OSDN Git Service
Paolo Bonzini [Fri, 23 Oct 2020 12:34:54 +0000 (08:34 -0400)]
Makefile: separate meson rerun from the rest of the ninja invocation
The rules to build Makefile.mtest are suffering from the "tunnel vision"
problem that is common with recursive makefiles. Makefile.mtest depends
on build.ninja, but Make does not know when build.ninja needs to be
rebuilt before creating Makefile.mtest.
To fix this, separate the ninja invocation into the "regenerate build
files" phase and the QEMU build phase. Sentinel files such as
meson-private/coredata.dat or build.ninja are used to figure out the
phases that haven't run yet; however, because those files' timestamps
are not guaranteed to be touched, the usual makefile stamp-file trick
is used on top.
Reported-by: Havard Skinnemoen <hskinnemoen@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Thomas Huth [Tue, 20 Oct 2020 16:05:04 +0000 (18:05 +0200)]
Remove deprecated -no-kvm option
The option has never been mentioned in our documentation, it's been
deprecated since years, it's marked with QEMU_ARCH_I386 (which does
not make sense anymore since KVM is available on other architectures,
too), it does not do anything by default in upstream QEMU (since TCG
is the default here anyway), and we're spending too much precious time
each year discussing whether it makes sense to keep this option as a
nice suger or not... let's finally put an end on this and remove it.
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <
20201020160504.62460-1-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Claudio Fontana [Tue, 13 Oct 2020 19:21:23 +0000 (21:21 +0200)]
replay: do not build if TCG is not available
this fixes non-TCG builds broken recently by replay reverse debugging.
Stub the needed functions in stub/, splitting roughly between functions
needed only by system emulation, by system emulation and tools,
and by everyone. This includes duplicating some code in replay/, and
puts the logic for non-replay related events in the replay/ module (+
the stubs), so this should be revisited in the future.
Surprisingly, only _one_ qtest was affected by this, ide-test.c, which
resulted in a buzz as the bh events were never delivered, and the bh
never executed.
Many other subsystems _should_ have been affected.
This fixes the immediate issue, however a better way to group replay
functionality to TCG-only code could be developed in the long term.
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Message-Id: <
20201013192123.22632-4-cfontana@suse.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Claudio Fontana [Tue, 13 Oct 2020 19:21:22 +0000 (21:21 +0200)]
qtest: unbreak non-TCG builds in bios-tables-test
the tests assume TCG is available, thus breaking
for TCG-only tests, where only the TCG accelerator option
is passed to the QEMU binary.
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Message-Id: <
20201013192123.22632-3-cfontana@suse.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Luc Michel [Tue, 20 Oct 2020 09:10:24 +0000 (11:10 +0200)]
hw/core/qdev-clock: add a reference on aliased clocks
When aliasing a clock with the qdev_alias_clock() function, a new link
property is created on the device aliasing the clock. The link points
to the aliased clock and use the OBJ_PROP_LINK_STRONG flag. This
property is read only since it does not provide a check callback for
modifications.
The object_property_add_link() documentation stats that with
OBJ_PROP_LINK_STRONG properties, the linked object reference count get
decremented when the property is deleted. But it is _not_ incremented on
creation (object_property_add_link() does not actually know the link).
This commit increments the reference count on the aliased clock to
ensure the aliased clock stays alive during the property lifetime, and
to avoid a double-free memory error when the property gets deleted.
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Luc Michel <luc@lmichel.fr>
Message-Id: <
20201020091024.320381-1-luc@lmichel.fr>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini [Mon, 19 Oct 2020 10:22:43 +0000 (06:22 -0400)]
do not use colons in test names
Starting with meson 0.56, colons are used to separate the subproject name
from the test name. Use dash or slash depending on what looks nicer.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini [Mon, 19 Oct 2020 08:42:11 +0000 (04:42 -0400)]
meson: rewrite curses/iconv test
Redo the curses test to do the same tests that the configure
check used to do. OpenBSD triggers the warning because
it does not support NCURSES_WIDECHAR and thus the cc.links
test fails.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini [Tue, 20 Oct 2020 09:18:17 +0000 (05:18 -0400)]
build: fix macOS --enable-modules build
Apple's nm implementation includes empty lines in the output that are not
found in GNU binutils. This confuses scripts/undefsym.py, though it did
not confuse the scripts/undefsym.sh script that it replaced. To fix
this, ignore lines that do not have two fields.
Reported-by: Emmanuel Blot <eblot.ml@gmail.com>
Tested-by: Emmanuel Blot <eblot.ml@gmail.com>
Fixes:
604f3e4e90 ("meson: Convert undefsym.sh to undefsym.py", 2020-09-08)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Peter Maydell [Thu, 22 Oct 2020 11:33:20 +0000 (12:33 +0100)]
Merge remote-tracking branch 'remotes/kraxel/tags/modules-
20201022-pull-request' into staging
modules: build spice and opengl as module.
# gpg: Signature made Thu 22 Oct 2020 06:12:03 BST
# gpg: using RSA key
4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138
* remotes/kraxel/tags/modules-
20201022-pull-request:
opengl: build opengl helper code modular
opengl: build egl-headless display modular
spice: flip modules switch
modules: add spice dependencies
modules: dependencies infrastructure
spice: load module when enabled on the cmdline
spice: wire up monitor in QemuSpiceOps.
spice: move display_add_client() to QemuSpiceOps.
spice: move auth functions to QemuSpiceOps.
spice: move add_interface() to QemuSpiceOps.
spice: move display_init() to QemuSpiceOps.
spice: move qemu_spice_init() to QemuSpiceOps.
spice: add QemuSpiceOps, move migrate_info
spice: add module helpers
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Thu, 22 Oct 2020 10:13:24 +0000 (11:13 +0100)]
Merge remote-tracking branch 'remotes/philmd-gitlab/tags/sd-next-
20201021' into staging
SD/MMC patches
Fix two heap-overflow reported by Alexander Bulekov while fuzzing:
- https://bugs.launchpad.net/qemu/+bug/
1892960
- https://bugs.launchpad.net/qemu/+bug/
1895310
CI jobs results:
. https://cirrus-ci.com/build/
6399328187056128
. https://gitlab.com/philmd/qemu/-/pipelines/
205701966
. https://travis-ci.org/github/philmd/qemu/builds/
737708930
# gpg: Signature made Wed 21 Oct 2020 18:33:08 BST
# gpg: using RSA key
FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE
* remotes/philmd-gitlab/tags/sd-next-
20201021:
hw/sd/sdcard: Assert if accessing an illegal group
hw/sd/sdcard: Do not attempt to erase out of range addresses
hw/sd/sdcard: Reset both start/end addresses on error
hw/sd/sdcard: Do not use legal address '0' for INVALID_ADDRESS
hw/sd/sdcard: Introduce the INVALID_ADDRESS definition
hw/sd/sdcard: Add trace event for ERASE command (CMD38)
hw/sd/sdhci: Yield if interrupt delivered during multiple transfer
hw/sd/sdhci: Let sdhci_update_irq() return if IRQ was delivered
hw/sd/sdhci: Resume pending DMA transfers on MMIO accesses
hw/sd/sdhci: Stop multiple transfers when block count is cleared
hw/sd/sdhci: Fix DMA Transfer Block Size field
hw/sd/sdhci: Document the datasheet used
hw/sd/sdhci: Fix qemu_log_mask() format string
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Wed, 21 Oct 2020 20:45:46 +0000 (21:45 +0100)]
Merge remote-tracking branch 'remotes/kraxel/tags/microvm-
20201021-pull-request' into staging
microvm: fix PCIe IRQs in APIC table.
microvm: add usb support.
