aboutsummaryrefslogtreecommitdiff
path: root/hw/misc
AgeCommit message (Collapse)AuthorFilesLines
2025-09-02hw/misc/xlnx-versal-cframe-reg: Free FIFO, g_tree on deinitPeter Maydell1-0/+9
In the xlnx-versal-cframe-reg device we create a FIFO in instance_init but don't destroy it on deinit, causing ASAN to report a leak in the device-introspect-test: Direct leak of 400 byte(s) in 1 object(s) allocated from: #0 0x5aded4d54e23 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/qemu-system-aarch64+0x24ffe23) (BuildId: 9f1e6c53fecd904ba5fc1f521d7da080a0e4103b) #1 0x71fbfac9bb09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75) #2 0x5aded850059d in fifo8_create /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../util/fifo8.c:27:18 #3 0x5aded582b9e4 in fifo32_create /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/include/qemu/fifo32.h:35:5 #4 0x5aded582b326 in cframe_reg_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/misc/xlnx-versal-cframe-reg.c:693:5 Similarly, we don't clean up the g_tree we create: Direct leak of 48 byte(s) in 1 object(s) allocated from: #0 0x5aded4d54e23 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/qemu-system-aarch64+0x24ffe23) (BuildId: 9f1e6c5 3fecd904ba5fc1f521d7da080a0e4103b) #1 0x71fbfac9bb09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75) #2 0x71fbfaccc799 in g_tree_new_full (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x93799) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d7 5) #3 0x5aded582b21a in cframe_reg_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/misc/xlnx-versal-cframe-reg.c:691:18 Add an instance_finalize method to clean up what we allocated in instance_init. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com> Message-ID: <20250826174956.3010274-2-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-07-21hw/misc/max78000_aes: Comment Internal Key StorageJackson Donaldson1-0/+6
Coverity Scan noted an unusual pattern in the MAX78000 aes device, with duplicated calls to set_decrypt. This commit adds a comment noting why the implementation is correct. Signed-off-by: Jackson Donaldson <jcksn@duck.com> Message-id: 20250716002622.84685-1-jcksn@duck.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-21hw/misc/ivshmem-pci: Improve error handlingPeter Maydell1-1/+8
Coverity points out that the ivshmem-pci code has some error handling cases where it incorrectly tries to use an invalid filedescriptor. These generally happen because ivshmem_recv_msg() calls qemu_chr_fe_get_msgfd(), which might return -1, but the code in process_msg() generally assumes that the file descriptor was provided when it was supposed to be. In particular: * the error case in process_msg() only needs to close the fd if one was provided * process_msg_shmem() should fail if no fd was provided Coverity: CID 1508726 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20250711145012.1521936-1-peter.maydell@linaro.org
2025-07-15hw/mips: Restrict ITU to TCGPhilippe Mathieu-Daudé1-0/+1
MIPS Inter-Thread Communication Unit is implemented using TCG. Check for TCG both in Kconfig and CPS source. Fixes: 2321d971b6f ("hw/mips: Add dependency MIPS_CPS -> MIPS_ITU") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250702164953.18579-1-philmd@linaro.org>
2025-07-08MAX78000: AES implementationJackson Donaldson4-0/+233
This commit implements AES for the MAX78000 Signed-off-by: Jackson Donaldson <jcksn@duck.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250704223239.248781-11-jcksn@duck.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-08MAX78000: TRNG ImplementationJackson Donaldson4-0/+149
This commit implements the True Random Number Generator for the MAX78000 Signed-off-by: Jackson Donaldson <jcksn@duck.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250704223239.248781-9-jcksn@duck.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-08MAX78000: GCR ImplementationJackson Donaldson3-0/+343
This commit implements the Global Control Register for the MAX78000 Signed-off-by: Jackson Donaldson <jcksn@duck.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250704223239.248781-7-jcksn@duck.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-08MAX78000: ICC ImplementationJackson Donaldson3-0/+124
