* [PULL 00/26] target-arm queue
@ 2020-01-30 16:15 Peter Maydell
2020-01-30 19:05 ` Peter Maydell
0 siblings, 1 reply; 46+ messages in thread
From: Peter Maydell @ 2020-01-30 16:15 UTC (permalink / raw)
To: qemu-devel
target-arm queue. The big thing here is the landing of the 3-phase
reset patches...
-- PMM
The following changes since commit 204aa60b37c23a89e690d418f49787d274303ca7:
Merge remote-tracking branch 'remotes/amarkovic/tags/mips-queue-jan-29-2020' into staging (2020-01-30 14:18:45 +0000)
are available in the Git repository at:
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200130
for you to fetch changes up to dea101a1ae9968c9fec6ab0291489dad7c49f36f:
target/arm/cpu: Add the kvm-no-adjvtime CPU property (2020-01-30 16:02:06 +0000)
----------------------------------------------------------------
target-arm queue:
* hw/core/or-irq: Fix incorrect assert forbidding num-lines == MAX_OR_LINES
* target/arm/arm-semi: Don't let the guest close stdin/stdout/stderr
* aspeed: some minor bugfixes
* aspeed: add eMMC controller model for AST2600 SoC
* hw/arm/raspi: Remove obsolete use of -smp to set the soc 'enabled-cpus'
* New 3-phase reset API for device models
* hw/intc/arm_gicv3_kvm: Stop wrongly programming GICR_PENDBASER.PTZ bit
* Arm KVM: stop/restart the guest counter when the VM is stopped and started
----------------------------------------------------------------
Andrew Jeffery (2):
hw/sd: Configure number of slots exposed by the ASPEED SDHCI model
hw/arm: ast2600: Wire up the eMMC controller
Andrew Jones (6):
target/arm/kvm: trivial: Clean up header documentation
hw/arm/virt: Add missing 5.0 options call to 4.2 options
target/arm/kvm64: kvm64 cpus have timer registers
tests/arm-cpu-features: Check feature default values
target/arm/kvm: Implement virtual time adjustment
target/arm/cpu: Add the kvm-no-adjvtime CPU property
Cédric Le Goater (2):
ftgmac100: check RX and TX buffer alignment
hw/arm/aspeed: add a 'execute-in-place' property to boot directly from CE0
Damien Hedde (11):
add device_legacy_reset function to prepare for reset api change
hw/core/qdev: add trace events to help with resettable transition
hw/core: create Resettable QOM interface
hw/core: add Resettable support to BusClass and DeviceClass
hw/core/resettable: add support for changing parent
hw/core/qdev: handle parent bus change regarding resettable
hw/core/qdev: update hotplug reset regarding resettable
hw/core: deprecate old reset functions and introduce new ones
docs/devel/reset.rst: add doc about Resettable interface
vl: replace deprecated qbus_reset_all registration
hw/s390x/ipl: replace deprecated qdev_reset_all registration
Joel Stanley (1):
misc/pca9552: Add qom set and get
Peter Maydell (2):
hw/core/or-irq: Fix incorrect assert forbidding num-lines == MAX_OR_LINES
target/arm/arm-semi: Don't let the guest close stdin/stdout/stderr
Philippe Mathieu-Daudé (1):
hw/arm/raspi: Remove obsolete use of -smp to set the soc 'enabled-cpus'
Zenghui Yu (1):
hw/intc/arm_gicv3_kvm: Stop wrongly programming GICR_PENDBASER.PTZ bit
hw/core/Makefile.objs | 1 +
tests/Makefile.include | 1 +
include/hw/arm/aspeed.h | 2 +
include/hw/arm/aspeed_soc.h | 2 +
include/hw/arm/virt.h | 1 +
include/hw/qdev-core.h | 58 +++++++-
include/hw/resettable.h | 247 +++++++++++++++++++++++++++++++++
include/hw/sd/aspeed_sdhci.h | 1 +
target/arm/cpu.h | 7 +
target/arm/kvm_arm.h | 95 ++++++++++---
hw/arm/aspeed.c | 72 ++++++++--
hw/arm/aspeed_ast2600.c | 31 ++++-
hw/arm/aspeed_soc.c | 2 +
hw/arm/raspi.c | 2 -
hw/arm/virt.c | 9 ++
hw/audio/intel-hda.c | 2 +-
hw/core/bus.c | 102 ++++++++++++++
hw/core/or-irq.c | 2 +-
hw/core/qdev.c | 160 ++++++++++++++++++++--
hw/core/resettable.c | 301 +++++++++++++++++++++++++++++++++++++++++
hw/hyperv/hyperv.c | 2 +-
hw/i386/microvm.c | 2 +-
hw/i386/pc.c | 2 +-
hw/ide/microdrive.c | 8 +-
hw/intc/arm_gicv3_kvm.c | 11 +-
hw/intc/spapr_xive.c | 2 +-
hw/misc/pca9552.c | 90 ++++++++++++
hw/net/ftgmac100.c | 13 ++
hw/ppc/pnv_psi.c | 4 +-
hw/ppc/spapr_pci.c | 2 +-
hw/ppc/spapr_vio.c | 2 +-
hw/s390x/ipl.c | 10 +-
hw/s390x/s390-pci-inst.c | 2 +-
hw/scsi/vmw_pvscsi.c | 2 +-
hw/sd/aspeed_sdhci.c | 11 +-
hw/sd/omap_mmc.c | 2 +-
hw/sd/pl181.c | 2 +-
target/arm/arm-semi.c | 9 ++
target/arm/cpu.c | 2 +
target/arm/cpu64.c | 1 +
target/arm/kvm.c | 120 ++++++++++++++++
target/arm/kvm32.c | 3 +
target/arm/kvm64.c | 4 +
target/arm/machine.c | 7 +
target/arm/monitor.c | 1 +
tests/qtest/arm-cpu-features.c | 41 ++++--
vl.c | 10 +-
docs/arm-cpu-features.rst | 37 ++++-
docs/devel/index.rst | 1 +
docs/devel/reset.rst | 289 +++++++++++++++++++++++++++++++++++++++
hw/core/trace-events | 27 ++++
51 files changed, 1727 insertions(+), 90 deletions(-)
create mode 100644 include/hw/resettable.h
create mode 100644 hw/core/resettable.c
create mode 100644 docs/devel/reset.rst
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PULL 00/26] target-arm queue
2020-01-30 16:15 Peter Maydell
@ 2020-01-30 19:05 ` Peter Maydell
0 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2020-01-30 19:05 UTC (permalink / raw)
To: QEMU Developers
On Thu, 30 Jan 2020 at 16:15, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> target-arm queue. The big thing here is the landing of the 3-phase
> reset patches...
>
> -- PMM
>
> The following changes since commit 204aa60b37c23a89e690d418f49787d274303ca7:
>
> Merge remote-tracking branch 'remotes/amarkovic/tags/mips-queue-jan-29-2020' into staging (2020-01-30 14:18:45 +0000)
>
> are available in the Git repository at:
>
> https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200130
>
> for you to fetch changes up to dea101a1ae9968c9fec6ab0291489dad7c49f36f:
>
> target/arm/cpu: Add the kvm-no-adjvtime CPU property (2020-01-30 16:02:06 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
> * hw/core/or-irq: Fix incorrect assert forbidding num-lines == MAX_OR_LINES
> * target/arm/arm-semi: Don't let the guest close stdin/stdout/stderr
> * aspeed: some minor bugfixes
> * aspeed: add eMMC controller model for AST2600 SoC
> * hw/arm/raspi: Remove obsolete use of -smp to set the soc 'enabled-cpus'
> * New 3-phase reset API for device models
> * hw/intc/arm_gicv3_kvm: Stop wrongly programming GICR_PENDBASER.PTZ bit
> * Arm KVM: stop/restart the guest counter when the VM is stopped and started
>
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/5.0
for any user-visible changes.
-- PMM
^ permalink raw reply [flat|nested] 46+ messages in thread
* [PULL 00/26] target-arm queue
@ 2020-11-02 17:09 Peter Maydell
2020-11-03 11:36 ` Peter Maydell
0 siblings, 1 reply; 46+ messages in thread
From: Peter Maydell @ 2020-11-02 17:09 UTC (permalink / raw)
To: qemu-devel
Small pile of bug fixes for rc1. I've included my patches to get
our docs building with Sphinx 3, just for convenience...
-- PMM
The following changes since commit b149dea55cce97cb226683d06af61984a1c11e96:
Merge remote-tracking branch 'remotes/cschoenebeck/tags/pull-9p-20201102' into staging (2020-11-02 10:57:48 +0000)
are available in the Git repository at:
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201102
for you to fetch changes up to ffb4fbf90a2f63c9cb33e4bb9f854c79bf04ca4a:
tests/qtest/npcm7xx_rng-test: Disable randomness tests (2020-11-02 16:52:18 +0000)
----------------------------------------------------------------
target-arm queue:
* target/arm: Fix Neon emulation bugs on big-endian hosts
* target/arm: fix handling of HCR.FB
* target/arm: fix LORID_EL1 access check
* disas/capstone: Fix monitor disassembly of >32 bytes
* hw/arm/smmuv3: Fix potential integer overflow (CID 1432363)
* hw/arm/boot: fix SVE for EL3 direct kernel boot
* hw/display/omap_lcdc: Fix potential NULL pointer dereference
* hw/display/exynos4210_fimd: Fix potential NULL pointer dereference
* target/arm: Get correct MMU index for other-security-state
* configure: Test that gio libs from pkg-config work
* hw/intc/arm_gicv3_cpuif: Make GIC maintenance interrupts work
* docs: Fix building with Sphinx 3
* tests/qtest/npcm7xx_rng-test: Disable randomness tests
----------------------------------------------------------------
AlexChen (2):
hw/display/omap_lcdc: Fix potential NULL pointer dereference
hw/display/exynos4210_fimd: Fix potential NULL pointer dereference
Peter Maydell (9):
target/arm: Fix float16 pairwise Neon ops on big-endian hosts
target/arm: Fix VUDOT/VSDOT (scalar) on big-endian hosts
disas/capstone: Fix monitor disassembly of >32 bytes
target/arm: Get correct MMU index for other-security-state
configure: Test that gio libs from pkg-config work
hw/intc/arm_gicv3_cpuif: Make GIC maintenance interrupts work
scripts/kerneldoc: For Sphinx 3 use c:macro for macros with arguments
qemu-option-trace.rst.inc: Don't use option:: markup
tests/qtest/npcm7xx_rng-test: Disable randomness tests
Philippe Mathieu-Daudé (1):
hw/arm/smmuv3: Fix potential integer overflow (CID 1432363)
Richard Henderson (11):
target/arm: Introduce neon_full_reg_offset
target/arm: Move neon_element_offset to translate.c
target/arm: Use neon_element_offset in neon_load/store_reg
target/arm: Use neon_element_offset in vfp_reg_offset
target/arm: Add read/write_neon_element32
target/arm: Expand read/write_neon_element32 to all MemOp
target/arm: Rename neon_load_reg32 to vfp_load_reg32
target/arm: Add read/write_neon_element64
target/arm: Rename neon_load_reg64 to vfp_load_reg64
target/arm: Simplify do_long_3d and do_2scalar_long
target/arm: Improve do_prewiden_3d
Rémi Denis-Courmont (3):
target/arm: fix handling of HCR.FB
target/arm: fix LORID_EL1 access check
hw/arm/boot: fix SVE for EL3 direct kernel boot
docs/qemu-option-trace.rst.inc | 6 +-
configure | 10 +-
include/hw/intc/arm_gicv3_common.h | 1 -
disas/capstone.c | 2 +-
hw/arm/boot.c | 3 +
hw/arm/smmuv3.c | 3 +-
hw/display/exynos4210_fimd.c | 4 +-
hw/display/omap_lcdc.c | 10 +-
hw/intc/arm_gicv3_cpuif.c | 5 +-
target/arm/helper.c | 24 +-
target/arm/m_helper.c | 3 +-
target/arm/translate.c | 153 +++++++++---
target/arm/vec_helper.c | 12 +-
tests/qtest/npcm7xx_rng-test.c | 14 +-
scripts/kernel-doc | 18 +-
target/arm/translate-neon.c.inc | 472 ++++++++++++++++++++-----------------
target/arm/translate-vfp.c.inc | 341 +++++++++++----------------
17 files changed, 588 insertions(+), 493 deletions(-)
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PULL 00/26] target-arm queue
2020-11-02 17:09 Peter Maydell
@ 2020-11-03 11:36 ` Peter Maydell
0 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2020-11-03 11:36 UTC (permalink / raw)
To: QEMU Developers
On Mon, 2 Nov 2020 at 17:10, Peter Maydell <peter.maydell@linaro.org> wrote:
>
>
> Small pile of bug fixes for rc1. I've included my patches to get
> our docs building with Sphinx 3, just for convenience...
>
> -- PMM
>
> The following changes since commit b149dea55cce97cb226683d06af61984a1c11e96:
>
> Merge remote-tracking branch 'remotes/cschoenebeck/tags/pull-9p-20201102' into staging (2020-11-02 10:57:48 +0000)
>
> are available in the Git repository at:
>
> https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201102
>
> for you to fetch changes up to ffb4fbf90a2f63c9cb33e4bb9f854c79bf04ca4a:
>
> tests/qtest/npcm7xx_rng-test: Disable randomness tests (2020-11-02 16:52:18 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
> * target/arm: Fix Neon emulation bugs on big-endian hosts
> * target/arm: fix handling of HCR.FB
> * target/arm: fix LORID_EL1 access check
> * disas/capstone: Fix monitor disassembly of >32 bytes
> * hw/arm/smmuv3: Fix potential integer overflow (CID 1432363)
> * hw/arm/boot: fix SVE for EL3 direct kernel boot
> * hw/display/omap_lcdc: Fix potential NULL pointer dereference
> * hw/display/exynos4210_fimd: Fix potential NULL pointer dereference
> * target/arm: Get correct MMU index for other-security-state
> * configure: Test that gio libs from pkg-config work
> * hw/intc/arm_gicv3_cpuif: Make GIC maintenance interrupts work
> * docs: Fix building with Sphinx 3
> * tests/qtest/npcm7xx_rng-test: Disable randomness tests
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/5.2
for any user-visible changes.
