+8
| | | | | | | | | | | | | | | | | | | | | | | qdev_prop_set_drive() screws up when the property already has a non-null value: it neglects to release the old value. Both the old and the new backend become attached to the same device. Example (taken from iotest 172): -fda ... -drive if=none,... -global floppy.drive=none0. Special case: attempting to use the same backend both times fails. Example (also from iotest 172): -fda ... -global floppy.drive=floppy0. Yet another example: -device with multiple drive=... (but not device_add, which silently drops all but the last duplicate property). Perhaps drive property override could be made to work. Perhaps it should. I can't afford the time to figure this out now. What I can do is reject usage that leaves backends in unhealthy states. For what it's worth, we've long done the same for netdev properties. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200622094227.1271650-12-armbru@redhat.com>
* qdev: Improve netdev property override error a bitMarkus Armbruster2020-06-232-3/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | qdev_prop_set_netdev() fails when the property already has a non-null value. Seems to go back to commit 30c367ed44 "qdev-properties-system.c: Allow vlan or netdev for -device, not both", v1.7.0. Board code doesn't expect failure, and crashes: $ qemu-system-x86_64 --nodefaults -nic user -netdev user,id=nic0 -global e1000.netdev=nic0 Unexpected error in error_set_from_qdev_prop_error() at /work/armbru/qemu/hw/core/qdev-properties.c:1101: qemu-system-x86_64: Property 'e1000.netdev' doesn't take value '__org.qemu.nic0 ' Aborted (core dumped) -device and device_add handle the failure: $ qemu-system-x86_64 -nodefaults -netdev user,id=net0 -netdev user,id=net1 -device e1000,netdev=net0,netdev=net1 qemu-system-x86_64: -device e1000,netdev=net0,netdev=net1: Property 'e1000.netdev' doesn't take value 'net1' $ qemu-system-x86_64 -nodefaults -S -display none -monitor stdio -netdev user,id=net0 -netdev user,id=net1 -global e1000.netdev=net0 QEMU 5.0.50 monitor - type 'help' for more information (qemu) qemu-system-x86_64: warning: netdev net0 has no peer qemu-system-x86_64: warning: netdev net1 has no peer device_add e1000,netdev=net1 Error: Property 'e1000.netdev' doesn't take value 'net1' Perhaps netdev property override could be made to work. Perhaps it should. I'm not the right guy to figure this out. What I can do is improve the error message a bit: (qemu) device_add e1000,netdev=net1 Error: -global e1000.netdev=... conflicts with netdev=net1 Cc: Jason Wang <jasowang@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200622094227.1271650-11-armbru@redhat.com>
* qdev: Eliminate get_pointer(), set_pointer()Markus Armbruster2020-06-231-60/+35
| | | | | | | | | | | We stopped using get_pointer() and set_pointer() for netdev in commit 23120b13c6 "net: don't use set/get_pointer() in set/get_netdev()" (v2.3.0), and for chardev in commit becdfa00cf "char: replace PROP_CHR with CharBackend" (v2.8.0). With only the drive user left, they're not helpful anymore. Eliminate. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200622094227.1271650-10-armbru@redhat.com>
* fdc: Deprecate configuring floppies with -global isa-fdcMarkus Armbruster2020-06-231-0/+17
| | | | | | | | | | | | | | | | | | Deprecate -global isa-fdc.driveA=... -global isa-fdc.driveB=... in favour of -device floppy,unit=0,drive=... -device floppy,unit=1,drive=... Same for the other floppy controller devices. Signed-off-by: Markus Armbruster <armbru@redhat.com> Acked-by: John Snow <jsnow@redhat.com> Message-Id: <20200622094227.1271650-7-armbru@redhat.com>
* fdc: Open-code fdctrl_init_isa()Markus Armbruster2020-06-232-16/+6
| | | | | | | | | | Helper function fdctrl_init_isa() is less than helpful: one of three places creating "isa-fdc" devices use it. Open-code it there, and drop the function. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200622094227.1271650-6-armbru@redhat.com>
* fdc: Reject clash between -drive if=floppy and -global isa-fdcMarkus Armbruster2020-06-233-43/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The floppy controller devices desugar their drive properties into floppy devices (since commit a92bd191a4 "fdc: Move qdev properties to FloppyDrive", v2.8.0). This involves some bad magic in fdctrl_connect_drives(), and exists for backward compatibility. The functions for boards to create floppy controller devices fdctrl_init_isa(), fdctrl_init_sysbus(), and sun4m_fdctrl_init() desugar -drive if=floppy to these floppy controller drive properties. If you use both -drive if=floppy (or its -fda / -fdb sugar) and -global isa-fdc for the same floppy device, -global silently loses the conflict, and both backends involved end up with the floppy device frontend attached, as demonstrated by iotest 172 (see commit before previous). This is wrong. Desugar -drive if=floppy straight to floppy devices instead, with helper fdctrl_init_drives(). The conflict now gets rejected cleanly: first, fdctrl_connect_drives() creates the floppy for the controller's property, then fdctrl_init_drives() attempts to create the floppy for -drive if=floppy, but fails because the unit is already in use. Output of iotest 172 changes in three ways: 1. The clash gets rejected. 