aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2024-11-05hw/i2c/mpc_i2c: Prefer DEFINE_TYPES() macroBernhard Beschow
Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Acked-by: Corey Minyard <cminyard@mvista.com> Message-ID: <20241103133412.73536-13-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-05hw/i2c/mpc_i2c: Convert DPRINTF to trace events for register accessBernhard Beschow
Reviewed-by: Cédric Le Goater <clg@redhat.com> Acked-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-ID: <20241103133412.73536-12-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-05hw/ppc/mpc8544_guts: Populate POR PLL ratio status registerBernhard Beschow
Populate this read-only register with some arbitrary values which avoids U-Boot's get_clocks() to hang(). Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-ID: <20241103133412.73536-11-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-05hw/ppc/e500: Add missing device tree properties to i2c controller nodeBernhard Beschow
When compiling a decompiled device tree blob created with dumpdtb, dtc complains with: /soc@e0000000/i2c@3000: incorrect #address-cells for I2C bus /soc@e0000000/i2c@3000: incorrect #size-cells for I2C bus Fix this by adding the missing device tree properties. Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-ID: <20241103133412.73536-6-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-05hw/ppc/e500: Remove unused "irqs" parameterBernhard Beschow
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-ID: <20241103133412.73536-5-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-05hw/ppc/e500: Prefer QOM castBernhard Beschow
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-ID: <20241103133412.73536-4-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-05hw/core: Add a helper to check the cache topology levelZhao Liu
Currently, we have no way to expose the arch-specific default cache model because the cache model is sometimes related to the CPU model (e.g., i386). Since the user might configure "default" level, any comparison with "default" is meaningless before the machine knows the specific level that "default" refers to. We can only check the correctness of the cache topology after the arch loads the user-configured cache model from MachineState.smp_cache and consumes the special "default" level by replacing it with the specific level. Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-ID: <20241101083331.340178-6-zhao1.liu@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-05hw/core: Check smp cache topology support for machineZhao Liu
Add cache_supported flags in SMPCompatProps to allow machines to configure various caches support. And check the compatibility of the cache properties with the machine support in machine_parse_smp_cache(). Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Tested-by: Yongwei Ma <yongwei.ma@intel.com> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-ID: <20241101083331.340178-5-zhao1.liu@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-05qapi/qom: Define cache enumeration and properties for machineZhao Liu
The x86 and ARM need to allow user to configure cache properties (current only topology): * For x86, the default cache topology model (of max/host CPU) does not always match the Host's real physical cache topology. Performance can increase when the configured virtual topology is closer to the physical topology than a default topology would be. * For ARM, QEMU can't get the cache topology information from the CPU registers, then user configuration is necessary. Additionally, the cache information is also needed for MPAM emulation (for TCG) to build the right PPTT. Define smp-cache related enumeration and properties in QAPI, so that user could configure cache properties for SMP system through -machine in the subsequent patch. Cache enumeration (CacheLevelAndType) is implemented as the combination of cache level (level 1/2/3) and cache type (data/instruction/unified). Currently, separated L1 cache (L1 data cache and L1 instruction cache) with unified higher-level cache (e.g., unified L2 and L3 caches), is the most common cache architectures. Therefore, enumerate the L1 D-cache, L1 I-cache, L2 cache and L3 cache with smp-cache object to add the basic cache topology support. Other kinds of caches (e.g., L1 unified or L2/L3 separated caches) can be added directly into CacheLevelAndType if necessary. Cache properties (SmpCacheProperties) currently only contains cache topology information, and other cache properties can be added in it if necessary. Note, define cache topology based on CPU topology level with two reasons: 1. In practice, a cache will always be bound to the CPU container (either private in the CPU container or shared among multiple containers), and CPU container is often expressed in terms of CPU topology level. 