aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2023-08-31Merge tag 'pull-target-arm-20230831' of ↵Stefan Hajnoczi11-106/+627
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * Some of the preliminary patches for Cortex-A710 support * i.MX7 and i.MX6UL refactoring * Implement SRC device for i.MX7 * Catch illegal-exception-return from EL3 with bad NSE/NS * Use 64-bit offsets for holding time_t differences in RTC devices * Model correct number of MPU regions for an505, an521, an524 boards # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmTwbukZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3ihBD/wK8Iz0KpTAwZBDAodnSZrh # tQnJAvYFp8CxA4O8sZ9IeWsZh90gzsTCZi0NqUTTzvWCJfxkB7qTPdlJT5IzVxou # oEUk2aogSJhRA3XRJzqArXsPlnZGSYDbtwKx4VtfCvOCCH08Y7nhnFaRj1oFnR4Q # 0PE/8YtGXTBxLHrO8U3tomg7zElzOUP8ZVZtb30BOyw1jtfSD03IZR8dzpA43u1E # Hh418WvVekmwFoFNh8yUeHzbyXMZufzvbJPuDGJ8pPWwIpvSG6chOnKF8jZll+Ur # DqOsDkGlQgcBR2QwYfSPClrEkX8yahJ95PBfM6giG+DQC7OiElqXqTiUGZcpgUVo # uSUbzS4YPsxCnyVV6SBXV+f/8hdXBxOSHTgl7OAFa8X9OwWwspxHJ/v2o/2ibnUT # hTTkFp/w1nQwVEN8xf1DOUpm/J2Wr8UeH4f776daSrfKAol2BKbHb8dOgGLQCwqb # G+iDcE4bkzRqly6f+uVk8xSEZDd9P1NYoxKV+gNlV1dTspdHVpTC+rXMa8dRw5hI # 4KgaAslj++Xa229xkjORXCJ1cICRIebYg7+SjvTtGBYsFV7plsCcYb/R9yLmhVCf # fKHKKaYe9sQJ82apOIkTc+nnW8BQQx6XUmU/A//iZ8JGLk6DpJcZ8f1m/2rVZTsl # 9+lsmpBf4w+uR4o+Womhfw== # =MFh3 # -----END PGP SIGNATURE----- # gpg: Signature made Thu 31 Aug 2023 06:43:53 EDT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20230831' of https://git.linaro.org/people/pmaydell/qemu-arm: (24 commits) hw/arm: Set number of MPU regions correctly for an505, an521, an524 hw/arm/armv7m: Add mpu-ns-regions and mpu-s-regions properties target/arm: Do all "ARM_FEATURE_X implies Y" checks in post_init rtc: Use time_t for passing and returning time offsets hw/rtc/aspeed_rtc: Use 64-bit offset for holding time_t difference hw/rtc/twl92230: Use int64_t for sec_offset and alm_sec hw/rtc/m48t59: Use 64-bit arithmetic in set_alarm() target/arm: Catch illegal-exception-return from EL3 with bad NSE/NS Add i.MX7 SRC device implementation Add i.MX7 missing TZ devices and memory regions Refactor i.MX7 processor code Add i.MX6UL missing devices. Refactor i.MX6UL processor code Remove i.MX7 IOMUX GPR device from i.MX6UL target/arm: properly document FEAT_CRC32 target/arm: Implement FEAT_HPDS2 as a no-op target/arm: Suppress FEAT_TRBE (Trace Buffer Extension) target/arm: Apply access checks to neoverse-v1 special registers target/arm: Apply access checks to neoverse-n1 special registers target/arm: Introduce make_ccsidr64 ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-08-31hw/arm: Set number of MPU regions correctly for an505, an521, an524Peter Maydell2-0/+45
The IoTKit, SSE200 and SSE300 all default to 8 MPU regions. The MPS2/MPS3 FPGA images don't override these except in the case of AN547, which uses 16 MPU regions. Define properties on the ARMSSE object for the MPU regions (using the same names as the documented RTL configuration settings, and following the pattern we already have for this device of using all-caps names as the RTL does), and set them in the board code. We don't actually need to override the default except on AN547, but it's simpler code to have the board code set them always rather than tracking which board subtypes want to set them to a non-default value separately from what that value is. Tho overall effect is that for mps2-an505, mps2-an521 and mps3-an524 we now correctly use 8 MPU regions, while mps3-an547 stays at its current 16 regions. It's possible some guest code wrongly depended on the previous incorrectly modeled number of memory regions. (Such guest code should ideally check the number of regions via the MPU_TYPE register.) The old behaviour can be obtained with additional -global arguments to QEMU: For mps2-an521 and mps2-an524: -global sse-200.CPU0_MPU_NS=16 -global sse-200.CPU0_MPU_S=16 -global sse-200.CPU1_MPU_NS=16 -global sse-200.CPU1_MPU_S=16 For mps2-an505: -global sse-200.CPU0_MPU_NS=16 -global sse-200.CPU0_MPU_S=16 NB that the way the implementation allows this use of -global is slightly fragile: if the board code explicitly sets the properties on the sse-200 object, this overrides the -global command line option. So we rely on: - the boards that need fixing all happen to use the SSE defaults - we can write the board code to only set the property if it is different from the default, rather than having all boards explicitly set the property - the board that does need to use a non-default value happens to need to set it to the same value (16) we previously used This works, but there are some kinds of refactoring of the mps2-tz.c code that would break the support for -global here. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1772 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230724174335.2150499-4-peter.maydell@linaro.org
2023-08-31hw/arm/armv7m: Add mpu-ns-regions and mpu-s-regions propertiesPeter Maydell1-0/+21