# gpg: Signature made Wed 21 Oct 2020 15:48:00 BST
# gpg: using RSA key
4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138
* remotes/kraxel/tags/microvm-
20201021-pull-request:
tests/acpi: update expected data files
tests/acpi: add microvm rtc test
tests/acpi: add microvm usb test
tests/acpi: add empty tests/data/acpi/microvm/DSDT.{usb, rtc} files
tests/acpi: allow updates for expected data files
microvm: add usb support
usb/xhci: fixup xhci kconfig deps
usb/xhci: add xhci_sysbus_build_aml() helper
usb/xhci: add include/hw/usb/xhci.h header file
acpi: add aml builder stubs
tests/acpi: disallow changes for microvm/APIC.pcie
tests/acpi: update expected data files
apci: drop has_pci arg for acpi_build_madt
microvm: set pci_irq_mask
x86: make pci irqs runtime configurable
tests/acpi: add empty microvm/APIC.pcie
tests/acpi: allow changes for microvm/APIC.pcie
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Wed, 21 Oct 2020 15:56:35 +0000 (16:56 +0100)]
Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2020-10-21' into staging
QAPI patches patches for 2020-10-21
# gpg: Signature made Wed 21 Oct 2020 04:01:41 BST
# gpg: using RSA key
354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg: issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full]
# gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full]
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653
* remotes/armbru/tags/pull-qapi-2020-10-21:
qapi: Restrict Xen migration commands to migration.json
qapi: Restrict 'query-kvm' command to machine code
qapi: Restrict '(p)memsave' command to machine code
qapi: Restrict 'system wakeup/reset/powerdown' commands to machine.json
qapi: Restrict 'inject-nmi' command to machine code
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Gerd Hoffmann [Mon, 19 Oct 2020 07:52:24 +0000 (09:52 +0200)]
opengl: build opengl helper code modular
Removes opengl dependency from core qemu. The number of shared
libraries for qemu-system-x86_64 goes down from 66 to 60 on my system.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id:
20201019075224.14803-15-kraxel@redhat.com
Gerd Hoffmann [Mon, 19 Oct 2020 07:52:23 +0000 (09:52 +0200)]
opengl: build egl-headless display modular
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id:
20201019075224.14803-14-kraxel@redhat.com
Gerd Hoffmann [Mon, 19 Oct 2020 07:52:22 +0000 (09:52 +0200)]
spice: flip modules switch
Build spice core code as module. This removes libspice-server and a
handful of indirect dependencies from core qemu. The number of shared
libraries for qemu-system-x86_64 goes down from 73 to 66 on my system.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id:
20201019075224.14803-13-kraxel@redhat.com
Gerd Hoffmann [Mon, 19 Oct 2020 07:52:21 +0000 (09:52 +0200)]
modules: add spice dependencies
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id:
20201019075224.14803-12-kraxel@redhat.com
Gerd Hoffmann [Mon, 19 Oct 2020 07:52:20 +0000 (09:52 +0200)]
modules: dependencies infrastructure
Allow modules depending on other modules.
module_load_file() gets the option to export symbols (by not adding the
G_MODULE_BIND_LOCAL flag).
module_load_one() will check the module dependency list to figure (a)
whenever are other modules must be loaded first, or (b) the module
should export the symbols.
The dependencies are specificed as static list in the source code for
now as I expect the list will stay small.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id:
20201019075224.14803-11-kraxel@redhat.com
Gerd Hoffmann [Mon, 19 Oct 2020 07:52:19 +0000 (09:52 +0200)]
spice: load module when enabled on the cmdline
In case the spice opts are not registered, try loading the spice module.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id:
20201019075224.14803-10-kraxel@redhat.com
Gerd Hoffmann [Mon, 19 Oct 2020 07:52:18 +0000 (09:52 +0200)]
spice: wire up monitor in QemuSpiceOps.
Rename qmp_query_spice() to qmp_query_spice_real(), add to QemuSpiceOps.
Add new qmp_query_spice() function which calls the real function via
QemuSpiceOps if available, otherwise return SpiceInfo.enabled = false.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id:
20201019075224.14803-9-kraxel@redhat.com
Gerd Hoffmann [Mon, 19 Oct 2020 07:52:17 +0000 (09:52 +0200)]
spice: move display_add_client() to QemuSpiceOps.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id:
20201019075224.14803-8-kraxel@redhat.com
Gerd Hoffmann [Mon, 19 Oct 2020 07:52:16 +0000 (09:52 +0200)]
spice: move auth functions to QemuSpiceOps.
Move qemu_spice_set_passwd() and qemu_spice_set_pw_expire() functions to
QemuSpiceOps.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id:
20201019075224.14803-7-kraxel@redhat.com
Gerd Hoffmann [Mon, 19 Oct 2020 07:52:15 +0000 (09:52 +0200)]
spice: move add_interface() to QemuSpiceOps.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id:
20201019075224.14803-6-kraxel@redhat.com
Gerd Hoffmann [Mon, 19 Oct 2020 07:52:14 +0000 (09:52 +0200)]
spice: move display_init() to QemuSpiceOps.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id:
20201019075224.14803-5-kraxel@redhat.com
Gerd Hoffmann [Mon, 19 Oct 2020 07:52:13 +0000 (09:52 +0200)]
spice: move qemu_spice_init() to QemuSpiceOps.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id:
20201019075224.14803-4-kraxel@redhat.com
Gerd Hoffmann [Mon, 19 Oct 2020 07:52:12 +0000 (09:52 +0200)]
spice: add QemuSpiceOps, move migrate_info
Add QemuSpiceOps struct. This struct holds function pointers to the
spice functions. It will be initialized with pointers to the stub
functions. When spice gets initialized the function pointers will
be re-written to the real functions.