2. The x86's cache-related CPUIDs encode cache topology based on APIC ID's CPU topology layout. And the ACPI PPTT table that ARM/RISCV relies on also requires CPU containers to help indicate the private shared hierarchy of the cache. Therefore, for SMP systems, it is natural to use the CPU topology hierarchy directly in QEMU to define the cache topology. With smp-cache QAPI support, add smp cache topology for machine by parsing the smp-cache object list. Also add the helper to access/update cache topology level of machine. Suggested-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Tested-by: Yongwei Ma <yongwei.ma@intel.com> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-ID: <20241101083331.340178-4-zhao1.liu@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-05hw/core: Make CPU topology enumeration arch-agnosticZhao Liu
Cache topology needs to be defined based on CPU topology levels. Thus, define CPU topology enumeration in qapi/machine.json to make it generic for all architectures. To match the general topology naming style, rename CPU_TOPO_LEVEL_* to CPU_TOPOLOGY_LEVEL_*, and rename SMT and package levels to thread and socket. Also, enumerate additional topology levels for non-i386 arches, and add a CPU_TOPOLOGY_LEVEL_DEFAULT to help future smp-cache object to work with compatibility requirement of arch-specific cache topology models. Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Tested-by: Yongwei Ma <yongwei.ma@intel.com> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Acked-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20241101083331.340178-3-zhao1.liu@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-05hw/core/machine: Add missing 'units.h' and 'error-report.h' headersPhilippe Mathieu-Daudé
Include the missing "qemu/units.h" to fix when refactoring code: ../hw/core/machine.c:743:34: error: use of undeclared identifier 'MiB' 743 | mc->default_ram_size = 128 * MiB; | ^ ../hw/core/machine.c:750:44: error: use of undeclared identifier 'TiB' 750 | mc->smbios_memory_device_size = 2047 * TiB; | ^ and "qemu/error-report.h" to fix: ../hw/core/machine.c:1029:13: error: call to undeclared function 'error_report' [-Wimplicit-function-declaration] 1029 | error_report("NUMA node %" PRIu16 " is missing, use " | ^ ../hw/core/machine.c:1240:9: error: call to undeclared function 'warn_report' [-Wimplicit-function-declaration] 1240 | warn_report("CPU model %s is deprecated -- %s", | ^ Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Message-Id: <20240930221900.59525-2-philmd@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-05hw/microblaze/s3adsp1800: Declare machine type using DEFINE_TYPES macroPhilippe Mathieu-Daudé
Replace DEFINE_MACHINE() by DEFINE_TYPES(), converting the class_init() handler. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Message-Id: <20241105130431.22564-6-philmd@linaro.org>
2024-11-05hw/microblaze/s3adsp1800: Rename unimplemented MMIO region as xps_gpioPhilippe Mathieu-Daudé
The machine datasheet mentions the GPIO device as 'xps_gpio'. Rename it accordingly to easily find its documentation. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Message-Id: <20241105130431.22564-5-philmd@linaro.org>
2024-11-05hw/microblaze/s3adsp1800: Explicit CPU endiannessPhilippe Mathieu-Daudé
By default the machine's CPU endianness is 'big' order ('little-endian' property set to %false). This corresponds to the default when this machine was added; see commits 6a8b1ae2020 "microblaze: Add petalogix s3a1800dsp MMU linux ref-design." and 72b675caacf "microblaze: Hook into the build-system." which added: [ "$target_cpu" = "microblaze" ] && target_bigendian=yes Later commit 877fdc12b1a ("microblaze: Allow targeting little-endian mb") added little-endian support, forgetting to set the CPU endianness to little-endian. Not an issue since this property was never used, but we will use it soon, so explicit the endianness to get the expected behavior. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Message-Id: <20241105130431.22564-4-philmd@linaro.org>
2024-11-05hw/microblaze: Deprecate big-endian petalogix-ml605 & xlnx-zynqmp-pmuPhilippe Mathieu-Daudé
The petalogix-ml605 machine was explicitly added as little-endian only machine in commit 00914b7d970 ("microblaze: Add PetaLogix ml605 MMU little-endian ref design"). Mark the big-endian version as deprecated. When the xlnx-zynqmp-pmu machine's CPU was added in commit 133d23b3ad1 ("xlnx-zynqmp-pmu: Add the CPU and memory"), its 'endianness' property was set to %true, thus wired in little endianness. Both machine are included in the big-endian system binary, while their CPU is working in little-endian. Unlikely to work as it. Deprecate now as broken config so we can remove soon. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng> Acked-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Message-Id: <20241105130431.22564-3-philmd@linaro.org>