-- PMM
^ permalink raw reply [flat|nested] 46+ messages in thread
* [PULL 00/26] target-arm queue
@ 2021-05-10 12:25 Peter Maydell
0 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2021-05-10 12:25 UTC (permalink / raw)
To: qemu-devel
The following changes since commit 4cc10cae64c51e17844dc4358481c393d7bf1ed4:
Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2021-05-06 18:56:17 +0100)
are available in the Git repository at:
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210510
for you to fetch changes up to 8f96812baa53005f32aece3e30b140826c20aa19:
hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9 (2021-05-10 13:24:09 +0100)
----------------------------------------------------------------
target-arm queue:
* docs: fix link in sbsa description
* linux-user/aarch64: Enable hwcap for RND, BTI, and MTE
* target/arm: Fix tlbbits calculation in tlbi_aa64_vae2is_write()
* target/arm: Split neon and vfp translation to their own
compilation units
* target/arm: Make WFI a NOP for userspace emulators
* hw/sd/omap_mmc: Use device_cold_reset() instead of
device_legacy_reset()
* include: More fixes for 'extern "C"' block use
* hw/arm/imx25_pdk: Fix error message for invalid RAM size
* hw/arm/mps2-tz: Implement AN524 memory remapping via machine property
* hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9
----------------------------------------------------------------
Alex Bennée (1):
docs: fix link in sbsa description
Guenter Roeck (1):
hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9
Peter Maydell (22):
target/arm: Fix tlbbits calculation in tlbi_aa64_vae2is_write()
target/arm: Move constant expanders to translate.h
target/arm: Share unallocated_encoding() and gen_exception_insn()
target/arm: Make functions used by m-nocp global
target/arm: Split m-nocp trans functions into their own file
target/arm: Move gen_aa32 functions to translate-a32.h
target/arm: Move vfp_{load, store}_reg{32, 64} to translate-vfp.c.inc
target/arm: Make functions used by translate-vfp global
target/arm: Make translate-vfp.c.inc its own compilation unit
target/arm: Move vfp_reg_ptr() to translate-neon.c.inc
target/arm: Delete unused typedef
target/arm: Move NeonGenThreeOpEnvFn typedef to translate.h
target/arm: Make functions used by translate-neon global
target/arm: Make translate-neon.c.inc its own compilation unit
target/arm: Make WFI a NOP for userspace emulators
hw/sd/omap_mmc: Use device_cold_reset() instead of device_legacy_reset()
osdep: Make os-win32.h and os-posix.h handle 'extern "C"' themselves
include/qemu/bswap.h: Handle being included outside extern "C" block
include/disas/dis-asm.h: Handle being included outside 'extern "C"'
hw/misc/mps2-scc: Add "QEMU interface" comment
hw/misc/mps2-scc: Support using CFG0 bit 0 for remapping
hw/arm/mps2-tz: Implement AN524 memory remapping via machine property
Philippe Mathieu-Daudé (1):
hw/arm/imx25_pdk: Fix error message for invalid RAM size
Richard Henderson (1):
linux-user/aarch64: Enable hwcap for RND, BTI, and MTE
docs/system/arm/mps2.rst | 10 +
docs/system/arm/sbsa.rst | 2 +-
include/disas/dis-asm.h | 12 +-
include/hw/misc/mps2-scc.h | 21 ++
include/qemu/bswap.h | 26 ++-
include/qemu/osdep.h | 8 +-
include/sysemu/os-posix.h | 8 +
include/sysemu/os-win32.h | 8 +
target/arm/translate-a32.h | 144 +++++++++++++
target/arm/translate-a64.h | 2 -
target/arm/translate.h | 29 +++
hw/arm/imx25_pdk.c | 5 +-
hw/arm/mps2-tz.c | 108 +++++++++-
hw/arm/xilinx_zynq.c | 2 +-
hw/misc/mps2-scc.c | 13 +-
hw/sd/omap_mmc.c | 2 +-
linux-user/elfload.c | 13 ++
target/arm/helper.c | 2 +-
target/arm/op_helper.c | 12 ++
target/arm/translate-a64.c | 15 --
target/arm/translate-m-nocp.c | 221 ++++++++++++++++++++
.../arm/{translate-neon.c.inc => translate-neon.c} | 19 +-
.../arm/{translate-vfp.c.inc => translate-vfp.c} | 230 +++------------------
target/arm/translate.c | 200 ++++--------------
disas/arm-a64.cc | 2 -
disas/nanomips.cpp | 2 -
target/arm/meson.build | 15 +-
27 files changed, 718 insertions(+), 413 deletions(-)
create mode 100644 target/arm/translate-a32.h
create mode 100644 target/arm/translate-m-nocp.c
rename target/arm/{translate-neon.c.inc => translate-neon.c} (99%)
rename target/arm/{translate-vfp.c.inc => translate-vfp.c} (94%)
^ permalink raw reply [flat|nested] 46+ messages in thread
* [PULL 00/26] target-arm queue
@ 2022-02-21 9:27 Peter Maydell
0 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2022-02-21 9:27 UTC (permalink / raw)
To: qemu-devel
The following changes since commit e670f6d825d4dee248b311197fd4048469d6772b:
Merge remote-tracking branch 'remotes/legoater/tags/pull-ppc-20220218' into staging (2022-02-20 15:05:41 +0000)
are available in the Git repository at:
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220221
for you to fetch changes up to d6333e2543fa41aed4d33f77c808168373e39bff:
ui/cocoa: Fix the leak of qemu_console_get_label (2022-02-21 09:12:18 +0000)
----------------------------------------------------------------
arm, cocoa and misc:
* MAINTAINERS file updates
* Mark remaining global TypeInfo instances as const
* checkpatch: Ensure that TypeInfos are const
* tests/qtest: add qtests for npcm7xx sdhci
* arm hvf: Handle unknown ID registers as RES0
* Make KVM -cpu max exactly like -cpu host
* Fix '-cpu max' for HVF
* Support PAuth extension for hvf
* Kconfig: Add I2C_DEVICES device group
* Kconfig: Add 'imply I2C_DEVICES' on boards with available i2c bus
* hw/arm/armv7m: Handle disconnected clock inputs
* osdep.h: pull out various things into new header files
* hw/timer: fix a9gtimer vmstate
* hw/arm: add initial mori-bmc board
* ui/cocoa: Remove allowedFileTypes restriction in SavePanel
* ui/cocoa: Do not alert even without block devices
* ui/cocoa: Fix the leak of qemu_console_get_label
----------------------------------------------------------------
Akihiko Odaki (3):
MAINTAINERS: Add Akihiko Odaki to macOS-relateds
ui/cocoa: Do not alert even without block devices
ui/cocoa: Fix the leak of qemu_console_get_label
Alexander Graf (2):
hvf: arm: Use macros for sysreg shift/masking
hvf: arm: Handle unknown ID registers as RES0
Ani Sinha (1):
MAINTAINERS: Adding myself as a reviewer of some components
Bernhard Beschow (2):
Mark remaining global TypeInfo instances as const
checkpatch: Ensure that TypeInfos are const
Patrick Venture (1):
hw/arm: add initial mori-bmc board
Pavel Dovgalyuk (1):
hw/timer: fix a9gtimer vmstate
Peter Maydell (14):
target/arm: Move '-cpu host' code to cpu64.c
target/arm: Use aarch64_cpu_register() for 'host' CPU type
target/arm: Make KVM -cpu max exactly like -cpu host
target/arm: Unindent unnecessary else-clause
target/arm: Fix '-cpu max' for HVF
target/arm: Support PAuth extension for hvf
Kconfig: Add I2C_DEVICES device group
Kconfig: Add 'imply I2C_DEVICES' on boards with available i2c bus
hw/arm/armv7m: Handle disconnected clock inputs
include: Move qemu_madvise() and related #defines to new qemu/madvise.h
include: Move qemu_mprotect_*() to new qemu/mprotect.h
include: Move QEMU_MAP_* constants to mmap-alloc.h
include: Move qemu_[id]cache_* declarations to new qemu/cacheinfo.h
include: Move hardware version declarations to new qemu/hw-version.h
Philippe Mathieu-Daudé (1):
ui/cocoa: Remove allowedFileTypes restriction in SavePanel
Shengtan Mao (1):
tests/qtest: add qtests for npcm7xx sdhci
docs/devel/kconfig.rst | 8 +-
docs/system/arm/nuvoton.rst | 1 +
include/qemu/cacheinfo.h | 21 +++
include/qemu/hw-version.h | 27 ++++
include/qemu/madvise.h | 95 +++++++++++
include/qemu/mmap-alloc.h | 23 +++
include/qemu/mprotect.h | 14 ++
include/qemu/osdep.h | 132 ----------------
accel/tcg/translate-all.c | 1 +
backends/hostmem-file.c | 1 +
backends/hostmem.c | 1 +
hw/arm/armv7m.c | 26 ++-
hw/arm/npcm7xx_boards.c | 32 ++++
hw/arm/nseries.c | 1 +
hw/core/generic-loader.c | 2 +-
hw/core/guest-loader.c | 2 +-
hw/display/bcm2835_fb.c | 2 +-
hw/display/i2c-ddc.c | 2 +-
hw/display/macfb.c | 4 +-
hw/display/virtio-vga.c | 2 +-
hw/dma/bcm2835_dma.c | 2 +-
hw/i386/pc_piix.c | 2 +-
hw/i386/sgx-epc.c | 2 +-
hw/ide/core.c | 1 +
hw/intc/bcm2835_ic.c | 2 +-
hw/intc/bcm2836_control.c | 2 +-
hw/ipmi/ipmi.c | 4 +-
hw/mem/nvdimm.c | 2 +-
hw/mem/pc-dimm.c | 2 +-
hw/misc/bcm2835_mbox.c | 2 +-
hw/misc/bcm2835_powermgt.c | 2 +-
hw/misc/bcm2835_property.c | 2 +-
hw/misc/bcm2835_rng.c | 2 +-
hw/misc/pvpanic-isa.c | 2 +-
hw/misc/pvpanic-pci.c | 2 +-
hw/net/fsl_etsec/etsec.c | 2 +-
hw/ppc/prep_systemio.c | 2 +-
hw/ppc/spapr_iommu.c | 2 +-
hw/s390x/s390-pci-bus.c | 2 +-
hw/s390x/sclp.c | 2 +-
hw/s390x/tod-kvm.c | 2 +-
hw/s390x/tod-tcg.c | 2 +-
hw/s390x/tod.c | 2 +-
hw/scsi/lsi53c895a.c | 2 +-
hw/scsi/megasas.c | 1 +
hw/scsi/scsi-bus.c | 1 +
hw/scsi/scsi-disk.c | 1 +
hw/sd/allwinner-sdhost.c | 2 +-
hw/sd/aspeed_sdhci.c | 2 +-
hw/sd/bcm2835_sdhost.c | 2 +-
hw/sd/cadence_sdhci.c | 2 +-
hw/sd/npcm7xx_sdhci.c | 2 +-
hw/timer/a9gtimer.c | 21 +++
hw/usb/dev-mtp.c | 2 +-
hw/usb/host-libusb.c | 2 +-
hw/vfio/igd.c | 2 +-
hw/virtio/virtio-balloon.c | 1 +
hw/virtio/virtio-pmem.c | 2 +-
migration/postcopy-ram.c | 1 +
migration/qemu-file.c | 1 +
migration/ram.c | 1 +
plugins/loader.c | 1 +
qom/object.c | 4 +-
softmmu/physmem.c | 1 +
softmmu/vl.c | 1 +
target/arm/cpu.c | 30 ----
target/arm/cpu64.c | 331 +++++++++++++++++++++------------------
target/arm/hvf/hvf.c | 83 +++++++---
target/i386/cpu.c | 1 +
target/s390x/cpu_models.c | 1 +
tcg/region.c | 3 +
tcg/tcg.c | 1 +
tests/qtest/npcm7xx_sdhci-test.c | 215 +++++++++++++++++++++++++
util/atomic64.c | 1 +
util/cacheflush.c | 1 +
util/cacheinfo.c | 1 +
util/osdep.c | 3 +
util/oslib-posix.c | 1 +
MAINTAINERS | 5 +
hw/arm/Kconfig | 10 ++
hw/i2c/Kconfig | 5 +
hw/rtc/Kconfig | 2 +
hw/sensor/Kconfig | 5 +
scripts/checkpatch.pl | 1 +
tests/qtest/meson.build | 1 +
ui/cocoa.m | 15 +-
86 files changed, 822 insertions(+), 393 deletions(-)
create mode 100644 include/qemu/cacheinfo.h
create mode 100644 include/qemu/hw-version.h
create mode 100644 include/qemu/madvise.h
create mode 100644 include/qemu/mprotect.h
create mode 100644 tests/qtest/npcm7xx_sdhci-test.c
^ permalink raw reply [flat|nested] 46+ messages in thread
* [PULL 00/26] target-arm queue
@ 2022-03-02 20:52 Peter Maydell
2022-03-03 19:57 ` Peter Maydell
0 siblings, 1 reply; 46+ messages in thread
From: Peter Maydell @ 2022-03-02 20:52 UTC (permalink / raw)
To: qemu-devel
The following changes since commit 64ada298b98a51eb2512607f6e6180cb330c47b1:
Merge remote-tracking branch 'remotes/legoater/tags/pull-ppc-20220302' into staging (2022-03-02 12:38:46 +0000)
are available in the Git repository at:
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220302
for you to fetch changes up to 268c11984e67867c22f53beb3c7f8b98900d66b2:
ui/cocoa.m: Remove unnecessary NSAutoreleasePools (2022-03-02 19:27:37 +0000)
----------------------------------------------------------------
target-arm queue:
* mps3-an547: Add missing user ahb interfaces
* hw/arm/mps2-tz.c: Update AN547 documentation URL
* hw/input/tsc210x: Don't abort on bad SPI word widths
* hw/i2c: flatten pca954x mux device
* target/arm: Support PSCI 1.1 and SMCCC 1.0
* target/arm: Fix early free of TCG temp in handle_simd_shift_fpint_conv()
* tests/qtest: add qtests for npcm7xx sdhci
* Implement FEAT_LVA
* Implement FEAT_LPA
* Implement FEAT_LPA2 (but do not enable it yet)
* Report KVM's actual PSCI version to guest in dtb
* ui/cocoa.m: Fix updateUIInfo threading issues
* ui/cocoa.m: Remove unnecessary NSAutoreleasePools
----------------------------------------------------------------
Akihiko Odaki (1):
target/arm: Support PSCI 1.1 and SMCCC 1.0
Jimmy Brisson (1):
mps3-an547: Add missing user ahb interfaces
Patrick Venture (1):
hw/i2c: flatten pca954x mux device
Peter Maydell (5):
hw/arm/mps2-tz.c: Update AN547 documentation URL
hw/input/tsc210x: Don't abort on bad SPI word widths
target/arm: Report KVM's actual PSCI version to guest in dtb
ui/cocoa.m: Fix updateUIInfo threading issues
ui/cocoa.m: Remove unnecessary NSAutoreleasePools
Richard Henderson (16):
hw/registerfields: Add FIELD_SEX<N> and FIELD_SDP<N>
target/arm: Set TCR_EL1.TSZ for user-only
target/arm: Fault on invalid TCR_ELx.TxSZ
target/arm: Move arm_pamax out of line
target/arm: Pass outputsize down to check_s2_mmu_setup
target/arm: Use MAKE_64BIT_MASK to compute indexmask
target/arm: Honor TCR_ELx.{I}PS
target/arm: Prepare DBGBVR and DBGWVR for FEAT_LVA
target/arm: Implement FEAT_LVA
target/arm: Implement FEAT_LPA
target/arm: Extend arm_fi_to_lfsc to level -1
target/arm: Introduce tlbi_aa64_get_range
target/arm: Fix TLBIRange.base for 16k and 64k pages
target/arm: Validate tlbi TG matches translation granule in use
target/arm: Advertise all page sizes for -cpu max
target/arm: Implement FEAT_LPA2
Shengtan Mao (1):
tests/qtest: add qtests for npcm7xx sdhci
Wentao_Liang (1):
target/arm: Fix early free of TCG temp in handle_simd_shift_fpint_conv()
docs/system/arm/emulation.rst | 3 +
include/hw/registerfields.h | 48 +++++-
target/arm/cpu-param.h | 4 +-
target/arm/cpu.h | 27 ++++
target/arm/internals.h | 58 ++++---
target/arm/kvm-consts.h | 14 +-
hw/arm/boot.c | 11 +-
hw/arm/mps2-tz.c | 6 +-
hw/i2c/i2c_mux_pca954x.c | 77 ++-------
hw/input/tsc210x.c | 8 +-
target/arm/cpu.c | 8 +-
target/arm/cpu64.c | 7 +-
target/arm/helper.c | 332 ++++++++++++++++++++++++++++++---------
target/arm/hvf/hvf.c | 27 +++-
target/arm/kvm64.c | 14 +-
target/arm/psci.c | 35 ++++-
target/arm/translate-a64.c | 2 +-
tests/qtest/npcm7xx_sdhci-test.c | 215 +++++++++++++++++++++++++
tests/qtest/meson.build | 1 +
ui/cocoa.m | 31 ++--
20 files changed, 736 insertions(+), 192 deletions(-)
create mode 100644 tests/qtest/npcm7xx_sdhci-test.c
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PULL 00/26] target-arm queue
2022-03-02 20:52 Peter Maydell
@ 2022-03-03 19:57 ` Peter Maydell
0 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2022-03-03 19:57 UTC (permalink / raw)
To: qemu-devel
On Wed, 2 Mar 2022 at 20:52, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> The following changes since commit 64ada298b98a51eb2512607f6e6180cb330c47b1:
>
> Merge remote-tracking branch 'remotes/legoater/tags/pull-ppc-20220302' into staging (2022-03-02 12:38:46 +0000)
>
> are available in the Git repository at:
>
> https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220302
>
> for you to fetch changes up to 268c11984e67867c22f53beb3c7f8b98900d66b2:
>
> ui/cocoa.m: Remove unnecessary NSAutoreleasePools (2022-03-02 19:27:37 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
> * mps3-an547: Add missing user ahb interfaces
> * hw/arm/mps2-tz.c: Update AN547 documentation URL
> * hw/input/tsc210x: Don't abort on bad SPI word widths
> * hw/i2c: flatten pca954x mux device
> * target/arm: Support PSCI 1.1 and SMCCC 1.0
> * target/arm: Fix early free of TCG temp in handle_simd_shift_fpint_conv()
> * tests/qtest: add qtests for npcm7xx sdhci
> * Implement FEAT_LVA
> * Implement FEAT_LPA
> * Implement FEAT_LPA2 (but do not enable it yet)
> * Report KVM's actual PSCI version to guest in dtb
> * ui/cocoa.m: Fix updateUIInfo threading issues
> * ui/cocoa.m: Remove unnecessary NSAutoreleasePools
>
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/7.0
for any user-visible changes.