This commit implements the Instruction Cache Controller for the MAX78000 Signed-off-by: Jackson Donaldson <jcksn@duck.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250704223239.248781-3-jcksn@duck.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-03hw/misc/aspeed_scu: Handle AST2600 protection key registers correctlyTan Siewert1-2/+14
The AST2600 SCU has two protection key registers (0x00 and 0x10) that both need to be unlocked. (Un-)locking 0x00 modifies both protection key registers, while modifying 0x10 only modifies itself. This commit updates the SCU write logic to reject writes unless both protection key registers are unlocked, matching the behaviour of real hardware. Signed-off-by: Tan Siewert <tan@siewert.io> Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com> Link: https://lore.kernel.org/qemu-devel/20250619085329.42125-1-tan@siewert.io Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-07-03hw/misc/aspeed_scu: Support the Frequency Counter Control register for AST2700Jamin Lin1-0/+6
According to the datasheet: BIT[1] (SCU_FREQ_OSC_EN) enables the oscillator frequency measurement counter. BIT[6] (SCU_FREQ_DONE) indicates the measurement is finished. Firmware polls BIT[6] to determine when measurement is complete. The flag can be cleared by writing BIT[1] to 0. To simulate this hardware behavior in QEMU: If BIT[1] is set to 1, BIT[6] is immediately set to 1 to avoid firmware hanging during polling. If BIT[1] is cleared to 0, BIT[6] is also cleared to 0 to match hardware semantics. The initial value of this register is initialized to 0x80, reflecting the default value confirmed from an EVB register dump. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250618080006.846355-3-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-07-03hw/misc/aspeed_sdmc: Skipping dram_init in u-boot for AST2700Jamin Lin1-0/+3
On AST2700 SoC, QEMU now sets BIT6 in VGA0 SCRATCH register to indicate that DDR training has completed, thus skipping the dram_init(). To align with the recent U-Boot changes, where the Main Control Register's BIT16 is checked to skip the dram_init() process, this patch sets BIT16 in the SDMC Main Control Register at reset time. This allows both the main U-Boot stage to correctly detect and bypass DRAM initialization when running under QEMU. Reference: - QEMU: https://github.com/qemu/qemu/commit/2d082fea485ee455a70ed3e963cdf9a70f34858a - U-Boot: https://github.com/AspeedTech-BMC/u-boot/commit/94e5435504fb0d8888f5c1bfd3fa284cdd6aaf9b Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250618080006.846355-2-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-07-02treewide: update docs file extensions (.txt -> .rst) in commentsSean Wei1-1/+1
Several source comments still refer to docs with the old .txt extension that were previously converted to reStructuredText. Update these references to use the correct .rst extensions to maintain accurate in-tree documentation pointers. No functional changes. Related commits: 50f8174c5c1 (Jul 2021): docs/specs/acpi_nvdimm: Convert to rST f054eb1c920 (Jul 2021): docs/specs/acpi_pci_hotplug: Convert to rST 912fb3678b8 (Sep 2023): docs/specs/vmgenid: Convert to rST bb1cff6ee04 (Sep 2023): docs/specs/ivshmem-spec: Convert to rST 55ff468f781 (Jan 2022): docs: Rename ppc-spapr-hotplug.txt to .rst Signed-off-by: Sean Wei <me@sean.taipei> Message-ID: <20250616.qemu.relocated.05@sean.taipei> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-06-12hw/misc/aspeed_hace: skip automatic zero-init of large arrayDaniel P. Berrangé1-1/+1
The 'do_hash_operation' method has a 256 element iovec array used for holding pointers to data that is to be hashed. Skip the automatic zero-init of this array to eliminate the performance overhead in the I/O hot path. The 'iovec' array will be selectively initialized based on data that needs to be hashed. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20250610123709.835102-19-berrange@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-06-10hw/misc/stm32_rcc: Fix stm32_rcc_write() arguments orderPhilippe Michaud-Boudreault1-1/+1
The tracing function for the write case incorrectly has parameters switched around. So order them in the correct way. Signed-off-by: Philippe Michaud-Boudreault <philmb3487@proton.me> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <HnyjTNqwrfGusE44bnM7kuLuj13Di1VgXN-dXVHMOSnfgCUhoipOVIoVS1WQaKrJxmEDy9XJGdlQj6zVTIdJE0QVlfBhfbcckFFWRRP56uY=@proton.me> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-05-25hw/misc/aspeed_hace: Support to dump plaintext and digest for better debuggingJamin Lin2-0/+47
