aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-07-17Merge tag 'sdmmc-20240716' of https://github.com/philmd/qemu into stagingRichard Henderson
SD/MMC patches queue Addition of eMMC support is a long-term collaborative virtual work by: - Cédric Le Goater - Edgar E. Iglesias - Francisco Iglesias - Joel Stanley - Luc Michel - Philippe Mathieu-Daudé - Sai Pavan Boddu - Vincent Palatin # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmaWvlEACgkQ4+MsLN6t # wN7p7hAAj6JV3fIg1iKBR49asQVzU3/nYRIlWnp6QsLRGX+qwjMnuMzlvpinTtq4 # SJZobw1OJp/2LNaEGqAqNHqBpwAPibUnkei0pd1Y+v6Cyywo7X5Y1hRvQf46Ezqm # u2FxsAfWc4cQs+sFrbNq/v7X2+R6VmChkA+EVc4cB0gwMOjvtg8RQObdhKr7Y6UX # b9KvRDSNMH75ht39RD/smtcn/kprkkTQYo/ciBbVWdnBMiKuhN0qLXbKnZu9lMs4 # Ru29ypT+98pL1E/4YbgNcLGYXHjKrSIpD3+DEvmWe09LdG2+YMASv7do3iKfAYN5 # KdQ9BNZxYrpmeDAiyL521pODsgvU/wDDdbK0xUztPqcHhpYkvcfYWdzO8wr28Ib0 # wOEA0+xzveeD+1ZKjilbZ6tKzsRrKgv1O8j1T8rXab2/3mjrW2R5G/5y4bpM8E4h # KuqGwC2YjWsJi3CwRL5Cvu5YBsiyYF7mk0zTKK2qwO87B7Pa0PJ3Y9x0xIWm4blp # RoZ1SaCChH3M1hKK3jDjrIutXrZG8CzHpe17QjTQeUxo+/wX3VfDYbXasTe1orFu # +JkUBU+xZ6m1+dWAa22H5KbeY8wd99p6w+ChnVmS15WqVK8i2e4gfTsKGh7Idt3t # Vf4CaCD/2vRtKo4AN+YNDUg1DWV89zXRbnkR5oWUWG3Fda5Qo3k= # =m52p # -----END PGP SIGNATURE----- # gpg: Signature made Wed 17 Jul 2024 04:39:13 AM AEST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'sdmmc-20240716' of https://github.com/philmd/qemu: hw/sd/sdcard: Support boot area in emmc image hw/sd/sdcard: Add mmc SWITCH function support (CMD6) hw/sd/sdcard: Add eMMC 'boot-partition-size' property hw/sd/sdcard: Add emmc_cmd_SEND_EXT_CSD handler (CMD8) hw/sd/sdcard: Implement eMMC sleep state (CMD5) hw/sd/sdcard: Add emmc_cmd_PROGRAM_CID handler (CMD26) hw/sd/sdcard: Fix SET_BLOCK_COUNT command argument on eMMC (CMD23) hw/sd/sdcard: Add emmc_cmd_SET_RELATIVE_ADDR handler (CMD3) hw/sd/sdcard: Register unimplemented command handlers hw/sd/sdcard: Register generic command handlers hw/sd/sdcard: Basis for eMMC support Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-17Merge tag 'hw-misc-20240716' of https://github.com/philmd/qemu into stagingRichard Henderson
Misc HW & UI patches queue - Allow loading safely ROMs larger than 4GiB (Gregor) - Convert vt82c686 IRQ as named 'intr' (Bernhard) - Clarify QDev GPIO API (Peter) - Drop unused load_image_gzipped function (Ani) - Make TCGCPUOps::cpu_exec_interrupt handler mandatory (Peter) - Factor cpu_pause() out (Nicholas) - Remove transfer size check from ESP DMA DATA IN / OUT transfers (Mark) - Add accelerated cursor composition to Cocoa UI (Akihiko) - Fix '-vga help' CLI (Marc-André) - Fix displayed errno in ram_block_add (Zhenzhong) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmaWto0ACgkQ4+MsLN6t # wN54fBAAwfhSQ9PKTYNlnsmJteXAsPCUg8KZwRblkAZs1z/xJX/sFKJF3PZ8fn4r # Ty+Fiu4Sylfv19mTc/8Bc8pKfHn9zwY7Kb/H5kHjEuFwEZolODHXO8znRV621iZq # PAeI64dVo5yIgqlAnf6xPSITwe2f75IS0ivIIKYwFsPqeGMUl6dvh/5xqoxis/hQ # j/1hFLe+jX4whIcOFcqbR3oV3CZy+nMBLJH1/OtvKJ5aC8vFxt5xsKM0xkG94Pmx # iYhVx4yjULRSSLMaRowqHqEtPB0pmYyuxz0CwjlcI8PU+gUa+dsZLOomD8YenmJR # FQubQJOKkqlvQ8j7+2okwQs3NDW1TzwsYnvJKB3+EE+DD3Wq/ny5D0eMcnn5NW1Z # 7rO624XhkvLsJlTJzVvuzpulmC+UFb/6S8CyStGPDxWCGrU3WqdZeoqbbhmXzacU # ck17Cs2Ma4k0OIRYgAVdnwq96cuQCFNNzNq/iakcJs5Lsaa6Cai/YByKf1tBaGRm # d/mJgN7WAJrOSpiRhNuNlay4O+hX0rn+wLwecbKW9sbKuoo9eHjzi8YAQuw/TVYr # oMF/McqtWFCUyVt0eHtA3C+1dSW4+qQTDQSvabbXx54otRSEnMSEubgYFsdu3hF4 # P0mZyxPg4nPxy3uoz9hVQ63F45quaXX/B2fwvoYSBl58xuyxY6M= # =rOg6 # -----END PGP SIGNATURE----- # gpg: Signature made Wed 17 Jul 2024 04:06:05 AM AEST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'hw-misc-20240716' of https://github.com/philmd/qemu: system/physmem: use return value of ram_block_discard_require() as errno vl: fix "type is NULL" in -vga help ui/console: Remove dpy_cursor_define_supported() ui/cocoa: Add cursor composition ui/console: Convert mouse visibility parameter into bool ui/cocoa: Release CGColorSpace esp: remove transfer size check from DMA DATA IN and DATA OUT transfers system/cpus: Add cpu_pause() function accel/tcg: Make cpu_exec_interrupt hook mandatory loader: remove load_image_gzipped function as its not used anywhere include/hw/qdev-core.h: Correct and clarify gpio doc comments hw/isa/vt82c686: Turn "intr" irq into a named gpio hw/core/loader: allow loading larger ROMs Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-16hw/sd/sdcard: Support boot area in emmc imageJoel Stanley