2. In one test case, "info qtree" has the floppy devices swapped, and "info block" has their QOM paths swapped. This is because the floppy device for -fda now gets created after the one for -global isa-fdc.driveB. 3. The error message for -global floppy.drive=floppy0 changes. Before the patch, we set isa-fdc.driveA to -fda's block backend, then create the floppy device for it, then move the backend from isa-fdc.driveA to floppy.drive. Floppy creation fails when applying -global floppy.drive=floppy0, because floppy0 is still attached to isa-fdc. After the patch, we create the floppy for -fda, then set its drive property to floppy0. Now floppy creation succeeds, but setting the drive property fails, because -global already set it. Yes, this is exasperatingly complicated. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200622094227.1271650-5-armbru@redhat.com>
* Merge remote-tracking branch ↵Peter Maydell2020-06-229-82/+1010
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/alistair/tags/pull-riscv-to-apply-20200619-3' into staging This is a range of patches for RISC-V. Some key points are: - Generalise the CPU init functions - Support the SiFive revB machine - Improvements to the Hypervisor implementation and error checking - Connect some OpenTitan devices - Changes to the sifive_u machine to support U-boot v2: - Fix missing realise assert # gpg: Signature made Fri 19 Jun 2020 17:34:34 BST # gpg: using RSA key F6C4AC46D4934868D3B8CE8F21E10D29DF977054 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [full] # Primary key fingerprint: F6C4 AC46 D493 4868 D3B8 CE8F 21E1 0D29 DF97 7054 * remotes/alistair/tags/pull-riscv-to-apply-20200619-3: (32 commits) hw/riscv: sifive_u: Add a dummy DDR memory controller device hw/riscv: sifive_u: Sort the SoC memmap table entries hw/riscv: sifive_u: Support different boot source per MSEL pin state hw/riscv: sifive: Change SiFive E/U CPU reset vector to 0x1004 target/riscv: Rename IBEX CPU init routine hw/riscv: sifive_u: Add a new property msel for MSEL pin state hw/riscv: sifive_u: Rename serial property get/set functions to a generic name hw/riscv: sifive_u: Add reset functionality hw/riscv: sifive_gpio: Do not blindly trigger output IRQs hw/riscv: sifive_u: Hook a GPIO controller hw/riscv: sifive_gpio: Add a new 'ngpio' property hw/riscv: sifive_gpio: Clean up the codes hw/riscv: sifive_u: Generate device tree node for OTP hw/riscv: sifive_u: Simplify the GEM IRQ connect code a little bit hw/riscv: opentitan: Remove the riscv_ prefix of the machine* and soc* functions hw/riscv: sifive_e: Remove the riscv_ prefix of the machine* and soc* functions target/riscv: Use a smaller guess size for no-MMU PMP riscv/opentitan: Connect the UART device riscv/opentitan: Connect the PLIC device hw/intc: Initial commit of lowRISC Ibex PLIC ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/riscv: sifive_u: Add a dummy DDR memory controller deviceBin Meng2020-06-191-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is enough to simply map the SiFive FU540 DDR memory controller into the MMIO space using create_unimplemented_device(), to make the upstream U-Boot v2020.07 DDR memory initialization codes happy. Note we do not generate device tree fragment for the DDR memory controller. Since the controller data in device tree consumes a very large space (see fu540-hifive-unleashed-a00-ddr.dtsi in the U-Boot source), and it is only needed by U-Boot SPL but not any operating system, we choose not to generate the fragment here. This also means when testing with U-Boot SPL, the device tree has to come from U-Boot SPL itself, but not the one generated by QEMU on the fly. The memory has to be set to 8GiB to match the real HiFive Unleashed board when invoking QEMU (-m 8G). With this commit, QEMU can boot U-Boot SPL built for SiFive FU540 all the way up to loading U-Boot proper from MMC: $ qemu-system-riscv64 -nographic -M sifive_u,msel=6 -m 8G -bios u-boot-spl.bin U-Boot SPL 2020.07-rc3-00208-g88bd5b1 (Jun 08 2020 - 20:16:10 +0800) Trying to boot from MMC1 Unhandled exception: Load access fault EPC: 0000000008009be6 TVAL: 0000000010050014 The above exception is expected because QSPI is unsupported yet. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1592268641-7478-6-git-send-email-bmeng.cn@gmail.com Message-Id: <1592268641-7478-6-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * hw/riscv: sifive_u: Sort the SoC memmap table entriesBin Meng2020-06-191-2/+2