1. Added "hace_hexdump()" to dump a contiguous buffer using qemu_hexdump. 2. Added "hace_iov_hexdump()" to flatten and dump scatter-gather source vectors. 3. Introduced a new trace event: "aspeed_hace_hexdump". Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-17-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Add trace-events for better debuggingJamin Lin2-0/+17
Introduced "trace_aspeed_hace_hash_addr", "trace_aspeed_hace_hash_sg", "trace_aspeed_hace_read", "trace_aspeed_hace_hash_execute_acc_mode", and "trace_aspeed_hace_write" trace events. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-16-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Support DMA 64 bits dram addressJamin Lin1-1/+16
According to the AST2700 design, the data source address is 64-bit, with R_HASH_SRC_HI storing bits [63:32] and R_HASH_SRC storing bits [31:0]. Similarly, the digest address is 64-bit, with R_HASH_DEST_HI storing bits [63:32] and R_HASH_DEST storing bits [31:0]. To maintain compatibility with older SoCs such as the AST2600, the AST2700 HW automatically set bit 34 of the 64-bit sg_addr. As a result, the firmware only needs to provide a 32-bit sg_addr containing bits [31:0]. This is sufficient for the AST2700, as it uses a DRAM offset rather than a DRAM address. Introduce a has_dma64 class attribute and set it to true for the AST2700. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-15-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Add support for source, digest, key buffer 64 bit addressesJamin Lin1-1/+30
According to the AST2700 design, the data source address is 64-bit, with R_HASH_SRC_HI storing bits [63:32] and R_HASH_SRC storing bits [31:0]. Similarly, the digest address is 64-bit, with R_HASH_DIGEST_HI storing bits [63:32] and R_HASH_DIGEST storing bits [31:0]. The HMAC key buffer address is also 64-bit, with R_HASH_KEY_BUFF_HI storing bits [63:32] and R_HASH_KEY_BUFF storing bits [31:0]. The AST2700 supports a maximum DRAM size of 8 GB, with a DRAM addressable range from 0x0_0000_0000 to 0x1_FFFF_FFFF. Since this range fits within 34 bits, only bits [33:0] are needed to store the DRAM offset. To optimize address storage, the high physical address bits [1:0] of the source, digest and key buffer addresses are stored as dram_offset bits [33:32]. To achieve this, a src_hi_mask with a mask value of 0x3 is introduced, ensuring that src_addr_hi consists of bits [1:0]. The final src_addr is computed as (src_addr_hi[1:0] << 32) | src_addr[31:0], representing the DRAM offset within bits [33:0]. Similarly, a dest_hi_mask with a mask value of 0x3 is introduced to ensure that dest_addr_hi consists of bits [1:0]. The final dest_addr is calculated as (dest_addr_hi[1:0] << 32) | dest_addr[31:0], representing the DRAM offset within bits [33:0]. Additionally, a key_hi_mask with a mask value of 0x3 is introduced to ensure that key_buf_addr_hi consists of bits [1:0]. The final key_buf_addr is determined as (key_buf_addr_hi[1:0] << 32) | key_buf_addr[31:0], representing the DRAM offset within bits [33:0]. This approach eliminates the need to reduce the high part of the DRAM physical address for DMA operations. Previously, this was calculated as (high physical address bits [7:0] - 4), since the DRAM start address is 0x4_00000000, making the high part address [7:0] - 4. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-14-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Move register size to instance class and dynamically ↵Jamin Lin1-17/+19
allocate regs Dynamically allocate the register array by removing the hardcoded ASPEED_HACE_NR_REGS macro. To support different register sizes across SoC variants, introduce a new "nr_regs" class attribute and replace the static "regs" array with dynamically allocated memory. Add a new "aspeed_hace_unrealize" function to properly free the allocated "regs" memory during device cleanup. Remove the bounds checking in the MMIO read/write handlers since the MemoryRegion size now matches the (register array size << 2). This commit updates the VMState fields accordingly. The VMState version was already bumped in a previous patch of this series, so no further version change is needed. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-13-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Support accumulative mode for direct access modeJamin Lin1-3/+21