This assumes a specially constructed image: $ dd if=/dev/zero of=mmc-bootarea.img count=2 bs=1M $ dd if=u-boot-spl.bin of=mmc-bootarea.img conv=notrunc $ dd if=u-boot.bin of=mmc-bootarea.img conv=notrunc count=64 bs=1K $ cat mmc-bootarea.img obmc-phosphor-image.wic > mmc.img $ truncate --size 16GB mmc.img For now this still requires a mtd image to load the SPL: $ qemu-system-arm -M tacoma-bmc -nographic \ -global driver=sd-card,property=emmc,value=true \ -drive file=mmc.img,if=sd,index=2,format=raw Signed-off-by: Joel Stanley <joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240712162719.88165-12-philmd@linaro.org>
2024-07-16hw/sd/sdcard: Add mmc SWITCH function support (CMD6)Sai Pavan Boddu
switch operation in mmc cards, updated the ext_csd register to request changes in card operations. Here we implement similar sequence but requests are mostly dummy and make no change. Implement SWITCH_ERROR if the write operation offset goes beyond length of ext_csd. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> [PMD: Convert to SDProto handlers, add trace events] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240712162719.88165-11-philmd@linaro.org>
2024-07-16hw/sd/sdcard: Add eMMC 'boot-partition-size' propertyPhilippe Mathieu-Daudé
Avoid hardcoding 1MiB boot size in EXT_CSD_BOOT_MULT, expose it as 'boot-partition-size' QOM property. By default, do not use any size. The board is responsible to set the boot partition size property. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240712162719.88165-10-philmd@linaro.org>
2024-07-16hw/sd/sdcard: Add emmc_cmd_SEND_EXT_CSD handler (CMD8)Vincent Palatin
The parameters mimick a real 4GB eMMC, but it can be set to various sizes. Signed-off-by: Vincent Palatin <vpalatin@chromium.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Cédric Le Goater <clg@redhat.com> EXT_CSD values from Vincent's patch simplivied for Spec v4.3: - Remove deprecated keys: . EXT_CSD_SEC_ERASE_MULT . EXT_CSD_SEC_TRIM_MULT - Set some keys to not defined / implemented: . EXT_CSD_HPI_FEATURES . EXT_CSD_BKOPS_SUPPORT . EXT_CSD_SEC_FEATURE_SUPPORT . EXT_CSD_ERASE_TIMEOUT_MULT . EXT_CSD_PART_SWITCH_TIME . EXT_CSD_OUT_OF_INTERRUPT_TIME - Simplify: . EXT_CSD_ACC_SIZE (6 -> 1) 16KB of super_page_size -> 512B (BDRV_SECTOR_SIZE) . EXT_CSD_HC_ERASE_GRP_SIZE (4 -> 1) . EXT_CSD_HC_WP_GRP_SIZE (4 -> 1) . EXT_CSD_S_C_VCC[Q] (8 -> 1) . EXT_CSD_S_A_TIMEOUT (17 -> 1) . EXT_CSD_CARD_TYPE (7 -> 3) Dual data rate -> High-Speed mode - Update: . EXT_CSD_CARD_TYPE (7 -> 3) High-Speed MultiMediaCard @ 26MHz & 52MHz . Performances (0xa -> 0x46) Class B at 3MB/s. -> Class J at 21MB/s . EXT_CSD_REV (5 -> 3) Rev 1.5 (spec v4.41) -> Rev 1.3 (spec v4.3) - Use load/store API to set EXT_CSD_SEC_CNT - Remove R/W keys, normally zeroed at reset . EXT_CSD_BOOT_INFO Migrate the Modes segment (192 lower bytes) but not the full EXT_CSD register, see Spec v4.3, chapter 8.4 "Extended CSD register": The Extended CSD register defines the card properties and selected modes. It is 512 bytes long. The most significant 320 bytes are the Properties segment, which defines the card capabilities and cannot be modified by the host. The lower 192 bytes are the Modes segment, which defines the configuration the card is working in. These modes can be changed by the host by means of the SWITCH command. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240712162719.88165-9-philmd@linaro.org>
2024-07-16hw/sd/sdcard: Implement eMMC sleep state (CMD5)Luc Michel
The JEDEC standards specifies a sleep state where the eMMC won't answer any command appart from RESET and WAKEUP and go to low power state. Implement this state and the corresponding command number 5. Signed-off-by: Luc Michel <luc.michel@amd.com> Signed-off-by: Francisco Iglesias <francisco.iglesias@amd.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240712162719.88165-8-philmd@linaro.org>
2024-07-16hw/sd/sdcard: Add emmc_cmd_PROGRAM_CID handler (CMD26)Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Message-Id: <20240712162719.88165-7-philmd@linaro.org>
2024-07-16hw/sd/sdcard: Fix SET_BLOCK_COUNT command argument on eMMC (CMD23)Cédric Le Goater
The number of blocks is defined in the lower bits [15:0]. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240712162719.88165-6-philmd@linaro.org>
2024-07-16hw/sd/sdcard: Add emmc_cmd_SET_RELATIVE_ADDR handler (CMD3)Cédric Le Goater
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240712162719.88165-5-philmd@linaro.org>
2024-07-16hw/sd/sdcard: Register unimplemented command handlersPhilippe Mathieu-Daudé
Per the spec v4.3 these commands are mandatory, but we don't implement them. Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240712162719.88165-4-philmd@linaro.org>
2024-07-16hw/sd/sdcard: Register generic command handlersPhilippe Mathieu-Daudé
Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240712162719.88165-3-philmd@linaro.org>
2024-07-16hw/sd/sdcard: Basis for eMMC supportPhilippe Mathieu-Daudé