The spice stubs will move from qemu-spice.h to spice-module.c for that,
because they will be needed for both "CONFIG_SPICE=n" and "CONFIG_SPICE=y
but spice module not loaded" cases.
This patch adds the infrastructure and starts with moving
qemu_spice_migrate_info() to QemuSpiceOps.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id:
20201019075224.14803-3-kraxel@redhat.com
Gerd Hoffmann [Mon, 19 Oct 2020 07:52:11 +0000 (09:52 +0200)]
spice: add module helpers
Add new spice-module.c + qemu-spice-module.h files. The code needed to
support modular spice will be there. For starters this will be only the
using_spice variable, more will follow ...
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id:
20201019075224.14803-2-kraxel@redhat.com
Philippe Mathieu-Daudé [Fri, 18 Sep 2020 17:14:52 +0000 (19:14 +0200)]
hw/sd/sdcard: Assert if accessing an illegal group
We can not have more group than 'wpgrps_size'.
Assert if we are accessing a group above this limit.
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <
20201015063824.212980-7-f4bug@amsat.org>
Philippe Mathieu-Daudé [Sun, 13 Sep 2020 11:18:52 +0000 (13:18 +0200)]
hw/sd/sdcard: Do not attempt to erase out of range addresses
While the Spec v3 is not very clear, v6 states:
If the host provides an out of range address as an argument
to CMD32 or CMD33, the card shall indicate OUT_OF_RANGE error
in R1 (ERX) for CMD38.
If an address is out of range, do not attempt to erase it:
return R1 with the error bit set.
Buglink: https://bugs.launchpad.net/qemu/+bug/1895310
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <
20201015063824.212980-6-f4bug@amsat.org>
Philippe Mathieu-Daudé [Sun, 13 Sep 2020 11:18:31 +0000 (13:18 +0200)]
hw/sd/sdcard: Reset both start/end addresses on error
From the Spec "4.3.5 Erase":
The host should adhere to the following command
sequence: ERASE_WR_BLK_START, ERASE_WR_BLK_END and
ERASE (CMD38).
If an erase (CMD38) or address setting (CMD32, 33)
command is received out of sequence, the card shall
set the ERASE_SEQ_ERROR bit in the status register
and reset the whole sequence.
Reset both addresses if the ERASE command occured
out of sequence (one of the start/end address is
not set).
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <
20201015063824.212980-5-f4bug@amsat.org>
Philippe Mathieu-Daudé [Fri, 18 Sep 2020 17:06:41 +0000 (19:06 +0200)]
hw/sd/sdcard: Do not use legal address '0' for INVALID_ADDRESS
As it is legal to WRITE/ERASE the address/block 0,
change the value of this definition to an illegal
address: UINT32_MAX.
Unfortunately this break the migration stream, so
bump the VMState version number. This affects some
ARM boards and the SDHCI_PCI device (which is only
used for testing).
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <
20201015063824.212980-4-f4bug@amsat.org>
Philippe Mathieu-Daudé [Fri, 18 Sep 2020 17:05:20 +0000 (19:05 +0200)]
hw/sd/sdcard: Introduce the INVALID_ADDRESS definition
'0' is used as a value to indicate an invalid (or unset)
address. Use a definition instead of a magic value.
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <
20201015063824.212980-3-f4bug@amsat.org>
Philippe Mathieu-Daudé [Sun, 13 Sep 2020 11:18:19 +0000 (13:18 +0200)]
hw/sd/sdcard: Add trace event for ERASE command (CMD38)
Trace addresses provided to the ERASE command.
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <
20201015063824.212980-2-f4bug@amsat.org>
Philippe Mathieu-Daudé [Thu, 3 Sep 2020 15:31:04 +0000 (17:31 +0200)]
hw/sd/sdhci: Yield if interrupt delivered during multiple transfer
The Descriptor Table has a bit to allow the DMA to generates
Interrupt when the operation of the descriptor line is completed
(see "1.13.4. Descriptor Table" of 'SD Host Controller Simplified
Specification Version 2.00').
If we have pending interrupt and the descriptor requires it
to be generated as soon as it is completed, reschedule pending
transfers and yield to the CPU.
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <
20200903172806.489710-5-f4bug@amsat.org>
Philippe Mathieu-Daudé [Thu, 3 Sep 2020 16:48:36 +0000 (18:48 +0200)]
hw/sd/sdhci: Let sdhci_update_irq() return if IRQ was delivered
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <
20200903172806.489710-4-f4bug@amsat.org>
Philippe Mathieu-Daudé [Thu, 3 Sep 2020 17:00:04 +0000 (19:00 +0200)]
hw/sd/sdhci: Resume pending DMA transfers on MMIO accesses
If we have pending DMA requests scheduled, process them first.
So far we don't need to implement a bottom half to process them.
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <
20200903172806.489710-3-f4bug@amsat.org>
Philippe Mathieu-Daudé [Thu, 3 Sep 2020 16:05:41 +0000 (18:05 +0200)]
hw/sd/sdhci: Stop multiple transfers when block count is cleared
Clearing BlockCount stops multiple transfers.
See "SD Host Controller Simplified Specification Version 2.00":
- 2.2.3. Block Count Register (Offset 006h)
- Table 2-8 : Determination of Transfer Type
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <
20200903172806.489710-2-f4bug@amsat.org>
Philippe Mathieu-Daudé [Tue, 1 Sep 2020 13:22:06 +0000 (15:22 +0200)]
hw/sd/sdhci: Fix DMA Transfer Block Size field
The 'Transfer Block Size' field is 12-bit wide.
See section '2.2.2. Block Size Register (Offset 004h)' in datasheet.
Two different bug reproducer available:
- https://bugs.launchpad.net/qemu/+bug/
1892960
- https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Fsdhci_oob_write1
Cc: qemu-stable@nongnu.org
Buglink: https://bugs.launchpad.net/qemu/+bug/1892960
Fixes:
d7dfca0807a ("hw/sdhci: introduce standard SD host controller")
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <
20200901140411.112150-3-f4bug@amsat.org>
Philippe Mathieu-Daudé [Tue, 1 Sep 2020 13:23:14 +0000 (15:23 +0200)]
hw/sd/sdhci: Document the datasheet used
Add datasheet name in the file header.
We can not add the direct download link since there is a disclaimers
to agree first on the SD Association website (www.sdcard.org).
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <
20200901140411.112150-3-f4bug@amsat.org>
Philippe Mathieu-Daudé [Tue, 1 Sep 2020 13:21:54 +0000 (15:21 +0200)]
hw/sd/sdhci: Fix qemu_log_mask() format string
Add missing newline character in qemu_log_mask() format.