Enable accumulative mode for direct access mode operations. In direct access mode, only a single source buffer is used, so the "iovec" count is set to 1. If "acc_mode" is enabled: 1. Accumulate "total_req_len" with the current request length ("plen"). 2. Check for padding and determine whether this is the final request. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-12-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Rename R_HASH_DEST to R_HASH_DIGEST and introduce ↵Jamin Lin1-6/+19
64-bit hash digest address helper Renaming R_HASH_DEST to R_HASH_DIGEST for better semantic clarity. The AST2700 CPU, based on the Cortex-A35, features a 64-bit DRAM address space. To prepare for future AST2700 support, this change introduces a new helper function hash_get_digest_addr() to encapsulate digest address extraction logic and improve code readability. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-11-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Introduce 64-bit hash source address helper functionJamin Lin1-7/+17
The AST2700 CPU, based on the Cortex-A35, is a 64-bit processor, and its DRAM address space is also 64-bit. To support future AST2700 updates, the source hash buffer address data type is being updated to 64-bit. Introduces the "hash_get_source_addr()" helper function to extract the source hash buffer address. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-10-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Extract accumulation-mode hash execution into helper ↵Jamin Lin1-33/+41
function To improve code readability and maintainability of do_hash_operation(), this commit introduces a new helper function: hash_execute_acc_mode(). This function encapsulates the full flow for accumulation mode, including context initialization, update, conditional finalization, and digest writeback with I/O vector unmapping. No functional changes are introduced. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-9-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Extract non-accumulation hash execution into helper ↵Jamin Lin1-8/+24
function To improve code readability and maintainability of do_hash_operation(), this commit introduces a new helper function: hash_execute_non_acc_mode(). The helper encapsulate the hashing logic for non-accumulation mode. No functional changes are introduced. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-8-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Extract digest write and iov unmap into helper functionJamin Lin1-12/+21
To improve code readability and maintainability of do_hash_operation(), this commit introduces a new helper function: hash_write_digest_and_unmap_iov(). The helper consolidates the final digest writeback and subsequent unmapping of the I/O vectors into a single routine. No functional changes are introduced. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-7-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Extract SG-mode hash buffer setup into helper functionJamin Lin1-48/+63
To improve code readability and maintainability of do_hash_operation(), this commit introduces a new helper function: hash_prepare_sg_iov(). This function handles scatter-gather (SG) mode setup, including SG list parsing, address mapping, and optional accumulation mode support with padding detection. No functional changes are introduced. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-6-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Extract direct mode hash buffer setup into helper functionJamin Lin1-10/+32
To improve code readability and maintainability of do_hash_operation(), this commit introduces a new helper function: hash_prepare_direct_iov(). This function encapsulates the logic for setting up the I/O vector (iov) in direct mode (non-scatter-gather). No functional changes are introduced. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-5-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Ensure HASH_IRQ is always set to prevent firmware hangJamin Lin1-9/+9