Since eMMC are soldered on boards, it is not user-creatable. RCA register is initialized to 0x0001, per spec v4.3, chapter 8.5 "RCA register": The default value of the RCA register is 0x0001. The value 0x0000 is reserved to set all cards into the Stand-by State with CMD7. The CSD register is very similar to SD one, except the version announced is v4.3. eMMC CID register is slightly different from SD: - One extra PNM (5 -> 6) - MDT is only 1 byte (2 -> 1). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240712162719.88165-2-philmd@linaro.org>
2024-07-16system/physmem: use return value of ram_block_discard_require() as errnoZhenzhong Duan
When ram_block_discard_require() fails, errno is passed to error_setg_errno(). It's a stale value or 0 which is unrelated to ram_block_discard_require(). As ram_block_discard_require() already returns -EBUSY in failure case, use it as errno for error_setg_errno(). Fixes: 852f0048f3ea ("make guest_memfd require uncoordinated discard") Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Message-ID: <20240716064213.290696-1-zhenzhong.duan@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16vl: fix "type is NULL" in -vga helpMarc-André Lureau
Don't pass NULL to module_object_class_by_name(), when the interface is unavailable. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240715114420.2062870-1-marcandre.lureau@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16ui/console: Remove dpy_cursor_define_supported()Akihiko Odaki
Remove dpy_cursor_define_supported() as it brings no benefit today and it has a few inherent problems. All graphical displays except egl-headless support cursor composition without DMA-BUF, and egl-headless is meant to be used in conjunction with another graphical display, so dpy_cursor_define_supported() always returns true and meaningless. Even if we add a new display without cursor composition in the future, dpy_cursor_define_supported() will be problematic as a cursor display fix for it because some display devices like virtio-gpu cannot tell the lack of cursor composition capability to the guest and are unable to utilize the value the function returns. Therefore, all non-headless graphical displays must actually implement cursor composition for correct cursor display. Another problem with dpy_cursor_define_supported() is that it returns true even if only some of the display listeners support cursor composition, which is wrong unless all display listeners that lack cursor composition is headless. Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Phil Dennis-Jordan <phil@philjordan.eu> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-ID: <20240715-cursor-v3-4-afa5b9492dbf@daynix.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16ui/cocoa: Add cursor compositionAkihiko Odaki
Add accelerated cursor composition to ui/cocoa. This does not only improve performance for display devices that exposes the capability to the guest according to dpy_cursor_define_supported(), but fixes the cursor display for devices that unconditionally expects the availability of the capability (e.g., virtio-gpu). The common pattern to implement accelerated cursor composition is to replace the cursor and warp it so that the replaced cursor is shown at the correct position on the guest display for relative pointer devices. Unfortunately, ui/cocoa cannot do the same because warping the cursor position interfers with the mouse input so it uses CALayer instead; although it is not specialized for cursor composition, it still can compose images with hardware acceleration. Co-authored-by: Phil Dennis-Jordan <phil@philjordan.eu> Tested-by: Phil Dennis-Jordan <phil@philjordan.eu> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-ID: <20240715-cursor-v3-3-afa5b9492dbf@daynix.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16ui/console: Convert mouse visibility parameter into boolAkihiko Odaki
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: Phil Dennis-Jordan <phil@philjordan.eu> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240715-cursor-v3-2-afa5b9492dbf@daynix.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16ui/cocoa: Release CGColorSpaceAkihiko Odaki
CGImageCreate | Apple Developer Documentation https://developer.apple.com/documentation/coregraphics/1455149-cgimagecreate > The color space is retained; on return, you may safely release it. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Tested-by: Phil Dennis-Jordan <phil@philjordan.eu> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240715-cursor-v3-1-afa5b9492dbf@daynix.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16esp: remove transfer size check from DMA DATA IN and DATA OUT transfersMark Cave-Ayland