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <
20200901140411.112150-2-f4bug@amsat.org>
Peter Maydell [Wed, 21 Oct 2020 10:09:13 +0000 (11:09 +0100)]
Merge remote-tracking branch 'remotes/jsnow-gitlab/tags/python-pull-request' into staging
Pull request
# gpg: Signature made Tue 20 Oct 2020 20:04:54 BST
# gpg: using RSA key
F9B7ABDBBCACDF95BE76CBD07DEF8106AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" [full]
# Primary key fingerprint: FAEB 9711 A12C F475 812F 18F2 88A9 064D 1835 61EB
# Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76 CBD0 7DEF 8106 AAFC 390E
* remotes/jsnow-gitlab/tags/python-pull-request: (21 commits)
python/qemu/qmp.py: Fix settimeout operation
python/qemu/qmp.py: re-raise OSError when encountered
python: add mypy config
python/qemu/qmp.py: Preserve error context on re-raise
python/qemu/console_socket.py: avoid encoding to/from string
python/qemu/console_socket.py: Add type hint annotations
python/qemu/console_socket.py: Clarify type of drain_thread
python/qemu/console_socket.py: fix typing of settimeout
python/qemu/console_socket.py: Correct type of recv()
python/qemu: Add mypy type annotations
iotests.py: Adjust HMP kwargs typing
python/qemu: make 'args' style arguments immutable
python/machine.py: fix _popen access
python/machine.py: Add _qmp access shim
python/machine.py: use qmp.command
python/machine.py: Handle None events in events_wait
python/machine.py: Don't modify state in _base_args()
python/machine.py: reorder __init__
python/machine.py: Fix monitor address typing
python/qemu: use isort to lay out imports
...
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Gerd Hoffmann [Tue, 20 Oct 2020 07:48:44 +0000 (09:48 +0200)]
tests/acpi: update expected data files
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201020074844.5304-11-kraxel@redhat.com
Gerd Hoffmann [Tue, 20 Oct 2020 07:48:43 +0000 (09:48 +0200)]
tests/acpi: add microvm rtc test
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201020074844.5304-10-kraxel@redhat.com
Gerd Hoffmann [Tue, 20 Oct 2020 07:48:42 +0000 (09:48 +0200)]
tests/acpi: add microvm usb test
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201020074844.5304-9-kraxel@redhat.com
Gerd Hoffmann [Tue, 20 Oct 2020 07:48:41 +0000 (09:48 +0200)]
tests/acpi: add empty tests/data/acpi/microvm/DSDT.{usb, rtc} files
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201020074844.5304-8-kraxel@redhat.com
Gerd Hoffmann [Tue, 20 Oct 2020 07:48:40 +0000 (09:48 +0200)]
tests/acpi: allow updates for expected data files
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201020074844.5304-7-kraxel@redhat.com
Gerd Hoffmann [Tue, 20 Oct 2020 07:48:39 +0000 (09:48 +0200)]
microvm: add usb support
Wire up "usb=on" machine option, when enabled add
a sysbus xhci controller with 8 ports.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201020074844.5304-6-kraxel@redhat.com
Gerd Hoffmann [Tue, 20 Oct 2020 07:48:38 +0000 (09:48 +0200)]
usb/xhci: fixup xhci kconfig deps
USB_XHCI does not depend on PCI any more.
USB_XHCI_SYSBUS must select USB_XHCI not USB.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Message-id:
20201020074844.5304-5-kraxel@redhat.com
Gerd Hoffmann [Tue, 20 Oct 2020 07:48:37 +0000 (09:48 +0200)]
usb/xhci: add xhci_sysbus_build_aml() helper
The helper generates an acpi dsdt device entry
for the xhci sysbus device.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201020074844.5304-4-kraxel@redhat.com
Gerd Hoffmann [Tue, 20 Oct 2020 07:48:36 +0000 (09:48 +0200)]
usb/xhci: add include/hw/usb/xhci.h header file
Move a bunch of defines which might be needed outside core xhci
code to that place. Add XHCI_ prefixes to avoid name clashes.
No functional change.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Message-id:
20201020074844.5304-3-kraxel@redhat.com
Gerd Hoffmann [Tue, 20 Oct 2020 07:48:35 +0000 (09:48 +0200)]
acpi: add aml builder stubs
Add stubs for aml_interrupt and aml_memory32_fixed,
these will be needed by followup patches,
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201020074844.5304-2-kraxel@redhat.com
Gerd Hoffmann [Fri, 16 Oct 2020 11:38:35 +0000 (13:38 +0200)]
tests/acpi: disallow changes for microvm/APIC.pcie
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201016113835.17465-8-kraxel@redhat.com
Gerd Hoffmann [Fri, 16 Oct 2020 11:38:34 +0000 (13:38 +0200)]
tests/acpi: update expected data files
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201016113835.17465-7-kraxel@redhat.com
Gerd Hoffmann [Fri, 16 Oct 2020 11:38:33 +0000 (13:38 +0200)]
apci: drop has_pci arg for acpi_build_madt
Setting x86ms->pci_irq_mask to zero has the same effect,
so we don't need the has_pci argument any more.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201016113835.17465-6-kraxel@redhat.com
Gerd Hoffmann [Fri, 16 Oct 2020 11:38:32 +0000 (13:38 +0200)]
microvm: set pci_irq_mask
Makes sure the PCI interrupt overrides are added to the
APIC table in case PCIe is enabled.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201016113835.17465-5-kraxel@redhat.com
Gerd Hoffmann [Fri, 16 Oct 2020 11:38:31 +0000 (13:38 +0200)]
x86: make pci irqs runtime configurable
Add a variable to x86 machine state instead of
hard-coding the PCI interrupts.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201016113835.17465-4-kraxel@redhat.com
Gerd Hoffmann [Fri, 16 Oct 2020 11:38:30 +0000 (13:38 +0200)]
tests/acpi: add empty microvm/APIC.pcie
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201016113835.17465-3-kraxel@redhat.com
Gerd Hoffmann [Fri, 16 Oct 2020 11:38:29 +0000 (13:38 +0200)]
tests/acpi: allow changes for microvm/APIC.pcie
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id:
20201016113835.17465-2-kraxel@redhat.com
Philippe Mathieu-Daudé [Mon, 12 Oct 2020 12:15:36 +0000 (14:15 +0200)]
qapi: Restrict Xen migration commands to migration.json
Restricting xen-set-global-dirty-log and xen-load-devices-state
commands migration.json pulls slightly less QAPI-generated code
into user-mode and tools.
Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <
20201012121536.
3381997-6-philmd@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Philippe Mathieu-Daudé [Mon, 12 Oct 2020 12:15:35 +0000 (14:15 +0200)]
qapi: Restrict 'query-kvm' command to machine code
Restricting query-kvm to machine.json pulls slightly
less QAPI-generated code into user-mode and tools.