Currently, if the program encounters an unsupported algorithm, it does not set the HASH_IRQ bit in the status register and send an interrupt to indicate command completion. As a result, the FW gets stuck waiting for a completion signal from the HACE module. Additionally, in do_hash_operation, if an error occurs within the conditional statement, the HASH_IRQ bit is not set in the status register. This causes the firmware to continuously send HASH commands, as it is unaware that the HACE model has completed processing the command. To fix this, the HASH_IRQ bit in the status register must always be set to ensure that the firmware receives an interrupt from the HACE module, preventing it from getting stuck or repeatedly sending HASH commands. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Fixes: c5475b3 ("hw: Model ASPEED's Hash and Crypto Engine") Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-4-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Improve readability and consistency in variable namingJamin Lin1-34/+33
Currently, users define multiple local variables within different if-statements. To improve readability and maintain consistency in variable naming, rename the variables accordingly. Introduced "sg_addr" to clearly indicate the scatter-gather mode buffer address. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-3-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-25hw/misc/aspeed_hace: Remove unused code for better readabilityJamin Lin1-37/+2
In the previous design of the hash framework, accumulative hashing was not supported. To work around this limitation, commit 5cd7d85 introduced an iov_cache array to store all the hash data from firmware. Once the ASPEED HACE model collected all the data, it passed the iov_cache to the hash API to calculate the final digest. However, with commit e3c0752, the hash framework now supports accumulative hashing. This allows us to refactor the ASPEED HACE model, removing redundant logic and simplifying the implementation for better readability and maintainability. As a result, the iov_count variable is no longer needed—it was previously used to track how many cached entries were used for hashing. To maintain VMSTATE compatibility after removing this field, the VMSTATE_VERSION is bumped to 2 This cleanup follows significant changes in commit 4c1d0af4a28d, making the model more readable. - Deleted "iov_cache" and "iov_count" from "AspeedHACEState". - Removed "reconstruct_iov" function and related logic. - Simplified "do_hash_operation" by eliminating redundant checks. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-2-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-19hw/misc: Add MPFS system reset supportSebastian Huber1-0/+7
Signed-off-by: Sebastian Huber <sebastian.huber@embedded-brains.de> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250319061342.26435-2-sebastian.huber@embedded-brains.de> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2025-05-15Merge tag 'pull-target-arm-20250515' of ↵Stefan Hajnoczi1-235/+235
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * target/arm: refactoring for compile-twice changes * MAINTAINERS: Add an entry for the Bananapi machine * arm/omap: remove hard coded tabs * rust: pl011: Cut down amount of text quoted from PL011 TRM * target/arm: refactor Arm CPU class hierarchy # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmglwIUZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3sclD/9AgQ5uDlN6gIRupx2PUHAt # liFvncSS/1hPHbf4h9A1WgN34EDaF8TuHi8eexSMMlHQpI5yFumd7UIYUDxpRqj4 # 13gYhBqbnV68S4tWB2g/kCcSNYSLmRQT/b+iwCBtwEJJrDFXlMYFWS50DDS/wxzl # sIbcEnixT9PfPh22e01Ib9jCILPzHEVzegMtn5dFl86nLCqQufycNExOvEOXTC9w # smCTNHGSIM4TFzKOQ7pNgaAFiqpYenwvPgYElqgGZdwpEB/vmFokXUauQzf2uwVH # Nx/361YWi8hQQkG/qEqzcu+J5PwydZssXCO2gEsQVUZMCK/g+naNAiFThMWv/zAu # gJ+MWghlSXqAEStLf/+D8w03+I+jChINNxip/F4pgAzbi8mPp/Te+u/G+ra6vD8W # AvWzvZwxbTLOlTOYzKsOGF7nq86A20hJBTfpm/Hlbd0ou80YQLO23Dxr4Wmbua5n # gbvUad88V5J9KeZUAg4wCyuMGii6X4rezJVL55hE+PIrPRi3q4TXBjk7KG29SkA1 # UCbXm8EGiBMCAE04u6dWkcd8003RbgAfrAK0b9VGUEcEXO1O//ivlWJw/TQWf8pn # V1UOiXocmXOI5vyy01gjz2iDv8ty/4jSGPzCQ80ijl58Gmm8fmDRxuWPLtDS0lBS # QcFEV2oIUjMEEpsCYV07KQ== # =MECx # -----END PGP SIGNATURE----- # gpg: Signature made Thu 15 May 2025 06:23:01 EDT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20250515' of https://git.linaro.org/people/pmaydell/qemu-arm: (58 commits) target/arm/tcg/vfp_helper: compile file twice (system, user) target/arm/tcg/arith_helper: compile file once target/arm/tcg/tlb-insns: compile file once (system) target/arm/helper: restrict define_tlb_insn_regs to system target target/arm/tcg/tlb_helper: compile file twice (system, user) target/arm/tcg/neon_helper: compile file twice (system, user) target/arm/tcg/iwmmxt_helper: compile file twice (system, user) target/arm/tcg/hflags: compile file twice (system, user) target/arm/tcg/crypto_helper: compile file once target/arm/tcg/vec_internal: use forward declaration for CPUARMState target/arm/machine: compile file once (system) target/arm/kvm-stub: add missing stubs target/arm/machine: move cpu_post_load kvm bits to kvm_arm_cpu_post_load function target/arm/machine: remove TARGET_AARCH64 from migration state target/arm/machine: reduce migration include to avoid target specific definitions target/arm/kvm-stub: compile file once (system) target/arm/meson: accelerator files are not needed in user mode target/arm/ptw: compile file once (system) target/arm/ptw: replace TARGET_AARCH64 by CONFIG_ATOMIC64 from arm_casq_ptw target/arm/ptw: replace target_ulong with int64_t ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-05-14hw/arm: Replace TABs for spaces in OMAP board and device codeSantiago Monserrat Campanello1-235/+235
In hw/arm and include/hw/arm, some source files for the OMAP SoC and the sx1 boards that are our only remaining OMAP boards still have hard-coded tabs (almost entirely used for the indent on inline comments, not for actual code indent). Replace the tabs with spaces using vim :retab. I used 4 spaces except in some defines and comments where I tried to put everything aligned in the same column for better readability. This commit is a purely whitespace-only change. Signed-off-by: Santiago Monserrat Campanello <santimonserr@gmail.com> Message-id: 20250505131130.82206-1-santimonserr@gmail.com Resolves: https://gitlab.com/qemu-project/qemu/-/issues/373 [PMM: expanded commit message] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-05-14pci-testdev.c: Add membar-backed option for backing membarStephen Bates1-2/+10
The pci-testdev device allows for an optional BAR. We have historically used this without backing to test that systems and OSes can accomodate large PCI BARs. However to help test p2pdma operations it is helpful to add an option to back this BAR with host memory. We add a membar-backed boolean parameter and when set to true or on we do a host RAM backing. The default is false which ensures backward compatability. Signed-off-by: Stephen Bates <sbates@raithlin.com> Message-Id: <Z_6JhDtn5PlaDgB_@MKMSTEBATES01.amd.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-04-25qom: Make InterfaceInfo[] uses constPhilippe Mathieu-Daudé10-11/+11
Mechanical change using: $ sed -i -E 's/\(InterfaceInfo.?\[/\(const InterfaceInfo\[/g' \ $(git grep -lE '\(InterfaceInfo.?\[\]\)') Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20250424194905.82506-7-philmd@linaro.org>
2025-04-25qom: Have class_init() take a const data argumentPhilippe Mathieu-Daudé122-176/+179
Mechanical change using gsed, then style manually adapted to pass checkpatch.pl script. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250424194905.82506-4-philmd@linaro.org>
2025-04-25hw/misc/edu: Convert type_init() -> DEFINE_TYPES()Philippe Mathieu-Daudé1-12/+9
Prefer DEFINE_TYPES() macro over type_init() to register QOM types. Initialize the .interfaces struct field as compound literal casted to InterfaceInfo type like the rest of our code base. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250424194905.82506-2-philmd@linaro.org>
2025-04-24Merge tag 'pull-misc-2025-04-24' of https://repo.or.cz/qemu/armbru into stagingStefan Hajnoczi3-6/+0
Miscellaneous patches for 2025-04-24 # -----BEGIN PGP SIGNATURE----- # # iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmgJ7dYSHGFybWJydUBy # ZWRoYXQuY29tAAoJEDhwtADrkYZTiZIP/1PFAg/s3SoiLQwH/ZrjyUkm1kiKnjOH # CC5Stw6I9tuYnDAhASAdSymofLv0NNydNe5ai6ZZAWRyRYjIcfNigKAGK4Di+Uhe # nYxT0Yk8hNGwMhl6NnBp4mmCUNCwcbjT9uXdiYQxFYO/qqYR1388xJjeN3c362l3 # AaLrE5bX5sqa6TAkTeRPjeIqxlyGT7jnCrN7I1hMhDvbc3ITF3AMfYFMjnmAQgr+ # mTWGS1QogqqkloODbR1DKD1CAWOlpK+0HibhNF+lz71P0HlwVvy+HPXso505Wf0B # dMwlSrZ1DnqNVF/y5IhMEMslahKajbjbFVhBjmrGl/8T821etCxxgB20c0vyFRy8 # qTyJGwBZaEo0VWr70unSmq45TRoeQvdHAw/e+GtilR0ci80q2ly4gbObnw7L8le+ # gqZo4IWmrwp2sbPepE57sYKQpEndwbRayf/kcFd0LPPpeINu9ZooXkYX0pOo6Cdg # vDKMaEB1/fmPhjSlknxkKN9LZdR+nDw8162S1CKsUdWanAOjmP8haN19aoHhIekZ # q+r2qUq/U827yNy9/qbInmsoFYDz9s6sAOE63jibd5rZZ9Anei6NOSgLzA4CqCR1 # +d0+TXp19gP9mLMFs7/ZclwkXCz47OQYhXYphjI3wM9x+xbdRcI4n+DOH5u5coKx # AsA6+2n0GF4Y # =GaoH # -----END PGP SIGNATURE----- # gpg: Signature made Thu 24 Apr 2025 03:52:54 EDT # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * tag 'pull-misc-2025-04-24' of https://repo.or.cz/qemu/armbru: cleanup: Drop pointless label at end of function cleanup: Drop pointless return at end of function cleanup: Re-run return_directly.cocci Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-04-24cleanup: Drop pointless return at end of functionMarkus Armbruster3-6/+0