The transfer size check was originally added to prevent consecutive DMA TI commands from causing an assert() due to an existing SCSI request being in progress, but since the last set of updates [*] this is no longer required. Remove the transfer size check from DMA DATA IN and DATA OUT transfers so that issuing a DMA TI command when there is no data left to transfer does not cause an assert() due to an existing SCSI request being in progress. [*] See commits f3ace75be8..78d68f312a Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2415 Message-ID: <20240713224249.468084-1-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16system/cpus: Add cpu_pause() functionNicholas Piggin
This factors the CPU pause function from pause_all_vcpus() into a new cpu_pause() function, similarly to cpu_resume(). cpu_resume() is moved to keep it next to cpu_pause(). Cc: Philippe Mathieu-Daudé <philmd@linaro.org> Cc: Peter Xu <peterx@redhat.com> Cc: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Xu <peterx@redhat.com> Message-ID: <20240712120247.477133-17-npiggin@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16accel/tcg: Make cpu_exec_interrupt hook mandatoryPeter Maydell
The TCGCPUOps::cpu_exec_interrupt hook is currently not mandatory; if it is left NULL then we treat it as if it had returned false. However since pretty much every architecture needs to handle interrupts, almost every target we have provides the hook. The one exception is Tricore, which doesn't currently implement the architectural interrupt handling. Add a "do nothing" implementation of cpu_exec_hook for Tricore, assert on startup that the CPU does provide the hook, and remove the runtime NULL check before calling it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240712113949.4146855-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16loader: remove load_image_gzipped function as its not used anywhereAni Sinha
load_image_gzipped() does not seem to be used anywhere. Remove it. Signed-off-by: Ani Sinha <anisinha@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240711072448.32673-1-anisinha@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16include/hw/qdev-core.h: Correct and clarify gpio doc commentsPeter Maydell
The doc comments for the functions for named GPIO inputs and outputs had a couple of problems: * some copy-and-paste errors meant the qdev_connect_gpio_out_named() doc comment had references to input GPIOs that should be to output GPIOs * it wasn't very clear that named GPIOs are arrays and so the connect functions specify a single GPIO line by giving both the name of the array and the index within that array Fix the copy-and-paste errors and slightly expand the text to say that functions are connecting one line in a named GPIO array, not a single named GPIO line. Reported-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240708153312.3109380-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16hw/isa/vt82c686: Turn "intr" irq into a named gpioBernhard Beschow
Makes the code more comprehensible, matches the datasheet and the piix4 device model. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240704205854.18537-2-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16hw/core/loader: allow loading larger ROMsGregor Haas
The read() syscall is not guaranteed to return all data from a file. The default ROM loader implementation currently does not take this into account, instead failing if all bytes are not read at once. This change loads the ROM using g_file_get_contents() instead, which correctly reads all data using multiple calls to read() while also returning the loaded ROM size. Signed-off-by: Gregor Haas <gregorhaas1997@gmail.com> Reviewed-by: Xingtao Yao <yaoxt.fnst@fujitsu.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240628182706.99525-1-gregorhaas1997@gmail.com> [PMD: Use gsize with g_file_get_contents()] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16target/i386/tcg: save current task state before loading new onePaolo Bonzini
This is how the steps are ordered in the manual. EFLAGS.NT is overwritten after the fact in the saved image. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16target/i386/tcg: use X86Access for TSS accessPaolo Bonzini
This takes care of probing the vaddr range in advance, and is also faster because it avoids repeated TLB lookups. It also matches the Intel manual better, as it says "Checks that the current (old) TSS, new TSS, and all segment descriptors used in the task switch are paged into system memory"; note however that it's not clear how the processor checks for segment descriptors, and this check is not included in the AMD manual. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16target/i386/tcg: check for correct busy state before switching to a new taskPaolo Bonzini
