* [PULL 00/20] target-arm queue
@ 2020-01-23 15:30 Peter Maydell
0 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2020-01-23 15:30 UTC (permalink / raw)
To: qemu-devel
The following changes since commit b7c359c748a2e3ccb97a184b9739feb2cd48de2f:
Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-5.0-pull-request' into staging (2020-01-23 14:38:43 +0000)
are available in the Git repository at:
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200123
for you to fetch changes up to 53c75ad8e72dc3a5102de7ed21e4990969cb0a19:
hw/arm/exynos4210: Connect serial port DMA busy signals with pl330 (2020-01-23 15:22:42 +0000)
----------------------------------------------------------------
target-arm queue:
* fix bug in PAuth emulation
* add PMU to Cortex-R5, Cortex-R5F
* qemu-nbd: Convert documentation to rST
* qemu-block-drivers: Convert documentation to rST
* Fix Exynos4210 UART DMA support
* Various minor code cleanups
----------------------------------------------------------------
Andrew Jones (1):
target/arm/arch_dump: Add SVE notes
Clement Deschamps (1):
target/arm: add PMU feature to cortex-r5 and cortex-r5f
Guenter Roeck (8):
dma/pl330: Convert to support tracing
hw/core/or-irq: Increase limit of or-lines to 48
hw/arm/exynos4210: Fix DMA initialization
hw/char/exynos4210_uart: Convert to support tracing
hw/char/exynos4210_uart: Implement post_load function
hw/char/exynos4210_uart: Implement Rx FIFO level triggers and timeouts
hw/char/exynos4210_uart: Add receive DMA support
hw/arm/exynos4210: Connect serial port DMA busy signals with pl330
Keqian Zhu (2):
hw/acpi: Remove extra indent in ACPI GED hotplug cb
hw/arm: Use helper function to trigger hotplug handler plug
Peter Maydell (3):
qemu-nbd: Convert invocation documentation to rST
docs: Create stub system manual
qemu-block-drivers: Convert to rST
Philippe Mathieu-Daudé (1):
hw/misc/stm32f4xx_syscfg: Fix copy/paste error
Richard Henderson (3):
tests/tcg/aarch64: Fix compilation parameters for pauth-%
tests/tcg/aarch64: Add pauth-3
tests/tcg/aarch64: Add pauth-4
Vincent Dehors (1):
target/arm: Fix PAuth sbox functions
Makefile | 37 +-
tests/tcg/aarch64/Makefile.softmmu-target | 5 +-
tests/tcg/aarch64/Makefile.target | 3 +-
include/elf.h | 1 +
include/hw/arm/exynos4210.h | 4 +
include/hw/or-irq.h | 2 +-
target/arm/cpu.h | 25 +
hw/acpi/generic_event_device.c | 2 +-
hw/arm/exynos4210.c | 77 ++-
hw/arm/virt.c | 6 +-
hw/char/exynos4210_uart.c | 245 +++++---
hw/dma/pl330.c | 88 +--
hw/misc/stm32f4xx_syscfg.c | 2 +-
target/arm/arch_dump.c | 124 +++-
target/arm/cpu.c | 1 +
target/arm/kvm64.c | 24 -
target/arm/pauth_helper.c | 4 +-
tests/tcg/aarch64/pauth-1.c | 2 -
tests/tcg/aarch64/pauth-2.c | 2 -
tests/tcg/aarch64/pauth-4.c | 25 +
tests/tcg/aarch64/system/pauth-3.c | 40 ++
MAINTAINERS | 1 +
docs/index.html.in | 1 +
docs/interop/conf.py | 4 +-
docs/interop/index.rst | 1 +
docs/interop/qemu-nbd.rst | 263 ++++++++
docs/interop/qemu-option-trace.rst.inc | 30 +
docs/qemu-block-drivers.texi | 889 ---------------------------
docs/system/conf.py | 22 +
docs/system/index.rst | 17 +
docs/system/qemu-block-drivers.rst | 985 ++++++++++++++++++++++++++++++
hw/char/trace-events | 20 +
hw/dma/trace-events | 24 +
qemu-doc.texi | 18 -
qemu-nbd.texi | 214 -------
qemu-option-trace.texi | 4 +
qemu-options.hx | 2 +-
37 files changed, 1897 insertions(+), 1317 deletions(-)
create mode 100644 tests/tcg/aarch64/pauth-4.c
create mode 100644 tests/tcg/aarch64/system/pauth-3.c
create mode 100644 docs/interop/qemu-nbd.rst
create mode 100644 docs/interop/qemu-option-trace.rst.inc
delete mode 100644 docs/qemu-block-drivers.texi
create mode 100644 docs/system/conf.py
create mode 100644 docs/system/index.rst
create mode 100644 docs/system/qemu-block-drivers.rst
delete mode 100644 qemu-nbd.texi
^ permalink raw reply [flat|nested] 33+ messages in thread
* [PULL 00/20] target-arm queue
@ 2020-12-15 14:12 Peter Maydell
2020-12-15 21:16 ` Peter Maydell
0 siblings, 1 reply; 33+ messages in thread
From: Peter Maydell @ 2020-12-15 14:12 UTC (permalink / raw)
To: qemu-devel
A grab-bag of minor stuff for the end of the year. My to-review
queue is not empty, but it it at least in single figures...