-- PMM
^ permalink raw reply [flat|nested] 46+ messages in thread
* [PULL 00/26] target-arm queue
@ 2023-01-23 13:35 Peter Maydell
2023-01-23 15:17 ` Peter Maydell
0 siblings, 1 reply; 46+ messages in thread
From: Peter Maydell @ 2023-01-23 13:35 UTC (permalink / raw)
To: qemu-devel
The following changes since commit 65cc5ccf06a74c98de73ec683d9a543baa302a12:
Merge tag 'pull-riscv-to-apply-20230120' of https://github.com/alistair23/qemu into staging (2023-01-20 16:17:56 +0000)
are available in the Git repository at:
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230123
for you to fetch changes up to 3b07a936d3bfe97b07ddffcfbb532985a88033dd:
target/arm: Look up ARMCPRegInfo at runtime (2023-01-23 13:32:38 +0000)
----------------------------------------------------------------
target-arm queue:
* Widen cnthctl_el2 to uint64_t
* Unify checking for M Main Extension in MRS/MSR
* bitbang_i2c, versatile_i2c: code cleanups
* SME: refactor SME SM/ZA handling
* Fix physical address resolution for MTE
* Fix in_debug path in S1_ptw_translate
* Don't set EXC_RETURN.ES if Security Extension not present
* Implement DBGCLAIM registers
* Provide stubs for more external debug registers
* Look up ARMCPRegInfo at runtime, not translate time
----------------------------------------------------------------
David Reiss (1):
target/arm: Unify checking for M Main Extension in MRS/MSR
Evgeny Iakovlev (2):
target/arm: implement DBGCLAIM registers
target/arm: provide stubs for more external debug registers
Peter Maydell (1):
target/arm: Don't set EXC_RETURN.ES if Security Extension not present
Philippe Mathieu-Daudé (10):
hw/i2c/bitbang_i2c: Define TYPE_GPIO_I2C in public header
hw/i2c/bitbang_i2c: Remove unused dummy MemoryRegion
hw/i2c/bitbang_i2c: Change state calling bitbang_i2c_set_state() helper
hw/i2c/bitbang_i2c: Trace state changes
hw/i2c/bitbang_i2c: Convert DPRINTF() to trace events
hw/i2c/versatile_i2c: Drop useless casts from void * to pointer
hw/i2c/versatile_i2c: Replace VersatileI2CState -> ArmSbconI2CState
hw/i2c/versatile_i2c: Replace TYPE_VERSATILE_I2C -> TYPE_ARM_SBCON_I2C
hw/i2c/versatile_i2c: Use ARM_SBCON_I2C() macro
hw/i2c/versatile_i2c: Rename versatile_i2c -> arm_sbcon_i2c
Richard Henderson (12):
target/arm: Widen cnthctl_el2 to uint64_t
target/arm/sme: Reorg SME access handling in handle_msr_i()
target/arm/sme: Rebuild hflags in set_pstate() helpers
target/arm/sme: Introduce aarch64_set_svcr()
target/arm/sme: Reset SVE state in aarch64_set_svcr()
target/arm/sme: Reset ZA state in aarch64_set_svcr()
target/arm/sme: Rebuild hflags in aarch64_set_svcr()
target/arm/sme: Unify set_pstate() SM/ZA helpers as set_svcr()
target/arm: Fix physical address resolution for MTE
target/arm: Fix in_debug path in S1_ptw_translate
target/arm: Reorg do_coproc_insn
target/arm: Look up ARMCPRegInfo at runtime
MAINTAINERS | 1 +
include/hw/i2c/arm_sbcon_i2c.h | 6 +-
include/hw/i2c/bitbang_i2c.h | 2 +
target/arm/cpu.h | 5 +-
target/arm/helper-sme.h | 3 +-
target/arm/helper.h | 11 +-
target/arm/translate.h | 7 +
hw/arm/musicpal.c | 3 +-
hw/arm/realview.c | 2 +-
hw/arm/versatilepb.c | 2 +-
hw/arm/vexpress.c | 2 +-
hw/i2c/{versatile_i2c.c => arm_sbcon_i2c.c} | 39 ++-
hw/i2c/bitbang_i2c.c | 80 ++++--
linux-user/aarch64/cpu_loop.c | 11 +-
linux-user/aarch64/signal.c | 13 +-
target/arm/debug_helper.c | 54 ++++
target/arm/helper.c | 41 ++-
target/arm/m_helper.c | 24 +-
target/arm/mte_helper.c | 2 +-
target/arm/op_helper.c | 27 +-
target/arm/ptw.c | 4 +-
target/arm/sme_helper.c | 37 +--
target/arm/translate-a64.c | 68 +++--
target/arm/translate.c | 430 +++++++++++++++-------------
hw/arm/Kconfig | 4 +-
hw/i2c/Kconfig | 2 +-
hw/i2c/meson.build | 2 +-
hw/i2c/trace-events | 7 +
28 files changed, 506 insertions(+), 383 deletions(-)
rename hw/i2c/{versatile_i2c.c => arm_sbcon_i2c.c} (70%)
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PULL 00/26] target-arm queue
2023-01-23 13:35 Peter Maydell
@ 2023-01-23 15:17 ` Peter Maydell
0 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2023-01-23 15:17 UTC (permalink / raw)
To: qemu-devel
On Mon, 23 Jan 2023 at 13:35, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> The following changes since commit 65cc5ccf06a74c98de73ec683d9a543baa302a12:
>
> Merge tag 'pull-riscv-to-apply-20230120' of https://github.com/alistair23/qemu into staging (2023-01-20 16:17:56 +0000)
>
> are available in the Git repository at:
>
> https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230123
>
> for you to fetch changes up to 3b07a936d3bfe97b07ddffcfbb532985a88033dd:
>
> target/arm: Look up ARMCPRegInfo at runtime (2023-01-23 13:32:38 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
> * Widen cnthctl_el2 to uint64_t
> * Unify checking for M Main Extension in MRS/MSR
> * bitbang_i2c, versatile_i2c: code cleanups
> * SME: refactor SME SM/ZA handling
> * Fix physical address resolution for MTE
> * Fix in_debug path in S1_ptw_translate
> * Don't set EXC_RETURN.ES if Security Extension not present
> * Implement DBGCLAIM registers
> * Provide stubs for more external debug registers
> * Look up ARMCPRegInfo at runtime, not translate time
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/8.0
for any user-visible changes.
-- PMM
^ permalink raw reply [flat|nested] 46+ messages in thread
* [PULL 00/26] target-arm queue
@ 2023-06-23 12:31 Peter Maydell
2023-06-25 8:25 ` Richard Henderson
0 siblings, 1 reply; 46+ messages in thread
From: Peter Maydell @ 2023-06-23 12:31 UTC (permalink / raw)
To: qemu-devel
Hi; here's a target-arm pullreq. Mostly this is RTH's FEAT_RME
series; there are also a handful of bug fixes including some
which aren't arm-specific but which it's convenient to include
here.
thanks
-- PMM
The following changes since commit b455ce4c2f300c8ba47cba7232dd03261368a4cb:
Merge tag 'q800-for-8.1-pull-request' of https://github.com/vivier/qemu-m68k into staging (2023-06-22 10:18:32 +0200)
are available in the Git repository at:
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230623
for you to fetch changes up to 497fad38979c16b6412388927401e577eba43d26:
pc-bios/keymaps: Use the official xkb name for Arabic layout, not the legacy synonym (2023-06-23 11:46:02 +0100)
----------------------------------------------------------------
target-arm queue:
* Add (experimental) support for FEAT_RME
* host-utils: Avoid using __builtin_subcll on buggy versions of Apple Clang
* target/arm: Restructure has_vfp_d32 test
* hw/arm/sbsa-ref: add ITS support in SBSA GIC
* target/arm: Fix sve predicate store, 8 <= VQ <= 15
* pc-bios/keymaps: Use the official xkb name for Arabic layout, not the legacy synonym
----------------------------------------------------------------
Peter Maydell (2):
host-utils: Avoid using __builtin_subcll on buggy versions of Apple Clang
pc-bios/keymaps: Use the official xkb name for Arabic layout, not the legacy synonym
Richard Henderson (23):
target/arm: Add isar_feature_aa64_rme
target/arm: Update SCR and HCR for RME
target/arm: SCR_EL3.NS may be RES1
target/arm: Add RME cpregs
target/arm: Introduce ARMSecuritySpace
include/exec/memattrs: Add two bits of space to MemTxAttrs
target/arm: Adjust the order of Phys and Stage2 ARMMMUIdx
target/arm: Introduce ARMMMUIdx_Phys_{Realm,Root}
target/arm: Remove __attribute__((nonnull)) from ptw.c
target/arm: Pipe ARMSecuritySpace through ptw.c
target/arm: NSTable is RES0 for the RME EL3 regime
target/arm: Handle Block and Page bits for security space
target/arm: Handle no-execute for Realm and Root regimes
target/arm: Use get_phys_addr_with_struct in S1_ptw_translate
target/arm: Move s1_is_el0 into S1Translate
target/arm: Use get_phys_addr_with_struct for stage2
target/arm: Add GPC syndrome
target/arm: Implement GPC exceptions
target/arm: Implement the granule protection check
target/arm: Add cpu properties for enabling FEAT_RME
docs/system/arm: Document FEAT_RME
target/arm: Restructure has_vfp_d32 test
target/arm: Fix sve predicate store, 8 <= VQ <= 15
Shashi Mallela (1):
hw/arm/sbsa-ref: add ITS support in SBSA GIC
docs/system/arm/cpu-features.rst | 23 ++
docs/system/arm/emulation.rst | 1 +
docs/system/arm/sbsa.rst | 14 +
include/exec/memattrs.h | 9 +-
include/qemu/compiler.h | 13 +
include/qemu/host-utils.h | 2 +-
target/arm/cpu.h | 151 ++++++++---
target/arm/internals.h | 27 ++
target/arm/syndrome.h | 10 +
hw/arm/sbsa-ref.c | 33 ++-
target/arm/cpu.c | 32 ++-
target/arm/helper.c | 162 ++++++++++-
target/arm/ptw.c | 570 +++++++++++++++++++++++++++++++--------
target/arm/tcg/cpu64.c | 53 ++++
target/arm/tcg/tlb_helper.c | 96 ++++++-
target/arm/tcg/translate-sve.c | 2 +-
pc-bios/keymaps/meson.build | 2 +-
17 files changed, 1034 insertions(+), 166 deletions(-)
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PULL 00/26] target-arm queue
2023-06-23 12:31 Peter Maydell
@ 2023-06-25 8:25 ` Richard Henderson
0 siblings, 0 replies; 46+ messages in thread
From: Richard Henderson @ 2023-06-25 8:25 UTC (permalink / raw)
To: Peter Maydell, qemu-devel
On 6/23/23 14:31, Peter Maydell wrote:
> Hi; here's a target-arm pullreq. Mostly this is RTH's FEAT_RME
> series; there are also a handful of bug fixes including some
> which aren't arm-specific but which it's convenient to include
> here.
>
> thanks
> -- PMM
>
> The following changes since commit b455ce4c2f300c8ba47cba7232dd03261368a4cb:
>
> Merge tag 'q800-for-8.1-pull-request' ofhttps://github.com/vivier/qemu-m68k into staging (2023-06-22 10:18:32 +0200)
>
> are available in the Git repository at:
>
> https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230623
>
> for you to fetch changes up to 497fad38979c16b6412388927401e577eba43d26:
>
> pc-bios/keymaps: Use the official xkb name for Arabic layout, not the legacy synonym (2023-06-23 11:46:02 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
> * Add (experimental) support for FEAT_RME
> * host-utils: Avoid using __builtin_subcll on buggy versions of Apple Clang
> * target/arm: Restructure has_vfp_d32 test
> * hw/arm/sbsa-ref: add ITS support in SBSA GIC
> * target/arm: Fix sve predicate store, 8 <= VQ <= 15
> * pc-bios/keymaps: Use the official xkb name for Arabic layout, not the legacy synonym
Applied, thanks. Please update https://wiki.qemu.org/ChangeLog/8.1 as appropriate.
r~
^ permalink raw reply [flat|nested] 46+ messages in thread
* [PULL 00/26] target-arm queue
@ 2023-09-08 17:05 Peter Maydell
2023-09-11 15:19 ` Stefan Hajnoczi
0 siblings, 1 reply; 46+ messages in thread
From: Peter Maydell @ 2023-09-08 17:05 UTC (permalink / raw)
To: qemu-devel
Hi; here's the latest arm pullreq...