M-profile CPUs generally allow configuration of the number of MPU regions that they have. We don't currently model this, so our implementations of some of the board models provide CPUs with the wrong number of regions. RTOSes like Zephyr that hardcode the expected number of regions may therefore not run on the model if they are set up to run on real hardware. Add properties mpu-ns-regions and mpu-s-regions to the ARMV7M object, matching the ability of hardware to configure the number of Secure and NonSecure regions separately. Our actual CPU implementation doesn't currently support that, and it happens that none of the MPS boards we model set the number of regions differently for Secure vs NonSecure, so we provide an interface to the boards and SoCs that won't need to change if we ever do add that functionality in future, but make it an error to configure the two properties to different values. (The property name on the CPU is the somewhat misnamed-for-M-profile "pmsav7-dregion", so we don't follow that naming convention for the properties here. The TRM doesn't say what the CPU configuration variable names are, so we pick something, and follow the lowercase convention we already have for properties here.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230724174335.2150499-3-peter.maydell@linaro.org
2023-08-31hw/rtc/aspeed_rtc: Use 64-bit offset for holding time_t differencePeter Maydell1-3/+2
In the aspeed_rtc device we store a difference between two time_t values in an 'int'. This is not really correct when time_t could be 64 bits. Enlarge the field to 'int64_t'. This is a migration compatibility break for the aspeed boards. While we are changing the vmstate, remove the accidental duplicate of the offset field. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Cédric Le Goater <clg@kaod.org>
2023-08-31hw/rtc/twl92230: Use int64_t for sec_offset and alm_secPeter Maydell1-2/+2
In the twl92230 device, use int64_t for the two state fields sec_offset and alm_sec, because we set these to values that are either time_t or differences between two time_t values. These fields aren't saved in vmstate anywhere, so we can safely widen them. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-08-31hw/rtc/m48t59: Use 64-bit arithmetic in set_alarm()Peter Maydell1-1/+1
In the m48t59 device we almost always use 64-bit arithmetic when dealing with time_t deltas. The one exception is in set_alarm(), which currently uses a plain 'int' to hold the difference between two time_t values. Switch to int64_t instead to avoid any possible overflow issues. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-08-31Add i.MX7 SRC device implementationJean-Christophe Dubois4-1/+288
The SRC device is normally used to start the secondary CPU. When running Linux directly, QEMU is emulating a PSCI interface that UBOOT is installing at boot time and therefore the fact that the SRC device is unimplemented is hidden as Qemu respond directly to PSCI requets without using the SRC device. But if you try to run a more bare metal application (maybe uboot itself), then it is not possible to start the secondary CPU as the SRC is an unimplemented device. This patch adds the ability to start the secondary CPU through the SRC device so that you can use this feature in bare metal applications. Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: ce9a0162defd2acee5dc7f8a674743de0cded569.1692964892.git.jcd@tribudubois.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-08-31Add i.MX7 missing TZ devices and memory regionsJean-Christophe Dubois1-0/+63
* Add TZASC as unimplemented device. - Allow bare metal application to access this (unimplemented) device * Add CSU as unimplemented device. - Allow bare metal application to access this (unimplemented) device * Add various memory segments - OCRAM - OCRAM EPDC - OCRAM PXP - OCRAM S - ROM - CAAM Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: f887a3483996ba06d40bd62ffdfb0ecf68621987.1692964892.git.jcd@tribudubois.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-08-31Refactor i.MX7 processor codeJean-Christophe Dubois1-39/+91
* Add Addr and size definition for all i.MX7 devices in i.MX7 header file. * Use those newly defined named constants whenever possible. * Standardize the way we init a familly of unimplemented devices - SAI - PWM - CAN * Add/rework few comments Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Message-id: 59e195d33e4d486a8d131392acd46633c8c10ed7.1692964892.git.jcd@tribudubois.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-08-31Add i.MX6UL missing devices.Jean-Christophe Dubois1-0/+16
* Add TZASC as unimplemented device. - Allow bare metal application to access this (unimplemented) device * Add CSU as unimplemented device. - Allow bare metal application to access this (unimplemented) device * Add 4 missing PWM devices Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 59e4dc56e14eccfefd379275ec19048dff9c10b3.1692964892.git.jcd@tribudubois.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-08-31Refactor i.MX6UL processor codeJean-Christophe Dubois1-49/+98