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <
20201012121536.
3381997-5-philmd@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Philippe Mathieu-Daudé [Mon, 12 Oct 2020 12:15:34 +0000 (14:15 +0200)]
qapi: Restrict '(p)memsave' command to machine code
Restricting memsave/pmemsave to machine.json pulls slightly
less QAPI-generated code into user-mode and tools.
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <
20201012121536.
3381997-4-philmd@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Philippe Mathieu-Daudé [Mon, 12 Oct 2020 12:15:33 +0000 (14:15 +0200)]
qapi: Restrict 'system wakeup/reset/powerdown' commands to machine.json
Restricting system_wakeup/system_reset/system_powerdown to
machine.json pulls slightly less QAPI-generated code into
user-mode and tools.
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <
20201012121536.
3381997-3-philmd@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Philippe Mathieu-Daudé [Mon, 12 Oct 2020 12:15:32 +0000 (14:15 +0200)]
qapi: Restrict 'inject-nmi' command to machine code
Restricting 'inject-nmi' to machine.json pulls slightly
less QAPI-generated code into user-mode and tools.
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <
20201012121536.
3381997-2-philmd@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Peter Maydell [Tue, 20 Oct 2020 20:11:35 +0000 (21:11 +0100)]
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-
20201020-1' into staging
target-arm queue:
* Fix AArch32 SMLAD incorrect setting of Q bit
* AArch32 VCVT fixed-point to float is always round-to-nearest
* strongarm: Fix 'time to transmit a char' unit comment
* Restrict APEI tables generation to the 'virt' machine
* bcm2835: minor code cleanups
* bcm2835: connect all IRQs from SYS_timer device
* correctly flush TLBs when TBI is enabled
* tests/qtest: Add npcm7xx timer test
* loads-stores.rst: add footnote that clarifies GETPC usage
* Fix reported EL for mte_check_fail
* Ignore HCR_EL2.ATA when {E2H,TGE} != 11
* microbit_i2c: Fix coredump when dump-vmstate
* nseries: Fix loading kernel image on n8x0 machines
* Implement v8.1M low-overhead-loops
# gpg: Signature made Tue 20 Oct 2020 21:10:35 BST
# gpg: using RSA key
E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg: issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE
* remotes/pmaydell/tags/pull-target-arm-
20201020-1: (29 commits)
target/arm: Implement FPSCR.LTPSIZE for M-profile LOB extension
target/arm: Allow M-profile CPUs with FP16 to set FPSCR.FP16
target/arm: Fix has_vfp/has_neon ID reg squashing for M-profile
target/arm: Implement v8.1M low-overhead-loop instructions
target/arm: Implement v8.1M branch-future insns (as NOPs)
target/arm: Don't allow BLX imm for M-profile
target/arm: Make the t32 insn[25:23]=111 group non-overlapping
target/arm: Implement v8.1M conditional-select insns
target/arm: Implement v8.1M NOCP handling
decodetree: Fix codegen for non-overlapping group inside overlapping group
hw/arm/nseries: Fix loading kernel image on n8x0 machines
microbit_i2c: Fix coredump when dump-vmstate
target/arm: Ignore HCR_EL2.ATA when {E2H,TGE} != 11
target/arm: Fix reported EL for mte_check_fail
target/arm: Remove redundant mmu_idx lookup
hw/intc/bcm2836_control: Use IRQ definitions instead of magic numbers
hw/intc/bcm2835_ic: Trace GPU/CPU IRQ handlers
loads-stores.rst: add footnote that clarifies GETPC usage
tests/qtest: Add npcm7xx timer test
target/arm: Use tlb_flush_page_bits_by_mmuidx*
...
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
John Snow [Fri, 9 Oct 2020 17:51:23 +0000 (13:51 -0400)]
python/qemu/qmp.py: Fix settimeout operation
We enabled callers to interface directly with settimeout, but this
reacts poorly with blocking/nonblocking operation; as they are using the
same internal mechanism.
1. Whenever we change the blocking mechanism temporarily, always set it
back to what it was afterwards.
2. Disallow callers from setting a timeout of "0", which means
Non-blocking mode. This is going to create more weird problems than
anybody wants, so just forbid it.
I opt not to coerce '0' to 'None' to maintain the principal of least
surprise in mirroring the semantics of Python's interface.
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id:
20201009175123.249009-4-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
John Snow [Fri, 9 Oct 2020 17:51:22 +0000 (13:51 -0400)]
python/qemu/qmp.py: re-raise OSError when encountered
Nested if conditions don't change when the exception block fires; we
need to explicitly re-raise the error if we didn't intend to capture and
suppress it.
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id:
20201009175123.249009-3-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
Peter Maydell [Mon, 19 Oct 2020 15:13:01 +0000 (16:13 +0100)]
target/arm: Implement FPSCR.LTPSIZE for M-profile LOB extension
If the M-profile low-overhead-branch extension is implemented, FPSCR
bits [18:16] are a new field LTPSIZE. If MVE is not implemented
(currently always true for us) then this field always reads as 4 and
ignores writes.
These bits used to be the vector-length field for the old
short-vector extension, so we need to take care that they are not
misinterpreted as setting vec_len. We do this with a rearrangement
of the vfp_set_fpscr() code that deals with vec_len, vec_stride
and also the QC bit; this obviates the need for the M-profile
only masking step that we used to have at the start of the function.
We provide a new field in CPUState for LTPSIZE, even though this
will always be 4, in preparation for MVE, so we don't have to
come back later and split it out of the vfp.xregs[FPSCR] value.
(This state struct field will be saved and restored as part of
the FPSCR value via the vmstate_fpscr in machine.c.)
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id:
20201019151301.2046-11-peter.maydell@linaro.org
Peter Maydell [Mon, 19 Oct 2020 15:13:00 +0000 (16:13 +0100)]
target/arm: Allow M-profile CPUs with FP16 to set FPSCR.FP16
M-profile CPUs with half-precision floating point support should
be able to write to FPSCR.FZ16, but an M-profile specific masking
of the value at the top of vfp_set_fpscr() currently prevents that.
This is not yet an active bug because we have no M-profile
FP16 CPUs, but needs to be fixed before we can add any.
The bits that the masking is effectively preventing from being
set are the A-profile only short-vector Len and Stride fields,
plus the Neon QC bit. Rearrange the order of the function so
that those fields are handled earlier and only under a suitable
guard; this allows us to drop the M-profile specific masking,
making FZ16 writeable.
This change also makes the QC bit correctly RAZ/WI for older
no-Neon A-profile cores.