-- PMM
The following changes since commit 5bfbd8170ce7acb98a1834ff49ed7340b0837144:
Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-for-6.0-pull-request' into staging (2020-12-14 20:32:38 +0000)
are available in the Git repository at:
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201215
for you to fetch changes up to 23af268566069183285bebbdf95b1b37cb7c0942:
hw/block/m25p80: Fix Numonyx fast read dummy cycle count (2020-12-15 13:39:30 +0000)
----------------------------------------------------------------
target-arm queue:
* gdbstub: Correct misparsing of vCont C/S requests
* openrisc: Move pic_cpu code into CPU object proper
* nios2: Move IIC code into CPU object proper
* Improve reporting of ROM overlap errors
* xlnx-versal: Add USB support
* hw/misc/zynq_slcr: Avoid #DIV/0! error
* Numonyx: Fix dummy cycles and check for SPI mode on cmds
----------------------------------------------------------------
Joe Komlodi (4):
hw/block/m25p80: Make Numonyx config field names more accurate
hw/block/m25p80: Fix when VCFG XIP bit is set for Numonyx
hw/block/m25p80: Check SPI mode before running some Numonyx commands
hw/block/m25p80: Fix Numonyx fast read dummy cycle count
Peter Maydell (11):
gdbstub: Correct misparsing of vCont C/S requests
hw/openrisc/openrisc_sim: Use IRQ splitter when connecting IRQ to multiple CPUs
hw/openrisc/openrisc_sim: Abstract out "get IRQ x of CPU y"
target/openrisc: Move pic_cpu code into CPU object proper
target/nios2: Move IIC code into CPU object proper
target/nios2: Move nios2_check_interrupts() into target/nios2
target/nios2: Use deposit32() to update ipending register
hw/core/loader.c: Track last-seen ROM in rom_check_and_register_reset()
hw/core/loader.c: Improve reporting of ROM overlap errors
elf_ops.h: Don't truncate name of the ROM blobs we create
elf_ops.h: Be more verbose with ROM blob names
Philippe Mathieu-Daudé (1):
hw/misc/zynq_slcr: Avoid #DIV/0! error
Sai Pavan Boddu (2):
usb: Add versal-usb2-ctrl-regs module
usb: xlnx-usb-subsystem: Add xilinx usb subsystem
Vikram Garhwal (2):
usb: Add DWC3 model
arm: xlnx-versal: Connect usb to virt-versal
include/hw/arm/xlnx-versal.h | 9 +
include/hw/elf_ops.h | 5 +-
include/hw/usb/hcd-dwc3.h | 55 +++
include/hw/usb/xlnx-usb-subsystem.h | 45 ++
include/hw/usb/xlnx-versal-usb2-ctrl-regs.h | 45 ++
target/nios2/cpu.h | 3 -
target/openrisc/cpu.h | 1 -
gdbstub.c | 2 +-
hw/arm/xlnx-versal-virt.c | 55 +++
hw/arm/xlnx-versal.c | 26 ++
hw/block/m25p80.c | 158 +++++--
hw/core/loader.c | 67 ++-
hw/intc/nios2_iic.c | 95 ----
hw/misc/zynq_slcr.c | 5 +
hw/nios2/10m50_devboard.c | 13 +-
hw/nios2/cpu_pic.c | 67 ---
hw/openrisc/openrisc_sim.c | 46 +-
hw/openrisc/pic_cpu.c | 61 ---
hw/usb/hcd-dwc3.c | 689 ++++++++++++++++++++++++++++
hw/usb/xlnx-usb-subsystem.c | 94 ++++
hw/usb/xlnx-versal-usb2-ctrl-regs.c | 229 +++++++++
softmmu/vl.c | 1 -
target/nios2/cpu.c | 29 ++
target/nios2/op_helper.c | 9 +
target/openrisc/cpu.c | 32 ++
MAINTAINERS | 1 -
hw/intc/meson.build | 1 -
hw/nios2/meson.build | 2 +-
hw/openrisc/Kconfig | 1 +
hw/openrisc/meson.build | 2 +-
hw/usb/Kconfig | 10 +
hw/usb/meson.build | 3 +
32 files changed, 1557 insertions(+), 304 deletions(-)
create mode 100644 include/hw/usb/hcd-dwc3.h
create mode 100644 include/hw/usb/xlnx-usb-subsystem.h
create mode 100644 include/hw/usb/xlnx-versal-usb2-ctrl-regs.h
delete mode 100644 hw/intc/nios2_iic.c
delete mode 100644 hw/nios2/cpu_pic.c
delete mode 100644 hw/openrisc/pic_cpu.c
create mode 100644 hw/usb/hcd-dwc3.c
create mode 100644 hw/usb/xlnx-usb-subsystem.c
create mode 100644 hw/usb/xlnx-versal-usb2-ctrl-regs.c
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PULL 00/20] target-arm queue
2020-12-15 14:12 Peter Maydell
@ 2020-12-15 21:16 ` Peter Maydell
0 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2020-12-15 21:16 UTC (permalink / raw)
To: QEMU Developers
On Tue, 15 Dec 2020 at 14:12, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> A grab-bag of minor stuff for the end of the year. My to-review
> queue is not empty, but it it at least in single figures...
>
> -- PMM
>
> The following changes since commit 5bfbd8170ce7acb98a1834ff49ed7340b0837144:
>
> Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-for-6.0-pull-request' into staging (2020-12-14 20:32:38 +0000)
>
> are available in the Git repository at:
>
> https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201215
>
> for you to fetch changes up to 23af268566069183285bebbdf95b1b37cb7c0942:
>
> hw/block/m25p80: Fix Numonyx fast read dummy cycle count (2020-12-15 13:39:30 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
> * gdbstub: Correct misparsing of vCont C/S requests
> * openrisc: Move pic_cpu code into CPU object proper
> * nios2: Move IIC code into CPU object proper
> * Improve reporting of ROM overlap errors
> * xlnx-versal: Add USB support
> * hw/misc/zynq_slcr: Avoid #DIV/0! error
> * Numonyx: Fix dummy cycles and check for SPI mode on cmds
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/6.0
for any user-visible changes.