-- PMM
The following changes since commit 03a3a62fbd0aa5227e978eef3c67d3978aec9e5f:
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2023-09-07 10:29:06 -0400)
are available in the Git repository at:
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230908
for you to fetch changes up to c8f2eb5d414b788420b938f2ffdde891aa6c3ae8:
arm/kvm: Enable support for KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE (2023-09-08 16:41:36 +0100)
----------------------------------------------------------------
target-arm queue:
* New CPU type: cortex-a710
* Implement new architectural features:
- FEAT_PACQARMA3
- FEAT_EPAC
- FEAT_Pauth2
- FEAT_FPAC
- FEAT_FPACCOMBINE
- FEAT_TIDCP1
* Xilinx Versal: Model the CFU/CFI
* Implement RMR_ELx registers
* Implement handling of HCR_EL2.TIDCP trap bit
* arm/kvm: Enable support for KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE
* hw/intc/arm_gicv3_its: Avoid maybe-uninitialized error in get_vte()
* target/arm: Do not use gen_mte_checkN in trans_STGP
* arm64: Restore trapless ptimer access
----------------------------------------------------------------
Aaron Lindsay (6):
target/arm: Add ID_AA64ISAR2_EL1
target/arm: Add feature detection for FEAT_Pauth2 and extensions
target/arm: Implement FEAT_EPAC
target/arm: Implement FEAT_Pauth2
target/arm: Inform helpers whether a PAC instruction is 'combined'
target/arm: Implement FEAT_FPAC and FEAT_FPACCOMBINE
Colton Lewis (1):
arm64: Restore trapless ptimer access
Francisco Iglesias (8):
hw/misc: Introduce the Xilinx CFI interface
hw/misc: Introduce a model of Xilinx Versal's CFU_APB
hw/misc/xlnx-versal-cfu: Introduce a model of Xilinx Versal CFU_FDRO
hw/misc/xlnx-versal-cfu: Introduce a model of Xilinx Versal's CFU_SFR
hw/misc: Introduce a model of Xilinx Versal's CFRAME_REG
hw/misc: Introduce a model of Xilinx Versal's CFRAME_BCAST_REG
hw/arm/xlnx-versal: Connect the CFU_APB, CFU_FDRO and CFU_SFR
hw/arm/versal: Connect the CFRAME_REG and CFRAME_BCAST_REG
Philippe Mathieu-Daudé (1):
hw/intc/arm_gicv3_its: Avoid maybe-uninitialized error in get_vte()
Richard Henderson (9):
tests/tcg/aarch64: Adjust pauth tests for FEAT_FPAC
target/arm: Don't change pauth features when changing algorithm
target/arm: Implement FEAT_PACQARMA3
target/arm: Do not use gen_mte_checkN in trans_STGP
target/arm: Implement RMR_ELx
target/arm: Implement cortex-a710
target/arm: Implement HCR_EL2.TIDCP
target/arm: Implement FEAT_TIDCP1
target/arm: Enable SCTLR_EL1.TIDCP for user-only
Shameer Kolothum (1):
arm/kvm: Enable support for KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE
MAINTAINERS | 10 +
docs/system/arm/cpu-features.rst | 21 +-
docs/system/arm/emulation.rst | 8 +
docs/system/arm/virt.rst | 1 +
include/hw/arm/xlnx-versal.h | 85 +++
include/hw/misc/xlnx-cfi-if.h | 59 +++
include/hw/misc/xlnx-versal-cframe-reg.h | 303 +++++++++++
include/hw/misc/xlnx-versal-cfu.h | 258 ++++++++++
include/sysemu/kvm_int.h | 1 +
target/arm/cpu.h | 54 +-
target/arm/helper.h | 2 +
target/arm/syndrome.h | 7 +
target/arm/tcg/helper-a64.h | 4 +
tests/tcg/aarch64/pauth.h | 23 +
accel/kvm/kvm-all.c | 1 +
hw/arm/virt.c | 1 +
hw/arm/xlnx-versal.c | 155 +++++-
hw/intc/arm_gicv3_its.c | 15 +-
hw/misc/xlnx-cfi-if.c | 34 ++
hw/misc/xlnx-versal-cframe-reg.c | 858 +++++++++++++++++++++++++++++++
hw/misc/xlnx-versal-cfu.c | 563 ++++++++++++++++++++
target/arm/arm-qmp-cmds.c | 2 +-
target/arm/cpu.c | 4 +
target/arm/cpu64.c | 86 +++-
target/arm/helper.c | 68 ++-
target/arm/hvf/hvf.c | 1 +
target/arm/kvm.c | 61 +++
target/arm/kvm64.c | 3 +
target/arm/tcg/cpu64.c | 215 ++++++++
target/arm/tcg/op_helper.c | 33 ++
target/arm/tcg/pauth_helper.c | 180 +++++--
target/arm/tcg/translate-a64.c | 74 +--
target/arm/tcg/translate.c | 33 ++
tests/qtest/arm-cpu-features.c | 12 +-
tests/tcg/aarch64/pauth-2.c | 54 +-
tests/tcg/aarch64/pauth-4.c | 18 +-
tests/tcg/aarch64/pauth-5.c | 10 +
hw/misc/meson.build | 3 +
qemu-options.hx | 15 +
tests/tcg/aarch64/Makefile.target | 6 +-
40 files changed, 3184 insertions(+), 157 deletions(-)
create mode 100644 include/hw/misc/xlnx-cfi-if.h
create mode 100644 include/hw/misc/xlnx-versal-cframe-reg.h
create mode 100644 include/hw/misc/xlnx-versal-cfu.h
create mode 100644 tests/tcg/aarch64/pauth.h
create mode 100644 hw/misc/xlnx-cfi-if.c
create mode 100644 hw/misc/xlnx-versal-cframe-reg.c
create mode 100644 hw/misc/xlnx-versal-cfu.c
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PULL 00/26] target-arm queue
2023-09-08 17:05 Peter Maydell
@ 2023-09-11 15:19 ` Stefan Hajnoczi
0 siblings, 0 replies; 46+ messages in thread
From: Stefan Hajnoczi @ 2023-09-11 15:19 UTC (permalink / raw)
To: Peter Maydell; +Cc: qemu-devel
[-- Attachment #1: Type: text/plain, Size: 115 bytes --]
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/8.2 for any user-visible changes.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 46+ messages in thread
* [PULL 00/26] target-arm queue
@ 2024-07-18 13:20 Peter Maydell
2024-07-19 1:26 ` Richard Henderson
0 siblings, 1 reply; 46+ messages in thread
From: Peter Maydell @ 2024-07-18 13:20 UTC (permalink / raw)
To: qemu-devel
Hi; hopefully this is the last arm pullreq before softfreeze.
There's a handful of miscellaneous bug fixes here, but the
bulk of the pullreq is Mostafa's implementation of 2-stage
translation in the SMMUv3.
thanks
-- PMM
The following changes since commit d74ec4d7dda6322bcc51d1b13ccbd993d3574795:
Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2024-07-18 10:07:23 +1000)
are available in the Git repository at:
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240718
for you to fetch changes up to 30a1690f2402e6c1582d5b3ebcf7940bfe2fad4b:
hvf: arm: Do not advance PC when raising an exception (2024-07-18 13:49:30 +0100)
----------------------------------------------------------------
target-arm queue:
* Fix handling of LDAPR/STLR with negative offset
* LDAPR should honour SCTLR_ELx.nAA
* Use float_status copy in sme_fmopa_s
* hw/display/bcm2835_fb: fix fb_use_offsets condition
* hw/arm/smmuv3: Support and advertise nesting
* Use FPST_F16 for SME FMOPA (widening)
* tests/arm-cpu-features: Do not assume PMU availability
* hvf: arm: Do not advance PC when raising an exception
----------------------------------------------------------------
Akihiko Odaki (2):
tests/arm-cpu-features: Do not assume PMU availability
hvf: arm: Do not advance PC when raising an exception
Daniyal Khan (2):
target/arm: Use float_status copy in sme_fmopa_s
tests/tcg/aarch64: Add test cases for SME FMOPA (widening)
Mostafa Saleh (18):
hw/arm/smmu-common: Add missing size check for stage-1
hw/arm/smmu: Fix IPA for stage-2 events
hw/arm/smmuv3: Fix encoding of CLASS in events
hw/arm/smmu: Use enum for SMMU stage
hw/arm/smmu: Split smmuv3_translate()
hw/arm/smmu: Consolidate ASID and VMID types
hw/arm/smmu: Introduce CACHED_ENTRY_TO_ADDR
hw/arm/smmuv3: Translate CD and TT using stage-2 table
hw/arm/smmu-common: Rework TLB lookup for nesting
hw/arm/smmu-common: Add support for nested TLB
hw/arm/smmu-common: Support nested translation
hw/arm/smmu: Support nesting in smmuv3_range_inval()
hw/arm/smmu: Introduce smmu_iotlb_inv_asid_vmid
hw/arm/smmu: Support nesting in the rest of commands
hw/arm/smmuv3: Support nested SMMUs in smmuv3_notify_iova()
hw/arm/smmuv3: Handle translation faults according to SMMUPTWEventInfo
hw/arm/smmuv3: Support and advertise nesting
hw/arm/smmu: Refactor SMMU OAS
Peter Maydell (2):
target/arm: Fix handling of LDAPR/STLR with negative offset
target/arm: LDAPR should honour SCTLR_ELx.nAA
Richard Henderson (1):
target/arm: Use FPST_F16 for SME FMOPA (widening)
SamJakob (1):
hw/display/bcm2835_fb: fix fb_use_offsets condition
hw/arm/smmuv3-internal.h | 19 +-
include/hw/arm/smmu-common.h | 46 +++-
target/arm/tcg/a64.decode | 2 +-
hw/arm/smmu-common.c | 312 ++++++++++++++++++++++---
hw/arm/smmuv3.c | 467 +++++++++++++++++++++++++-------------
hw/display/bcm2835_fb.c | 2 +-
target/arm/hvf/hvf.c | 1 +
target/arm/tcg/sme_helper.c | 2 +-
target/arm/tcg/translate-a64.c | 2 +-
target/arm/tcg/translate-sme.c | 12 +-
tests/qtest/arm-cpu-features.c | 13 +-
tests/tcg/aarch64/sme-fmopa-1.c | 63 +++++
tests/tcg/aarch64/sme-fmopa-2.c | 56 +++++
tests/tcg/aarch64/sme-fmopa-3.c | 63 +++++
hw/arm/trace-events | 26 ++-
tests/tcg/aarch64/Makefile.target | 5 +-
16 files changed, 846 insertions(+), 245 deletions(-)
create mode 100644 tests/tcg/aarch64/sme-fmopa-1.c
create mode 100644 tests/tcg/aarch64/sme-fmopa-2.c
create mode 100644 tests/tcg/aarch64/sme-fmopa-3.c
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PULL 00/26] target-arm queue
2024-07-18 13:20 Peter Maydell
@ 2024-07-19 1:26 ` Richard Henderson
0 siblings, 0 replies; 46+ messages in thread
From: Richard Henderson @ 2024-07-19 1:26 UTC (permalink / raw)
To: Peter Maydell, qemu-devel
On 7/18/24 23:20, Peter Maydell wrote:
> Hi; hopefully this is the last arm pullreq before softfreeze.
> There's a handful of miscellaneous bug fixes here, but the
> bulk of the pullreq is Mostafa's implementation of 2-stage
> translation in the SMMUv3.
>
> thanks
> -- PMM
>
> The following changes since commit d74ec4d7dda6322bcc51d1b13ccbd993d3574795:
>
> Merge tag 'pull-trivial-patches' ofhttps://gitlab.com/mjt0k/qemu into staging (2024-07-18 10:07:23 +1000)
>
> are available in the Git repository at:
>
> https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240718
>
> for you to fetch changes up to 30a1690f2402e6c1582d5b3ebcf7940bfe2fad4b:
>
> hvf: arm: Do not advance PC when raising an exception (2024-07-18 13:49:30 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
> * Fix handling of LDAPR/STLR with negative offset
> * LDAPR should honour SCTLR_ELx.nAA
> * Use float_status copy in sme_fmopa_s
> * hw/display/bcm2835_fb: fix fb_use_offsets condition
> * hw/arm/smmuv3: Support and advertise nesting
> * Use FPST_F16 for SME FMOPA (widening)
> * tests/arm-cpu-features: Do not assume PMU availability
> * hvf: arm: Do not advance PC when raising an exception
Applied, thanks. Please update https://wiki.qemu.org/ChangeLog/9.1 as appropriate.
r~
^ permalink raw reply [flat|nested] 46+ messages in thread
* [PULL 00/26] target-arm queue
@ 2026-02-10 13:51 Peter Maydell
2026-02-11 19:46 ` Peter Maydell
0 siblings, 1 reply; 46+ messages in thread
From: Peter Maydell @ 2026-02-10 13:51 UTC (permalink / raw)
To: qemu-devel
The following changes since commit 0b91040d23dc8820724a60c811223b777f3bc6b7:
Merge tag 'pull-loongarch-20260210' of https://github.com/gaosong715/qemu into staging (2026-02-10 09:12:38 +0000)
are available in the Git repository at:
https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20260210
for you to fetch changes up to a2834b853d9e0f3e193671ab1f20b27329a02ece:
target/arm: implement FEAT_E2H0 (2026-02-10 12:52:39 +0000)
----------------------------------------------------------------
target-arm queue:
* Add whpx accelerator support for the virt board
* Implement FEAT_E2H0
* Implement WFE, SEV and SEVONPEND for Cortex-M
----------------------------------------------------------------
Alex Bennée (1):
target/arm: implement FEAT_E2H0
Ashish Anand (1):
target/arm: Implement WFE, SEV and SEVONPEND for Cortex-M
Eric Auger (1):
hw/arm/virt: Rename arm_virt_compat into arm_virt_compat_defaults
Mohamed Mediouni (20):
qtest: hw/arm: virt: skip ACPI test for IORT with GICv2
hw: arm: virt: rework MSI-X configuration
tests: data: update AArch64 ACPI tables
qtest: hw/arm: virt: add ACPI tables for new GICv3 + GICv2m test case
qtest: hw/arm: virt: add new test case for GICv3 + GICv2m
docs: arm: update virt machine model description
whpx: Move around files before introducing AArch64 support
whpx: reshuffle common code
whpx: ifdef out winhvemulation on non-x86_64
whpx: common: add WHPX_INTERCEPT_DEBUG_TRAPS define
hw, target, accel: whpx: change apic_in_platform to kernel_irqchip
whpx: add arm64 support
whpx: change memory management logic
target/arm: cpu: mark WHPX as supporting PSCI 1.3
whpx: arm64: clamp down IPA size
hw/arm, accel/hvf, whpx: unify get_physical_address_range between WHPX and HVF
whpx: arm64: implement -cpu host
target/arm: whpx: instantiate GIC early
whpx: enable arm64 builds
whpx: arm64: add partition-wide reset on the reboot path
Philippe Mathieu-Daudé (2):
accel/system: Introduce hwaccel_enabled() helper
target/arm: Remove entry for "any" from cpu32 arm_tcg_cpus[] list
Sebastian Ott (1):
target/arm/kvm: add constants for new PSCI versions
MAINTAINERS | 6 +
accel/hvf/hvf-all.c | 7 +-
accel/meson.build | 1 +
accel/stubs/whpx-stub.c | 1 +
accel/whpx/meson.build | 7 +
{target/i386 => accel}/whpx/whpx-accel-ops.c | 6 +-
accel/whpx/whpx-common.c | 536 +++++++++++
docs/system/arm/emulation.rst | 1 +
docs/system/arm/virt.rst | 24 +-
hw/arm/virt-acpi-build.c | 20 +-
hw/arm/virt.c | 154 +++-
hw/i386/x86-cpu.c | 4 +-
hw/intc/arm_gicv3_common.c | 3 +
hw/intc/arm_gicv3_whpx.c | 237 +++++
hw/intc/armv7m_nvic.c | 79 +-
hw/intc/meson.build | 1 +
include/hw/arm/virt.h | 5 +-
include/hw/core/boards.h | 3 +-
include/hw/intc/arm_gicv3_common.h | 3 +
include/system/hvf_int.h | 4 +
include/system/hw_accel.h | 13 +
.../i386/whpx => include/system}/whpx-accel-ops.h | 4 +-
include/system/whpx-all.h | 20 +
include/system/whpx-common.h | 26 +
.../i386/whpx => include/system}/whpx-internal.h | 16 +-
include/system/whpx.h | 5 +-
meson.build | 20 +-
target/arm/cpu-features.h | 15 +
target/arm/cpu.c | 9 +
target/arm/cpu.h | 7 +
target/arm/cpu64.c | 17 +-
target/arm/helper.c | 21 +-
target/arm/hvf-stub.c | 20 -
target/arm/hvf/hvf.c | 6 +-
target/arm/hvf_arm.h | 3 -
target/arm/kvm-consts.h | 2 +
target/arm/machine.c | 19 +
target/arm/meson.build | 2 +-
target/arm/tcg/cpu32.c | 3 -
target/arm/tcg/helper.h | 1 +
target/arm/tcg/m_helper.c | 5 +
target/arm/tcg/op_helper.c | 56 +-
target/arm/tcg/t16.decode | 5 +-
target/arm/tcg/t32.decode | 5 +-
target/arm/tcg/translate.c | 29 +-
target/arm/whpx/meson.build | 5 +
target/arm/whpx/whpx-all.c | 994 +++++++++++++++++++++
target/arm/whpx/whpx-stub.c | 15 +
target/arm/whpx_arm.h | 17 +
target/i386/cpu-apic.c | 2 +-
target/i386/hvf/hvf.c | 11 +
target/i386/whpx/meson.build | 1 -
target/i386/whpx/whpx-all.c | 569 +-----------
target/i386/whpx/whpx-apic.c | 2 +-
tests/data/acpi/aarch64/virt/APIC.msi_gicv2m | Bin 0 -> 188 bytes
tests/data/acpi/aarch64/virt/IORT | Bin 128 -> 84 bytes
tests/data/acpi/aarch64/virt/IORT.msi_gicv2m | Bin 0 -> 172 bytes
tests/data/acpi/aarch64/virt/IORT.smmuv3-dev | Bin 364 -> 260 bytes
tests/data/acpi/aarch64/virt/IORT.smmuv3-legacy | Bin 276 -> 192 bytes
tests/qtest/bios-tables-test.c | 21 +
60 files changed, 2383 insertions(+), 685 deletions(-)
create mode 100644 accel/whpx/meson.build
rename {target/i386 => accel}/whpx/whpx-accel-ops.c (96%)
create mode 100644 accel/whpx/whpx-common.c
create mode 100644 hw/intc/arm_gicv3_whpx.c
rename {target/i386/whpx => include/system}/whpx-accel-ops.h (92%)
create mode 100644 include/system/whpx-all.h
create mode 100644 include/system/whpx-common.h
rename {target/i386/whpx => include/system}/whpx-internal.h (95%)
delete mode 100644 target/arm/hvf-stub.c
create mode 100644 target/arm/whpx/meson.build
create mode 100644 target/arm/whpx/whpx-all.c
create mode 100644 target/arm/whpx/whpx-stub.c
create mode 100644 target/arm/whpx_arm.h
create mode 100644 tests/data/acpi/aarch64/virt/APIC.msi_gicv2m
create mode 100644 tests/data/acpi/aarch64/virt/IORT.msi_gicv2m
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PULL 00/26] target-arm queue
2026-02-10 13:51 Peter Maydell
@ 2026-02-11 19:46 ` Peter Maydell
0 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-02-11 19:46 UTC (permalink / raw)
To: qemu-devel
On Tue, 10 Feb 2026 at 13:52, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> The following changes since commit 0b91040d23dc8820724a60c811223b777f3bc6b7:
>
> Merge tag 'pull-loongarch-20260210' of https://github.com/gaosong715/qemu into staging (2026-02-10 09:12:38 +0000)
>
> are available in the Git repository at:
>
> https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20260210
>
> for you to fetch changes up to a2834b853d9e0f3e193671ab1f20b27329a02ece:
>
> target/arm: implement FEAT_E2H0 (2026-02-10 12:52:39 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
> * Add whpx accelerator support for the virt board
> * Implement FEAT_E2H0
> * Implement WFE, SEV and SEVONPEND for Cortex-M
>
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/11.0
for any user-visible changes.