2024-11-05target/microblaze: Alias CPU endianness property as 'little-endian'Philippe Mathieu-Daudé
Alias the 'endian' property as 'little-endian' because the 'ENDI' bit is set when the endianness is in little order, and unset in big order. Reviewed-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20241105130431.22564-2-philmd@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Message-Id: <3f61b85c-9382-4520-a1ce-5476eb16fb56@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-05Merge tag 'pull-target-arm-20241105' of ↵Peter Maydell
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * Fix MMU indexes for AArch32 Secure PL1&0 in a less complex and buggy way * Fix SVE SDOT/UDOT/USDOT (4-way, indexed) * softfloat: set 2-operand NaN propagation rule at runtime * disas: Fix build against Capstone v6 (again) * hw/rtc/ds1338: Trace send and receive operations * hw/timer/imx_gpt: Convert DPRINTF to trace events * hw/watchdog/wdt_imx2: Remove redundant assignment * hw/sensor/tmp105: Convert printf() to trace event, add tracing for read/write access * hw/net/npcm_gmac: Change error log to trace event * target/arm: Enable FEAT_CMOW for -cpu max # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmcp/yoZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3ucMD/9pWk2ETLjdviPxlacs5IoM # HvGn8Ll2BSMbeb4YdJc7oZ4YJchGpgHhocEwZuaU9HheWjSg+ZEbyhZgN4DdkT8J # pYr+Rl0MgDNN219kYnO/yqnqlgHbtUpE7y57Li3ApoGNbWAVxsH0xoT45Lpi7DOd # uvJfIy/xdaT3zu/4uBjj7c2VrD8wntEayLM8hpqlgeQZKRG3Wtlk/xrQFKOHPDPO # MDbsGoc2FyogRQoo6WH+J6gkkR9PhqXe6Hbf6WIr1/uffZUZU4M8leSw2DgxrYHo # Zf36AzttwO4GHyML/5SR7uvzfXl7OkGyjedLGCUa7INc3br2+GvLMltdLGGPM9cc # ckMHOWd9ZQuSxcpbtPkSYRG0McRE1GLT+KV3BNOLnN9AJl3qv5Qa55iPrtpB08vX # 3jN6H964w99+NoSB2tTHszpep+M7SRuw5QLsuk3tC/qnBMpzKRwZjGVUegNUtfi/ # Lg5ExF8B62K+xb5j5FmODbbXZmb5AD0rV2MGRIVHjiHdnf7J2FmWUJCe2sYFRnRm # nzszhdOKw4PBhC2fb6Vb/DwCqdQy9vcITWpWBtcjkV5mAPhcBo/VNKNeKoc/tPNS # H8FIFIJbtv5aIixqtKcUBUmrBCYy4EoiRMLkqfC09VW60wtWswAP4KBQxi1ogehV # jJw8AgSLCl2MsVmyzgleZQ== # =Woag # -----END PGP SIGNATURE----- # gpg: Signature made Tue 05 Nov 2024 11:19:06 GMT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20241105' of https://git.linaro.org/people/pmaydell/qemu-arm: (31 commits) target/arm: Enable FEAT_CMOW for -cpu max hw/net/npcm_gmac: Change error log to trace event hw/sensor/tmp105: Convert printf() to trace event, add tracing for read/write access hw/watchdog/wdt_imx2: Remove redundant assignment hw/timer/imx_gpt: Convert DPRINTF to trace events hw/rtc/ds1338: Trace send and receive operations disas: Fix build against Capstone v6 (again) target/arm: Fix SVE SDOT/UDOT/USDOT (4-way, indexed) target/arm: Add new MMU indexes for AArch32 Secure PL1&0 Revert "target/arm: Fix usage of MMU indexes when EL3 is AArch32" softfloat: Remove fallback rule from pickNaN() target/rx: Explicitly set 2-NaN propagation rule target/openrisc: Explicitly set 2-NaN propagation rule target/microblaze: Explicitly set 2-NaN propagation rule target/microblaze: Move setting of float rounding mode to reset target/alpha: Explicitly set 2-NaN propagation rule target/i386: Set 2-NaN propagation rule explicitly target/xtensa: Explicitly set 2-NaN propagation rule target/xtensa: Factor out calls to set_use_first_nan() target/sparc: Explicitly set 2-NaN propagation rule ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-05Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Peter Maydell
into staging virtio,pc,pci: features, fixes, cleanups CXL now can use Generic Port Affinity Structures. CXL now allows control of link speed and width vhost-user-blk now supports live resize, by means of a new device-sync-config command amd iommu now supports interrupt remapping pcie devices now report extended tag field support intel_iommu dropped support for Transient Mapping, to match VTD spec arch agnostic ACPI infrastructure for vCPU Hotplug Fixes, cleanups all over the place. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmcpNqUPHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRp/2oH/0qO33prhDa48J5mqT9NuJzzYwp5QHKF9Zjv # fDAplMUEmfxZIEgJchcyDWPYTGX2geT4pCFhRWioZMIR/0JyzrFgSwsk1kL88cMh # 46gzhNVD6ybyPJ7O0Zq3GLy5jo7rlw/n+fFxKAuRCzcbK/fmH8gNC+RwW1IP64Na # HDczYilHUhnO7yKZFQzQNQVbK4BckrG1bu0Fcx0EMUQBf4V6x7GLOrT+3hkKYcr6 # +DG5DmUmv20or/FXnu2Ye+MzR8Ebx6JVK3A3sXEE4Ns2CCzK9QLzeeyc2aU13jWN # OpZ6WcKF8HqYprIwnSsMTxhPcq0/c7TvrGrazVwna5RUBMyjjvc= # =zSX4 # -----END PGP SIGNATURE----- # gpg: Signature made Mon 04 Nov 2024 21:03:33 GMT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (65 commits) intel_iommu: Add missed reserved bit check for IEC descriptor intel_iommu: Add missed sanity check for 256-bit invalidation queue intel_iommu: Send IQE event when setting reserved bit in IQT_TAIL hw/acpi: Update GED with vCPU Hotplug VMSD for migration tests/qtest/bios-tables-test: Update DSDT golden masters for x86/{pc,q35} hw/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug states qtest: allow ACPI DSDT Table changes hw/acpi: Make CPUs ACPI `presence` conditional during vCPU hot-unplug hw/pci: Add parenthesis to PCI_BUILD_BDF macro hw/cxl: Ensure there is enough data to read the input header in cmd_get_physical_port_state() hw/cxl: Ensure there is enough data for the header in cmd_ccls_set_lsa() hw/cxl: Check that writes do not go beyond end of target attributes hw/cxl: Ensuring enough data to read parameters in cmd_tunnel_management_cmd() hw/cxl: Avoid accesses beyond the end of cel_log. hw/cxl: Check the length of data requested fits in get_log() hw/cxl: Check enough data in cmd_firmware_update_transfer() hw/cxl: Check input length is large enough in cmd_events_clear_records() hw/cxl: Check input includes at least the header in cmd_features_set_feature() hw/cxl: Check size of input data to dynamic capacity mailbox commands hw/cxl/cxl-mailbox-util: Fix output buffer index update when retrieving DC extents ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-05vfio/migration: Add vfio_save_block_precopy_empty_hit trace eventMaciej S. Szmigiero
This way it is clearly known when there's no more data to send for that device. Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
2024-11-05vfio/migration: Add save_{iterate, complete_precopy}_start trace eventsMaciej S. Szmigiero
This way both the start and end points of migrating a particular VFIO device are known. Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
2024-11-05Merge tag 'pull-nvme-20241104' of https://gitlab.com/birkelund/qemu into stagingPeter Maydell
nvme queue # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmcpDm8ACgkQTeGvMW1P # DenpLQgAjpk5tN8oYQKxJVu8qO3RUDatlIXgaZ8ljDSZVIB3cg/qh36qByt2iZNK # FC7oLl/Yl44FHF+6ScWJBcSjXuVkQ/aT8UA1pYbTb9wcURB8atMG9IJxmQuhjlnl # hgvDbpLwyHb4eVuWwA2aKukGZtYyhUcJIoP2RN8wugwg5T7I6R/eaiBG3kCCqIHB # xshgEPIWModzGKR8i6NawhIhFFc3icOabB15QHYwA69BuAK69O9XNlVut2oMLquS # Lv9INkAtYQtqHHvUJGsgcQcTS8vxBGR+TFk05heiThgu2f9kGLu+lV1Ud3WBWeW1 # 6Kt4N1WF9hw6Y4I8pGzEs8C49marFg== # =0S/1 # -----END PGP SIGNATURE----- # gpg: Signature made Mon 04 Nov 2024 18:11:59 GMT # gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9 # gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [full] # gpg: aka "Klaus Jensen <k.jensen@samsung.com>" [full] # Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838 # Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9 * tag 'pull-nvme-20241104' of https://gitlab.com/birkelund/qemu: hw/nvme: remove dead code hw/nvme: add NPDAL/NPDGL hw/nvme: i/o cmd set independent namespace data structure Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-05rust: add PL011 device modelManos Pitsidianakis
This commit adds a re-implementation of hw/char/pl011.c in Rust. How to build: 1. Configure a QEMU build with: --enable-system --target-list=aarch64-softmmu --enable-rust 2. Launching a VM with qemu-system-aarch64 should use the Rust version of the pl011 device Co-authored-by: Junjie Mao <junjie.mao@intel.com> Co-authored-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Junjie Mao <junjie.mao@intel.com> Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Link: https://lore.kernel.org/r/20241024-rust-round-2-v1-2-051e7a25b978@linaro.org
2024-11-05Revert "rust: add PL011 device model"Manos Pitsidianakis
Patch was applied with invalid authorship by accident, which confuses git tooling that look at git blame for contributors etc. Patch will be re-applied with correct authorship right after this commit. This reverts commit d0f0cd5b1f7e9780753344548e17ad4df9fcf5d8. Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Link: https://lore.kernel.org/r/20241024-rust-round-2-v1-1-051e7a25b978@linaro.org
2024-11-05qdev: make properties array "const"Paolo Bonzini
Constify all accesses to qdev properties, except for the ObjectPropertyAccessor itself. This makes it possible to place them in read-only memory, and also lets Rust bindings switch from "static mut" arrays to "static"; which is advantageous, because mutable statics are highly discouraged. Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-11-05hw/net/npcm_gmac: Change error log to trace eventNabih Estefan
Convert the LOG_GUEST_ERROR for the "tx descriptor is owned by software" to a trace message. This condition is normal when there is there is nothing to transmit, and we would otherwise spam the logs with it in that situation. Signed-off-by: Nabih Estefan <nabihestefan@google.com> Signed-off-by: Roque Arcudia Hernandez <roqueh@google.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20241014184847.1594056-1-roqueh@google.com [PMM: tweaked commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-05hw/sensor/tmp105: Convert printf() to trace event, add tracing for ↵Bernhard Beschow