-- PMM
^ permalink raw reply [flat|nested] 33+ messages in thread
* [PULL 00/20] target-arm queue
@ 2024-03-05 13:52 Peter Maydell
2024-03-05 15:26 ` Peter Maydell
0 siblings, 1 reply; 33+ messages in thread
From: Peter Maydell @ 2024-03-05 13:52 UTC (permalink / raw)
To: qemu-devel
The following changes since commit 4eac9dfbd72d346505642fb45ac3141c7eb2c516:
Merge tag 'pull-tcg-20240301' of https://gitlab.com/rth7680/qemu into staging (2024-03-05 09:45:22 +0000)
are available in the Git repository at:
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240305
for you to fetch changes up to 7558300c53057126514ee0fd5cf629c65ccc20e1:
qemu-options.hx: Don't claim "-serial" has limit of 4 serial ports (2024-03-05 13:22:56 +0000)
----------------------------------------------------------------
target-arm queue:
* raspi: Implement Broadcom Serial Controller (BSC) for BCM2835 boards
* hw/char/pl011: Add support for loopback
* STM32L4x5: Implement RCC clock control device
* target/arm: Do memory type alignment checks
* atomic.h: Reword confusing comment for qatomic_cmpxchg
* qemu-options.hx: Don't claim "-serial" has limit of 4 serial ports
----------------------------------------------------------------
Arnaud Minier (8):
hw/misc/stm32l4x5_rcc: Implement STM32L4x5_RCC skeleton
hw/misc/stm32l4x5_rcc: Add an internal clock multiplexer object
hw/misc/stm32l4x5_rcc: Add an internal PLL Clock object
hw/misc/stm32l4x5_rcc: Initialize PLLs and clock multiplexers
hw/misc/stm32l4x5_rcc: Handle Register Updates
hw/misc/stm32l4x5_rcc: Add write protections to CR register
hw/arm/stm32l4x5_soc.c: Use the RCC Sysclk
tests/qtest/stm32l4x5_rcc-test.c: Add tests for the STM32L4x5_RCC
Peter Maydell (1):
atomic.h: Reword confusing comment for qatomic_cmpxchg
Rayhan Faizel (3):
hw/i2c: Implement Broadcom Serial Controller (BSC)
hw/arm: Connect BSC to BCM2835 board as I2C0, I2C1 and I2C2
tests/qtest: Add testcase for BCM2835 BSC
Richard Henderson (6):
target/arm: Support 32-byte alignment in pow2_align
exec/memattrs: Remove target_tlb_bit*
accel/tcg: Add tlb_fill_flags to CPUTLBEntryFull
accel/tcg: Add TLB_CHECK_ALIGNED
target/arm: Do memory type alignment check when translation disabled
target/arm: Do memory type alignment check when translation enabled
Steven Shen (1):
qemu-options.hx: Don't claim "-serial" has limit of 4 serial ports
Tong Ho (1):
hw/char/pl011: Add support for loopback
MAINTAINERS | 5 +-
docs/system/arm/b-l475e-iot01a.rst | 2 +-
docs/system/arm/raspi.rst | 1 +
include/exec/cpu-all.h | 4 +-
include/exec/memattrs.h | 12 -
include/hw/arm/bcm2835_peripherals.h | 4 +-
include/hw/arm/stm32l4x5_soc.h | 5 +-
include/hw/core/cpu.h | 3 +
include/hw/i2c/bcm2835_i2c.h | 80 ++
include/hw/misc/stm32l4x5_rcc.h | 239 +++++
include/hw/misc/stm32l4x5_rcc_internals.h | 1042 +++++++++++++++++++++
include/qemu/atomic.h | 2 +-
accel/tcg/cputlb.c | 35 +-
hw/arm/b-l475e-iot01a.c | 10 +-
hw/arm/bcm2835_peripherals.c | 45 +-
hw/arm/stm32l4x5_soc.c | 45 +-
hw/char/pl011.c | 110 ++-
hw/i2c/bcm2835_i2c.c | 282 ++++++
hw/misc/stm32l4x5_rcc.c | 1457 +++++++++++++++++++++++++++++
target/arm/ptw.c | 39 +
target/arm/tcg/hflags.c | 34 +-
target/arm/tcg/translate.c | 8 +-
target/sparc/mmu_helper.c | 2 +-
tests/qtest/bcm2835-i2c-test.c | 115 +++
tests/qtest/stm32l4x5_rcc-test.c | 189 ++++
hw/arm/Kconfig | 2 +
hw/i2c/Kconfig | 4 +
hw/i2c/meson.build | 1 +
hw/misc/Kconfig | 3 +
hw/misc/meson.build | 1 +
hw/misc/trace-events | 14 +
qemu-options.hx | 2 +-
tests/qtest/meson.build | 5 +-
33 files changed, 3718 insertions(+), 84 deletions(-)
create mode 100644 include/hw/i2c/bcm2835_i2c.h
create mode 100644 include/hw/misc/stm32l4x5_rcc.h
create mode 100644 include/hw/misc/stm32l4x5_rcc_internals.h
create mode 100644 hw/i2c/bcm2835_i2c.c
create mode 100644 hw/misc/stm32l4x5_rcc.c
create mode 100644 tests/qtest/bcm2835-i2c-test.c
create mode 100644 tests/qtest/stm32l4x5_rcc-test.c
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PULL 00/20] target-arm queue
2024-03-05 13:52 Peter Maydell
@ 2024-03-05 15:26 ` Peter Maydell
0 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2024-03-05 15:26 UTC (permalink / raw)
To: qemu-devel
On Tue, 5 Mar 2024 at 13:52, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> The following changes since commit 4eac9dfbd72d346505642fb45ac3141c7eb2c516:
>
> Merge tag 'pull-tcg-20240301' of https://gitlab.com/rth7680/qemu into staging (2024-03-05 09:45:22 +0000)
>
> are available in the Git repository at:
>
> https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240305
>
> for you to fetch changes up to 7558300c53057126514ee0fd5cf629c65ccc20e1:
>
> qemu-options.hx: Don't claim "-serial" has limit of 4 serial ports (2024-03-05 13:22:56 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
> * raspi: Implement Broadcom Serial Controller (BSC) for BCM2835 boards
> * hw/char/pl011: Add support for loopback
> * STM32L4x5: Implement RCC clock control device
> * target/arm: Do memory type alignment checks
> * atomic.h: Reword confusing comment for qatomic_cmpxchg
> * qemu-options.hx: Don't claim "-serial" has limit of 4 serial ports
>
> ----------------------------------------------------------------
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/9.0
for any user-visible changes.