This refactoring also paves the way for the low-overhead-branch
LTPSIZE field, which uses some of the bits that are used for
A-profile Stride and Len.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id:
20201019151301.2046-10-peter.maydell@linaro.org
Peter Maydell [Mon, 19 Oct 2020 15:12:59 +0000 (16:12 +0100)]
target/arm: Fix has_vfp/has_neon ID reg squashing for M-profile
In arm_cpu_realizefn(), if the CPU has VFP or Neon disabled then we
squash the ID register fields so that we don't advertise it to the
guest. This code was written for A-profile and needs some tweaks to
work correctly on M-profile:
* A-profile only fields should not be zeroed on M-profile:
- MVFR0.FPSHVEC,FPTRAP
- MVFR1.SIMDLS,SIMDINT,SIMDSP,SIMDHP
- MVFR2.SIMDMISC
* M-profile only fields should be zeroed on M-profile:
- MVFR1.FP16
In particular, because MVFR1.SIMDHP on A-profile is the same field as
MVFR1.FP16 on M-profile this code was incorrectly disabling FP16
support on an M-profile CPU (where has_neon is always false). This
isn't a visible bug yet because we don't have any M-profile CPUs with
FP16 support, but the change is necessary before we introduce any.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id:
20201019151301.2046-9-peter.maydell@linaro.org
Peter Maydell [Mon, 19 Oct 2020 15:12:58 +0000 (16:12 +0100)]
target/arm: Implement v8.1M low-overhead-loop instructions
v8.1M's "low-overhead-loop" extension has three instructions
for looping:
* DLS (start of a do-loop)
* WLS (start of a while-loop)
* LE (end of a loop)
The loop-start instructions are both simple operations to start a
loop whose iteration count (if any) is in LR. The loop-end
instruction handles "decrement iteration count and jump back to loop
start"; it also caches the information about the branch back to the
start of the loop to improve performance of the branch on subsequent
iterations.
As with the branch-future instructions, the architecture permits an
implementation to discard the LO_BRANCH_INFO cache at any time, and
QEMU takes the IMPDEF option to never set it in the first place
(equivalent to discarding it immediately), because for us a "real"
implementation would be unnecessary complexity.
(This implementation only provides the simple looping constructs; the
vector extension MVE (Helium) adds some extra variants to handle
looping across vectors. We'll add those later when we implement
MVE.)
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id:
20201019151301.2046-8-peter.maydell@linaro.org
Peter Maydell [Mon, 19 Oct 2020 15:12:57 +0000 (16:12 +0100)]
target/arm: Implement v8.1M branch-future insns (as NOPs)
v8.1M implements a new 'branch future' feature, which is a
set of instructions that request the CPU to perform a branch
"in the future", when it reaches a particular execution address.
In hardware, the expected implementation is that the information
about the branch location and destination is cached and then
acted upon when execution reaches the specified address.
However the architecture permits an implementation to discard
this cached information at any point, and so guest code must
always include a normal branch insn at the branch point as
a fallback. In particular, an implementation is specifically
permitted to treat all BF insns as NOPs (which is equivalent
to discarding the cached information immediately).
For QEMU, implementing this caching of branch information
would be complicated and would not improve the speed of
execution at all, so we make the IMPDEF choice to implement
all BF insns as NOPs.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id:
20201019151301.2046-7-peter.maydell@linaro.org
Peter Maydell [Mon, 19 Oct 2020 15:12:56 +0000 (16:12 +0100)]
target/arm: Don't allow BLX imm for M-profile
The BLX immediate insn in the Thumb encoding always performs
a switch from Thumb to Arm state. This would be totally useless
in M-profile which has no Arm decoder, and so the instruction
does not exist at all there. Make the encoding UNDEF for M-profile.
(This part of the encoding space is used for the branch-future
and low-overhead-loop insns in v8.1M.)
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id:
20201019151301.2046-6-peter.maydell@linaro.org
Peter Maydell [Mon, 19 Oct 2020 15:12:55 +0000 (16:12 +0100)]
target/arm: Make the t32 insn[25:23]=111 group non-overlapping
The t32 decode has a group which represents a set of insns
which overlap with B_cond_thumb because they have [25:23]=111
(which is an invalid condition code field for the branch insn).
This group is currently defined using the {} overlap-OK syntax,
but it is almost entirely non-overlapping patterns. Switch
it over to use a non-overlapping group.
For this to be valid syntactically, CPS must move into the same
overlapping-group as the hint insns (CPS vs hints was the
only actual use of the overlap facility for the group).
The non-overlapping subgroup for CLREX/DSB/DMB/ISB/SB is no longer
necessary and so we can remove it (promoting those insns to
be members of the parent group).
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id:
20201019151301.2046-5-peter.maydell@linaro.org
Peter Maydell [Mon, 19 Oct 2020 15:12:54 +0000 (16:12 +0100)]
target/arm: Implement v8.1M conditional-select insns
v8.1M brings four new insns to M-profile:
* CSEL : Rd = cond ? Rn : Rm
* CSINC : Rd = cond ? Rn : Rm+1
* CSINV : Rd = cond ? Rn : ~Rm
* CSNEG : Rd = cond ? Rn : -Rm
Implement these.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id:
20201019151301.2046-4-peter.maydell@linaro.org
Peter Maydell [Mon, 19 Oct 2020 15:12:53 +0000 (16:12 +0100)]
target/arm: Implement v8.1M NOCP handling
From v8.1M, disabled-coprocessor handling changes slightly:
* coprocessors 8, 9, 14 and 15 are also governed by the
cp10 enable bit, like cp11
* an extra range of instruction patterns is considered
to be inside the coprocessor space
We previously marked these up with TODO comments; implement the
correct behaviour.
Unfortunately there is no ID register field which indicates this
behaviour. We could in theory test an unrelated ID register which
indicates guaranteed-to-be-in-v8.1M behaviour like ID_ISAR0.CmpBranch
>= 3 (low-overhead-loops), but it seems better to simply define a new
ARM_FEATURE_V8_1M feature flag and use it for this and other
new-in-v8.1M behaviour that isn't identifiable from the ID registers.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id:
20201019151301.2046-3-peter.maydell@linaro.org
Peter Maydell [Mon, 19 Oct 2020 15:12:52 +0000 (16:12 +0100)]
decodetree: Fix codegen for non-overlapping group inside overlapping group
For nested groups like:
{
[
pattern 1
pattern 2
]
pattern 3
}
the intended behaviour is that patterns 1 and 2 must not
overlap with each other; if the insn matches neither then
we fall through to pattern 3 as the next thing in the
outer overlapping group.
Currently we generate incorrect code for this situation,
because in the code path for a failed match inside the
inner non-overlapping group we generate a "return" statement,
which causes decode to stop entirely rather than continuing
to the next thing in the outer group.