| | | | | | | | | | | | | | | | | | | | Move the flash and DRAM to the end of the SoC memmap table. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1592268641-7478-5-git-send-email-bmeng.cn@gmail.com Message-Id: <1592268641-7478-5-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * hw/riscv: sifive_u: Support different boot source per MSEL pin stateBin Meng2020-06-191-8/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SiFive FU540 SoC supports booting from several sources, which are controlled using the Mode Select (MSEL[3:0]) pins on the chip. Typically, the boot process runs through several stages before it begins execution of user-provided programs. The SoC supports booting from memory-mapped QSPI flash, which is how start_in_flash property is used for at present. This matches MSEL = 1 configuration (QSPI0). Typical booting flows involve the Zeroth Stage Boot Loader (ZSBL). It's not necessary for QEMU to implement the full ZSBL ROM codes, because we know ZSBL downloads the next stage program into the L2 LIM at address 0x8000000 and executes from there. We can bypass the whole ZSBL execution and use "-bios" to load the next stage program directly if MSEL indicates a ZSBL booting flow. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1592268641-7478-4-git-send-email-bmeng.cn@gmail.com Message-Id: <1592268641-7478-4-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * hw/riscv: sifive: Change SiFive E/U CPU reset vector to 0x1004Bin Meng2020-06-192-7/+9
| | | | | | | | | | | | | | | | | | | | | | Per the SiFive manual, all E/U series CPU cores' reset vector is at 0x1004. Update our codes to match the hardware. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1592268641-7478-3-git-send-email-bmeng.cn@gmail.com Message-Id: <1592268641-7478-3-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * hw/riscv: sifive_u: Add a new property msel for MSEL pin stateBin Meng2020-06-191-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | On SiFive FU540 SoC, the value stored at physical address 0x1000 stores the MSEL pin state that is used to control the next boot location that ROM codes jump to. Add a new property msel to sifive_u machine for this. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591625864-31494-12-git-send-email-bmeng.cn@gmail.com Message-Id: <1591625864-31494-12-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * hw/riscv: sifive_u: Rename serial property get/set functions to a generic nameBin Meng2020-06-191-6/+8
| | | | | | | | | | | | | | | | | | | | | | In prepration to add more properties to this machine, rename the existing serial property get/set functions to a generic name. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591625864-31494-11-git-send-email-bmeng.cn@gmail.com Message-Id: <1591625864-31494-11-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * hw/riscv: sifive_u: Add reset functionalityBin Meng2020-06-191-1/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | The HiFive Unleashed board wires GPIO pin#10 to the input of the system reset signal. Let's set up the GPIO pin#10 and insert a "gpio-restart" device tree node so that reboot is now functional with QEMU 'sifive_u' machine. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591625864-31494-10-git-send-email-bmeng.cn@gmail.com Message-Id: <1591625864-31494-10-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * hw/riscv: sifive_gpio: Do not blindly trigger output IRQsBin Meng2020-06-191-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | At present the GPIO output IRQs are triggered each time any GPIO register is written. However this is not correct. We should only trigger the output IRQ when the pin is configured as output enable. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591625864-31494-9-git-send-email-bmeng.cn@gmail.com Message-Id: <1591625864-31494-9-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * hw/riscv: sifive_u: Hook a GPIO controllerBin Meng2020-06-191-2/+41
| | | | | | | | | | | | | | | | | | | | | | | | SiFive FU540 SoC integrates a GPIO controller with 16 GPIO lines. This hooks the exsiting SiFive GPIO model to the SoC, and adds its device tree data as well. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591625864-31494-8-git-send-email-bmeng.cn@gmail.com Message-Id: <1591625864-31494-8-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * hw/riscv: sifive_gpio: Add a new 'ngpio' propertyBin Meng2020-06-191-11/+19