-- PMM
^ permalink raw reply [flat|nested] 33+ messages in thread
* [PULL 00/20] target-arm queue
@ 2024-03-11 19:12 Peter Maydell
2024-03-12 13:07 ` Peter Maydell
0 siblings, 1 reply; 33+ messages in thread
From: Peter Maydell @ 2024-03-11 19:12 UTC (permalink / raw)
To: qemu-devel
The following changes since commit 7489f7f3f81dcb776df8c1b9a9db281fc21bf05f:
Merge tag 'hw-misc-20240309' of https://github.com/philmd/qemu into staging (2024-03-09 20:12:21 +0000)
are available in the Git repository at:
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240311
for you to fetch changes up to 5dd6bfd90d01e0cb27c349157208e5e4ce883846:
docs: update copyright date to the year 2024 (2024-03-11 17:21:21 +0000)
----------------------------------------------------------------
target-arm queue:
* contrib/elf2dmp: Improve robustness to corrupt input files
* docs: update copyright date to the year 2024
* hw/arm: Deprecate various old Arm machine types
----------------------------------------------------------------
Akihiko Odaki (18):
contrib/elf2dmp: Remove unnecessary err flags
contrib/elf2dmp: Assume error by default
contrib/elf2dmp: Continue even contexts are lacking
contrib/elf2dmp: Change pa_space_create() signature
contrib/elf2dmp: Fix error reporting style in addrspace.c
contrib/elf2dmp: Fix error reporting style in download.c
contrib/elf2dmp: Fix error reporting style in pdb.c
contrib/elf2dmp: Fix error reporting style in qemu_elf.c
contrib/elf2dmp: Fix error reporting style in main.c
contrib/elf2dmp: Always check for PA resolution failure
contrib/elf2dmp: Always destroy PA space
contrib/elf2dmp: Ensure segment fits in file
contrib/elf2dmp: Use lduw_le_p() to read PDB
contrib/elf2dmp: Use rol64() to decode
MAINTAINERS: Add Akihiko Odaki as a elf2dmp reviewer
contrib/elf2dmp: Use GPtrArray
contrib/elf2dmp: Clamp QEMU note to file size
contrib/elf2dmp: Ensure phdrs fit in file
Ani Sinha (1):
docs: update copyright date to the year 2024
Peter Maydell (1):
hw/arm: Deprecate various old Arm machine types
MAINTAINERS | 1 +
docs/about/deprecated.rst | 15 ++++
docs/conf.py | 2 +-
contrib/elf2dmp/addrspace.h | 6 +-
contrib/elf2dmp/download.h | 2 +-
contrib/elf2dmp/pdb.h | 2 +-
contrib/elf2dmp/qemu_elf.h | 2 +-
include/qemu/help-texts.h | 2 +-
contrib/elf2dmp/addrspace.c | 63 ++++++++++-------
contrib/elf2dmp/download.c | 12 ++--
contrib/elf2dmp/main.c | 168 ++++++++++++++++++++------------------------
contrib/elf2dmp/pdb.c | 61 +++++++---------
contrib/elf2dmp/qemu_elf.c | 150 ++++++++++++++++++++++-----------------
hw/arm/gumstix.c | 2 +
hw/arm/mainstone.c | 1 +
hw/arm/nseries.c | 2 +
hw/arm/palm.c | 1 +
hw/arm/spitz.c | 1 +
hw/arm/tosa.c | 1 +
hw/arm/z2.c | 1 +
20 files changed, 263 insertions(+), 232 deletions(-)
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PULL 00/20] target-arm queue
2024-03-11 19:12 Peter Maydell
@ 2024-03-12 13:07 ` Peter Maydell
0 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2024-03-12 13:07 UTC (permalink / raw)
To: qemu-devel
On Mon, 11 Mar 2024 at 19:12, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> The following changes since commit 7489f7f3f81dcb776df8c1b9a9db281fc21bf05f:
>
> Merge tag 'hw-misc-20240309' of https://github.com/philmd/qemu into staging (2024-03-09 20:12:21 +0000)
>
> are available in the Git repository at:
>
> https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240311
>
> for you to fetch changes up to 5dd6bfd90d01e0cb27c349157208e5e4ce883846:
>
> docs: update copyright date to the year 2024 (2024-03-11 17:21:21 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
> * contrib/elf2dmp: Improve robustness to corrupt input files
> * docs: update copyright date to the year 2024
> * hw/arm: Deprecate various old Arm machine types
>
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/9.0
for any user-visible changes.
-- PMM
^ permalink raw reply [flat|nested] 33+ messages in thread
* [PULL 00/20] target-arm queue
@ 2025-07-21 13:26 Peter Maydell
2025-07-21 18:31 ` Stefan Hajnoczi
0 siblings, 1 reply; 33+ messages in thread
From: Peter Maydell @ 2025-07-21 13:26 UTC (permalink / raw)
To: qemu-devel
Hi; here is a target-arm pullreq for rc0. It has various bugfixes; the
biggest bit here is adding a handful of bfloat16 instructions we
accidentally forgot to implement in the recent SVE2p1 feature.
I consider those to count under the "bugfix" heading because without
them we would UNDEF when we should not; plus this is still very early
in the release cycle.