Generate a "break" instead, so that decode flow behaves
as required for this nested group case.
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id:
20201019151301.2046-2-peter.maydell@linaro.org
Philippe Mathieu-Daudé [Mon, 19 Oct 2020 09:51:48 +0000 (11:51 +0200)]
hw/arm/nseries: Fix loading kernel image on n8x0 machines
Commit
7998beb9c2e removed the ram_size initialization in the
arm_boot_info structure, however it is used by arm_load_kernel().
Initialize the field to fix:
$ qemu-system-arm -M n800 -append 'console=ttyS1' \
-kernel meego-arm-n8x0-1.0.80.
20100712.1431-vmlinuz-2.6.35~rc4-129.1-n8x0
qemu-system-arm: kernel 'meego-arm-n8x0-1.0.80.
20100712.1431-vmlinuz-2.6.35~rc4-129.1-n8x0' is too large to fit in RAM (kernel size
1964608, RAM size 0)
Noticed while running the test introduced in commit
050a82f0c5b
("tests/acceptance: Add a test for the N800 and N810 arm machines").
Fixes:
7998beb9c2e ("arm/nseries: use memdev for RAM")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Thomas Huth <thuth@redhat.com>
Message-id:
20201019095148.
1602119-1-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peng Liang [Mon, 19 Oct 2020 09:34:01 +0000 (17:34 +0800)]
microbit_i2c: Fix coredump when dump-vmstate
VMStateDescription.fields should be end with VMSTATE_END_OF_LIST().
However, microbit_i2c_vmstate doesn't follow it. Let's change it.
Fixes:
9d68bf564e ("arm: Stub out NRF51 TWI magnetometer/accelerometer detection")
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Peng Liang <liangpeng10@huawei.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id:
20201019093401.
2993833-1-liangpeng10@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Richard Henderson [Thu, 8 Oct 2020 16:21:55 +0000 (11:21 -0500)]
target/arm: Ignore HCR_EL2.ATA when {E2H,TGE} != 11
Unlike many other bits in HCR_EL2, the description for this
bit does not contain the phrase "if ... this field behaves
as 0 for all purposes other than", so do not squash the bit
in arm_hcr_el2_eff.
Instead, replicate the E2H+TGE test in the two places that
require it.
Reported-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Tested-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Message-id:
20201008162155.161886-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Richard Henderson [Thu, 8 Oct 2020 16:21:54 +0000 (11:21 -0500)]
target/arm: Fix reported EL for mte_check_fail
The reporting in AArch64.TagCheckFail only depends on PSTATE.EL,
and not the AccType of the operation. There are two guest
visible problems that affect LDTR and STTR because of this:
(1) Selecting TCF0 vs TCF1 to decide on reporting,
(2) Report "data abort same el" not "data abort lower el".
Reported-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Tested-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Message-id:
20201008162155.161886-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Richard Henderson [Thu, 8 Oct 2020 16:21:53 +0000 (11:21 -0500)]
target/arm: Remove redundant mmu_idx lookup
We already have the full ARMMMUIdx as computed from the
function parameter.
For the purpose of regime_has_2_ranges, we can ignore any
difference between AccType_Normal and AccType_Unpriv, which
would be the only difference between the passed mmu_idx
and arm_mmu_idx_el.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Tested-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Message-id:
20201008162155.161886-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Philippe Mathieu-Daudé [Sat, 17 Oct 2020 18:07:31 +0000 (20:07 +0200)]
hw/intc/bcm2836_control: Use IRQ definitions instead of magic numbers
The IRQ values are defined few lines earlier, use them instead of
the magic numbers.
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id:
20201017180731.
1165871-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Philippe Mathieu-Daudé [Sat, 17 Oct 2020 18:07:30 +0000 (20:07 +0200)]
hw/intc/bcm2835_ic: Trace GPU/CPU IRQ handlers
Add trace events for GPU and CPU IRQs.
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id:
20201017180731.
1165871-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Emanuele Giuseppe Esposito [Thu, 15 Oct 2020 09:51:47 +0000 (11:51 +0200)]
loads-stores.rst: add footnote that clarifies GETPC usage
Current documentation is not too clear on the GETPC usage.
In particular, when used outside the top level helper function
it causes unexpected behavior.
Signed-off-by: Emanuele Giuseppe Esposito <e.emanuelegiuseppe@gmail.com>
Message-id:
20201015095147.1691-1-e.emanuelegiuseppe@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Havard Skinnemoen [Thu, 8 Oct 2020 23:21:49 +0000 (16:21 -0700)]
tests/qtest: Add npcm7xx timer test
This test exercises the various modes of the npcm7xx timer. In
particular, it triggers the bug found by the fuzzer, as reported here:
https://lists.gnu.org/archive/html/qemu-devel/2020-09/msg02992.html
It also found several other bugs, especially related to interrupt
handling.
The test exercises all the timers in all the timer modules, which
expands to 180 test cases in total.
Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id:
20201008232154.94221-2-hskinnemoen@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Richard Henderson [Fri, 16 Oct 2020 21:07:54 +0000 (14:07 -0700)]
target/arm: Use tlb_flush_page_bits_by_mmuidx*
When TBI is enabled in a given regime, 56 bits of the address
are significant and we need to clear out any other matching
virtual addresses with differing tags.
The other uses of tlb_flush_page (without mmuidx) in this file
are only used by aarch32 mode.
Fixes:
38d931687fa1
Reported-by: Jordan Frank <jordanfrank@fb.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id:
20201016210754.818257-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Richard Henderson [Fri, 16 Oct 2020 21:07:53 +0000 (14:07 -0700)]
accel/tcg: Add tlb_flush_page_bits_by_mmuidx*
On ARM, the Top Byte Ignore feature means that only 56 bits of
the address are significant in the virtual address. We are
required to give the entire 64-bit address to FAR_ELx on fault,
which means that we do not "clean" the top byte early in TCG.
This new interface allows us to flush all 256 possible aliases
for a given page, currently missed by tlb_flush_page*.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id:
20201016210754.818257-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Philippe Mathieu-Daudé [Sat, 10 Oct 2020 20:37:09 +0000 (22:37 +0200)]
hw/arm/bcm2835_peripherals: Correctly wire the SYS_timer IRQs
The SYS_timer is not directly wired to the ARM core, but to the
SoC (peripheral) interrupt controller.
Fixes:
0e5bbd74064 ("hw/arm/bcm2835_peripherals: Use the SYS_timer")
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id:
20201010203709.
3116542-5-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Philippe Mathieu-Daudé [Sat, 10 Oct 2020 20:37:08 +0000 (22:37 +0200)]
hw/timer/bcm2835: Support the timer COMPARE registers
This peripheral has 1 free-running timer and 4 compare registers.