| | | | | | | | | | | | | | | | | | | | | | Add a new property to represent the number of GPIO pins supported by the GPIO controller. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591625864-31494-7-git-send-email-bmeng.cn@gmail.com Message-Id: <1591625864-31494-7-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * hw/riscv: sifive_gpio: Clean up the codesBin Meng2020-06-191-8/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Do various minor clean-ups to the exisiting codes for: - coding convention conformance - remove unnecessary blank lines - spell SiFive correctly Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591625864-31494-6-git-send-email-bmeng.cn@gmail.com Message-Id: <1591625864-31494-6-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * hw/riscv: sifive_u: Generate device tree node for OTPBin Meng2020-06-191-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | Upstream U-Boot v2020.07 codes switch to access SiFive FU540 OTP based on device tree information. Let's generate the device tree node for OTP. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591625864-31494-5-git-send-email-bmeng.cn@gmail.com Message-Id: <1591625864-31494-5-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * hw/riscv: sifive_u: Simplify the GEM IRQ connect code a little bitBin Meng2020-06-191-6/+1
| | | | | | | | | | | | | | | | | | | | | | | | There is no need to retrieve all PLIC IRQ information in order to just connect the GEM IRQ. Use qdev_get_gpio_in() directly like what is done for other peripherals. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591625864-31494-4-git-send-email-bmeng.cn@gmail.com Message-Id: <1591625864-31494-4-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * hw/riscv: opentitan: Remove the riscv_ prefix of the machine* and soc* functionsBin Meng2020-06-191-15/+14
| | | | | | | | | | | | | | | | | | | | | | This was done in the virt & sifive_u codes, but opentitan codes were missed. Remove the riscv_ prefix of the machine* and soc* functions. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591625864-31494-3-git-send-email-bmeng.cn@gmail.com Message-Id: <1591625864-31494-3-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * hw/riscv: sifive_e: Remove the riscv_ prefix of the machine* and soc* functionsBin Meng2020-06-191-12/+12
| | | | | | | | | | | | | | | | | | | | | | This was done in the virt & sifive_u codes, but sifive_e codes were missed. Remove the riscv_ prefix of the machine* and soc* functions. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591625864-31494-2-git-send-email-bmeng.cn@gmail.com Message-Id: <1591625864-31494-2-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * riscv/opentitan: Connect the UART deviceAlistair Francis2020-06-191-2/+23
| | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
| * riscv/opentitan: Connect the PLIC deviceAlistair Francis2020-06-191-2/+12
| | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
| * hw/intc: Initial commit of lowRISC Ibex PLICAlistair Francis2020-06-192-0/+262
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The Ibex core contains a PLIC that although similar to the RISC-V spec is not RISC-V spec compliant. This patch implements a Ibex PLIC in a somewhat generic way. As the current RISC-V PLIC needs tidying up, my hope is that as the Ibex PLIC move towards spec compliance this PLIC implementation can be updated until it can replace the current PLIC. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
| * hw/char: Initial commit of Ibex UARTAlistair Francis2020-06-193-0/+497
| | | | | | | | | | | | | | | | | | | | | | This is the initial commit of the Ibex UART device. Serial TX is working, while RX has been implemeneted but untested. This is based on the documentation from: https://docs.opentitan.org/hw/ip/uart/doc/ Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: LIU Zhiwei<zhiwei_liu@c-sky.com>
| * riscv/opentitan: Fix the ROM sizeAlistair Francis2020-06-191-1/+2
| | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reported-by: Damien Hedde <damien.hedde@greensocs.com>
| * sifive_e: Support the revB machineAlistair Francis2020-06-191-4/+30
| | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* | Merge remote-tracking branch ↵Peter Maydell2020-06-192-2/+2
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/kraxel/tags/audio-20200619-pull-request' into staging audio: bugfixes for jack backend and gus emulation. # gpg: Signature made Fri 19 Jun 2020 14:17:22 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/audio-20200619-pull-request: hw/audio/gus: Fix registers 32-bit access audio/jack: simplify the re-init code path audio/jack: honour the enable state of the audio device audio/jack: do not remove ports when finishing audio/jack: remove invalid set of input support bool audio/jack: remove unused stopped state audio/jack: fix invalid minimum buffer size check Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/audio/gus: Fix registers 32-bit accessAllan Peramaki2020-06-192-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix audio on software that accesses DRAM above 64k via register peek/poke and some cases when more than 16 voices are used. Cc: qemu-stable@nongnu.org Fixes: 135f5ae1974c ("audio: GUSsample is int16_t") Signed-off-by: Allan Peramaki <aperamak@pp1.inet.fi> Tested-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200618103623.6031-1-philmd@redhat.com Message-Id: <20200615201757.16868-1-aperamak@pp1.inet.fi> [PMD: Removed unrelated style changes] Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20200618' into stagingPeter Maydell2020-06-193-38/+248