thanks
-- PMM
The following changes since commit e82989544e38062beeeaad88c175afbeed0400f8:
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2025-07-18 14:10:02 -0400)
are available in the Git repository at:
https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20250721
for you to fetch changes up to 7724ca9a772594b96939ff549c74f46e11d7870b:
accel/hvf: Display executable bit as 'X' (2025-07-21 13:38:33 +0100)
----------------------------------------------------------------
target-arm queue:
* hvf: arm: Remove $pc from trace_hvf_data_abort()
* target/arm: Correct encoding of Debug Communications Channel registers
* hw/misc/ivshmem-pci: Improve error handling
* target/arm: Provide always-false kvm_arm_*_supported() stubs for usermode
* host-utils: Drop workaround for buggy Apple Clang __builtin_subcll()
* hw/misc/max78000_aes: Comment Internal Key Storage
* docs: Fix Aspeed title
* Implement a handful of missing FEAT_SVE_B16_B16 insns
* Fix bugs in FMAXQV, FMINQV, etc
* Fix assert in LD1Q decode
* hvf: arm: Add permission check in GIC sysreg handlers
* hvf: arm: Emulate ICC_RPR_EL1 accesses properly
* accel/hvf: Display executable bit as 'X'
----------------------------------------------------------------
Cédric Le Goater (1):
docs: Fix Aspeed title
Jackson Donaldson (1):
hw/misc/max78000_aes: Comment Internal Key Storage
Peter Maydell (14):
target/arm: Correct encoding of Debug Communications Channel registers
hw/misc/ivshmem-pci: Improve error handling
target/arm: Provide always-false kvm_arm_*_supported() stubs for usermode
host-utils: Drop workaround for buggy Apple Clang __builtin_subcll()
target/arm: Add BFADD, BFSUB, BFMUL (unpredicated)
target/arm: Add BFADD, BFSUB, BFMUL, BFMAXNM, BFMINNM (predicated)
target/arm: Add BFMIN, BFMAX (predicated)
target/arm: Add BFMUL (indexed)
target/arm: Add BFMLA, BFMLS (vectors)
target/arm: Add BFMLA, BFMLS (indexed)
target/arm: Correct sense of FPCR.AH test for FMAXQV and FMINQV
target/arm: Don't nest H() macro calls in SVE DO_REDUCE
target/arm: Honour FPCR.AH=1 default NaN value in FMAXNMQV, FMINNMQV
target/arm: Make LD1Q decode and trans fn agree about a->u
Philippe Mathieu-Daudé (1):
accel/hvf: Display executable bit as 'X'
Zenghui Yu (3):
hvf: arm: Remove $pc from trace_hvf_data_abort()
hvf: arm: Add permission check in GIC sysreg handlers
hvf: arm: Emulate ICC_RPR_EL1 accesses properly
docs/system/arm/aspeed.rst | 1 +
include/qemu/compiler.h | 13 -----
include/qemu/host-utils.h | 2 +-
target/arm/kvm_arm.h | 35 +++++++++++++
target/arm/tcg/helper-sve.h | 32 ++++++++++++
target/arm/tcg/helper.h | 5 ++
target/arm/tcg/sve.decode | 5 +-
accel/hvf/hvf-all.c | 2 +-
hw/misc/ivshmem-pci.c | 9 +++-
hw/misc/max78000_aes.c | 6 +++
target/arm/debug_helper.c | 13 ++++-
target/arm/hvf/hvf.c | 10 +++-
target/arm/tcg/sve_helper.c | 109 ++++++++++++++++++++++++++++++++++++-----
target/arm/tcg/translate-sve.c | 97 ++++++++++++++++++++++++++----------
target/arm/tcg/vec_helper.c | 4 ++
target/arm/hvf/trace-events | 2 +-
16 files changed, 285 insertions(+), 60 deletions(-)
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PULL 00/20] target-arm queue
2025-07-21 13:26 Peter Maydell
@ 2025-07-21 18:31 ` Stefan Hajnoczi
0 siblings, 0 replies; 33+ messages in thread
From: Stefan Hajnoczi @ 2025-07-21 18:31 UTC (permalink / raw)
To: Peter Maydell; +Cc: qemu-devel
[-- Attachment #1: Type: text/plain, Size: 116 bytes --]
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/10.1 for any user-visible changes.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 33+ messages in thread
* [PULL 00/20] target-arm queue
@ 2026-02-26 15:55 Peter Maydell
2026-02-26 17:52 ` Peter Maydell
0 siblings, 1 reply; 33+ messages in thread
From: Peter Maydell @ 2026-02-26 15:55 UTC (permalink / raw)
To: qemu-devel
The following changes since commit 7390b0825b8e041a961f6215a18fa68213dc4779:
Merge tag 'single-binary-20260226' of https://github.com/philmd/qemu into staging (2026-02-26 09:33:12 +0000)
are available in the Git repository at:
https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20260226
for you to fetch changes up to 907b8d56351b1ba6c97953edaca6a08f02fa2048:
hw/char/pl011: Only log "data written to disabled UART" once (2026-02-26 11:27:19 +0000)
----------------------------------------------------------------
target-arm queue:
* target/arm: set the correct TI bits for WFIT traps
* target/arm: Refactorings preparatory to KVM SME support
* target/arm/kvm: Don't free migration-blocker reason on failure
* target/arm/kvm: add kvm-psci-version vcpu property
* Revert "target/arm/hvf: Sync CNTV_CTL_EL0 & CNTV_CVAL_EL0"
* hw/arm/virt: Add virtio-mmio-transports property
* hw/arm/virt: Update error message for bad gic-version option
* hw/cpu: Build a15mpcore.c once as common object
* hw/misc/allwinner-cpucfg: Remove use of ARM_CPU() cast macro
* hw/ssi/xilinx_spips: Reset TX FIFO in reset
* hw/char/pl011: Only log "data written to disabled UART" once
* tests/functional: Make sure test case .py files are executable
----------------------------------------------------------------
Alex Bennée (1):
target/arm: set the correct TI bits for WFIT traps
Mohamed Mediouni (1):
Revert "target/arm/hvf: Sync CNTV_CTL_EL0 & CNTV_CVAL_EL0"
Mohammadfaiz Bawa (1):
hw/arm/virt: Add virtio-mmio-transports property
Peter Maydell (4):
hw/arm/virt: Update error message for bad gic-version option
tests/functional: Make sure test case .py files are executable
target/arm/kvm: Don't free migration-blocker reason on failure
hw/char/pl011: Only log "data written to disabled UART" once
Philippe Mathieu-Daudé (2):
hw/cpu: Build a15mpcore.c once as common object
hw/misc/allwinner-cpucfg: Remove use of ARM_CPU() cast macro
Richard Henderson (9):
target/arm: Remove aarch64 test for kvm
target/arm: Move kvm_arm_sve_get_vls within kvm.c
target/arm: Init sve_vq in kvm_arm_set_cpu_features_from_host
target/arm: Move kvm test out of cpu_arm_set_sve
target/arm: Drop kvm_arm_sve_supported
target/arm: Remove kvm test in arm_set_pmu
target/arm: Drop kvm_arm_pmu_supported
target/arm: Add vq argument to kvm_arch_{get, put}_sve
target/arm: Add have_ffr argument to kvm_arch_{get, put}_sve
Sebastian Ott (1):
target/arm/kvm: add kvm-psci-version vcpu property
Weixie Cui (1):
hw/ssi/xilinx_spips: Reset TX FIFO in reset