This step is listed in the Intel manual: "Checks that the new task is available (call, jump, exception, or interrupt) or busy (IRET return)". The AMD manual lists the same operation under the "Preventing recursion" paragraph of "12.3.4 Nesting Tasks", though it is not clear if the processor checks the busy bit in the IRET case. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16target/i386/tcg: Compute MMU index oncePaolo Bonzini
Add the MMU index to the StackAccess struct, so that it can be cached or (in the next patch) computed from information that is not in CPUX86State. Co-developed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16target/i386/tcg: Introduce x86_mmu_index_{kernel_,}plRichard Henderson
Disconnect mmu index computation from the current pl as stored in env->hflags. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Link: https://lore.kernel.org/r/20240617161210.4639-2-richard.henderson@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16target/i386/tcg: Reorg push/pop within seg_helper.cRichard Henderson
Interrupts and call gates should use accesses with the DPL as the privilege level. While computing the applicable MMU index is easy, the harder thing is how to plumb it in the code. One possibility could be to add a single argument to the PUSH* macros for the privilege level, but this is repetitive and risks confusion between the involved privilege levels. Another possibility is to pass both CPL and DPL, and adjusting both PUSH* and POP* to use specific privilege levels (instead of using cpu_{ld,st}*_data). This makes the code more symmetric. However, a more complicated but much nicer approach is to use a structure to contain the stack parameters, env, unwind return address, and rewrite the macros into functions. The struct provides an easy home for the MMU index as well. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Link: https://lore.kernel.org/r/20240617161210.4639-4-richard.henderson@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16target/i386/tcg: use PUSHL/PUSHW for error codePaolo Bonzini
Do not pre-decrement esp, let the macros subtract the appropriate operand size. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16target/i386/tcg: Allow IRET from user mode to user mode with SMAPPaolo Bonzini
This fixes a bug wherein i386/tcg assumed an interrupt return using the IRET instruction was always returning from kernel mode to either kernel mode or user mode. This assumption is violated when IRET is used as a clever way to restore thread state, as for example in the dotnet runtime. There, IRET returns from user mode to user mode. This bug is that stack accesses from IRET and RETF, as well as accesses to the parameters in a call gate, are normal data accesses using the current CPL. This manifested itself as a page fault in the guest Linux kernel due to SMAP preventing the access. This bug appears to have been in QEMU since the beginning. Analyzed-by: Robert R. Henry <rrh.henry@gmail.com> Co-developed-by: Robert R. Henry <rrh.henry@gmail.com> Signed-off-by: Robert R. Henry <rrh.henry@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16target/i386/tcg: Remove SEG_ADDLRichard Henderson
This truncation is now handled by MMU_*32_IDX. The introduction of MMU_*32_IDX in fact applied correct 32-bit wraparound to 16-bit accesses with a high segment base (e.g. big real mode or vm86 mode), which did not use SEG_ADDL. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Link: https://lore.kernel.org/r/20240617161210.4639-3-richard.henderson@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16target/i386/tcg: fix POP to memory in long modePaolo Bonzini
In long mode, POP to memory will write a full 64-bit value. However, the call to gen_writeback() in gen_POP will use MO_32 because the decoding table is incorrect. The bug was latent until commit aea49fbb01a ("target/i386: use gen_writeback() within gen_POP()", 2024-06-08), and then became visible because gen_op_st_v now receives op->ot instead of the "ot" returned by gen_pop_T0. Analyzed-by: Clément Chigot <chigot@adacore.com> Fixes: 5e9e21bcc4d ("target/i386: move 60-BF opcodes to new decoder", 2024-05-07) Tested-by: Clément Chigot <chigot@adacore.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16hpet: fix HPET_TN_SETVAL for high 32-bits of the comparatorPaolo Bonzini