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | s390x update: - update Linux headers to 5.8-rc1 (for vfio-ccw path handling) - vfio-ccw: add support for path handling - documentation fix # gpg: Signature made Thu 18 Jun 2020 16:36:04 BST # gpg: using RSA key C3D0D66DC3624FF6A8C018CEDECF6B93C6F02FAF # gpg: issuer "cohuck@redhat.com" # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [marginal] # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full] # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full] # gpg: aka "Cornelia Huck <cohuck@kernel.org>" [marginal] # gpg: aka "Cornelia Huck <cohuck@redhat.com>" [marginal] # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20200618: docs/s390x: fix vfio-ap device_del description vfio-ccw: Add support for the CRW region and IRQ s390x/css: Refactor the css_queue_crw() routine vfio-ccw: Refactor ccw irq handler vfio-ccw: Add support for the schib region vfio-ccw: Refactor cleanup of regions Linux headers: update Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | vfio-ccw: Add support for the CRW region and IRQFarhan Ali2020-06-181-0/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The crw region can be used to obtain information about Channel Report Words (CRW) from vfio-ccw driver. Currently only channel-path related CRWs are passed to QEMU from vfio-ccw driver. Signed-off-by: Farhan Ali <alifm@linux.ibm.com> Signed-off-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200505125757.98209-7-farman@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
| * | s390x/css: Refactor the css_queue_crw() routineEric Farman2020-06-181-15/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We have a use case (vfio-ccw) where a CRW is already built and ready to use. Rather than teasing out the components just to reassemble it later, let's rework this code so we can queue a fully-qualified CRW directly. Signed-off-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200505125757.98209-6-farman@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
| * | vfio-ccw: Refactor ccw irq handlerEric Farman2020-06-181-16/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | Make it easier to add new ones in the future. Signed-off-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200505125757.98209-5-farman@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
| * | vfio-ccw: Add support for the schib regionFarhan Ali2020-06-183-2/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The schib region can be used to obtain the latest SCHIB from the host passthrough subchannel. Since the guest SCHIB is virtualized, we currently only update the path related information so that the guest is aware of any path related changes when it issues the 'stsch' instruction. Signed-off-by: Farhan Ali <alifm@linux.ibm.com> Signed-off-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200505125757.98209-4-farman@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
| * | vfio-ccw: Refactor cleanup of regionsEric Farman2020-06-181-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While we're at it, add a g_free() for the async_cmd_region that is the last thing currently created. g_free() knows how to handle NULL pointers, so this makes it easier to remember what cleanups need to be performed when new regions are added. Signed-off-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200505125757.98209-3-farman@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* | | Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell2020-06-187-248/+625
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging # gpg: Signature made Thu 18 Jun 2020 14:16:22 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: (33 commits) net: Drop the NetLegacy structure, always use Netdev instead net: Drop the legacy "name" parameter from the -net option hw/net/e1000e: Do not abort() on invalid PSRCTL register value colo-compare: Fix memory leak in packet_enqueue() net/colo-compare.c: Correct ordering in complete and finalize net/colo-compare.c: Check that colo-compare is active net/colo-compare.c: Only hexdump packets if tracing is enabled net/colo-compare.c: Fix deadlock in compare_chr_send chardev/char.c: Use qemu_co_sleep_ns if in coroutine net/colo-compare.c: Create event_bh with the right AioContext net: use peer when purging queue in qemu_flush_or_purge_queue_packets() net: cadence_gem: Fix RX address filtering net: cadence_gem: TX_LAST bit should be set by guest net: cadence_gem: Update the reset value for interrupt mask register net: cadnece_gem: Update irq_read_clear field of designcfg_debug1 reg net: cadence_gem: Add support for jumbo frames net: cadence_gem: Fix up code style net: cadence_gem: Move tx/rx packet buffert to CadenceGEMState net: cadence_gem: Set ISR according to queue in use net: cadence_gem: Define access permission for