docs/system/arm/cpu-features.rst | 11 +++
docs/system/arm/virt.rst | 5 +
hw/arm/virt-acpi-build.c | 2 +-
hw/arm/virt.c | 45 ++++++++-
hw/char/pl011.c | 24 ++++-
hw/cpu/a15mpcore.c | 2 +-
hw/cpu/meson.build | 2 +-
hw/misc/allwinner-cpucfg.c | 4 +-
hw/ssi/xilinx_spips.c | 4 +-
include/hw/arm/virt.h | 1 +
include/hw/char/pl011.h | 1 +
target/arm/cpu.c | 12 ++-
target/arm/cpu64.c | 72 ++++++++------
target/arm/hvf/hvf.c | 25 -----
target/arm/kvm-stub.c | 15 ---
target/arm/kvm.c | 197 ++++++++++++++++++++-----------------
target/arm/kvm_arm.h | 35 -------
target/arm/tcg/cpu64.c | 2 +-
target/arm/tcg/op_helper.c | 2 +-
tests/functional/ppc/test_ppe42.py | 0
20 files changed, 246 insertions(+), 215 deletions(-)
mode change 100644 => 100755 tests/functional/ppc/test_ppe42.py
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PULL 00/20] target-arm queue
2026-02-26 15:55 Peter Maydell
@ 2026-02-26 17:52 ` Peter Maydell
0 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-02-26 17:52 UTC (permalink / raw)
To: qemu-devel
On Thu, 26 Feb 2026 at 15:55, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> The following changes since commit 7390b0825b8e041a961f6215a18fa68213dc4779:
>
> Merge tag 'single-binary-20260226' of https://github.com/philmd/qemu into staging (2026-02-26 09:33:12 +0000)
>
> are available in the Git repository at:
>
> https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20260226
>
> for you to fetch changes up to 907b8d56351b1ba6c97953edaca6a08f02fa2048:
>
> hw/char/pl011: Only log "data written to disabled UART" once (2026-02-26 11:27:19 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
> * target/arm: set the correct TI bits for WFIT traps
> * target/arm: Refactorings preparatory to KVM SME support
> * target/arm/kvm: Don't free migration-blocker reason on failure
> * target/arm/kvm: add kvm-psci-version vcpu property
> * Revert "target/arm/hvf: Sync CNTV_CTL_EL0 & CNTV_CVAL_EL0"
> * hw/arm/virt: Add virtio-mmio-transports property
> * hw/arm/virt: Update error message for bad gic-version option
> * hw/cpu: Build a15mpcore.c once as common object
> * hw/misc/allwinner-cpucfg: Remove use of ARM_CPU() cast macro
> * hw/ssi/xilinx_spips: Reset TX FIFO in reset
> * hw/char/pl011: Only log "data written to disabled UART" once
> * tests/functional: Make sure test case .py files are executable
>
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/11.0
for any user-visible changes.
-- PMM
^ permalink raw reply [flat|nested] 33+ messages in thread
* [PULL 00/20] target-arm queue
@ 2026-07-28 12:31 Peter Maydell
2026-07-28 12:31 ` [PULL 01/20] hw/intc/arm_gicv3: Fix ARM_GICV3 dependency for KVM / WHPX Peter Maydell
` (20 more replies)
0 siblings, 21 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
Hi; here's an arm pullreq: these are all bugfixes suitable
for the next 11.1 RC.
thanks
-- PMM
The following changes since commit 299e7557ed15a9a325620698add379a3ce2d1d95:
Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu into staging (2026-07-27 16:51:28 -0400)
are available in the Git repository at:
https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20260728
for you to fetch changes up to a5f8d33682be079e6b9b41f07b2eb517121b3b46:
hw/display/exynos4210_fimd: Clamp windows to screen size (2026-07-28 11:38:51 +0100)
----------------------------------------------------------------
target-arm queue:
* target/arm: Fix various compilation issues in --disable-tcg configs
* hw/net/flexcan: Fix issues spotted by Coverity
* docs/system/arm: Update Nuvoton OpenBMC image guidance
* hw/misc/mps2-scc.c: Ffix cfg7 write
* hw/misc/mps2-scc.c: fix scc_partno field width
* hw/i2c/bcm2835_i2c: Correct CLKT register offset
* hw/display/exynos4210_fimd: fix coordinates bounds handling to avoid
guest being able to access outside the framebuffer backing memory
----------------------------------------------------------------
Bernhard Beschow (9):
hw/net/can/flexcan: Use mbs[] array for FIFO pop
hw/net/flexcan: Drop unused RX FIFO register overlay
hw/net/can/flexcan: Fix out-of-bounds access in flexcan_mx_rx()
hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_write()
hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_read()
hw/net/can/flexcan: Fix mailbox reset mask initialization
hw/net/flexcan: Drop oversized 'mb[]' mailbox view
hw/net/can/flexcan: Fix RXIMR reset mask
hw/net/can/flexcan: Remove RX SMB raw view
Bin Meng (1):
docs/system/arm: Update Nuvoton OpenBMC image guidance
Peter Maydell (3):
hw/display/exynos4210_fimd: Factor out finding screen width/height
hw/display/exynos4210_fimd: Pass width to draw_line functions
hw/display/exynos4210_fimd: Clamp windows to screen size
Philippe Mathieu-Daudé (4):
hw/intc/arm_gicv3: Fix ARM_GICV3 dependency for KVM / WHPX
target/arm: Add stub for define_gicv5_cpuif_regs()
target/arm: Only compile gicv5-cpuif.c when GICv5 is selected
target/arm: Build TCG stubs as stub library
Simon Xu (2):
hw/misc/mps2-scc.c: fix cfg7 write
hw/misc/mps2-scc.c: fix scc_partno field width
botszhuang (1):
hw/i2c/bcm2835_i2c: Correct CLKT register offset
docs/system/arm/nuvoton.rst | 54 ++++++++++++++++++++++++++++++++++++++++----
hw/display/exynos4210_fimd.c | 54 ++++++++++++++++++++++++++++++++------------
hw/intc/meson.build | 4 ++--
hw/misc/mps2-scc.c | 4 ++--
hw/net/can/flexcan.c | 47 ++++++++++++++++++++++----------------
include/hw/i2c/bcm2835_i2c.h | 2 +-
include/hw/net/flexcan.h | 22 +++---------------
target/arm/gicv5-stubs.c | 17 ++++++++++++++
target/arm/meson.build | 6 ++---
target/arm/tcg-stubs.c | 4 ----
target/arm/tcg/meson.build | 3 +++
11 files changed, 147 insertions(+), 70 deletions(-)
create mode 100644 target/arm/gicv5-stubs.c
^ permalink raw reply [flat|nested] 33+ messages in thread
* [PULL 01/20] hw/intc/arm_gicv3: Fix ARM_GICV3 dependency for KVM / WHPX
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 02/20] target/arm: Add stub for define_gicv5_cpuif_regs() Peter Maydell
` (19 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
KVM and WHPX GICv3 implementations call gicv3_init_irqs_and_mmio()
which is defined in arm_gicv3_common.c, itself build when ARM_GIC
is selected. Both KVM and WHPX are conditional on ARM_GICV3,
itself selecting ARM_GIC. Only build the ARM_GICV3 accelerator
variants when ARM_GICV3 is selected.