Commit 3787324101b ("hpet: Fix emulation of HPET_TN_SETVAL (Jan Kiszka)", 2009-04-17) applied the fix only to the low 32-bits of the comparator, but it should be done for the high bits as well. Otherwise, the high 32-bits of the comparator cannot be written and they remain fixed to 0xffffffff. Co-developed-by: TaiseiIto <taisei1212@outlook.jp> Signed-off-by: TaiseiIto <taisei1212@outlook.jp> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16hpet: fix clamping of periodPaolo Bonzini
When writing a new period, the clamping should use a maximum value rather tyhan a bit mask. Also, when writing the high bits new_val is shifted right by 32, so the maximum allowed period should also be shifted right. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16docs: Update description of 'user=username' for '-run-with'Boqiao Fu
The description of '-runas' and '-run-with' didn't explain that QEMU will use setuid/setgid to implement the option, so the user might get confused if using 'elevateprivileges=deny' as well. Since '-runas' is going to be deprecated and replaced by '-run-with' in the coming qemu9.1, add the message there. Signed-off-by: Boqiao Fu <bfu@redhat.com> Link: https://lore.kernel.org/r/CAFRHJ6J9uMk+HMZL+W+KE1yoRCOLPgbPUVVDku55sdXYiGXXHg@mail.gmail.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16qemu/timer: Add host ticks function for LoongArchSong Gao
Signed-off-by: Song Gao <gaosong@loongson.cn> Link: https://lore.kernel.org/r/20240716031500.4193498-1-gaosong@loongson.cn Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16scsi: fix regression and honor bootindex again for legacy drivesFiona Ebner
Commit 3089637461 ("scsi: Don't ignore most usb-storage properties") removed the call to object_property_set_int() and thus the 'set' method for the bootindex property was also not called anymore. Here that method is device_set_bootindex() (as configured by scsi_dev_instance_init() -> device_add_bootindex_property()) which as a side effect registers the device via add_boot_device_path(). As reported by a downstream user [0], the bootindex property did not have the desired effect anymore for legacy drives. Fix the regression by explicitly calling the add_boot_device_path() function after checking that the bootindex is not yet used (to avoid add_boot_device_path() calling exit()). [0]: https://forum.proxmox.com/threads/149772/post-679433 Cc: qemu-stable@nongnu.org Fixes: 3089637461 ("scsi: Don't ignore most usb-storage properties") Suggested-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Fiona Ebner <f.ebner@proxmox.com> Link: https://lore.kernel.org/r/20240710152529.1737407-1-f.ebner@proxmox.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16hw/scsi/lsi53c895a: bump instruction limit in scripts processing to fix ↵Fiona Ebner
regression Commit 9876359990 ("hw/scsi/lsi53c895a: add timer to scripts processing") reduced the maximum allowed instruction count by a factor of 100 all the way down to 100. This causes the "Check Point R81.20 Gaia" appliance [0] to fail to boot after fully finishing the installation via the appliance's web interface (there is already one reboot before that). With a limit of 150, the appliance still fails to boot, while with a limit of 200, it works. Bump to 500 to fix the regression and be on the safe side. Originally reported in the Proxmox community forum[1]. [0]: https://support.checkpoint.com/results/download/124397 [1]: https://forum.proxmox.com/threads/149772/post-683459 Cc: qemu-stable@nongnu.org Fixes: 9876359990 ("hw/scsi/lsi53c895a: add timer to scripts processing") Signed-off-by: Fiona Ebner <f.ebner@proxmox.com> Acked-by: Sven Schnelle <svens@stackframe.org> Link: https://lore.kernel.org/r/20240715131403.223239-1-f.ebner@proxmox.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16disas: Fix build against Capstone v6Gustavo Romero
Capstone v6 made major changes, such as renaming for AArch64, which broke programs using the old headers, like QEMU. However, Capstone v6 provides the CAPSTONE_AARCH64_COMPAT_HEADER compatibility definition allowing to build against v6 with the old definitions, so fix the QEMU build using it. We can lift that definition and switch to the new naming once our supported distros have Capstone v6 in place. Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org> Suggested-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Link: https://lore.kernel.org/r/20240715213943.1210355-1-gustavo.romero@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16cpu: Free queued CPU workAkihiko Odaki
Running qemu-system-aarch64 -M virt -nographic and terminating it will result in a LeakSanitizer error due to remaining queued CPU work so free it. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Link: https://lore.kernel.org/r/20240714-cpu-v1-1-19c2f8de2055@daynix.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16Revert "qemu-char: do not operate on sources from finalize callbacks"Sergey Dyasli