* Add Addr and size definition for most i.MX6UL devices in i.MX6UL header file. * Use those newly defined named constants whenever possible. * Standardize the way we init a familly of unimplemented devices - SAI - PWM - CAN * Add/rework few comments Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Message-id: d579043fbd4e4b490370783fda43fc02c8e9be75.1692964892.git.jcd@tribudubois.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-08-31Remove i.MX7 IOMUX GPR device from i.MX6ULJean-Christophe Dubois1-11/+0
i.MX7 IOMUX GPR device is not equivalent to i.MX6UL IOMUXC GPR device. In particular, register 22 is not present on i.MX6UL and this is actualy The only register that is really emulated in the i.MX7 IOMUX GPR device. Note: The i.MX6UL code is actually also implementing the IOMUX GPR device as an unimplemented device at the same bus adress and the 2 instantiations were actualy colliding. So we go back to the unimplemented device for now. Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Message-id: 48681bf51ee97646479bb261bee19abebbc8074e.1692964892.git.jcd@tribudubois.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-08-30xen_arm: Initialize RAM and add hi/low memory regionsOleksandr Tyshchenko1-0/+45
In order to use virtio backends we need to initialize RAM for the xen-mapcache (which is responsible for mapping guest memory using foreign mapping) to work. Calculate and add hi/low memory regions based on machine->ram_size. Use the constants defined in public header arch-arm.h to be aligned with the xen toolstack. While using this machine, the toolstack should then pass real ram_size using "-m" arg. If "-m" is not given, create a QEMU machine without IOREQ and other emulated devices like TPM and VIRTIO. This is done to keep this QEMU machine usable for /etc/init.d/xencommons. Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com> Signed-off-by: Vikram Garhwal <vikram.garhwal@amd.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
2023-08-30xen_arm: Create virtio-mmio devices during initializationOleksandr Tyshchenko1-0/+35
In order to use virtio backends we need to allocate virtio-mmio parameters (irq and base) and register corresponding buses. Use the constants defined in public header arch-arm.h to be aligned with the toolstack. So the number of current supported virtio-mmio devices is 10. For the interrupts triggering use already existing on Arm device-model hypercall. The toolstack should then insert the same amount of device nodes into guest device-tree. Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com> Signed-off-by: Vikram Garhwal <vikram.garhwal@amd.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
2023-08-24Merge tag 'pull-target-arm-20230824' of ↵Stefan Hajnoczi4-5/+15
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * hw/gpio/nrf51: implement DETECT signal * accel/kvm: Specify default IPA size for arm64 * ptw: refactor, fix some FEAT_RME bugs * target/arm: Adjust PAR_EL1.SH for Device and Normal-NC memory types * target/arm/helper: Implement CNTHCTL_EL2.CNT[VP]MASK * Fix SME ST1Q * Fix 64-bit SSRA # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmTnIoUZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3vufEACPJcwyFvSBHDv4VQ6tbgOU # zwjpUMv4RMKhCOjuxBlJ2DICwOcGNuKer0tc6wkH2T5Ebhoego1osYbRZZoawAJf # ntg+Ndrx1QH9ORuGqYccLXtHnP741KiKggDHM05BJqB7rqtuH+N4fEn7Cdsw/DNg # XuCYD5QrxMYvkSOD1l8W0aqp81ucYPgkFqLufypgxrXUiRZ1RBAmPF47BFFdnM8f # NmrmT1LTF5jr70ySRB+ukK6BAGDc0CUfs6R6nYRwUjRPmSG2rrtUDGo+nOQGDqJo # PHWmt7rdZQG2w7HVyE/yc3h/CQ3NciwWKbCkRlaoujxHx/B6DRynSeO3NXsP8ELu # Gizoi3ltwHDQVIGQA19P5phZKHZf7x3MXmK4fDBGB9znvoSFTcjJqkdaN/ARXXO3 # e1vnK1MqnPI8Z1nGdeVIAUIrqhtLHnrrM7jf1tI/e4sjpl3prHq2PvQkakXu8clr # H8bPZ9zZzyrrSbl4NhpaFTsUiYVxeLoJsNKAmG8dHb+9YsFGXTvEBhtR9eUxnbaV # XyZ3jEdeW7/ngQ4C6XMD2ZDiKVdx2xJ2Pp5npvljldjmtGUvwQabKo+fPDt2fKjM # BwjhHA50I633k4fYIwm8YOb70I4oxoL9Lr6PkKriWPMTI5r7+dtwgigREVwnCn+Y # RsiByKMkDO2TcoQjvBZlCA== # =3MJ8 # -----END PGP SIGNATURE----- # gpg: Signature made Thu 24 Aug 2023 05:27:33 EDT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20230824' of https://git.linaro.org/people/pmaydell/qemu-arm: (35 commits) target/arm: Fix 64-bit SSRA target/arm: Fix SME ST1Q target/arm/helper: Implement CNTHCTL_EL2.CNT[VP]MASK target/arm/helper: Check SCR_EL3.{NSE, NS} encoding for AT instructions target/arm: Pass security space rather than flag for AT instructions target/arm: Skip granule protection checks for AT instructions target/arm/helper: Fix tlbmask and tlbbits for TLBI VAE2* target/arm/ptw: Load stage-2 tables from realm physical space target/arm: Adjust PAR_EL1.SH for Device and Normal-NC memory types target/arm/ptw: Report stage 2 fault level for stage 2 faults on stage 1 ptw target/arm/ptw: Check for block descriptors at invalid levels target/arm/ptw: Set attributes correctly for MMU disabled data accesses target/arm/ptw: Drop S1Translate::out_secure target/arm/ptw: Remove S1Translate::in_secure target/arm/ptw: Remove last uses of ptw->in_secure target/arm/ptw: Only fold in NSTable bit effects in Secure state target/arm: Pass an ARMSecuritySpace to arm_is_el2_enabled_secstate() target/arm/ptw: Pass an ARMSecuritySpace to arm_hcr_el2_eff_secstate() target/arm/ptw: Pass ARMSecurityState to regime_translation_disabled() target/arm/ptw: Pass ptw into get_phys_addr_pmsa*() and get_phys_addr_disabled() ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-08-24Merge tag 'pull-loongarch-20230824' of https://gitlab.com/gaosong/qemu into ↵Stefan Hajnoczi3-7/+9