-- PMM
^ permalink raw reply [flat|nested] 46+ messages in thread
* [PULL 00/26] target-arm queue
@ 2026-07-13 15:32 Peter Maydell
2026-07-13 15:32 ` [PULL 01/26] hw/misc/zynq_slcr.c: drop duplicate reset value for DDRIOB_DCI_CTRL Peter Maydell
` (26 more replies)
0 siblings, 27 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
Hi; here's an arm pullreq. These are all bugfixes and minor docs updates.
thanks
-- PMM
The following changes since commit 499039798cdad7d86b787fec0eaf1da4151c0f05:
Merge tag 'pull-request-2026-07-12' of https://gitlab.com/huth/qemu into staging (2026-07-12 21:49:04 +0200)
are available in the Git repository at:
https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20260713
for you to fetch changes up to 3c2749443429a2a6b60bfa5c32964628631dfa23:
hw/misc/stm32_rcc: Correct offset-to-irq calculation (2026-07-13 12:34:17 +0100)
----------------------------------------------------------------
target-arm queue:
* hw/misc/zynq_slcr.c: drop duplicate reset value for DDRIOB_DCI_CTRL
* hw/arm/tegra241-cmdqv: Do not sync GERRORN on VCMDQ allocation
* hw/arm/smmuv3: Sanitize fields provided by guest
* hw/i2c: pmbus: clear output buffer on write
* docs/system/arm: Add some missing FEAT_FOO we already implement
* arm/virt: fix smmuv3_devices leak
* target/arm: Be more defensive for invalid tlbi_aa64_get_range
* hw/dma: don't allow weird transfer lengths for bcm2835
* hw/net/vmxnet3: Correct bounds check on tx queue index
* hw/usb/dev-wacom: Don't write off end of buffer
* hw/display/sm501: Don't let guest write off end of buffer
* hw/misc/allwinner-r40-ccu.c: Correct handling of out of range accesses
* hw/misc/stm32_rcc: Correct offset-to-irq calculation
----------------------------------------------------------------
Alex Bennée (9):
docs/system: declare support for FEAT_EVT2
docs/system: add big and little endian features names
docs/system: document FEAT_Secure
docs/system: document FEAT_MTE4
docs/system: document FEAT_IVIPT
docs/system: fix sorting of FEAT_S2[PIE|FWB]
docs/system: add FEAT_S2TGran[4|16|64]K features
docs/system: add FEAT_HAF
hw/dma: don't allow weird transfer lengths for bcm2835
Corvin Köhne (1):
hw/misc/zynq_slcr.c: drop duplicate reset value for DDRIOB_DCI_CTRL
Eric Auger (5):
hw/arm/smmuv3: Fix off-by-one bug in alignment strtab mask
hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.SPLIT
hw/arm/smmuv3: Fix possible overflow in strtab_base computation
hw/arm/smmuv3: Check L1STD.SPAN
hw/arm/smmuv3: Enforce alignment of L2Ptr according to the span
Marc-André Lureau (1):
arm/virt: fix smmuv3_devices leak
Peter Maydell (7):
hw/net/vmxnet3: Correct bounds check on tx queue index
hw/usb/dev-wacom: Don't write off end of buffer
hw/display/sm501: Catch bad coordinates for RTL operations
hw/display/sm501: Avoid overflow problems in bounds check calculations
hw/display/sm501: Don't allow guest to set ram size larger than it is
hw/misc/allwinner-r40-ccu.c: Correct handling of out of range accesses
hw/misc/stm32_rcc: Correct offset-to-irq calculation
Richard Henderson (1):
target/arm: Be more defensive for invalid tlbi_aa64_get_range
Shameer Kolothum (1):
hw/arm/tegra241-cmdqv: Do not sync GERRORN on VCMDQ allocation
titusr (1):
hw/i2c: pmbus: clear output buffer on write
docs/system/arm/emulation.rst | 14 +++++++++-
hw/arm/smmuv3-internal.h | 3 ++
hw/arm/smmuv3.c | 32 ++++++++++++++++++----
hw/arm/tegra241-cmdqv.c | 7 ++---
hw/arm/virt.c | 1 +
hw/display/sm501.c | 64 +++++++++++++++++++++++++++++++++++++------
hw/dma/bcm2835_dma.c | 17 ++++++++++++
hw/i2c/pmbus_device.c | 10 +++++++
hw/misc/allwinner-r40-ccu.c | 6 ++--
hw/misc/stm32_rcc.c | 31 ++++++++++++++++++---
hw/misc/zynq_slcr.c | 1 -
hw/net/vmxnet3.c | 2 +-
hw/usb/dev-wacom.c | 4 +++
include/hw/misc/stm32_rcc.h | 6 +++-
target/arm/cpu-max.c | 2 +-
target/arm/tcg/tlb-insns.c | 2 +-
tests/qtest/adm1266-test.c | 10 ++++---
17 files changed, 176 insertions(+), 36 deletions(-)
^ permalink raw reply [flat|nested] 46+ messages in thread
* [PULL 01/26] hw/misc/zynq_slcr.c: drop duplicate reset value for DDRIOB_DCI_CTRL
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 02/26] hw/arm/tegra241-cmdqv: Do not sync GERRORN on VCMDQ allocation Peter Maydell
` (25 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Corvin Köhne <c.koehne@beckhoff.com>
When adding a reset value for DDRIOB_DCI_CTRL in c8ba862dbfdc, we haven't
noticed that a reset value already exists. DDRIOB is a 32 bit register, so
incrementing it by 12 will access the DDRIOB_DCI_CTRL register. According to
the manual [1] the correct reset value is 0x00000020. Additionally,
c8ba862dbfdc won't work with a reset value of 0x00000021 because it tries to
detect a toggle of the reset bit (bit 0). Therefore, we drop the old reset
value and keep the new one introduced in c8ba862dbfdc.
[1] https://docs.amd.com/r/en-US/ug585-zynq-7000-SoC-TRM/Register-slcr-DDRIOB_DCI_CTRL
Fixes: c8ba862dbfdc ("hw/misc/zynq_slcr: Add logic for DCI configuration")
Signed-off-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20260707145407.70287-1-corvin.koehne@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/misc/zynq_slcr.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
index 0ae5d607be9..d0f899c3be4 100644
--- a/hw/misc/zynq_slcr.c
+++ b/hw/misc/zynq_slcr.c
@@ -427,7 +427,6 @@ static void zynq_slcr_reset_init(Object *obj, ResetType type)
= s->regs[R_DDRIOB + 3] = 0x00000e00;
s->regs[R_DDRIOB + 4] = s->regs[R_DDRIOB + 5] = s->regs[R_DDRIOB + 6]
= 0x00000e00;
- s->regs[R_DDRIOB + 12] = 0x00000021;
s->regs[R_DDRIOB_DCI_CTRL] = 0x00000020;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 02/26] hw/arm/tegra241-cmdqv: Do not sync GERRORN on VCMDQ allocation
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
2026-07-13 15:32 ` [PULL 01/26] hw/misc/zynq_slcr.c: drop duplicate reset value for DDRIOB_DCI_CTRL Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 03/26] hw/arm/smmuv3: Fix off-by-one bug in alignment strtab mask Peter Maydell
` (24 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Shameer Kolothum <skolothumtho@nvidia.com>
When a guest hits a command error, the hardware sets GERROR and the guest
acknowledges it by writing GERRORN to match. These registers use toggle
semantics, and since GERROR is read-only, both GERROR and GERRORN may
remain set after an error has been handled. As long as they stay equal
there is no pending error, so a subsequent VM is unaffected.
When a new VM starts, QEMU allocates the hardware VCMDQ and flushes its
cached GERRORN of zero, while the hardware may still have both GERROR and
GERRORN set from an error the previous guest acknowledged. This makes them
differ again, so the hardware sees a pending error and stall the VCMDQ,
leading to CMD_SYNC timeouts.
Do not sync GERRORN when allocating a hardware VCMDQ.
Fixes: 1d0f77535417 ("hw/arm/tegra241-cmdqv: Route allocated VCMDQ Page0 accesses to the mmap'd host VINTF page0")
Suggested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20260707112450.111178-1-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/arm/tegra241-cmdqv.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/hw/arm/tegra241-cmdqv.c b/hw/arm/tegra241-cmdqv.c
index 7223aa9d1d9..273633e6293 100644
--- a/hw/arm/tegra241-cmdqv.c
+++ b/hw/arm/tegra241-cmdqv.c
@@ -212,7 +212,9 @@ static inline uint32_t *tegra241_cmdqv_vintf_lvcmdq_ptr(Tegra241CMDQV *cmdqv,
/*
* Flush cached register writes into the mmap'd host VINTF page0 after a
* successful HW_QUEUE_ALLOC, so the guest's earlier writes survive
- * the cache-to-hardware transition.
+ * the cache-to-hardware transition. GERRORN is intentionally not synced,
+ * as overwriting it with the cached value could recreate a GERROR != GERRORN
+ * mismatch and stall the VCMDQ.
*/
static void tegra241_cmdqv_sync_vcmdq(Tegra241CMDQV *cmdqv, int index)
{
@@ -229,9 +231,6 @@ static void tegra241_cmdqv_sync_vcmdq(Tegra241CMDQV *cmdqv, int index)
ptr = tegra241_cmdqv_vintf_lvcmdq_ptr(cmdqv, index, A_VCMDQ0_CONFIG);
*ptr = cmdqv->vcmdq_config[index];
-
- ptr = tegra241_cmdqv_vintf_lvcmdq_ptr(cmdqv, index, A_VCMDQ0_GERRORN);
- *ptr = cmdqv->vcmdq_gerrorn[index];
}
/*
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 03/26] hw/arm/smmuv3: Fix off-by-one bug in alignment strtab mask
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
2026-07-13 15:32 ` [PULL 01/26] hw/misc/zynq_slcr.c: drop duplicate reset value for DDRIOB_DCI_CTRL Peter Maydell
2026-07-13 15:32 ` [PULL 02/26] hw/arm/tegra241-cmdqv: Do not sync GERRORN on VCMDQ allocation Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 04/26] hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.SPLIT Peter Maydell
` (23 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Eric Auger <eric.auger@redhat.com>
The stream table base address needs to be aligned to its size.
With FMT == 0 (linear stream table), the table size is log2size *
STE_SIZE (2^6). So the spec says the base address
must have ADDR[LOG2SIZE + 5:0] = 0.
With FMT == 1 (2 level stream table), the table size is
(log2size - split) * L1STD_SIZE (2^3) So the spec days
the effective base address is aligned by the SMMU to the larger of
64 bytes or the first-level table size:
ADDR[MAX(5, (LOG2SIZE - SPLIT - 1 + 3)):0] = 0.
MAKE_64BIT_MASK() second argument is a size and not a shift, so
fix this off-by-one computation.
Subsequent patches will fix the risk of overflow in MAKE_64BIT_MASK()
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Message-id: 20260707085028.165557-2-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/arm/smmuv3-internal.h | 3 +++
hw/arm/smmuv3.c | 10 +++++-----
2 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index eb482c7000f..0819a4b2e8d 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -359,6 +359,9 @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
void smmuv3_propagate_event(SMMUv3State *s, Evt *evt);
int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event);
+#define STE_SIZE 6
+#define L1STD_SIZE 3
+
static inline int oas2bits(int oas_field)
{
switch (oas_field) {
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 5e5a6a960c9..10c67645a57 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -664,7 +664,7 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event)
{
dma_addr_t addr, strtab_base;
uint32_t log2size;
- int strtab_size_shift;
+ int strtab_size;
int ret;
trace_smmuv3_find_ste(sid, s->features, s->sid_split);
@@ -685,9 +685,9 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event)
* Align strtab base address to table size. For this purpose, assume it
* is not bounded by SMMU_IDR1_SIDSIZE.
*/
- strtab_size_shift = MAX(5, (int)log2size - s->sid_split - 1 + 3);
+ strtab_size = MAX(6, (int)log2size - s->sid_split + L1STD_SIZE);
strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
- ~MAKE_64BIT_MASK(0, strtab_size_shift);
+ ~MAKE_64BIT_MASK(0, strtab_size);
l1_ste_offset = sid >> s->sid_split;
l2_ste_offset = sid & ((1 << s->sid_split) - 1);
l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));
@@ -729,9 +729,9 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event)
}
addr = l2ptr + l2_ste_offset * sizeof(*ste);
} else {
- strtab_size_shift = log2size + 5;
+ strtab_size = log2size + STE_SIZE;
strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
- ~MAKE_64BIT_MASK(0, strtab_size_shift);
+ ~MAKE_64BIT_MASK(0, strtab_size);
addr = strtab_base + sid * sizeof(*ste);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 04/26] hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.SPLIT
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (2 preceding siblings ...)