read/write access printf() unconditionally prints to the console which disturbs `-serial stdio`. Fix that by converting into a trace event. While at it, add some tracing for read and write access. Fixes: 7e7c5e4c1ba5 "Nokia N800 machine support (ARM)." Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20241103143330.123596-5-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-05hw/watchdog/wdt_imx2: Remove redundant assignmentBernhard Beschow
The same statement is executed unconditionally right before the if statement. Cc: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20241103143330.123596-4-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-05hw/timer/imx_gpt: Convert DPRINTF to trace eventsBernhard Beschow
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-id: 20241103143330.123596-3-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-05hw/rtc/ds1338: Trace send and receive operationsBernhard Beschow
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-id: 20241103143330.123596-2-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-05Merge tag 'pull-aspeed-20241104' of https://github.com/legoater/qemu into ↵Peter Maydell
staging aspeed queue: * Fixed eMMC size calculation * Fixed IRQ definitions on AST2700 * Added RTC support to AST2700 * Fixed timer IRQ status on AST2600 * Improved SDHCI model with new registers * Added -nodefaults support to AST1030 * Provided a way to use an eMMC device without boot partitions # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmcoo4oACgkQUaNDx8/7 # 7KGYAQ/9GWiwM7SHFD/WTEo6iClQCk+Do3pzGXZPQq7WLqYhBU8mYwSaqMDUtXj+ # MQVywyLxSYaKdCKessN0haATyzEDVRtxKwIRnbrSDWWnxG8NGj2esOTsU6/wgfD4 # FqARaMH91FQB6rY8QbmbGmqTJ1QbWEPXj7v2piJol5dvI2Oe8iqn/6z1Cv4NMXwh # aYHwSVwcHLD9tfmyXP0DKN/XHLC4pTAOoU96ajcN6RRW+D6vuQEsQq0caZt8CHQc # I2oSptU+RZF2DPbSeEB42y9I138/kQzTIaVnbBN//NLRwbzRsLlXhA92F2CJyDrD # FGNQyynteil8F7M5Oab47fFia1QF/v4G45VOAsHpT1tLBsZPKJdRwfLLqDPZbVbG # 2lAVuukqW0gKoEHsXfVsDzcIxpX81SlUsccHY4kCxsRNnwSzCWaDK9OOTx3CAxjG # CzzDgQszNr/12dzkWExIhLpMhQNeiUXX1veAH/jzbjyRAKxzjkDYaX2lUC3MfmqX # irjmzOU0AbtComv4ybeBqtqNmQvUx5/y993Hgakc9mqqCoAm/Fn4qtx6uW5vSSZJ # w4heyWbzcLp5RIzSYZypWlmgI+3bJgJq2aX276MYqAe3m8PnUCkuW9NTsfb+ARMl # XGExHPNrAsw7eiiQsTa7Byt/jkEf3KmEp8ye+3cAvJwPgxlDyys= # =ms8H # -----END PGP SIGNATURE----- # gpg: Signature made Mon 04 Nov 2024 10:35:54 GMT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [full] # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-aspeed-20241104' of https://github.com/legoater/qemu: aspeed: Don't set always boot properties of the emmc device aspeed: Support create flash devices via command line for AST1030 hw/sd/aspeed_sdhci: Introduce Capabilities Register 2 for SD slot 0 and 1 hw/timer/aspeed: Fix interrupt status does not be cleared for AST2600 hw/timer/aspeed: Fix coding style aspeed/soc: Support RTC for AST2700 hw/arm/aspeed_ast27x0: Avoid hardcoded '256' in IRQ calculation hw/arm/aspeed_ast27x0: Use bsa.h for PPI definitions hw/sd/sdcard: Fix calculation of size when using eMMC boot partitions hw/arm: enable at24c with aspeed Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-05Merge tag 'pull-ppc-for-9.2-1-20241104' of https://gitlab.com/npiggin/qemu ↵Peter Maydell
into staging * Various bug fixes * Big cleanup of deprecated machines * Power11 support for spapr * XIVE improvements * Goodbye to Cedric and David as ppc reviewers, thank you both o7 # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEETkN92lZhb0MpsKeVZ7MCdqhiHK4FAmcoEicACgkQZ7MCdqhi # HK5M8Q//fz+ZkJndXkBjb1Oinx+q+eVtNm2JrvcWIsXyhG3K+6VxYPp69H+SRv/Z # TWuUqMQPxq8mhQvBJlDAttp/oaUEiOcCRvs/iUoBN12L4mVxXfdoT88TZ4frN3eP # 8bePq+DW2N/7gpmsJm5CyEZPpcf9AjVHgLRp3KYFkOJ/14uzvuwnocU39gl+2IUh # MXHTedQgMNXaKorJXk1NVdM6NxMuVhOvwxAs6ya2gwhxyA5tteo5PiQOnDJWkejf # xg3RRsNzGYcs1Qg/3kFIf3RfEB0aYbPxROM8IfPaJWKN5KnMggj/JAkHyK1x/V3J # wml7+cB0doMt/yRiuYJhXpyrtOqpvjRWPA6RhxECWW2kwrovv8NAF8IrFnw9NvOQ # QC66ZaaFcbAcFrVT1e/iggU76d01II6m4OAgKcXw+FRHgps4VU9y83j7ApNnNUWN # IXp9hkzoHi5VwX0FrG4ELUr2iEf1HASMvM8EZ/0AxzWj5iNtQB8lFsrEdaGVXyIS # M5JaJeNjCn4koCyYaFSctH5eKtbzIwnGWnDcdTwaOuQ+9itBvY8O+HZalE6sAc5S # kLFZ7i/Ut/qxbY5pMumt8LKD4pR1SsOxFB8dJCmn/f/tvRGtIVsoY6btNe4M0+24 # 42MxZbWO6W379C32bwbtsPiGA+aLSgShjP4cWm9cgRjz4RJFnwg= # =vmIG # -----END PGP SIGNATURE----- # gpg: Signature made Mon 04 Nov 2024 00:15:35 GMT # gpg: using RSA key 4E437DDA56616F4329B0A79567B30276A8621CAE # gpg: Good signature from "Nicholas Piggin <npiggin@gmail.