staging pull-loongarch-20230824 # -----BEGIN PGP SIGNATURE----- # # iLMEAAEIAB0WIQS4/x2g0v3LLaCcbCxAov/yOSY+3wUCZOcdAwAKCRBAov/yOSY+ # 3w3CA/sH8+Ay+Qnaqa2vEyuhOlFQuxHKeR7mYfsitAdzh8yMK2K8C2iBUzDzL1H3 # kZmZbCcYX7ko9RLhsuXmvfBJ7iwzY55ozSHLIjJ/VS4JVE5B0cUSZ5jjIPDqpzDs # 7TUt9qpTkwg0e+klzVREWLSWP5xopvkRvFHZM3KZZhGMphOTUQ== # =/HHZ # -----END PGP SIGNATURE----- # gpg: Signature made Thu 24 Aug 2023 05:04:03 EDT # gpg: using RSA key B8FF1DA0D2FDCB2DA09C6C2C40A2FFF239263EDF # gpg: Good signature from "Song Gao <m17746591750@163.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: B8FF 1DA0 D2FD CB2D A09C 6C2C 40A2 FFF2 3926 3EDF * tag 'pull-loongarch-20230824' of https://gitlab.com/gaosong/qemu: (31 commits) hw/loongarch: Fix ACPI processor id off-by-one error target/loongarch: Split fcc register to fcc0-7 in gdbstub hw/intc/loongarch_pch: fix edge triggered irq handling target/loongarch: cpu: Implement get_arch_id callback target/loongarch: Add avail_IOCSR to check iocsr instructions target/loongarch: Add avail_LSX to check LSX instructions target/loongarch: Add avail_LAM to check atomic instructions target/loongarch: Add avail_LSPW to check LSPW instructions target/loongarch: Add avail_FP/FP_SP/FP_DP to check fpu instructions hw/loongarch: Remove restriction of la464 cores in the virt machine target/loongarch: Add LoongArch32 cpu la132 target/loongarch: Add avail_64 to check la64-only instructions target/loongarch: Add a check parameter to the TRANS macro target/loongarch: Sign extend results in VA32 mode target/loongarch: Truncate high 32 bits of address in VA32 mode target/loongarch: Extract set_pc() helper target/loongarch: Extract make_address_pc() helper target/loongarch: Extract make_address_i() helper target/loongarch: Extract make_address_x() helper target/loongarch: Add LA64 & VA32 to DisasContext ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-08-24hw/loongarch: Fix ACPI processor id off-by-one errorJiajie Chen1-1/+1
In hw/acpi/aml-build.c:build_pptt() function, the code assumes that the ACPI processor id equals to the cpu index, for example if we have 8 cpus, then the ACPI processor id should be in range 0-7. However, in hw/loongarch/acpi-build.c:build_madt() function we broke the assumption. If we have 8 cpus again, the ACPI processor id in MADT table would be in range 1-8. It violates the following description taken from ACPI spec 6.4 table 5.138: If the processor structure represents an actual processor, this field must match the value of ACPI processor ID field in the processor’s entry in the MADT. It will break the latest Linux 6.5-rc6 with the following error message: ACPI PPTT: PPTT table found, but unable to locate core 7 (8) Invalid BIOS PPTT Here 7 is the last cpu index, 8 is the ACPI processor id learned from MADT. With this patch, Linux can properly detect SMT threads when "-smp 8,sockets=1,cores=4,threads=2" is passed: Thread(s) per core: 2 Core(s) per socket: 2 Socket(s): 2 The detection of number of sockets is still wrong, but that is out of scope of the commit. Signed-off-by: Jiajie Chen <c@jia.je> Reviewed-by: Bibo Mao <maobibo@loongson.cn> Message-Id: <20230820105658.99123-2-c@jia.je> Signed-off-by: Song Gao <gaosong@loongson.cn>
2023-08-24hw/intc/loongarch_pch: fix edge triggered irq handlingBibo Mao1-1/+6
For edge triggered irq, qemu_irq_pulse is used to inject irq. It will set irq with high level and low level soon to simluate pulse irq. For edge triggered irq, irq is injected and set as pending at rising level, do not clear irq at lowering level. LoongArch pch interrupt will clear irq for lowering level irq, there will be problem. ACPI ged deivce is edge-triggered irq, it is used for cpu/memory hotplug. This patch fixes memory hotplug issue on LoongArch virt machine. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn> Message-Id: <20230707091557.1474790-1-maobibo@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2023-08-24target/loongarch: cpu: Implement get_arch_id callbackBibo Mao1-0/+2
Implement the callback for getting the architecture-dependent CPU ID, the cpu ID is physical id described in ACPI MADT table, this will be used for cpu hotplug. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn> Message-Id: <20230824005007.2000525-1-maobibo@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2023-08-24hw/loongarch: Remove restriction of la464 cores in the virt machineSong Gao1-5/+0
Allow virt machine to be used with la132 instead of la464. Co-authored-by: Jiajie Chen <c@jia.je> Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20230822032724.1353391-11-gaosong@loongson.cn> Message-Id: <20230822071959.35620-5-philmd@linaro.org>