2026-07-13 15:32 ` [PULL 03/26] hw/arm/smmuv3: Fix off-by-one bug in alignment strtab mask Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 05/26] hw/arm/smmuv3: Fix possible overflow in strtab_base computation Peter Maydell
` (22 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Eric Auger <eric.auger@redhat.com>
Currently the guest value for the SPLIT field is not checked.
Also the spec says that values different from 6, 8, 10, respectively
meaning 4KB, 16kB and 64kB leaf tables are reserved and behave as 6.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Message-id: 20260707085028.165557-3-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/arm/smmuv3.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 10c67645a57..c2946d8d23c 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -1688,6 +1688,13 @@ static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,
s->strtab_base_cfg = data;
if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) {
s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT);
+ if (s->sid_split != 6 && s->sid_split != 8 && s->sid_split != 10) {
+ /* Other values are reserved, behave as 6 */
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "Invalid STRTAB_BASE_CFG.SPLIT=%u, use 6 instead\n",
+ s->sid_split);
+ s->sid_split = 6;
+ }
s->features |= SMMU_FEATURE_2LVL_STE;
}
break;
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 05/26] hw/arm/smmuv3: Fix possible overflow in strtab_base computation
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (3 preceding siblings ...)
2026-07-13 15:32 ` [PULL 04/26] hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.SPLIT Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 06/26] hw/arm/smmuv3: Check L1STD.SPAN Peter Maydell
` (21 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Eric Auger <eric.auger@redhat.com>
In the linear stream table mode (FMT = 0), if the guest programs
SMMU_STRTAB_BASE_CFG.LOG2SIZE (8 bits) to something bigger than 58,
MAKE_64BIT_MASK() will overflow. So cap the mask length to 64. We
still comply with the spec ADDR alignment computation:
ADDR[LOG2SIZE + 5:0] = 0.
In the 2 level stream table mode (FMT = 1), we don't have this risk
anymore since SPLIT is sanitized and equals to 6 at minimum.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Message-id: 20260707085028.165557-4-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/arm/smmuv3.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index c2946d8d23c..3fd1dd7cf81 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -730,6 +730,7 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event)
addr = l2ptr + l2_ste_offset * sizeof(*ste);
} else {
strtab_size = log2size + STE_SIZE;
+ strtab_size = MIN(64, strtab_size);
strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
~MAKE_64BIT_MASK(0, strtab_size);
addr = strtab_base + sid * sizeof(*ste);
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 06/26] hw/arm/smmuv3: Check L1STD.SPAN
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (4 preceding siblings ...)
2026-07-13 15:32 ` [PULL 05/26] hw/arm/smmuv3: Fix possible overflow in strtab_base computation Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 07/26] hw/arm/smmuv3: Enforce alignment of L2Ptr according to the span Peter Maydell
` (20 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Eric Auger <eric.auger@redhat.com>
Span values above 11 are reserved and behave as 0.
Also span must be within the range of 0 to (SMMU_STRTAB_BASE_CFG.SPLIT + 1),
ie. it must stay within the bounds of the stream table split point.
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Message-id: 20260707085028.165557-5-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/arm/smmuv3.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 3fd1dd7cf81..9008ba7acd9 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -707,7 +707,7 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event)
span = L1STD_SPAN(&l1std);
- if (!span) {
+ if (!span || span > 11) {
/* l2ptr is not valid */
if (!event->inval_ste_allowed) {
qemu_log_mask(LOG_GUEST_ERROR,
@@ -716,6 +716,16 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event)
event->type = SMMU_EVT_C_BAD_STREAMID;
return -EINVAL;
}
+
+ if (span > s->sid_split + 1) {
+ if (!event->inval_ste_allowed) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "invalid span (0x%x)\n", span);
+ }
+ event->type = SMMU_EVT_C_BAD_STREAMID;
+ return -EINVAL;
+ }
+
max_l2_ste = (1 << span) - 1;
l2ptr = l1std_l2ptr(&l1std);
trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 07/26] hw/arm/smmuv3: Enforce alignment of L2Ptr according to the span
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (5 preceding siblings ...)
2026-07-13 15:32 ` [PULL 06/26] hw/arm/smmuv3: Check L1STD.SPAN Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 08/26] hw/i2c: pmbus: clear output buffer on write Peter Maydell
` (19 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Eric Auger <eric.auger@redhat.com>
Spec says: Bits L2Ptr[N:0] are treated as 0 by the SMMU, where
N == 5 + (Span - 1).
Let's enforce this alignment.
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Message-id: 20260707085028.165557-6-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/arm/smmuv3.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 9008ba7acd9..ed19536a4dc 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -728,6 +728,8 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event)
max_l2_ste = (1 << span) - 1;
l2ptr = l1std_l2ptr(&l1std);
+
+ l2ptr &= ~MAKE_64BIT_MASK(0, 6 + (span - 1));
trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,
l2ptr, l2_ste_offset, max_l2_ste);
if (l2_ste_offset > max_l2_ste) {
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 08/26] hw/i2c: pmbus: clear output buffer on write
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (6 preceding siblings ...)
2026-07-13 15:32 ` [PULL 07/26] hw/arm/smmuv3: Enforce alignment of L2Ptr according to the span Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 09/26] docs/system: declare support for FEAT_EVT2 Peter Maydell
` (18 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: titusr <titusr@google.com>
Generally we expect a PMBus sensor to issue writes after all pending
reads have completed. If a data read needs to be resumed, this state can
be tracked in the device model and the pending data placed in the output
buffer.
Signed-off-by: Titus Rwantare <titusr@google.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260706230056.1888992-4-titusr@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/i2c/pmbus_device.c | 10 ++++++++++
tests/qtest/adm1266-test.c | 10 ++++++----
2 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/hw/i2c/pmbus_device.c b/hw/i2c/pmbus_device.c
index b1f9843f52e..1ca117bd3c1 100644
--- a/hw/i2c/pmbus_device.c
+++ b/hw/i2c/pmbus_device.c
@@ -1245,6 +1245,16 @@ static int pmbus_write_data(SMBusDevice *smd, uint8_t *buf, uint8_t len)
pmdev->in_buf_len = len;
pmdev->in_buf = buf;
+ /* clear the output buffer on any new write transaction */
+ if (pmdev->out_buf_len != 0) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: previous read was not completed, %d bytes dropped\n",
+ __func__, pmdev->out_buf_len);
+
+ pmdev->out_buf_len = 0;
+ memset(pmdev->out_buf, 0, sizeof(pmdev->out_buf));
+ }
+
pmdev->code = buf[0]; /* PMBus command code */
if (pmdev->code == PMBUS_CLEAR_FAULTS) {
diff --git a/tests/qtest/adm1266-test.c b/tests/qtest/adm1266-test.c
index 5ae82062342..726e4759380 100644
--- a/tests/qtest/adm1266-test.c
+++ b/tests/qtest/adm1266-test.c
@@ -48,11 +48,13 @@
static void compare_string(QI2CDevice *i2cdev, uint8_t reg,
const char *test_str)
{
- uint8_t len = i2c_get8(i2cdev, reg);
- char i2c_str[SMBUS_DATA_MAX_LEN] = {0};
+ uint8_t expected_len = strlen(test_str);
+ uint8_t resp[SMBUS_DATA_MAX_LEN] = {0};
- i2c_read_block(i2cdev, reg, (uint8_t *)i2c_str, len);
- g_assert_cmpstr(i2c_str, ==, test_str);
+ g_assert(expected_len + 1 < SMBUS_DATA_MAX_LEN);
+ i2c_read_block(i2cdev, reg, resp, expected_len + 1);
+ g_assert_cmpint(resp[0], ==, expected_len);
+ g_assert_cmpstr((char *)resp + 1, ==, test_str);
}
static void write_and_compare_string(QI2CDevice *i2cdev, uint8_t reg,
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 09/26] docs/system: declare support for FEAT_EVT2
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (7 preceding siblings ...)
2026-07-13 15:32 ` [PULL 08/26] hw/i2c: pmbus: clear output buffer on write Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 10/26] docs/system: add big and little endian features names Peter Maydell
` (17 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Alex Bennée <alex.bennee@linaro.org>
The actual implementation supports the additional trapping registers
of HCR_TTLBIS | HCR_TTLBOS. We already set the value to 2 for -cpu max
and don't currently model any CPUs that only have FEAT_EVT.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-2-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
docs/system/arm/emulation.rst | 1 +
target/arm/cpu-max.c | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index 4f413d69efc..fb8d263db49 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -68,6 +68,7 @@ the following architecture extensions:
- FEAT_EPAC (Enhanced pointer authentication)
- FEAT_ETS2 (Enhanced Translation Synchronization)
- FEAT_EVT (Enhanced Virtualization Traps)
+- FEAT_EVT2 (Enhanced Virtualization Traps 2)
- FEAT_F8F16MM (8-bit floating-point matrix multiply-accumulate to half-precision)
- FEAT_F8F32MM (8-bit floating-point matrix multiply-accumulate to single-precision)
- FEAT_F32MM (Single-precision Matrix Multiplication)
diff --git a/target/arm/cpu-max.c b/target/arm/cpu-max.c
index d38bdfcf811..88b7c046333 100644
--- a/target/arm/cpu-max.c
+++ b/target/arm/cpu-max.c
@@ -130,7 +130,7 @@ void aa32_max_features(ARMCPU *cpu)
t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* FEAT_TTCNP */
t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* FEAT_XNX */
- t = FIELD_DP32(t, ID_MMFR4, EVT, 2); /* FEAT_EVT */
+ t = FIELD_DP32(t, ID_MMFR4, EVT, 2); /* FEAT_EVT2 */
SET_IDREG(isar, ID_MMFR4, t);
FIELD_DP32_IDREG(isar, ID_MMFR5, ETS, 2); /* FEAT_ETS2 */
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 10/26] docs/system: add big and little endian features names
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (8 preceding siblings ...)
2026-07-13 15:32 ` [PULL 09/26] docs/system: declare support for FEAT_EVT2 Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 11/26] docs/system: document FEAT_Secure Peter Maydell
` (16 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Alex Bennée <alex.bennee@linaro.org>
We've always supported these features but they have official feature
names in the Arm ARM now so we should declare them for completeness.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-3-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
docs/system/arm/emulation.rst | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index fb8d263db49..d19b6c04429 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -31,6 +31,8 @@ the following architecture extensions:
- FEAT_BBML1 (Translation table break-before-make level 1)
- FEAT_BBML2 (Translation table break-before-make level 2)
- FEAT_BF16 (AArch64 BFloat16 instructions)
+- FEAT_BigEnd (Support for big-endian at EL1 and above)
+- FEAT_BigEndEL0 (Support for big-endian at EL0)
- FEAT_BTI (Branch Target Identification)
- FEAT_CCIDX (Extended cache index)
- FEAT_CHK (Check Feature Status)
@@ -103,6 +105,8 @@ the following architecture extensions:
- FEAT_IDST (ID space trap handling)
- FEAT_IESB (Implicit error synchronization event)
- FEAT_JSCVT (JavaScript conversion instructions)
+- FEAT_LittleEnd (Support for little-endian at EL1 and above)
+- FEAT_LittleEndEL0 (Support for little-endian at EL0)
- FEAT_LOR (Limited ordering regions)
- FEAT_LPA (Large Physical Address space)
- FEAT_LPA2 (Large Physical and virtual Address space v2)
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 11/26] docs/system: document FEAT_Secure
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (9 preceding siblings ...)
2026-07-13 15:32 ` [PULL 10/26] docs/system: add big and little endian features names Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 12/26] docs/system: document FEAT_MTE4 Peter Maydell
` (15 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Alex Bennée <alex.bennee@linaro.org>
We have had support for Secure state ever since the initial TrustZone
support.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-4-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
docs/system/arm/emulation.rst | 1 +
1 file changed, 1 insertion(+)
diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index d19b6c04429..b751646e10e 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -162,6 +162,7 @@ the following architecture extensions:
- FEAT_S2FWB (Stage 2 forced Write-Back)
- FEAT_SB (Speculation Barrier)
- FEAT_SCTLR2 (Extension to SCTLR_ELx)
+- FEAT_Secure (Support for Secure state)
- FEAT_SEL2 (Secure EL2)
- FEAT_SHA1 (SHA1 instructions)
- FEAT_SHA256 (SHA256 instructions)
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 12/26] docs/system: document FEAT_MTE4
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (10 preceding siblings ...)
2026-07-13 15:32 ` [PULL 11/26] docs/system: document FEAT_Secure Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 13/26] docs/system: document FEAT_IVIPT Peter Maydell
` (14 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Alex Bennée <alex.bennee@linaro.org>
FEAT_MTE4 includes the sub-features: FEAT_MTE_CANONICAL_TAGS,
FEAT_MTE_TAGGED_FAR, FEAT_MTE_STORE_ONLY and FEAT_MTE_NO_ADDRESS_TAGS.
We have already implemented those so update the docs to include the
rolled up feature.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-5-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
docs/system/arm/emulation.rst | 1 +
1 file changed, 1 insertion(+)
diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index b751646e10e..05e85d7a367 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -126,6 +126,7 @@ the following architecture extensions:
- FEAT_MTE (Memory Tagging Extension)
- FEAT_MTE2 (Memory Tagging Extension)
- FEAT_MTE3 (MTE Asymmetric Fault Handling)
+- FEAT_MTE4 (Enhanced Memory Tagging Extension)
- FEAT_MTE_ASYM_FAULT (Memory tagging asymmetric faults)
- FEAT_MTE_ASYNC (Asynchronous reporting of Tag Check Fault)
- FEAT_MTE_CANONICAL_TAGS (Canonical tag checking)
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 13/26] docs/system: document FEAT_IVIPT
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (11 preceding siblings ...)
2026-07-13 15:32 ` [PULL 12/26] docs/system: document FEAT_MTE4 Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 14/26] docs/system: fix sorting of FEAT_S2[PIE|FWB] Peter Maydell
` (13 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Alex Bennée <alex.bennee@linaro.org>
This is for documentation completeness - a system implements
FEAT_IVIPT if it implements any permitted instruction cache
implementation. QEMU doesn't model caches which is a
permitted (non)implementation.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-6-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
docs/system/arm/emulation.rst | 1 +
1 file changed, 1 insertion(+)
diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index 05e85d7a367..7806982e0d6 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -104,6 +104,7 @@ the following architecture extensions:
- FEAT_I8MM (AArch64 Int8 matrix multiplication instructions)
- FEAT_IDST (ID space trap handling)
- FEAT_IESB (Implicit error synchronization event)
+- FEAT_IVIPT (The IVIPT Extension)
- FEAT_JSCVT (JavaScript conversion instructions)
- FEAT_LittleEnd (Support for little-endian at EL1 and above)
- FEAT_LittleEndEL0 (Support for little-endian at EL0)
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 14/26] docs/system: fix sorting of FEAT_S2[PIE|FWB]
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (12 preceding siblings ...)
2026-07-13 15:32 ` [PULL 13/26] docs/system: document FEAT_IVIPT Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 15/26] docs/system: add FEAT_S2TGran[4|16|64]K features Peter Maydell
` (12 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-7-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
docs/system/arm/emulation.rst | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index 7806982e0d6..b4b65694ff5 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -160,8 +160,8 @@ the following architecture extensions:
- FEAT_RNG_TRAP (Trapping support for RNDR/RNDRRS)
- FEAT_RPRES (Increased precision of FRECPE and FRSQRTE)
- FEAT_S1PIE (Stage 1 permission indirections)
-- FEAT_S2PIE (Stage 2 permission indirections)
- FEAT_S2FWB (Stage 2 forced Write-Back)
+- FEAT_S2PIE (Stage 2 permission indirections)
- FEAT_SB (Speculation Barrier)
- FEAT_SCTLR2 (Extension to SCTLR_ELx)
- FEAT_Secure (Support for Secure state)
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 15/26] docs/system: add FEAT_S2TGran[4|16|64]K features
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (13 preceding siblings ...)