A few functions now end with a label. The next commit will clean them up. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250407082643.2310002-3-armbru@redhat.com> [Straightforward conflict with commit 988ad4ccebb6 (hw/loongarch/virt: Fix cpuslot::cpu set at last in virt_cpu_plug()) resolved]
2025-04-23include/system: Move exec/address-spaces.h to system/address-spaces.hRichard Henderson4-4/+4
Convert the existing includes with sed. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2025-04-01Merge tag 'pull-aspeed-20250401' of https://github.com/legoater/qemu into ↵Stefan Hajnoczi1-2/+14
staging aspeed queue: * Fixed SCU access size on AST2500 and AST2600 SoCs # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmfr2DsACgkQUaNDx8/7 # 7KHlHg/8D5/maW8yAfQjUBfvy2+tzpV1SvBTKxSvv5n9tP3CFDSgNjFXfDnt06qK # xNE4YzK5I7wWQ20OKXB1LfqHqaJJXT7G1Qc44ZbmfHdiISMuaZaWDjQyzXO/TDSH # e8Svb3iV4IA2J2B6dsbPOym6XMFL9awhXurhYTxfnl9oFhkvgaP1H6Ur0/m8peOq # HELkY18nyWbpeZyIArEagXtBb1n1ucn51dwaDLq9F+D5vXAe6NN8Am5RG/gEED6X # P/o6/VphxR/EmijbIrixHUWmORnuXV4KI13xdLb3hyjIOtgjFPENQuUJTczwkK/8 # mpdTOj+m8ovGMuFGmvnGy6uyYRmXQarBOSSR19XPlMF1qlO7rUUzYPTl7M8M45C5 # UuU9Q60KNSiCHdQqimdZwy/IoI8nuEHMT6g2/Vd82OUJ6K/uR3V0dVel7LVEOvVj # 1xXtNOL8Xy5W0Z84nPLOjpD1WU8Khl8m6OZR81RWR9jTj61dX9AfggkJXSzU6G0Z # Yhv6shqYRn+LpAN/cjqUP6hR1C0iBCi+lBNG6wKq3DVCDXPCg8yEW9D+NUwVj64z # 6BMF335RP3phkmpFMniJ83Ad4yxOmKubQcIIXjLvEiAdppxvDCjQBgYkKHRXkJV0 # wVYnfDwB2quDA1oS3tLibvRf366NjhPfJhMx+yiL4RgFUQ/BvfI= # =VRwA # -----END PGP SIGNATURE----- # gpg: Signature made Tue 01 Apr 2025 08:12:43 EDT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [full] # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-aspeed-20250401' of https://github.com/legoater/qemu: hw/misc/aspeed_scu: Correct minimum access size for AST2500 / AST2600 hw/misc/aspeed_scu: Set MemoryRegionOps::impl::access_size to 32-bit Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-04-01hw/misc/aspeed_scu: Correct minimum access size for AST2500 / AST2600Joel Stanley1-2/+2
Guest code was performing a byte load to the SCU MMIO region, leading to the guest code crashing (it should be using proper accessors, but that is not Qemu's bug). Hardware and the documentation[1] both agree that byte loads are okay, so change all of the aspeed SCU devices to accept a minimum access size of 1. [1] See the 'ARM Address Space Mapping' table in the ASPEED docs. This is section 6.1 in the ast2400 and ast2700, and 7.1 in the ast2500 and ast2600 datasheets. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2636 Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Troy Lee <leetroy@gmail.com> Message-ID: <20241118021820.4928-1-joel@jms.id.au> [PMD: Rebased, only including SCU changes] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au> Link: https://lore.kernel.org/qemu-devel/20250331230444.88295-3-philmd@linaro.org Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-04-01hw/misc/aspeed_scu: Set MemoryRegionOps::impl::access_size to 32-bitPhilippe Mathieu-Daudé1-0/+12
All MemoryRegionOps::read/write() handlers switch over a 32-bit aligned value, because converted using TO_REG(), which is defined as: #define TO_REG(offset) ((offset) >> 2) So all implementations are 32-bit. Set min/max access_size accordingly. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au> Link: https://lore.kernel.org/qemu-devel/20250331230444.88295-2-philmd@linaro.org Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-03-31hw/misc/pll: Do not expose as user-creatablePhilippe Mathieu-Daudé3-0/+18
All these devices are part of SoC components and can not be created manually. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20250325224310.8785-9-philmd@linaro.org>
2025-03-23hw/misc/aspeed_hace: Fix buffer overflow in has_padding functionJamin Lin1-0/+5