2023-08-23hw/s390x/s390-virtio-ccw: Remove superfluous code to set the NIC modelThomas Huth1-4/+0
The check for nd->model being NULL was originally required, but in commit e11f463295d95aba ("s390x/virtio: use qemu_check_nic_model()") the corresponding code had been replaced by a call to the function qemu_check_nic_model() - and this in turn calls qemu_find_nic_model() which contains the same check for nd->model being NULL again. So we can remove this from the calling site now. Message-Id: <20230804073525.11857-1-thuth@redhat.com> Reviewed-by: Halil Pasic <pasic@linux.ibm.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-08-23s390x: Convert DPRINTF to trace eventsCédric Le Goater3-46/+44
Output message are slightly modified to ease selection with wildcards and to report extra parameters. Signed-off-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20230804080415.56852-1-clg@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-08-23hw: Add compat machines for 8.2Cornelia Huck8-10/+73
Add 8.2 machine types for arm/i440fx/m68k/q35/s390x/spapr. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20230718142235.135319-1-cohuck@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Acked-by: Laurent Vivier <laurent@vivier.eu> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-08-22accel/kvm: Use negative KVM type for error propagationAkihiko Odaki2-2/+2
On MIPS, kvm_arch_get_default_type() returns a negative value when an error occurred so handle the case. Also, let other machines return negative values when errors occur and declare returning a negative value as the correct way to propagate an error that happened when determining KVM type. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230727073134.134102-5-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-08-22kvm: Introduce kvm_arch_get_default_type hookAkihiko Odaki1-2/+0
kvm_arch_get_default_type() returns the default KVM type. This hook is particularly useful to derive a KVM type that is valid for "none" machine model, which is used by libvirt to probe the availability of KVM. For MIPS, the existing mips_kvm_type() is reused. This function ensures the availability of VZ which is mandatory to use KVM on the current QEMU. Cc: qemu-stable@nongnu.org Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230727073134.134102-2-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: added doc comment for new function] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-08-22hw/gpio/nrf51: implement DETECT signalChris Laplante1-1/+13
Implement nRF51 DETECT signal in the GPIO peripheral. The reference manual makes mention of a per-pin DETECT signal, but these are not exposed to the user. See https://devzone.nordicsemi.com/f/nordic-q-a/39858/gpio-per-pin-detect-signal-available for more information. Currently, I don't see a reason to model these. Signed-off-by: Chris Laplante <chris@laplante.io> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230728160324.1159090-2-chris@laplante.io Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-08-11Merge tag 'pull-riscv-to-apply-20230811-3' of ↵Richard Henderson1-7/+13
https://github.com/alistair23/qemu into staging Sixth RISC-V PR for 8.1 This is a last minute PR for RISC-V. The main goal is to fix https://gitlab.com/qemu-project/qemu/-/issues/1823 which is a regression that means the aclint option cannot be enabled. While we are here we also fixup KVM issue. * KVM: fix mvendorid size * Fixup aclint check # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmTWfK0ACgkQr3yVEwxT # gBNDTw/9EnIjXKBCwSejcL3xYpwTDbUbwou3dkkSjnEkhmxvPPM3H0pWet+xYlPg # Lgt9b9clHZAjqGoHFxEdU8fS0MY4Jq5jDAinsS2TK6czLPBe5EEhyVjoDH5iRhTX # AymK1XgwQ2kAuw2lhcb74GDboajkC7hNhr2Km1hLtpYV7bCW/efAUSO7adG4KBlB # SCu06s9VdFtINW0mVN249JvRVQ1408HCQ5gwA0lLVdXhfHluVidwOjc//ELtdnQn # SeHdX1V+e+3fiYuqmr2UHaJXp9s0ZInOyLIDBPA97SOUdaO/oy+siZYRk25yV99h # Ec7tpNnYJjzppmc++GlzTNpUWVEBM6j+QyD7ioEj4yAGkMEjUlgLcImyGng1TT4i # uvABg91uzJyBoUga3GhZYt/sPW00Jft4VYH3QvGOOwjarIor8K0J7sox8eIOfEs4 # JqCIYX4kas+DwK4+i8WyjMeuihWFJ5ipKR7Gwhbe5uQ5szTXFYIT4TZH/78BWozI # dMu5HOyu5+l9yCy39NP7FjNJ6VQKBYGvlkUr5rLRS0yQWGThaK8wIBMXcuZCW96p # hSy/pratHQYaIRr0ZiqRcNyFNsTMua/C2DMPcjQR1ci8xdj010DoriyS0Vsh88xq # pVgC6gYn59gDUdBx0gB/ZSMu4O+F/+Z5htnucoTxvwpKxUU48Lg= # =x8Fl # -----END PGP SIGNATURE----- # gpg: Signature made Fri 11 Aug 2023 11:23:41 AM PDT # gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013 * tag 'pull-riscv-to-apply-20230811-3' of https://github.com/alistair23/qemu: hw/riscv/virt.c: change 'aclint' TCG check target/riscv/kvm.c: fix mvendorid size in vcpu_set_machine_ids() Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-11hw/riscv/virt.c: change 'aclint' TCG checkDaniel Henrique Barboza1-7/+13