2026-07-13 15:32 ` [PULL 14/26] docs/system: fix sorting of FEAT_S2[PIE|FWB] Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 16/26] docs/system: add FEAT_HAF Peter Maydell
` (11 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Alex Bennée <alex.bennee@linaro.org>
We already have the logic to handle these granule sizes in our stage 2
page table walk code.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-8-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
docs/system/arm/emulation.rst | 3 +++
1 file changed, 3 insertions(+)
diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index b4b65694ff5..903a5f90880 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -162,6 +162,9 @@ the following architecture extensions:
- FEAT_S1PIE (Stage 1 permission indirections)
- FEAT_S2FWB (Stage 2 forced Write-Back)
- FEAT_S2PIE (Stage 2 permission indirections)
+- FEAT_S2TGran16K (Support for 16KB memory translation granule size at stage 2)
+- FEAT_S2TGran4K (Support for 4KB memory translation granule size at stage 2)
+- FEAT_S2TGran64K (Support for 64KB memory translation granule size at stage 2)
- FEAT_SB (Speculation Barrier)
- FEAT_SCTLR2 (Extension to SCTLR_ELx)
- FEAT_Secure (Support for Secure state)
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 16/26] docs/system: add FEAT_HAF
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (14 preceding siblings ...)
2026-07-13 15:32 ` [PULL 15/26] docs/system: add FEAT_S2TGran[4|16|64]K features Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 17/26] arm/virt: fix smmuv3_devices leak Peter Maydell
` (10 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Alex Bennée <alex.bennee@linaro.org>
This is a subset of FEAT_HAFDBS which we have already implemented.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-9-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
docs/system/arm/emulation.rst | 1 +
1 file changed, 1 insertion(+)
diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index 903a5f90880..9930974a501 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -95,6 +95,7 @@ the following architecture extensions:
- FEAT_FlagM2 (Enhancements to flag manipulation instructions)
- FEAT_GCS (Guarded Control Stack Extension)
- FEAT_GTG (Guest translation granule size)
+- FEAT_HAF (Hardware management of the Access flag)
- FEAT_HAFDBS (Hardware management of the access flag and dirty bit state)
- FEAT_HBC (Hinted conditional branches)
- FEAT_HCX (Support for the HCRX_EL2 register)
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 17/26] arm/virt: fix smmuv3_devices leak
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (15 preceding siblings ...)
2026-07-13 15:32 ` [PULL 16/26] docs/system: add FEAT_HAF Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 18/26] target/arm: Be more defensive for invalid tlbi_aa64_get_range Peter Maydell
` (9 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Marc-André Lureau <marcandre.lureau@redhat.com>
Fixes: 92e340997f861 ("hw/arm/virt: Use stored SMMUv3 device list for IORT build")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20260709111225.1106856-1-marcandre.lureau@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/arm/virt.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 6a3c69ba8f9..219597cabd0 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -4417,6 +4417,7 @@ static void virt_instance_finalize(Object *obj)
}
g_free(vms->oem_id);
g_free(vms->oem_table_id);
+ g_ptr_array_free(vms->smmuv3_devices, TRUE);
}
static const TypeInfo virt_machine_info = {
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 18/26] target/arm: Be more defensive for invalid tlbi_aa64_get_range
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (16 preceding siblings ...)
2026-07-13 15:32 ` [PULL 17/26] arm/virt: fix smmuv3_devices leak Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 19/26] hw/dma: don't allow weird transfer lengths for bcm2835 Peter Maydell
` (8 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Richard Henderson <richard.henderson@linaro.org>
It's possible to program TCR_ELx with an invalid granule size,
which could match passing an invalid granule size to TLBI RVA,
which would then fall through to assert in arm_granule_bits.
Cc: qemu-stable@nongnu.org
Fixes: 3c003f7029e ("target/arm: Use ARMGranuleSize in ARMVAParameters")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260710175818.528974-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
target/arm/tcg/tlb-insns.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/target/arm/tcg/tlb-insns.c b/target/arm/tcg/tlb-insns.c
index 1a0a3325836..b24eb57788b 100644
--- a/target/arm/tcg/tlb-insns.c
+++ b/target/arm/tcg/tlb-insns.c
@@ -854,7 +854,7 @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
gran = tlbi_range_tg_to_gran_size(page_size_granule);
/* The granule encoded in value must match the granule in use. */
- if (gran != param.gran) {
+ if (gran != param.gran || gran == GranInvalid) {
qemu_log_mask(LOG_GUEST_ERROR, "Invalid tlbi page size granule %d\n",
page_size_granule);
return ret;
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 19/26] hw/dma: don't allow weird transfer lengths for bcm2835
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (17 preceding siblings ...)
2026-07-13 15:32 ` [PULL 18/26] target/arm: Be more defensive for invalid tlbi_aa64_get_range Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 20/26] hw/net/vmxnet3: Correct bounds check on tx queue index Peter Maydell
` (7 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
From: Alex Bennée <alex.bennee@linaro.org>
The datasheet doesn't explicitly say that TXFR_LEN has to be word
aligned but the fact there is a DMA_D_WIDTH flag to select between 32
bit and 128 bit strongly implies that is how it works. The downstream
rpi kernel also goes to efforts to not write sub-4 byte lengths so
lets:
- fail when mis-programmed and report GUEST_ERROR
- catch setting D_WIDTH for 128 bit and report UNIMP
Yodel did some digging into the specs (see discussion link):
{A} AMBA AXI Protocol Version: 2.0 Specification
https://documentation-service.arm.com/static/64256e84314e245d086bc88f
{B} BCM2835 ARM Peripherals
https://datasheets.raspberrypi.com/bcm2835/bcm2835-peripherals.pdf
[1] {A} (p. 10-2)
[2] {B} (p. 51)
[3] {A} (p. 14-5)
[4] {A} (p. 4-3)
[5] {A} (p. 9-4)
[6] {B} (p. 53)
However was unable to come up with an unambiguous conclusion without
testing on the real hardware. So in the absence of certainty and for
the sake of addressing the DoS I suggest we merge as is for now.
Link: https://lore.kernel.org/all/20251111105429.3993300-1-alex.bennee@linaro.org/
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3201
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20260710131500.2323848-1-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/dma/bcm2835_dma.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/hw/dma/bcm2835_dma.c b/hw/dma/bcm2835_dma.c
index d07459de2d0..b842aef4b74 100644
--- a/hw/dma/bcm2835_dma.c
+++ b/hw/dma/bcm2835_dma.c
@@ -86,6 +86,23 @@ static void bcm2835_dma_update(BCM2835DMAState *s, unsigned c)
}
xlen_td = xlen;
+ if (ch->ti & BCM2708_DMA_D_WIDTH) {
+ qemu_log_mask(LOG_UNIMP, "%s: 128bit transfers not yet supported", __func__);
+ ch->cs |= BCM2708_DMA_ERR;
+ break;
+ }
+
+ /*
+ * Datasheet implies 32bit or 128bit transfers only
+ *
+ * TODO: test on real HW and report back.
+ */
+ if (xlen & 0x3) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: bad transfer size\n", __func__);
+ ch->cs |= BCM2708_DMA_ERR;
+ break;
+ }
+
while (ylen != 0) {
/* Normal transfer mode */
while (xlen != 0) {
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 20/26] hw/net/vmxnet3: Correct bounds check on tx queue index
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (18 preceding siblings ...)
2026-07-13 15:32 ` [PULL 19/26] hw/dma: don't allow weird transfer lengths for bcm2835 Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 21/26] hw/usb/dev-wacom: Don't write off end of buffer Peter Maydell
` (6 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
In vmxnet3_io_bar0_write(), we try to bounds-check the TX queue index
provided by the guest against the total number of queues. However,
we have an off-by-one error: the valid indexes are from 0 to
txq_num-1, so we need a "<" comparison, not "<=".
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3780
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260706175408.905362-1-peter.maydell@linaro.org
---
hw/net/vmxnet3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 97156dd33b9..8569484b2f2 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -1079,7 +1079,7 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr,
int tx_queue_idx =
VMW_MULTIREG_IDX_BY_ADDR(addr, VMXNET3_REG_TXPROD,
VMXNET3_REG_ALIGN);
- if (tx_queue_idx <= s->txq_num) {
+ if (tx_queue_idx < s->txq_num) {
vmxnet3_process_tx_queue(s, tx_queue_idx);
} else {
qemu_log_mask(LOG_GUEST_ERROR, "vmxnet3: Illegal TX queue %d/%d\n",
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 21/26] hw/usb/dev-wacom: Don't write off end of buffer
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (19 preceding siblings ...)
2026-07-13 15:32 ` [PULL 20/26] hw/net/vmxnet3: Correct bounds check on tx queue index Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 22/26] hw/display/sm501: Catch bad coordinates for RTL operations Peter Maydell
` (5 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
In usb_wacom_handle_data() we allocate a buffer with a size
determined by the transfer size requested by the guest. We then fill
it in by calling either usb_mouse_poll() or usb_wacom_poll(), both of
which functions take a length and return an actual length, which we
pass to usb_packet_copy(). However, usb_mouse_poll() doesn't check
the buffer size as it fills in the buffer, so if the guest passes an
overly short transfer size then it will write off the end of the
allocated buffer.
Check the length is at least big enough for the minimum 3 byte
packet and return nothing if it is not, as usb_wacom_poll() does.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3672
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260706182034.1003176-1-peter.maydell@linaro.org
---
hw/usb/dev-wacom.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/hw/usb/dev-wacom.c b/hw/usb/dev-wacom.c
index c69e247f7b7..895edcc17e7 100644
--- a/hw/usb/dev-wacom.c
+++ b/hw/usb/dev-wacom.c
@@ -285,6 +285,10 @@ static int usb_mouse_poll(USBWacomState *s, uint8_t *buf, int len)
b |= 0x04;
}
+ if (len < 3) {
+ return 0;
+ }
+
buf[0] = b;
buf[1] = dx;
buf[2] = dy;
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 22/26] hw/display/sm501: Catch bad coordinates for RTL operations
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (20 preceding siblings ...)
2026-07-13 15:32 ` [PULL 21/26] hw/usb/dev-wacom: Don't write off end of buffer Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 23/26] hw/display/sm501: Avoid overflow problems in bounds check calculations Peter Maydell
` (4 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
The sm501 code doesn't check whether a right-to-left operation has
specified a width greater than the x-coordinate (which would make it
extend off the left edge of the screen), or similarly a height
greater than the y-coordinate. This means the guest can misprogram
the device so that we underflow when calculating the address of the
top left pixel, which might result in accessing out of bounds
memory. Catch this as a guest error and ignore the operation.
Reported-by: Yannick Wang
Tested-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260707150933.1410507-2-peter.maydell@linaro.org
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3920
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/display/sm501.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index af870048372..0da25477bcc 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -723,6 +723,10 @@ static void sm501_2d_operation(SM501State *s)
}
if (rtl) {
+ if (dst_x < (width - 1) || dst_y < (height - 1)) {
+ qemu_log_mask(LOG_GUEST_ERROR, "sm501: RTL op out of bounds\n");
+ return;
+ }
dst_x -= width - 1;
dst_y -= height - 1;
}
@@ -748,6 +752,10 @@ static void sm501_2d_operation(SM501State *s)
}
if (rtl) {
+ if (src_x < (width - 1) || src_y < (height - 1)) {
+ qemu_log_mask(LOG_GUEST_ERROR, "sm501: RTL op out of bounds\n");
+ return;
+ }
src_x -= width - 1;
src_y -= height - 1;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 23/26] hw/display/sm501: Avoid overflow problems in bounds check calculations
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (21 preceding siblings ...)
2026-07-13 15:32 ` [PULL 22/26] hw/display/sm501: Catch bad coordinates for RTL operations Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 24/26] hw/display/sm501: Don't allow guest to set ram size larger than it is Peter Maydell
` (3 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
When we check that a 2D rectangle operation isn't going to run off
the end of video RAM, we do the calculations as 32 bit arithmetic.
This means that carefully chosen guest register values can cause an
overflow so we don't detect that the operation is going to go outside
video memory.
Abstract the check out into a function, do the calculations as
64-bit arithmetic, and add assertions about the ranges of the
inputs.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3584
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-id: 20260707150933.1410507-3-peter.maydell@linaro.org
---
hw/display/sm501.c | 32 ++++++++++++++++++++++++++------
1 file changed, 26 insertions(+), 6 deletions(-)
diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 0da25477bcc..d5e165daefc 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -682,6 +682,28 @@ static inline void hwc_invalidate(SM501State *s, int crt)
get_fb_addr(s, crt) + start, end - start);
}
+static bool sm501_rect_outside_vram(SM501State *s, uint32_t base,
+ uint32_t x, uint32_t y,
+ uint32_t width, uint32_t height,
+ uint32_t pitch, uint32_t bypp)
+{
+ /*
+ * Return true if the 2D area specified by the arguments is
+ * partially or completely outside the VRAM (a guest error)
+ *
+ * Limits on the input sizes mean we can't overflow as long as
+ * we do all the arithmetic at 64 bits.
+ */
+ uint64_t rect_size, last_addr;
+
+ assert(x <= UINT16_MAX && y <= UINT16_MAX && height <= UINT16_MAX &&
+ pitch <= UINT16_MAX && bypp <= 8);
+ rect_size = (((uint64_t)y + height) * pitch + x + width) * bypp;
+ last_addr = base + rect_size;
+
+ return last_addr >= get_local_mem_size(s);
+}
+
static void sm501_2d_operation(SM501State *s)
{
int cmd = (s->twoD_control >> 16) & 0x1F;
@@ -731,9 +753,8 @@ static void sm501_2d_operation(SM501State *s)
dst_y -= height - 1;
}
- if (dst_base >= get_local_mem_size(s) ||
- dst_base + (dst_x + width + (dst_y + height) * dst_pitch) * bypp >=
- get_local_mem_size(s)) {
+ if (sm501_rect_outside_vram(s, dst_base, dst_x, dst_y, width, height,
+ dst_pitch, bypp)) {
qemu_log_mask(LOG_GUEST_ERROR, "sm501: 2D op dest is outside vram.\n");
return;
}
@@ -760,9 +781,8 @@ static void sm501_2d_operation(SM501State *s)
src_y -= height - 1;
}
- if (src_base >= get_local_mem_size(s) ||
- src_base + (src_x + width + (src_y + height) * src_pitch) * bypp >=
- get_local_mem_size(s)) {
+ if (sm501_rect_outside_vram(s, src_base, src_x, src_y, width, height,
+ src_pitch, bypp)) {
qemu_log_mask(LOG_GUEST_ERROR,
"sm501: 2D op src is outside vram.\n");
return;
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 24/26] hw/display/sm501: Don't allow guest to set ram size larger than it is
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (22 preceding siblings ...)
2026-07-13 15:32 ` [PULL 23/26] hw/display/sm501: Avoid overflow problems in bounds check calculations Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 25/26] hw/misc/allwinner-r40-ccu.c: Correct handling of out of range accesses Peter Maydell
` (2 subsequent siblings)
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
The SM501 DRAM_CONTROL register has a 7 bit Size field which allows
the guest to change the local memory size. We use the local memory
size in bounds checks calculations for 2D operations. Currently we
have no check on the validity of the value the guest programs to
this field, which means that the guest can:
- set it to a reserved value (6 or 7) which will cause
get_local_mem_size() to read outside sm501_mem_local_size[]
- set it to a value corresponding to more RAM than the card
was created with, so that the 2D bounds check will let 2D
operations access off the end of the memory region
Fix this by decoupling the value the guest reads and writes to this
field from the internal size we consider the local memory to have.
We validate changes and ignore them except for readback if they would
be reserved values or values for more memory than the card has.