This reverts commit 2b316774f60291f57ca9ecb6a9f0712c532cae34. After 038b4217884c ("Revert "chardev: use a child source for qio input source"") we've been observing the "iwp->src == NULL" assertion triggering periodically during the initial capabilities querying by libvirtd. One of possible backtraces: Thread 1 (Thread 0x7f16cd4f0700 (LWP 43858)): 0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 1 0x00007f16c6c21e65 in __GI_abort () at abort.c:79 2 0x00007f16c6c21d39 in __assert_fail_base at assert.c:92 3 0x00007f16c6c46e86 in __GI___assert_fail (assertion=assertion@entry=0x562e9bcdaadd "iwp->src == NULL", file=file@entry=0x562e9bcdaac8 "../chardev/char-io.c", line=line@entry=99, function=function@entry=0x562e9bcdab10 <__PRETTY_FUNCTION__.20549> "io_watch_poll_finalize") at assert.c:101 4 0x0000562e9ba20c2c in io_watch_poll_finalize (source=<optimized out>) at ../chardev/char-io.c:99 5 io_watch_poll_finalize (source=<optimized out>) at ../chardev/char-io.c:88 6 0x00007f16c904aae0 in g_source_unref_internal () from /lib64/libglib-2.0.so.0 7 0x00007f16c904baf9 in g_source_destroy_internal () from /lib64/libglib-2.0.so.0 8 0x0000562e9ba20db0 in io_remove_watch_poll (source=0x562e9d6720b0) at ../chardev/char-io.c:147 9 remove_fd_in_watch (chr=chr@entry=0x562e9d5f3800) at ../chardev/char-io.c:153 10 0x0000562e9ba23ffb in update_ioc_handlers (s=0x562e9d5f3800) at ../chardev/char-socket.c:592 11 0x0000562e9ba2072f in qemu_chr_fe_set_handlers_full at ../chardev/char-fe.c:279 12 0x0000562e9ba207a9 in qemu_chr_fe_set_handlers at ../chardev/char-fe.c:304 13 0x0000562e9ba2ca75 in monitor_qmp_setup_handlers_bh (opaque=0x562e9d4c2c60) at ../monitor/qmp.c:509 14 0x0000562e9bb6222e in aio_bh_poll (ctx=ctx@entry=0x562e9d4c2f20) at ../util/async.c:216 15 0x0000562e9bb4de0a in aio_poll (ctx=0x562e9d4c2f20, blocking=blocking@entry=true) at ../util/aio-posix.c:722 16 0x0000562e9b99dfaa in iothread_run (opaque=0x562e9d4c26f0) at ../iothread.c:63 17 0x0000562e9bb505a4 in qemu_thread_start (args=0x562e9d4c7ea0) at ../util/qemu-thread-posix.c:543 18 0x00007f16c70081ca in start_thread (arg=<optimized out>) at pthread_create.c:479 19 0x00007f16c6c398d3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 io_remove_watch_poll(), which makes sure that iwp->src is NULL, calls g_source_destroy() which finds that iwp->src is not NULL in the finalize callback. This can only happen if another thread has managed to trigger io_watch_poll_prepare() callback in the meantime. Move iwp->src destruction back to the finalize callback to prevent the described race, and also remove the stale comment. The deadlock glib bug was fixed back in 2010 by b35820285668 ("gmain: move finalization of GSource outside of context lock"). Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Sergey Dyasli <sergey.dyasli@nutanix.com> Link: https://lore.kernel.org/r/20240712092659.216206-1-sergey.dyasli@nutanix.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16i386/sev: Don't allow automatic fallback to legacy KVM_SEV*_INITMichael Roth
Currently if the 'legacy-vm-type' property of the sev-guest object is 'on', QEMU will attempt to use the newer KVM_SEV_INIT2 kernel interface in conjunction with the newer KVM_X86_SEV_VM and KVM_X86_SEV_ES_VM KVM VM types. This can lead to measurement changes if, for instance, an SEV guest was created on a host that originally had an older kernel that didn't support KVM_SEV_INIT2, but is booted on the same host later on after the host kernel was upgraded. Instead, if legacy-vm-type is 'off', QEMU should fail if the KVM_SEV_INIT2 interface is not provided by the current host kernel. Modify the fallback handling accordingly. In the future, VMSA features and other flags might be added to QEMU which will require legacy-vm-type to be 'off' because they will rely on the newer KVM_SEV_INIT2 interface. It may be difficult to convey to users what values of legacy-vm-type are compatible with which features/options, so as part of this rework, switch legacy-vm-type to a tri-state OnOffAuto option. 'auto' in this case will automatically switch to using the newer KVM_SEV_INIT2, but only if it is required to make use of new VMSA features or other options only available via KVM_SEV_INIT2. Defining 'auto' in this way would avoid inadvertantly breaking compatibility with older kernels since it would only be used in cases where users opt into newer features that are only available via KVM_SEV_INIT2 and newer kernels, and provide better default behavior than the legacy-vm-type=off behavior that was previously in place, so make it the default for 9.1+ machine types. Cc: Daniel P. Berrangé <berrange@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> cc: kvm@vger.kernel.org Signed-off-by: Michael Roth <michael.roth@amd.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Link: https://lore.kernel.org/r/20240710041005.83720-1-michael.roth@amd.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16Merge tag 'python-pull-request' of https://gitlab.com/jsnow/qemu into stagingRichard Henderson