The 'aclint' property is being conditioned with tcg acceleration in virt_machine_class_init(). But acceleration code starts later than the class init of the board, meaning that tcg_enabled() will be always be false during class_init(), and the option is never being declared even when declaring TCG accel: $ ./build/qemu-system-riscv64 -M virt,accel=tcg,aclint=on qemu-system-riscv64: Property 'virt-machine.aclint' not found Fix it by moving the check from class_init() to machine_init(). Tune the description to mention that the option is TCG only. Cc: Philippe Mathieu-Daudé <philmd@linaro.org> Fixes: c0716c81b ("hw/riscv/virt: Restrict ACLINT to TCG") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1823 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20230811160224.440697-2-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2023-08-11Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Richard Henderson2-1/+2
into staging pci: last minute bugfixes two fixes that seem very safe and important enough to sneak in before the release. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmTWXvIPHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRpe7sH/0KteOBt324LUYZ+4NR6EQE5KDsCANGiySBK # r0B6lhcFHvNd2ej0g2hW7lL6nVVCQBkJLLzfNIR/aHkeCmOttfbhv4eF4S6Ho27d # DpkXCPZRT6F11gY7G1swFapNS/f0P7F5LGRjq4sbuw3FpyHBz0DqCQ0GOab2Qorq # VfuOfA01nYGNzHOKrEL7k9Io55oqPVcAe+5TaipNCQ4nW82i32ItTyFjQFdLIAay # qY4HEwP9vPuVwWNdQjXJNfirLMO5GQfEbyKDAjap2sL25zAV2w+mgn7xg/xkTfM6 # iMX2m14lKRMy2hr8dEVh/XdLf7loAN1jSE8/Wdt+PEaexolqxCM= # =1GLE # -----END PGP SIGNATURE----- # gpg: Signature made Fri 11 Aug 2023 09:16:50 AM PDT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [undefined] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: pci: Fix the update of interrupt disable bit in PCI_COMMAND register hw/pci-host: Allow extended config space access for Designware PCIe host Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-11pci: Fix the update of interrupt disable bit in PCI_COMMAND registerGuoyi Tu1-1/+1
The PCI_COMMAND register is located at offset 4 within the PCI configuration space and occupies 2 bytes. The interrupt disable bit is at the 10th bit, which corresponds to the byte at offset 5 in the PCI configuration space. In our testing environment, the guest driver may directly updates the byte at offset 5 in the PCI configuration space. The backtrace looks like as following: at hw/pci/pci.c:1442 at hw/virtio/virtio-pci.c:605 val=5, len=1) at hw/pci/pci_host.c:81 In this situation, the range_covers_byte function called by the pci_default_write_config function will return false, resulting in the inability to handle the interrupt disable update event. To fix this issue, we can use the ranges_overlap function instead of range_covers_byte to determine whether the interrupt bit has been updated. Signed-off-by: Guoyi Tu <tugy@chinatelecom.cn> Signed-off-by: yuanminghao <yuanmh12@chinatelecom.cn> Message-Id: <ce2d0437-8faa-4d61-b536-4668f645a959@chinatelecom.cn> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Fixes: b6981cb57be5 ("pci: interrupt disable bit support")
2023-08-11hw/pci-host: Allow extended config space access for Designware PCIe hostJason Chien1-0/+1
In pcie_bus_realize(), a root bus is realized as a PCIe bus and a non-root bus is realized as a PCIe bus if its parent bus is a PCIe bus. However, the child bus "dw-pcie" is realized before the parent bus "pcie" which is the root PCIe bus. Thus, the extended configuration space is not accessible on "dw-pcie". The issue can be resolved by adding the PCI_BUS_EXTENDED_CONFIG_SPACE flag to "pcie" before "dw-pcie" is realized. Signed-off-by: Jason Chien <jason.chien@sifive.com> Message-Id: <20230809102257.25121-1-jason.chien@sifive.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Signed-off-by: Jason Chien &lt;<a href="mailto:jason.chien@sifive.com" target="_blank">jason.chien@sifive.com</a>&gt;<br>
2023-08-09hw/nvme: fix null pointer access in ruh updateKlaus Jensen1-1/+7
The Reclaim Unit Update operation in I/O Management Receive does not verify the presence of a configured endurance group prior to accessing it. Fix this. Cc: qemu-stable@nongnu.org Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation") Reviewed-by: Jesper Wendel Devantier <j.devantier@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2023-08-09hw/nvme: fix null pointer access in directive receiveKlaus Jensen1-1/+1
nvme_directive_receive() does not check if an endurance group has been configured (set) prior to testing if flexible data placement is enabled or not. Fix this. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1815 Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation") Reviewed-by: Jesper Wendel Devantier <j.devantier@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2023-08-08hw/nvme: fix CRC64 for guard tagAnkit Kumar1-2/+2
The nvme CRC64 generator expects the caller to pass inverted seed value. Pass inverted crc value for metadata buffer. Cc: qemu-stable@nongnu.org Fixes: 44219b6029fc ("hw/nvme: 64-bit pi support") Signed-off-by: Ankit Kumar <ankit.kumar@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2023-08-07Merge tag 'fixes-pull-request' of https://gitlab.com/marcandre.lureau/qemu ↵Richard Henderson3-11/+54