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 4E43 7DDA 5661 6F43 29B0 A795 67B3 0276 A862 1CAE * tag 'pull-ppc-for-9.2-1-20241104' of https://gitlab.com/npiggin/qemu: (67 commits) MAINTAINERS: Remove myself as reviewer MAINTAINERS: Remove myself from XIVE MAINTAINERS: Remove myself from the PowerNV machines hw/ppc: Consolidate ppc440 initial mapping creation functions hw/ppc: Consolidate e500 initial mapping creation functions tests/qtest: Add XIVE tests for the powernv10 machine pnv/xive2: TIMA CI ops using alternative offsets or byte lengths pnv/xive2: TIMA support for 8-byte OS context push for PHYP pnv/xive: Update PIPR when updating CPPR pnv/xive: Add special handling for pool targets ppc/xive2: Support "Pull Thread Context to Odd Thread Reporting Line" ppc/xive2: Change context/ring specific functions to be generic ppc/xive2: Support "Pull Thread Context to Register" operation ppc/xive2: Allow 1-byte write of Target field in TIMA ppc/xive2: Dump the VP-group and crowd tables with 'info pic' ppc/xive2: Dump more NVP state with 'info pic' pnv/xive2: Support for "OS LGS Push" TIMA operation ppc/xive2: Support TIMA "Pull OS Context to Odd Thread Reporting Line" pnv/xive2: Define OGEN field in the TIMA pnv/xive: TIMA patch sets pre-req alignment and formatting changes ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-04intel_iommu: Add missed reserved bit check for IEC descriptorZhenzhong Duan
IEC descriptor is 128-bit invalidation descriptor, must be padded with 128-bits of 0s in the upper bytes to create a 256-bit descriptor when the invalidation queue is configured for 256-bit descriptors (IQA_REG.DW=1). Fixes: 02a2cbc872df ("x86-iommu: introduce IEC notifiers") Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Message-Id: <20241104125536.1236118-4-zhenzhong.duan@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04intel_iommu: Add missed sanity check for 256-bit invalidation queueZhenzhong Duan
According to VTD spec, a 256-bit descriptor will result in an invalid descriptor error if submitted in an IQ that is setup to provide hardware with 128-bit descriptors (IQA_REG.DW=0). Meanwhile, there are old inv desc types (e.g. iotlb_inv_desc) that can be either 128bits or 256bits. If a 128-bit version of this descriptor is submitted into an IQ that is setup to provide hardware with 256-bit descriptors will also result in an invalid descriptor error. The 2nd will be captured by the tail register update. So we only need to focus on the 1st. Because the reserved bit check between different types of invalidation desc are common, so introduce a common function vtd_inv_desc_reserved_check() to do all the checks and pass the differences as parameters. With this change, need to replace error_report_once() call with error_report() to catch different call sites. This isn't an issue as error_report_once() here is mainly used to help debug guest error, but it only dumps once in qemu life cycle and doesn't help much, we need error_report() instead. Fixes: c0c1d351849b ("intel_iommu: add 256 bits qi_desc support") Suggested-by: Yi Liu <yi.l.liu@intel.com> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Message-Id: <20241104125536.1236118-3-zhenzhong.duan@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04intel_iommu: Send IQE event when setting reserved bit in IQT_TAILZhenzhong Duan
According to VTD spec, Figure 11-22, Invalidation Queue Tail Register, "When Descriptor Width (DW) field in Invalidation Queue Address Register (IQA_REG) is Set (256-bit descriptors), hardware treats bit-4 as reserved and a value of 1 in the bit will result in invalidation queue error." Current code missed to send IQE event to guest, fix it. Fixes: c0c1d351849b ("intel_iommu: add 256 bits qi_desc support") Suggested-by: Yi Liu <yi.l.liu@intel.com> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Message-Id: <20241104125536.1236118-2-zhenzhong.duan@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04hw/acpi: Update GED with vCPU Hotplug VMSD for migrationSalil Mehta
The ACPI CPU hotplug states must be migrated along with other vCPU hotplug states to the destination VM. Update the GED's VM State Description (VMSD) table subsection to conditionally include the CPU Hotplug VM State Description (VMSD). Excerpt of GED VMSD State Dump at Source: "acpi-ged (16)": { "ged_state": { "sel": "0x00000000" }, [...] "acpi-ged/cpuhp": { "cpuhp_state": { "selector": "0x00000005", "command": "0x00", "devs": [ { "is_inserting": false, "is_removing": false, "ost_event": "0x00000000", "ost_status": "0x00000000" }, [...] { "is_inserting": false, "is_removing": false, "ost_event": "0x00000000", "ost_status": "0x00000000" } ] } } }, Signed-off-by: Salil Mehta <salil.mehta@huawei.com> Message-Id: <20241103102419.202225-6-salil.mehta@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04hw/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug statesSalil Mehta