Cc: qemu-stable@nongnu.org
Reported-by: Heechan Kang
Tested-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260707150933.1410507-4-peter.maydell@linaro.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3811
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/display/sm501.c | 24 +++++++++++++++++++++---
1 file changed, 21 insertions(+), 3 deletions(-)
diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index d5e165daefc..cacb6c87ec9 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -571,6 +571,25 @@ static uint32_t get_local_mem_size_index(uint32_t size)
return index;
}
+static void set_new_local_mem_size_index(SM501State *s, uint32_t idx)
+{
+ /*
+ * Update local_mem_size_index on guest write. We don't allow this
+ * to be set to larger than the actual RAM size. (The guest will
+ * still read back the SYSTEM_CONTROL.Size bits that it wrote.)
+ */
+ if (idx < ARRAY_SIZE(sm501_mem_local_size) &&
+ sm501_mem_local_size[idx] <= memory_region_size(&s->local_mem_region)) {
+ s->local_mem_size_index = idx;
+ return;
+ }
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "sm501: Guest set DRAM_CONTROL.Size to 0x%x but "
+ "local memory is not that large\n",
+ idx);
+ /* Don't change the effective size, leave it as whatever it was */
+}
+
static ram_addr_t get_fb_addr(SM501State *s, int crt)
{
return (crt ? s->dc_crt_fb_addr : s->dc_panel_fb_addr) & 0x3FFFFF0;
@@ -990,7 +1009,7 @@ static uint64_t sm501_system_config_read(void *opaque, hwaddr addr,
ret = 0x050100A0;
break;
case SM501_DRAM_CONTROL:
- ret = (s->dram_control & 0x07F107C0) | s->local_mem_size_index << 13;
+ ret = (s->dram_control & 0x07F1E7C0);
break;
case SM501_ARBTRTN_CONTROL:
ret = s->arbitration_control;
@@ -1049,8 +1068,7 @@ static void sm501_system_config_write(void *opaque, hwaddr addr,
s->gpio_63_32_control = value & 0xFF80FFFF;
break;
case SM501_DRAM_CONTROL:
- s->local_mem_size_index = (value >> 13) & 0x7;
- /* TODO : check validity of size change */
+ set_new_local_mem_size_index(s, (value >> 13) & 0x7);
s->dram_control &= 0x80000000;
s->dram_control |= value & 0x7FFFFFC3;
break;
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 25/26] hw/misc/allwinner-r40-ccu.c: Correct handling of out of range accesses
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (23 preceding siblings ...)
2026-07-13 15:32 ` [PULL 24/26] hw/display/sm501: Don't allow guest to set ram size larger than it is Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-13 15:32 ` [PULL 26/26] hw/misc/stm32_rcc: Correct offset-to-irq calculation Peter Maydell
2026-07-14 19:23 ` [PULL 00/26] target-arm queue Stefan Hajnoczi
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
In allwinner_r40_ccu_write() we handle writes to a MemoryRegion of
size AW_R40_CCU_IOSIZE, and the register array is sized accordingly
at (AW_R40_CCU_IOSIZE / sizeof(uint32_t)). However, one of the cases
in the switch is a range up to AW_R40_CCU_IOSIZE, which makes
Coverity think we might index off the end of the array. We also
have a similar case in the read function, but since that returns
early it doesn't have the same issue.
Adjust the handling of out of range accesses:
- use AW_R40_CCU_IOSIZE - 4 as the upper bound, as this is the
largest value we will actually see
- return early in the write case, as we do in the read case
Coverity CID: 1663687
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
Message-id: 20260709104802.1989086-1-peter.maydell@linaro.org
---
hw/misc/allwinner-r40-ccu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/hw/misc/allwinner-r40-ccu.c b/hw/misc/allwinner-r40-ccu.c
index 8ba4e7aa429..00840e98507 100644
--- a/hw/misc/allwinner-r40-ccu.c
+++ b/hw/misc/allwinner-r40-ccu.c
@@ -71,7 +71,7 @@ static uint64_t allwinner_r40_ccu_read(void *opaque, hwaddr offset,
const uint32_t idx = REG_INDEX(offset);
switch (offset) {
- case 0x324 ... AW_R40_CCU_IOSIZE:
+ case 0x324 ... AW_R40_CCU_IOSIZE - 4:
qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
__func__, (uint32_t)offset);
return 0;
@@ -113,10 +113,10 @@ static void allwinner_r40_ccu_write(void *opaque, hwaddr offset,
val |= REG_PLL_LOCK;
}
break;
- case 0x324 ... AW_R40_CCU_IOSIZE:
+ case 0x324 ... AW_R40_CCU_IOSIZE - 4:
qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
__func__, (uint32_t)offset);
- break;
+ return;
default:
qemu_log_mask(LOG_UNIMP, "%s: unimplemented write offset 0x%04x\n",
__func__, (uint32_t)offset);
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* [PULL 26/26] hw/misc/stm32_rcc: Correct offset-to-irq calculation
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (24 preceding siblings ...)
2026-07-13 15:32 ` [PULL 25/26] hw/misc/allwinner-r40-ccu.c: Correct handling of out of range accesses Peter Maydell
@ 2026-07-13 15:32 ` Peter Maydell
2026-07-14 19:23 ` [PULL 00/26] target-arm queue Stefan Hajnoczi
26 siblings, 0 replies; 46+ messages in thread
From: Peter Maydell @ 2026-07-13 15:32 UTC (permalink / raw)
To: qemu-devel
In the STM32 RCC, there is a block of 5 "enable" registers, each of
which has 32 bits; each bit determines the level of one of the 5 * 32
= 160 enable_irq output lines. The code calculates the irq to be
worked on using
irq_offset = ((addr - STM32_RCC_AHB1_ENR) / 4) * 32;
This assumes that the registers are all consecutive; however, there
is a gap between the AHB1/2/3 registers and the APB1/2 registers, so
for the APB1/2 registers we calculate a number that is 32 too high
and can index off the end of the enable_irq[] array.
The handling of the reset registers has an identical bug.
Adjust the calculation of irq_offset to cope with the gap, and fix
the case labels so accesses to the gap fall into the default
LOG_UNIMP rather than being treated as if they were an actual
register.
Coverity CID: 1663683, 1663686
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20260709104832.1989240-1-peter.maydell@linaro.org
---
hw/misc/stm32_rcc.c | 31 +++++++++++++++++++++++++++----
include/hw/misc/stm32_rcc.h | 6 +++++-
2 files changed, 32 insertions(+), 5 deletions(-)
diff --git a/hw/misc/stm32_rcc.c b/hw/misc/stm32_rcc.c
index 74ea29b1560..5cfb39e5607 100644
--- a/hw/misc/stm32_rcc.c
+++ b/hw/misc/stm32_rcc.c
@@ -53,6 +53,27 @@ static uint64_t stm32_rcc_read(void *opaque, hwaddr addr, unsigned int size)
return value;
}
+static int reg_offset_to_irq_offset(hwaddr addr)
+{
+ /*
+ * The reset and enable registers aren't all consecutive. In getting the
+ * irq index from the register offset, we need to account for the gap
+ * between the AHB regs and the APB regs.
+ */
+ switch (addr) {
+ case STM32_RCC_AHB1_RSTR ... STM32_RCC_AHB3_RSTR:
+ return ((addr - STM32_RCC_AHB1_RSTR) / 4) * 32;
+ case STM32_RCC_APB1_RSTR ... STM32_RCC_APB2_RSTR:
+ return ((addr - STM32_RCC_APB1_RSTR) / 4) * 32 + STM32_RCC_N_AHB_IRQS;
+ case STM32_RCC_AHB1_ENR ... STM32_RCC_AHB3_ENR:
+ return ((addr - STM32_RCC_AHB1_ENR) / 4) * 32;
+ case STM32_RCC_APB1_ENR ... STM32_RCC_APB2_ENR:
+ return ((addr - STM32_RCC_APB1_ENR) / 4) * 32 + STM32_RCC_N_AHB_IRQS;
+ default:
+ g_assert_not_reached();
+ }
+}
+
static void stm32_rcc_write(void *opaque, hwaddr addr,
uint64_t val64, unsigned int size)
{
@@ -69,11 +90,12 @@ static void stm32_rcc_write(void *opaque, hwaddr addr,
}
switch (addr) {
- case STM32_RCC_AHB1_RSTR...STM32_RCC_APB2_RSTR:
+ case STM32_RCC_AHB1_RSTR ... STM32_RCC_AHB3_RSTR:
+ case STM32_RCC_APB1_RSTR ... STM32_RCC_APB2_RSTR:
prev_value = s->regs[addr / 4];
s->regs[addr / 4] = value;
- irq_offset = ((addr - STM32_RCC_AHB1_RSTR) / 4) * 32;
+ irq_offset = reg_offset_to_irq_offset(addr);
for (int i = 0; i < 32; i++) {
new_value = extract32(value, i, 1);
if (extract32(prev_value, i, 1) && !new_value) {
@@ -82,11 +104,12 @@ static void stm32_rcc_write(void *opaque, hwaddr addr,
}
}
return;
- case STM32_RCC_AHB1_ENR...STM32_RCC_APB2_ENR:
+ case STM32_RCC_AHB1_ENR ... STM32_RCC_AHB3_ENR:
+ case STM32_RCC_APB1_ENR ... STM32_RCC_APB2_ENR:
prev_value = s->regs[addr / 4];
s->regs[addr / 4] = value;
- irq_offset = ((addr - STM32_RCC_AHB1_ENR) / 4) * 32;
+ irq_offset = reg_offset_to_irq_offset(addr);
for (int i = 0; i < 32; i++) {
new_value = extract32(value, i, 1);
if (!extract32(prev_value, i, 1) && new_value) {
diff --git a/include/hw/misc/stm32_rcc.h b/include/hw/misc/stm32_rcc.h
index 4dccacc2db5..a94781bf347 100644
--- a/include/hw/misc/stm32_rcc.h
+++ b/include/hw/misc/stm32_rcc.h
@@ -65,7 +65,11 @@
#define STM32_RCC_NREGS ((STM32_RCC_DCKCFGR2 >> 2) + 1)
#define STM32_RCC_PERIPHERAL_SIZE 0x400
-#define STM32_RCC_NIRQS (32 * 5) /* 32 bits per reg, 5 en/rst regs */
+
+/* 32 bits per reg, 3 AHB regs and 2 APB regs */
+#define STM32_RCC_N_AHB_IRQS (32 * 3)
+#define STM32_RCC_N_APB_IRQS (32 * 2)
+#define STM32_RCC_NIRQS (STM32_RCC_N_AHB_IRQS + STM32_RCC_N_APB_IRQS)
#define STM32_RCC_GPIO_IRQ_OFFSET 0
--
2.43.0
^ permalink raw reply related [flat|nested] 46+ messages in thread
* Re: [PULL 00/26] target-arm queue
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
` (25 preceding siblings ...)
2026-07-13 15:32 ` [PULL 26/26] hw/misc/stm32_rcc: Correct offset-to-irq calculation Peter Maydell
@ 2026-07-14 19:23 ` Stefan Hajnoczi
26 siblings, 0 replies; 46+ messages in thread
From: Stefan Hajnoczi @ 2026-07-14 19:23 UTC (permalink / raw)
To: Peter Maydell; +Cc: qemu-devel
[-- Attachment #1: Type: text/plain, Size: 116 bytes --]
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 46+ messages in thread
end of thread, other threads:[~2026-07-15 6:53 UTC | newest]
Thread overview: 46+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-13 15:32 [PULL 00/26] target-arm queue Peter Maydell
2026-07-13 15:32 ` [PULL 01/26] hw/misc/zynq_slcr.c: drop duplicate reset value for DDRIOB_DCI_CTRL Peter Maydell
2026-07-13 15:32 ` [PULL 02/26] hw/arm/tegra241-cmdqv: Do not sync GERRORN on VCMDQ allocation Peter Maydell
2026-07-13 15:32 ` [PULL 03/26] hw/arm/smmuv3: Fix off-by-one bug in alignment strtab mask Peter Maydell
2026-07-13 15:32 ` [PULL 04/26] hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.SPLIT Peter Maydell
2026-07-13 15:32 ` [PULL 05/26] hw/arm/smmuv3: Fix possible overflow in strtab_base computation Peter Maydell
2026-07-13 15:32 ` [PULL 06/26] hw/arm/smmuv3: Check L1STD.SPAN Peter Maydell
2026-07-13 15:32 ` [PULL 07/26] hw/arm/smmuv3: Enforce alignment of L2Ptr according to the span Peter Maydell
2026-07-13 15:32 ` [PULL 08/26] hw/i2c: pmbus: clear output buffer on write Peter Maydell
2026-07-13 15:32 ` [PULL 09/26] docs/system: declare support for FEAT_EVT2 Peter Maydell
2026-07-13 15:32 ` [PULL 10/26] docs/system: add big and little endian features names Peter Maydell
2026-07-13 15:32 ` [PULL 11/26] docs/system: document FEAT_Secure Peter Maydell
2026-07-13 15:32 ` [PULL 12/26] docs/system: document FEAT_MTE4 Peter Maydell
2026-07-13 15:32 ` [PULL 13/26] docs/system: document FEAT_IVIPT Peter Maydell
2026-07-13 15:32 ` [PULL 14/26] docs/system: fix sorting of FEAT_S2[PIE|FWB] Peter Maydell
2026-07-13 15:32 ` [PULL 15/26] docs/system: add FEAT_S2TGran[4|16|64]K features Peter Maydell
2026-07-13 15:32 ` [PULL 16/26] docs/system: add FEAT_HAF Peter Maydell
2026-07-13 15:32 ` [PULL 17/26] arm/virt: fix smmuv3_devices leak Peter Maydell
2026-07-13 15:32 ` [PULL 18/26] target/arm: Be more defensive for invalid tlbi_aa64_get_range Peter Maydell
2026-07-13 15:32 ` [PULL 19/26] hw/dma: don't allow weird transfer lengths for bcm2835 Peter Maydell
2026-07-13 15:32 ` [PULL 20/26] hw/net/vmxnet3: Correct bounds check on tx queue index Peter Maydell
2026-07-13 15:32 ` [PULL 21/26] hw/usb/dev-wacom: Don't write off end of buffer Peter Maydell
2026-07-13 15:32 ` [PULL 22/26] hw/display/sm501: Catch bad coordinates for RTL operations Peter Maydell
2026-07-13 15:32 ` [PULL 23/26] hw/display/sm501: Avoid overflow problems in bounds check calculations Peter Maydell
2026-07-13 15:32 ` [PULL 24/26] hw/display/sm501: Don't allow guest to set ram size larger than it is Peter Maydell
2026-07-13 15:32 ` [PULL 25/26] hw/misc/allwinner-r40-ccu.c: Correct handling of out of range accesses Peter Maydell
2026-07-13 15:32 ` [PULL 26/26] hw/misc/stm32_rcc: Correct offset-to-irq calculation Peter Maydell
2026-07-14 19:23 ` [PULL 00/26] target-arm queue Stefan Hajnoczi
-- strict thread matches above, loose matches on Subject: below --
2026-02-10 13:51 Peter Maydell
2026-02-11 19:46 ` Peter Maydell
2024-07-18 13:20 Peter Maydell
2024-07-19 1:26 ` Richard Henderson
2023-09-08 17:05 Peter Maydell
2023-09-11 15:19 ` Stefan Hajnoczi
2023-06-23 12:31 Peter Maydell
2023-06-25 8:25 ` Richard Henderson
2023-01-23 13:35 Peter Maydell
2023-01-23 15:17 ` Peter Maydell
2022-03-02 20:52 Peter Maydell
2022-03-03 19:57 ` Peter Maydell
2022-02-21 9:27 Peter Maydell
2021-05-10 12:25 Peter Maydell
2020-11-02 17:09 Peter Maydell
2020-11-03 11:36 ` Peter Maydell
2020-01-30 16:15 Peter Maydell
2020-01-30 19:05 ` Peter Maydell
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.