$ git grep -w gicv3_init_irqs_and_mmio
hw/intc/arm_gicv3_common.c:314:void gicv3_init_irqs_and_mmio(GICv3State *s,
hw/intc/arm_gicv3.c:450: gicv3_init_irqs_and_mmio(s, gicv3_set_irq, gic_ops);
hw/intc/arm_gicv3_hvf.c:710: gicv3_init_irqs_and_mmio(s, hvf_gicv3_set_irq, NULL);
hw/intc/arm_gicv3_kvm.c:822: gicv3_init_irqs_and_mmio(s, kvm_arm_gicv3_set_irq, NULL);
hw/intc/arm_gicv3_whpx.c:186: gicv3_init_irqs_and_mmio(s, whpx_gicv3_set_irq, NULL);
Fixes: a7bf30342e6 ("hw/intc: Initial implementation of vGICv3")
Fixes: e4c95f78a47 ("hw, target, accel: whpx: change apic_in_platform to kernel_irqchip")
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260721122135.6288-2-philmd@oss.qualcomm.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/intc/meson.build | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index fac2d228f9b..377de78bb41 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -45,10 +45,10 @@ specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))
arm_common_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))
arm_common_ss.add(when: 'CONFIG_ARM_GICV3', if_true: files('arm_gicv3_cpuif.c'))
specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))
-specific_ss.add(when: ['CONFIG_WHPX', 'TARGET_AARCH64'], if_true: files('arm_gicv3_whpx.c'))
+specific_ss.add(when: ['CONFIG_WHPX', 'CONFIG_ARM_GICV3'], if_true: files('arm_gicv3_whpx.c'))
specific_ss.add(when: ['CONFIG_HVF', 'CONFIG_ARM_GICV3'], if_true: files('arm_gicv3_hvf.c'))
stub_ss.add(files('arm_gicv3_hvf_stub.c'))
-specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))
+specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'CONFIG_ARM_GICV3'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))
arm_common_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_nvic.c'))
specific_ss.add(when: 'CONFIG_GRLIB', if_true: files('grlib_irqmp.c'))
specific_ss.add(when: 'CONFIG_IOAPIC', if_true: files('ioapic.c'))
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 02/20] target/arm: Add stub for define_gicv5_cpuif_regs()
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
2026-07-28 12:31 ` [PULL 01/20] hw/intc/arm_gicv3: Fix ARM_GICV3 dependency for KVM / WHPX Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 03/20] target/arm: Only compile gicv5-cpuif.c when GICv5 is selected Peter Maydell
` (18 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
The common helper.c file calls define_gicv5_cpuif_regs() which
is only defined when TCG is built:
$ git grep -w define_gicv5_cpuif_regs
target/arm/internals.h:1885:void define_gicv5_cpuif_regs(ARMCPU *cpu);
target/arm/helper.c:6334: define_gicv5_cpuif_regs(cpu);
target/arm/tcg/gicv5-cpuif.c:923:void define_gicv5_cpuif_regs(ARMCPU *cpu)
This fixes when building on macOS with --disable-tcg:
Undefined symbols for architecture arm64:
"_define_gicv5_cpuif_regs", referenced from:
_register_cp_regs_for_features in target_arm_helper.c.o
Define the GICv5 stubs in their own compilation unit, otherwise
we get the following error:
duplicate symbol '_raise_exception_ra' in:
libsystem_arm.a.p/target_arm_tcg_op_helper.c.o
libstubs_arm.a[4](target_arm_tcg-stubs.c.o)
Fixes: ee0f1ce00db ("target/arm: GICv5 cpuif: Initial skeleton and GSB barrier insns")
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260721122135.6288-3-philmd@oss.qualcomm.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
target/arm/gicv5-stubs.c | 17 +++++++++++++++++
target/arm/meson.build | 1 +
target/arm/tcg-stubs.c | 4 ----
3 files changed, 18 insertions(+), 4 deletions(-)
create mode 100644 target/arm/gicv5-stubs.c
diff --git a/target/arm/gicv5-stubs.c b/target/arm/gicv5-stubs.c
new file mode 100644
index 00000000000..845626d7c6b
--- /dev/null
+++ b/target/arm/gicv5-stubs.c
@@ -0,0 +1,17 @@
+/*
+ * QEMU ARM stubs for GICv5 TCG helper functions
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "internals.h"
+
+void define_gicv5_cpuif_regs(ARMCPU *cpu)
+{
+ g_assert_not_reached();
+}
+
+void gicv5_update_ppi_state(CPUARMState *env, int ppi, bool level)
+{
+}
diff --git a/target/arm/meson.build b/target/arm/meson.build
index 4412fde065f..f6ae8934d1b 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -37,6 +37,7 @@ arm_system_ss.add(when: 'CONFIG_HVF', if_true: files('hyp_gdbstub.c'))
arm_user_ss.add(files('cpu.c'))
arm_stubs_ss.add(files(
'cpu32-stubs.c',
+ 'gicv5-stubs.c',
'kvm-stub.c'
))
arm_user_ss.add(files(
diff --git a/target/arm/tcg-stubs.c b/target/arm/tcg-stubs.c
index 8d97449cfc6..aeeede80661 100644
--- a/target/arm/tcg-stubs.c
+++ b/target/arm/tcg-stubs.c
@@ -43,7 +43,3 @@ void vfp_clear_float_status_exc_flags(CPUARMState *env)
void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
{
}
-
-void gicv5_update_ppi_state(CPUARMState *env, int ppi, bool level)
-{
-}
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 03/20] target/arm: Only compile gicv5-cpuif.c when GICv5 is selected
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
2026-07-28 12:31 ` [PULL 01/20] hw/intc/arm_gicv3: Fix ARM_GICV3 dependency for KVM / WHPX Peter Maydell
2026-07-28 12:31 ` [PULL 02/20] target/arm: Add stub for define_gicv5_cpuif_regs() Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 04/20] target/arm: Build TCG stubs as stub library Peter Maydell
` (17 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Only compile gicv5-cpuif.c when ARM_GICV5 is Kconfig-selected,