Only the free-running timer is implemented. Add support the
COMPARE registers (each register is wired to an IRQ).
Reference: "BCM2835 ARM Peripherals" datasheet [*]
chapter 12 "System Timer":
The System Timer peripheral provides four 32-bit timer channels
and a single 64-bit free running counter. Each channel has an
output compare register, which is compared against the 32 least
significant bits of the free running counter values. When the
two values match, the system timer peripheral generates a signal
to indicate a match for the appropriate channel. The match signal
is then fed into the interrupt controller.
This peripheral is used since Linux 3.7, commit
ee4af5696720
("ARM: bcm2835: add system timer").
[*] https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id:
20201010203709.
3116542-4-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Philippe Mathieu-Daudé [Sat, 10 Oct 2020 20:37:07 +0000 (22:37 +0200)]
hw/timer/bcm2835: Rename variable holding CTRL_STATUS register
The variable holding the CTRL_STATUS register is misnamed
'status'. Rename it 'ctrl_status' to make it more obvious
this register is also used to control the peripheral.
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id:
20201010203709.
3116542-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Philippe Mathieu-Daudé [Sat, 10 Oct 2020 20:37:06 +0000 (22:37 +0200)]
hw/timer/bcm2835: Introduce BCM2835_SYSTIMER_COUNT definition
Use the BCM2835_SYSTIMER_COUNT definition instead of the
magic '4' value.
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id:
20201010203709.
3116542-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Philippe Mathieu-Daudé [Thu, 8 Oct 2020 16:14:14 +0000 (18:14 +0200)]
hw/arm: Restrict APEI tables generation to the 'virt' machine
While APEI is a generic ACPI feature (usable by X86 and ARM64), only
the 'virt' machine uses it, by enabling the RAS Virtualization. See
commit
2afa8c8519: "hw/arm/virt: Introduce a RAS machine option").
Restrict the APEI tables generation code to the single user: the virt
machine. If another machine wants to use it, it simply has to 'select
ACPI_APEI' in its Kconfig.
Fixes:
aa16508f1d ("ACPI: Build related register address fields via hardware error fw_cfg blob")
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Dongjiu Geng <gengdongjiu@huawei.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id:
20201008161414.
2672569-1-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Philippe Mathieu-Daudé [Wed, 14 Oct 2020 21:36:01 +0000 (23:36 +0200)]
hw/arm/strongarm: Fix 'time to transmit a char' unit comment
The time to transmit a char is expressed in nanoseconds, not in ticks.
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id:
20201014213601.205222-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Tue, 13 Oct 2020 10:35:32 +0000 (11:35 +0100)]
target/arm: AArch32 VCVT fixed-point to float is always round-to-nearest
For AArch32, unlike the VCVT of integer to float, which honours the
rounding mode specified by the FPSCR, VCVT of fixed-point to float is
always round-to-nearest. (AArch64 fixed-point-to-float conversions
always honour the FPCR rounding mode.)
Implement this by providing _round_to_nearest versions of the
relevant helpers which set the rounding mode temporarily when making
the call to the underlying softfloat function.
We only need to change the VFP VCVT instructions, because the
standard- FPSCR value used by the Neon VCVT is always set to
round-to-nearest, so we don't need to do the extra work of saving
and restoring the rounding mode.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id:
20201013103532.13391-1-peter.maydell@linaro.org
Peter Maydell [Fri, 9 Oct 2020 14:47:12 +0000 (15:47 +0100)]
target/arm: Fix SMLAD incorrect setting of Q bit
The SMLAD instruction is supposed to:
* signed multiply Rn[15:0] * Rm[15:0]
* signed multiply Rn[31:16] * Rm[31:16]
* perform a signed addition of the products and Ra
* set Rd to the low 32 bits of the theoretical
infinite-precision result
* set the Q flag if the sign-extension of Rd
would differ from the infinite-precision result
(ie on overflow)
Our current implementation doesn't quite do this, though: it performs
an addition of the products setting Q on overflow, and then it adds
Ra, again possibly setting Q. This sometimes incorrectly sets Q when
the architecturally mandated only-check-for-overflow-once algorithm
does not. For instance:
r1 = 0x80008000; r2 = 0x80008000; r3 = 0xffffffff
smlad r0, r1, r2, r3
This is (-32768 * -32768) + (-32768 * -32768) - 1
The products are both 0x4000_0000, so when added together as 32-bit
signed numbers they overflow (and QEMU sets Q), but because the
addition of Ra == -1 brings the total back down to 0x7fff_ffff
there is no overflow for the complete operation and setting Q is
incorrect.
Fix this edge case by resorting to 64-bit arithmetic for the
case where we need to add three values together.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id:
20201009144712.11187-1-peter.maydell@linaro.org
John Snow [Fri, 9 Oct 2020 17:51:21 +0000 (13:51 -0400)]
python: add mypy config
Formalize the options used for checking the python library. You can run
mypy from the directory that mypy.ini is in by typing `mypy qemu/`.
Signed-off-by: John Snow <jsnow@redhat.com>
Message-id:
20201009175123.249009-2-jsnow@redhat.com
[Edit: Added newline; thanks Bin Meng --js]
Signed-off-by: John Snow <jsnow@redhat.com>
John Snow [Tue, 6 Oct 2020 23:58:14 +0000 (19:58 -0400)]
python/qemu/qmp.py: Preserve error context on re-raise
Use the "from ..." phrasing when re-raising errors to preserve their
initial context, to help aid debugging when things go wrong.
This also silences a pylint 2.6.0+ error.
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id:
20201006235817.
3280413-18-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
John Snow [Tue, 6 Oct 2020 23:58:13 +0000 (19:58 -0400)]
python/qemu/console_socket.py: avoid encoding to/from string
We can work directly in bytes instead of translating back and forth to
string, which removes the question of which encodings to use.
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id:
20201006235817.
3280413-17-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
John Snow [Tue, 6 Oct 2020 23:58:12 +0000 (19:58 -0400)]
python/qemu/console_socket.py: Add type hint annotations
Finish the typing of console_socket.py with annotations and no code
changes.
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id:
20201006235817.
3280413-16-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
John Snow [Tue, 6 Oct 2020 23:58:11 +0000 (19:58 -0400)]
python/qemu/console_socket.py: Clarify type of drain_thread
Mypy needs just a little help to guess the type here.
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id:
20201006235817.
3280413-15-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
John Snow [Tue, 6 Oct 2020 23:58:10 +0000 (19:58 -0400)]
python/qemu/console_socket.py: fix typing of settimeout
The types and names of the parameters must match the socket.socket interface.
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id:
20201006235817.
3280413-14-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>