interrupt registers ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | hw/net/e1000e: Do not abort() on invalid PSRCTL register valuePhilippe Mathieu-Daudé2020-06-181-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | libFuzzer found using 'qemu-system-i386 -M q35': qemu: hardware error: e1000e: PSRCTL.BSIZE0 cannot be zero CPU #0: EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000663 ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000 EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 00000000 0000ffff 00009300 CS =f000 ffff0000 0000ffff 00009b00 SS =0000 00000000 0000ffff 00009300 DS =0000 00000000 0000ffff 00009300 FS =0000 00000000 0000ffff 00009300 GS =0000 00000000 0000ffff 00009300 LDT=0000 00000000 0000ffff 00008200 TR =0000 00000000 0000ffff 00008b00 GDT= 00000000 0000ffff IDT= 00000000 0000ffff CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000 DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000 DR6=ffff0ff0 DR7=00000400 EFER=0000000000000000 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000 XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 ==1988== ERROR: libFuzzer: deadly signal #6 0x7fae4d3ea894 in __GI_abort (/lib64/libc.so.6+0x22894) #7 0x563f4cc59a1d in hw_error (qemu-fuzz-i386+0xe8ca1d) #8 0x563f4d7c93f2 in e1000e_set_psrctl (qemu-fuzz-i386+0x19fc3f2) #9 0x563f4d7b798f in e1000e_core_write (qemu-fuzz-i386+0x19ea98f) #10 0x563f4d7afc46 in e1000e_mmio_write (qemu-fuzz-i386+0x19e2c46) #11 0x563f4cc9a0a7 in memory_region_write_accessor (qemu-fuzz-i386+0xecd0a7) #12 0x563f4cc99c13 in access_with_adjusted_size (qemu-fuzz-i386+0xeccc13) #13 0x563f4cc987b4 in memory_region_dispatch_write (qemu-fuzz-i386+0xecb7b4) It simply sent the following 2 I/O command to the e1000e PCI BAR #2 I/O region: writew 0x0100 0x0c00 # RCTL = E1000_RCTL_DTYP_MASK writeb 0x2170 0x00 # PSRCTL = 0 2813 static void 2814 e1000e_set_psrctl(E1000ECore *core, int index, uint32_t val) 2815 { 2816 if (core->mac[RCTL] & E1000_RCTL_DTYP_MASK) { 2817 2818 if ((val & E1000_PSRCTL_BSIZE0_MASK) == 0) { 2819 hw_error("e1000e: PSRCTL.BSIZE0 cannot be zero"); 2820 } Instead of calling hw_error() which abort the process (it is meant for CPU fatal error condition, not for device logging), log the invalid request with qemu_log_mask(LOG_GUEST_ERROR) and return, ignoring the request. Cc: qemu-stable@nongnu.org Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * | | net: cadence_gem: Fix RX address filteringTong Ho2020-06-181-15/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two defects are fixed: 1/ Detection of multicast frames 2/ Treating drop of mis-addressed frames as non-error Signed-off-by: Tong Ho <tong.ho@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * | | net: cadence_gem: TX_LAST bit should be set by guestSai Pavan Boddu2020-06-181-6/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TX_LAST bit should not be set by hardware, its set by guest to inform the last bd of the frame. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * | | net: cadence_gem: Update the reset value for interrupt mask registerSai Pavan Boddu2020-06-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Mask all interrupt on reset. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * | | net: cadnece_gem: Update irq_read_clear field of designcfg_debug1 regSai Pavan Boddu2020-06-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Advertise support of clear-on-read for ISR registers. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * | | net: cadence_gem: Add support for jumbo framesSai Pavan Boddu2020-06-181-5/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a property "jumbo-max-len", which sets default value of jumbo frames up to 16,383 bytes. Add Frame length checks for standard and jumbo frames. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * | | net: cadence_gem: Fix up code styleSai Pavan Boddu2020-06-181-101/+103
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the code style for register definitions. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * | | net: cadence_gem: Move tx/rx packet buffert to CadenceGEMStateSai Pavan Boddu2020-06-181-21/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Moving this buffers to CadenceGEMState, as their size will be increased more when JUMBO frames support is added. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * | | net: cadence_gem: Set ISR according to queue in useSai Pavan Boddu2020-06-181-10/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Set ISR according to queue in use, added interrupt support for all queues. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * | | net: cadence_gem: Define access permission for interrupt registersSai Pavan Boddu2020-06-181-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Q1 to Q7 ISR's are clear-on-read, IER/IDR registers are write-only, mask reg are read-only. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>