Python: 3.13 compat & sphinx minver bump # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+ber27ys35W+dsvQfe+BBqr8OQ4FAmaVXSsACgkQfe+BBqr8 # OQ6tQw//blMWAbcaijg+GyesMrJGJ2xJx0G68DNfhGgpsTcRu9qnd3Q+s56c2pLq # iJwxaRtTOaYvUhDdcsjpxKJXUIn2WnoqePb31lxXtB9DMxJW6egOvoEzYVpBqlER # mFp4Feo8bi4/immHcnB8J05fJqGB5Rthp3Bl0s+QH6s2OKHl4rIKYNZTrxwrqKoF # 8vLg25MMHVzsojXPMfr6VTfxQ84OWXPvHTKMg5E0/OEK6FxGo3PSVTSpc6MtQJuV # UPAWVqykfuiXC08xg9QpzEvcJGXhGjNDILWWxI+d/8e1rkTiDqOb0LvLhWsa7paO # LOwsC863YpEPxH0utwfqNQKdTZx1VcnAss4uxULXBucnZ2J7OZp/xZ3xbJCHIbuN # XRX7/bGKQl3KJ+d+fw5Nto0ANScU+uGaOMAb4tAT+0ChD3uVmkjS4h8D3BAoCBeO # 9PNtUkpaNGeRAg+iFrGKLTtEUUVsJNIKTlFLSEHRJUCI+/AvX+UvZeEVnlO+qf1/ # rz1chIbw6YgY60NEc7dy7aDhqa9hPTRSYwT79WoPUh74hIiwE3d4TJfL22n5H2jM # 0ryVPd+lIC7XqF+1FDx/PMxD0mhX2k++WjEpYldsZ2s3UQP5L8M8APKm6MHdMGhn # rl0fPyVSveF7CMTvy1Y9BTycZHQAOH/9QMM1fm+6JBFgz52QsYg= # =PLig # -----END PGP SIGNATURE----- # gpg: Signature made Tue 16 Jul 2024 03:32:27 AM AEST # gpg: using RSA key F9B7ABDBBCACDF95BE76CBD07DEF8106AAFC390E # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: FAEB 9711 A12C F475 812F 18F2 88A9 064D 1835 61EB # Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76 CBD0 7DEF 8106 AAFC 390E * tag 'python-pull-request' of https://gitlab.com/jsnow/qemu: docs: remove Sphinx 1.x compatibility code Python: bump minimum sphinx version to 3.4.3 python: enable testing for 3.13 iotests: Change imports for Python 3.13 python: Do not use pylint 3.2.4 with python 3.8 python: linter changes for pylint 3.x Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-15Merge tag 'pull-ufs-20240714' of https://gitlab.com/jeuk20.kim/qemu into stagingRichard Henderson
hw/ufs: - Fix invalid address access in mcq register check # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEUBfYMVl8eKPZB+73EuIgTA5dtgIFAmaTiKAACgkQEuIgTA5d # tgKiAQ//fnlOsp22jEuM6Wf3372XvVWOZJ4IgxmkPNAvAhmzJdFZfx5Z4+k/uFdX # xSYCXVAH56wQn5MVdyfFNjB9LxwQZzewky7c3kq6QWO8QPxVRoNbWkVqYZ0zlnmf # HLBENR7sAjINKVa01yR5fkHh2zCX1dW99heY5KXlP4AynFP0QNikgsjhcrDPeDK8 # UWWFPVmx3SAWzTUbTdOJzQ38X25XzRid6xYN/rWAHZSJIsjukWm0nFo6rZkf2BZK # fqpBqBe2maeeF3iw2BJKQ/KL7pyNJaqk7nXKG4oSBjsm11RU9Zb0Vl4CDRtZ8NJn # p0v/RwH6E0sOq64r9dC/8QALB8dCl6vdN1WOLiUeT+ukAoUnrmCoIllAXC49gugd # 68nyTagfHHogzFNW2QrJArsZO+IHzYDZRlSiLoW/PN8JIB9spu44D5HA/HVIQtBh # 4f5DGl+emKbKiKwYoxm5qL8f5mHpc5PQ4OaoAkHpM/cfAe7o01SQ7doul5HPPApD # +BnMjHYqv8kvCelNlLRb23MKe+YH7yRNFxWUfdrhj4uznM4fBVyTUC07VuK25m2B # 9ShInmL1YnTyAbOLoBxwA8DV2dEv1jYXWuXyABTozlrPbWVVR7L4HLk9GLrwI5s+ # YHUa5KOoet8Jnxkh7QvMftPuWV0rTv0HM4m8Ko8GY01Sl7Q2Fos= # =rxk1 # -----END PGP SIGNATURE----- # gpg: Signature made Sun 14 Jul 2024 06:13:20 PM AEST # gpg: using RSA key 5017D831597C78A3D907EEF712E2204C0E5DB602 # gpg: Good signature from "Jeuk Kim <jeuk20.kim@samsung.com>" [unknown] # gpg: aka "Jeuk Kim <jeuk20.kim@gmail.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 5017 D831 597C 78A3 D907 EEF7 12E2 204C 0E5D B602 * tag 'pull-ufs-20240714' of https://gitlab.com/jeuk20.kim/qemu: hw/ufs: Fix mcq register range check logic Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-14hw/ufs: Fix mcq register range check logicJeuk Kim
The function ufs_is_mcq_reg() and ufs_is_mcq_op_reg() only evaluated the range of the mcq_reg and mcq_op_reg offset, which is defined as a constant. Therefore, it was possible for them to return true even though the ufs device is configured to not support the mcq. This could cause ufs_mmio_read()/ufs_mmio_write() to result in Null-pointer-dereference. So fix it. Resolves: #2428 Fixes: 5c079578d2e4 ("hw/ufs: Add support MCQ of UFSHCI 4.0") Reported-by: Zheyu Ma <zheyuma97@gmail.com> Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com> Reviewed-by: Minwoo Im <minwoo.im@samsung.com>
2024-07-12docs: remove Sphinx 1.x compatibility codeJohn Snow
In general, the Use_SSI workaround is no longer needed, and neither is the pre-1.6 logging shim for kerneldoc. Signed-off-by: John Snow <jsnow@redhat.com> Acked-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20240703175235.239004-3-jsnow@redhat.com [rebased on top of origin/master. --js] Signed-off-by: John Snow <jsnow@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-17 18:13:35 +0000