into staging Fixes for 8.1 Hi, Here is a collection of ui, dump and chardev fixes that are worth for 8.1. thanks # -----BEGIN PGP SIGNATURE----- # # iQJQBAABCAA6FiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmTRWDscHG1hcmNhbmRy # ZS5sdXJlYXVAcmVkaGF0LmNvbQAKCRDa6OEJdZac5eUrD/9BvqJ87XSKchV01jji # PmA+yFyI0JSG68oYbNPYJXxkLWdRCKp6GGcT8h1yiVtGH/SVey9spxDqbV+sK0uW # FmqIcmSBbjI4A6+Mne07Iyd0QtgL9H6YNenRXDFLIXLh84HP47Dg9vfgx4AsRY7O # efcCdi43/PoJOelVfn9wIkP/8DU4pZV6IsdtdUxZ3rtu/zwjW61rLzuxtLcAoCIE # rAYiTp699NH5fKBbMzm3puK4hpaPLj4GuGPrSaWVSCcgARqi7LWpgZC5i+a6FUfS # eWzK8WkdvHIPaUPRNl70LTWPKVxJ4PdSxFlIKgiH0bnpXHBvJnO2y1v4jaiGI0y2 # WSHKJWY513zTF4B+pMdQLjNiLotkiqtAXHw5rrjPTuVHxi1N5w6Z/BvWOSAvs8V6 # ijYmjksNoqwfpbPRTyu8psLcmj3fo2UIjQ739PgLN2lfC8d+nzdx4PIIq/ybQdZZ # 7QBJGhxP33Ou8c3ok43Jz3go6w0WOKM0ucG1K1iTVxQ27leMKTO5Zsm2TShG2pMG # CY6d/dumID8+G7sho8TmtTDjC5ZBkY5e27etkS+P4p+Buc60lqDrL+u6UadxWNZ1 # 3ifsQ1PhVTRuhZUJNMcX1Qo3PuEfAOH1ZuCbvXpubHwcUr4o/ZqlVrMaJtYB3ueo # 7SX8YistmktaEeN+Y50qoiEVgg== # =ANQg # -----END PGP SIGNATURE----- # gpg: Signature made Mon 07 Aug 2023 01:46:51 PM PDT # gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5 # gpg: issuer "marcandre.lureau@redhat.com" # gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full] # gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full] * tag 'fixes-pull-request' of https://gitlab.com/marcandre.lureau/qemu: ui/gtk: set scanout mode in gd_egl/gd_gl_area_scanout_texture hw/i386/vmmouse:add relative packet flag for button status dump: kdump-zlib data pages not dumped with pvtime/aarch64 virtio-gpu: reset gfx resources in main thread virtio-gpu: free BHs, by implementing unrealize chardev: report the handshake error Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-07Merge tag 'trivial-patches-pull' of https://gitlab.com/mjt0k/qemu into stagingRichard Henderson2-2/+2
trivial-patches for 2023-08-07 there are 3 trivial bugfixes in there, for 8.1 # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEe3O61ovnosKJMUsicBtPaxppPlkFAmTQzUsPHG1qdEB0bHMu # bXNrLnJ1AAoJEHAbT2saaT5Z438H/3MEc7pR3UllQ/9OFHR9JU8V14sCANgkEWMo # fYNoVPDli24Y5oxFnmC249YdbaO2PtLwxnarxRAXESi9r2PYjVfTMyJvkMYv0fMm # VNK2LE6Cs4pGivBhAFHvdceWlpLXVaea6jTGfoctSqXa0lMKy6ae44SbsJ8vOnPs # 9XXn+rrAtxRoaN10AKE8hRFDHaS4LIxVNhU3Y2aRijlzFRIf9kr8PGRtes56aZS1 # IOZ5YlmibgCh3ZLofj+/4NcT/l4ViKIKmUXv0mSY55VsfmVaANM98biQ55f+4lt7 # BlgI749QMuB7q+5eELOaZsDt7YTXp3Y0LLvGi7kBZIGIzUkSnXI= # =7luP # -----END PGP SIGNATURE----- # gpg: Signature made Mon 07 Aug 2023 03:54:03 AM PDT # gpg: using RSA key 7B73BAD68BE7A2C289314B22701B4F6B1A693E59 # gpg: issuer "mjt@tls.msk.ru" # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" [undefined] # gpg: aka "Michael Tokarev <mjt@debian.org>" [undefined] # gpg: aka "Michael Tokarev <mjt@corpit.ru>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * tag 'trivial-patches-pull' of https://gitlab.com/mjt0k/qemu: Fixed incorrect LLONG alignment for openrisc and cris stubs/colo.c: spelling hw/i2c: Fix bitbang_i2c_data trace event Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-07hw/i386/vmmouse:add relative packet flag for button statusZongmin Zhou1-3/+12
The buttons value use macros instead of direct numbers. If request relative mode, have to add this for guest vmmouse driver to judge this is a relative packet. otherwise,vmmouse driver will not match the condition 'status & VMMOUSE_RELATIVE_PACKET', and can't report events on the correct(relative) input device, result to relative mode unuseful. Signed-off-by: Zongmin Zhou<zhouzongmin@kylinos.cn> Message-ID: <20230413081526.2229916-1-zhouzongmin@kylinos.cn> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2023-08-07virtio-gpu: reset gfx resources in main threadMarc-André Lureau1-7/+31
Calling OpenGL from different threads can have bad consequences if not carefully reviewed. It's not generally supported. In my case, I was debugging a crash in glDeleteTextures from OPENGL32.DLL, where I asked qemu for gl=es, and thus ANGLE implementation was expected. libepoxy did resolution of the global pointer for glGenTexture to the GLES version from the main thread. But it resolved glDeleteTextures to the GL version, because it was done from a different thread without correct context. Oops. Let's stick to the main thread for GL calls by using a BH. Note: I didn't use atomics for reset_finished check, assuming the BQL will provide enough of sync, but I might be wrong. Acked-by: Dongwon Kim <dongwon.kim@intel.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230726173929.690601-3-marcandre.lureau@redhat.com>
2023-08-07virtio-gpu: free BHs, by implementing unrealizeMarc-André Lureau2-1/+11
Acked-by: Dongwon Kim <dongwon.kim@intel.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230726173929.690601-2-marcandre.lureau@redhat.com>
2023-08-07hw/i2c: Fix bitbang_i2c_data trace eventBALATON Zoltan2-2/+2
The clock and data values were logged swapped. Correct the trace event text to match what is logged. Also fix a typo in a comment nearby. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-08-07hw/nvme: fix compliance issue wrt. iosqes/iocqesKlaus Jensen3-36/+20