Reflect the QOM vCPUs ACPI CPU hotplug states in the `_STA.Present` and and `_STA.Enabled` bits when the guest kernel evaluates the ACPI `_STA` method during initialization, as well as when vCPUs are hot-plugged or hot-unplugged. If the CPU is present then the its `enabled` status can be fetched using architecture-specific code [1]. Reference: [1] Example implementation of architecture-specific hook to fetch CPU `enabled status Link: https://github.com/salil-mehta/qemu/commit/c0b416b11e5af6505e558866f0eb6c9f3709173e Signed-off-by: Salil Mehta <salil.mehta@huawei.com> Message-Id: <20241103102419.202225-4-salil.mehta@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04hw/acpi: Make CPUs ACPI `presence` conditional during vCPU hot-unplugSalil Mehta
On most architectures, during vCPU hot-plug and hot-unplug actions, the firmware or VMM/QEMU can update the OS on vCPU status by toggling the ACPI method `_STA.Present` bit. However, certain CPU architectures prohibit [1] modifications to a CPU’s `presence` status after the kernel has booted. This limitation [2][3] exists because many per-CPU components, such as interrupt controllers and various per-CPU features tightly integrated with CPUs, may not support reconfiguration once the kernel is initialized. Often, these components cannot be powered down, as they may belong to an `always-on` power domain. As a result, some architectures require all CPUs to remain `_STA.Present` after system initialization. Therefore, it is essential to mirror the exact QOM vCPU status through ACPI for the Guest kernel. For this, we should determine—via architecture-specific code[4]—whether vCPUs must always remain present and whether the associated `AcpiCpuStatus::cpu` object should remain valid, even following a vCPU hot-unplug operation. References: [1] Check comment 5 in the bugzilla entry Link: https://bugzilla.tianocore.org/show_bug.cgi?id=4481#c5 [2] KVMForum 2023 Presentation: Challenges Revisited in Supporting Virt CPU Hotplug on architectures that don’t Support CPU Hotplug (like ARM64) a. Kernel Link: https://kvm-forum.qemu.org/2023/KVM-forum-cpu-hotplug_7OJ1YyJ.pdf b. Qemu Link: https://kvm-forum.qemu.org/2023/Challenges_Revisited_in_Supporting_Virt_CPU_Hotplug_-__ii0iNb3.pdf [3] KVMForum 2020 Presentation: Challenges in Supporting Virtual CPU Hotplug on SoC Based Systems (like ARM64) Link: https://kvmforum2020.sched.com/event/eE4m [4] Example implementation of architecture-specific CPU persistence hook Link: https://github.com/salil-mehta/qemu/commit/c0b416b11e5af6505e558866f0eb6c9f3709173e Signed-off-by: Salil Mehta <salil.mehta@huawei.com> Message-Id: <20241103102419.202225-2-salil.mehta@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04hw/cxl: Ensure there is enough data to read the input header in ↵Jonathan Cameron
cmd_get_physical_port_state() If len_in is smaller than the header length then the accessing the number of ports will result in an out of bounds access. Add a check to avoid this. Reported-by: Esifiel <esifiel@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241101133917.27634-11-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04hw/cxl: Ensure there is enough data for the header in cmd_ccls_set_lsa()Jonathan Cameron
The properties of the requested set command cannot be established if len_in is less than the size of the header. Reported-by: Esifiel <esifiel@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241101133917.27634-10-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04hw/cxl: Check that writes do not go beyond end of target attributesJonathan Cameron
In cmd_features_set_feature() the an offset + data size schemed is used to allow for large features. Ensure this does not write beyond the end fo the buffers used to accumulate the full feature attribute set. Reported-by: Esifiel <esifiel@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241101133917.27634-9-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04hw/cxl: Ensuring enough data to read parameters in cmd_tunnel_management_cmd()Jonathan Cameron
If len_in is less than the minimum spec allowed value, then return CXL_MBOX_INVALID_PAYLOAD_LENGTH Reported-by: Esifiel <esifiel@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241101133917.27634-8-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04hw/cxl: Avoid accesses beyond the end of cel_log.Jonathan Cameron
Add a check that the requested offset + length does not go beyond the end of the cel_log. Whilst the cci->cel_log is large enough to include all possible CEL entries, the guest might still ask for entries beyond the end of it. Move the comment to this new check rather than before the check on the type of log requested. Reported-by: Esifiel <esifiel@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241101133917.27634-7-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04hw/cxl: Check the length of data requested fits in get_log()Jonathan Cameron
Checking offset + length is of no relevance when verifying the CEL data will fit in the mailbox payload. Only the length is is relevant. Note that this removes a potential overflow. Reported-by: Esifiel <esifiel@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241101133917.27634-6-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04hw/cxl: Check enough data in cmd_firmware_update_transfer()Jonathan Cameron