The maximum padding size is either 64 or 128 bytes and should always be smaller than "req_len". If "padding_size" exceeds "req_len", then "req_len - padding_size" underflows due to "uint32_t" data type, leading to a large incorrect value (e.g., `0xFFXXXXXX`). This causes an out-of-bounds memory access, potentially leading to a buffer overflow. Added a check to ensure "padding_size" does not exceed "req_len" before computing "pad_offset". This prevents "req_len - padding_size" from underflowing and avoids accessing invalid memory. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Fixes: 5cd7d8564a8b563da724b9e6264c967f0a091afa ("aspeed/hace: Support AST2600 HACE ") Link: https://lore.kernel.org/qemu-devel/20250321092623.2097234-3-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-03-17hw/misc: use extract64 instead of 1 << iTigran Sogomonian1-1/+1
1 << i is casted to uint64_t while bitwise and with val. So this value may become 0xffffffff80000000 but only 31th "start" bit is required. Use the bitfield extract() API instead. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Tigran Sogomonian <tsogomonian@astralinux.ru> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Link: https://lore.kernel.org/r/20241227104618.2526-1-tsogomonian@astralinux.ru Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-03-09hw/misc/aspeed_scu: Add Support for AST2700/AST2750 A1 Silicon RevisionsJamin Lin1-0/+2
Added new definitions for AST2700_A1_SILICON_REV and AST2750_A1_SILICON_REV to identify the A1 silicon revisions. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250307035945.3698802-19-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-03-09hw/misc/aspeed_scu: Fix the hw-strap1 cannot be set in the SOC layer for AST2700Jamin Lin1-2/+1
There is one hw_strap1 register in the SCU (CPU DIE) and another hw_strap1 register in the SCUIO (IO DIE). In the "ast2700_a0_resets" function, the hardcoded value "0x00000800" is set in SCU hw-strap1 (CPU DIE), and in "ast2700_a0_resets_io" the hardcoded value "0x00000504" is set in SCUIO hw-strap1 (IO DIE). Both values cannot be set via the SOC layer. The value of "s->hw_strap1" is set by the SOC layer via the "hw-strap1" property. Update the "aspeed_ast2700_scu_reset" function to set the value of "s->hw_strap1" in both the SCU and SCUIO hw-strap1 registers. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Nabih Estefan <nabihestefan@google.com> Link: https://lore.kernel.org/qemu-devel/20250304064710.2128993-5-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-03-09hw/misc/aspeed_scu: Fix the revision ID cannot be set in the SOC layer for ↵Jamin Lin1-2/+1
AST2700 According to the design of the AST2600, it has a Silicon Revision ID Register, specifically SCU004 and SCU014, to set the Revision ID for the AST2600. For the AST2600 A3, SCU004 is set to 0x05030303 and SCU014 is set to 0x05030303. In the "aspeed_ast2600_scu_reset" function, the hardcoded value "AST2600_A3_SILICON_REV" is set in SCU004, and "s->silicon_rev" is set in SCU014. The value of "s->silicon_rev" is set by the SOC layer via the "silicon-rev" property. However, the design of the AST2700 is different. There are two SCU controllers: SCU0 (CPU Die) and SCU1 (IO Die). In the AST2700, the firmware reads the SCU Silicon Revision ID register (SCU0_000) and the SCUIO Silicon Revision ID register (SCU1_000), combining them into a single 64-bit value. The upper 32 bits represent the SCUIO, while the lower 32 bits correspond to the SCU. For example, the AST2700-A1 revision is represented as 0x0601010306010103. SCUIO_000 occupies bits [63:32] with a value of 0x06010103 and SCU_000 occupies bits [31:0] with a value of 0x06010103. Reference: https://github.com/AspeedTech-BMC/u-boot/blob/aspeed-master-v2023.10/arch/arm/mach-aspeed/ast2700/cpu-info.c Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Tested-by: Nabih Estefan <nabihestefan@google.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250304064710.2128993-3-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-03-09hw/misc/aspeed_scu: Skipping dram_init in u-bootJamin Lin1-0/+2
Setting BIT6 in VGA0 SCRATCH register will indicate that the ddr traning is done, therefore skipping the u-boot-spl dram_init() process. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Nabih Estefan <nabihestefan@google.com> Link: https://lore.kernel.org/qemu-devel/20250304064710.2128993-2-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
generated by cgit v1.1 at 2025-09-19 16:39:41 +0000