As of prior to this patch, the controller checks the value of CC.IOCQES and CC.IOSQES prior to enabling the controller. As reported by Ben in GitLab issue #1691, this is not spec compliant. The controller should only check these values when queues are created. This patch moves these checks to nvme_create_cq(). We do not need to check it in nvme_create_sq() since that will error out if the completion queue is not already created. Also, since the controller exclusively supports SQEs of size 64 bytes and CQEs of size 16 bytes, hard code that. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1691 Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2023-08-07hw/nvme: fix oob memory read in fdp events logKlaus Jensen1-0/+5
As reported by Trend Micro's Zero Day Initiative, an oob memory read vulnerability exists in nvme_fdp_events(). The host-provided offset is not verified. Fix this. This is only exploitable when Flexible Data Placement mode (fdp=on) is enabled. Fixes: CVE-2023-4135 Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation") Reported-by: Trend Micro's Zero Day Initiative Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2023-08-04ppc/pegasos2: Fix reg property of 64 bit BARs in device treeBALATON Zoltan1-1/+5
The board firmware handles this correctly following the Open Firmware standard which we missed. This fixes 64 bit BARs when using VOF. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-ID: <20230721221320.1311E7456AB@zero.eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-08-04ppc/pegasos2: Fix naming of device tree nodesBALATON Zoltan1-0/+8
The board firmware names devices by their class so match that for common devices. Also make sure the /rtas node has a name. This is needed because VOF otherwise does not include it in results got by nextprop which is how AmigaOS queries it and fails if no name property is found. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-ID: <808ade37aa141563d1ee349254151672bf7a5d59.1689725688.git.balaton@eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-08-04ppc/pegasos2: Fix reg property of ROM BARsBALATON Zoltan1-1/+5
The register offset of the ROM BAR is 0x30 not 0x28. This fixes the reg property entry of the ROM region in the device tree. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-ID: <6abd73b1211f9d0776dfa5d71d6294f17eecb426.1689725688.git.balaton@eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-08-04ppc/pegasos2: Fix reset state of USB functionsBALATON Zoltan1-0/+4
The original non-free board firmware sets the command register of the USB functions to 7 and some guests rely on this for working USB. Match what the board firmware does when using VOF instead. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-ID: <06a2b864431425f23d1f2b5abf0c027819ac11c6.1689725688.git.balaton@eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-08-03virtio-crypto: verify src&dst buffer length for sym requestzhenwei pi1-0/+5
For symmetric algorithms, the length of ciphertext must be as same as the plaintext. The missing verification of the src_len and the dst_len in virtio_crypto_sym_op_helper() may lead buffer overflow/divulged. This patch is originally written by Yiming Tao for QEMU-SECURITY, resend it(a few changes of error message) in qemu-devel. Fixes: CVE-2023-3180 Fixes: 04b9b37edda("virtio-crypto: add data queue processing handler") Cc: Gonglei <arei.gonglei@huawei.com> Cc: Mauro Matteo Cascella <mcascell@redhat.com> Cc: Yiming Tao <taoym@zju.edu.cn> Signed-off-by: zhenwei pi <pizhenwei@bytedance.com> Message-Id: <20230803024314.29962-2-pizhenwei@bytedance.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-08-03hw/i386/x86-iommu: Fix endianness issue in x86_iommu_irq_to_msi_message()Thomas Huth1-1/+1
The values in "msg" are assembled in host endian byte order (the other field are also not swapped), so we must not swap the __addr_head here. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230802135723.178083-6-thuth@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Xu <peterx@redhat.com>
2023-08-03hw/i386/intel_iommu: Fix index calculation in vtd_interrupt_remap_msi()Thomas Huth1-1/+1
The values in "addr" are populated locally in this function in host endian byte order, so we must not swap the index_l field here. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230802135723.178083-5-thuth@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Xu <peterx@redhat.com>
2023-08-03hw/i386/intel_iommu: Fix struct VTDInvDescIEC on big endian hostsThomas Huth1-0/+9
On big endian hosts, we need to reverse the bitfield order in the struct VTDInvDescIEC, just like it is already done for the other bitfields in the various structs of the intel-iommu device. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230802135723.178083-4-thuth@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com>
generated by cgit v1.1 at 2024-12-27 12:17:29 +0000