Buggy guest can write a message that advertises more data that is provided. As QEMU internally duplicates the reported message size, this may result in an out of bounds access. Add sanity checks on the size to avoid this. Reported-by: Esifiel <esifiel@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241101133917.27634-5-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04hw/cxl: Check input length is large enough in cmd_events_clear_records()Jonathan Cameron
Buggy software might write a message that is too short for either the header, or the header + the event data that is specified in the header. This may result in accesses beyond the range of the message allocated as a duplicate of the incoming message buffer. Reported-by: Esifiel <esifiel@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241101133917.27634-4-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04hw/cxl: Check input includes at least the header in cmd_features_set_feature()Jonathan Cameron
A buggy guest might write an insufficiently large message. Check the header is present. Whilst zero data after the header is very odd it will just result in failure to copy any data. Reported-by: Esifiel <esifiel@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241101133917.27634-3-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04hw/cxl: Check size of input data to dynamic capacity mailbox commandsJonathan Cameron
cxl_cmd_dcd_release_dyn_cap() and cmd_dcd_add_dyn_cap_rsp() are missing input message size checks. These must be done in the individual commands when the command has a variable length input payload. A buggy or malicious guest might send undersized messages via the mailbox. As that size is used to take a copy of the mailbox content, each command must check there is sufficient data. In this case the first check is that there is enough data to read how many extents there are, and the second that there is enough for those elements to be accessed. Reported-by: Esifiel <esifiel@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241101133917.27634-2-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04hw/cxl/cxl-mailbox-util: Fix output buffer index update when retrieving DC ↵Fan Ni
extents In the function of retrieving DC extents (cmd_dcd_get_dyn_cap_ext_list), the output buffer index was not correctly updated while iterating the extent list on the device, leaving the extents returned incorrect except for the first one. Fixes: 1c9221f19e62 ("hw/mem/cxl_type3: Add DC extent list representative and get DC extent list mailbox support") Signed-off-by: Fan Ni <fan.ni@samsung.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241101132005.26633-3-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04cxl/cxl-mailbox-utils: Fix size check for cmd_firmware_update_get_infoFan Ni
In the function cmd_firmware_update_get_info for handling Get FW info command (0x0200h), the vmem, pmem and DC capacity size check were incorrect. The size should be aligned to 256MiB, not smaller than 256MiB. Signed-off-by: Fan Ni <fan.ni@samsung.com> Reviewed-by: Davidlohr Bueso <dave@stgolabs.net> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241101132005.26633-2-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-11-04pcie: enable Extended tag field supportMarcin Juszkiewicz
>From what I read PCI has 32 transactions, PCI Express devices can handle 256 with Extended tag enabled (spec mentions also larger values but I lack PCIe knowledge). QEMU leaves 'Extended tag field' with 0 as value: Capabilities: [e0] Express (v1) Root Complex Integrated Endpoint, IntMsgNum 0 DevCap: MaxPayload 128 bytes, PhantFunc 0 ExtTag- RBE+ FLReset- TEE-IO- SBSA ACS has test 824 which checks for PCIe device capabilities. BSA specification [1] (SBSA is on top of BSA) in section F.3.2 lists expected values for Device Capabilities Register: Device Capabilities Register Requirement Role based error reporting RCEC and RCiEP: Hardwired to 1 Endpoint L0s acceptable latency RCEC and RCiEP: Hardwired to 0 L1 acceptable latency RCEC and RCiEP: Hardwired to 0 Captured slot power limit scale RCEC and RCiEP: Hardwired to 0 Captured slot power limit value RCEC and RCiEP: Hardwired to 0 Max payload size value must be compliant with PCIe spec Phantom functions RCEC and RCiEP: Recommendation is to hardwire this bit to 0. Extended tag field Hardwired to 1 1. https://developer.arm.com/documentation/den0094/c/ This change enables Extended tag field. All versioned platforms should have it disabled for older versions (tested with Arm/virt). Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> Message-Id: <20241023113820.486017-1-marcin.juszkiewicz@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-08 00:20:14 +0000