otherwise we get when building with --without-default-devices:
Undefined symbols for architecture arm64:
"_gicv5_activate", referenced from:
_gicr_cdia_read in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_deactivate", referenced from:
_gic_cddi_write in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_get_hppi", referenced from:
_gic_hppi in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_request_config", referenced from:
_gic_cdrcfg_write in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_set_enabled", referenced from:
_gic_cddis_write in target_arm_tcg_gicv5-cpuif.c.o
_gic_cden_write in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_set_handling", referenced from:
_gic_cdhm_write in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_set_pending", referenced from:
_gic_cdpend_write in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_set_priority", referenced from:
_gic_cdpri_write in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_set_target", referenced from:
_gic_cdaff_write in target_arm_tcg_gicv5-cpuif.c.o
Fixes: ee0f1ce00db ("target/arm: GICv5 cpuif: Initial skeleton and GSB barrier insns")
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260721122135.6288-4-philmd@oss.qualcomm.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
target/arm/tcg/meson.build | 3 +++
1 file changed, 3 insertions(+)
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index 227e674ae2f..cbfac0036e7 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -91,6 +91,9 @@ arm_common_system_ss.add(files(
'tlb_helper.c',
'tlb-insns.c',
))
+arm_common_system_ss.add(when: 'CONFIG_ARM_GICV5', if_true: files(
+ 'gicv5-cpuif.c',
+))
arm_user_ss.add(files(
'tlb_helper.c',
))
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 04/20] target/arm: Build TCG stubs as stub library
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (2 preceding siblings ...)
2026-07-28 12:31 ` [PULL 03/20] target/arm: Only compile gicv5-cpuif.c when GICv5 is selected Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 05/20] hw/net/can/flexcan: Use mbs[] array for FIFO pop Peter Maydell
` (16 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Use the stub library introduced in commit 0da978cdbc6 ("target/arm:
define stub library") to prevent symbol conflicts.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260721122135.6288-5-philmd@oss.qualcomm.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
target/arm/meson.build | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/target/arm/meson.build b/target/arm/meson.build
index f6ae8934d1b..0369f96b4cc 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -38,7 +38,8 @@ arm_user_ss.add(files('cpu.c'))
arm_stubs_ss.add(files(
'cpu32-stubs.c',
'gicv5-stubs.c',
- 'kvm-stub.c'
+ 'kvm-stub.c',
+ 'tcg-stubs.c',
))
arm_user_ss.add(files(
'el2-stubs.c',
@@ -65,8 +66,6 @@ subdir('whpx')
if 'CONFIG_TCG' in config_all_accel
subdir('tcg')
-else
- arm_common_system_ss.add(files('tcg-stubs.c'))
endif
arm_user_ss.add_all(arm_common_user_system_ss)
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 05/20] hw/net/can/flexcan: Use mbs[] array for FIFO pop
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (3 preceding siblings ...)
2026-07-28 12:31 ` [PULL 04/20] target/arm: Build TCG stubs as stub library Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 06/20] hw/net/flexcan: Drop unused RX FIFO register overlay Peter Maydell
` (15 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
Implement FIFO entry shifting using the underlying `mbs[]` array instead
of the overlapping `fifo` union view. This makes it explicit that the
operation copies within a contiguous mailbox array and avoids Coverity
CID 1662971.
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-2-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/net/can/flexcan.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index da36d10bd33..3a97edf7a4d 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -879,22 +879,22 @@ static bool flexcan_can_receive(CanBusClientState *client)
*/
static void flexcan_fifo_pop(FlexcanState *s)
{
- if (s->regs.fifo.mb_back.can_ctrl != 0) {
+ if (s->regs.mbs[0].can_ctrl != 0) {
/* move queue elements forward */
- memmove(&s->regs.fifo.mb_back, &s->regs.fifo.mbs_queue[0],
- sizeof(s->regs.fifo.mbs_queue));
+ memmove(&s->regs.mbs[0], &s->regs.mbs[1],
+ sizeof(s->regs.mbs[0]) * (FLEXCAN_FIFO_DEPTH - 1));
/* clear the first-in slot */
memset(&s->regs.mbs[FLEXCAN_FIFO_DEPTH - 1], 0,
sizeof(FlexcanRegsMessageBuffer));
trace_flexcan_fifo_pop(DEVICE(s)->canonical_path, 1,
- s->regs.fifo.mb_back.can_ctrl != 0);
+ s->regs.mbs[0].can_ctrl != 0);
} else {
trace_flexcan_fifo_pop(DEVICE(s)->canonical_path, 0, 0);
}
- if (s->regs.fifo.mb_back.can_ctrl != 0) {
+ if (s->regs.mbs[0].can_ctrl != 0) {
flexcan_irq_iflag_set(s, I_FIFO_AVAILABLE);
} else {
flexcan_irq_iflag_clear(s, I_FIFO_AVAILABLE);
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 06/20] hw/net/flexcan: Drop unused RX FIFO register overlay
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (4 preceding siblings ...)
2026-07-28 12:31 ` [PULL 05/20] hw/net/can/flexcan: Use mbs[] array for FIFO pop Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 07/20] hw/net/can/flexcan: Fix out-of-bounds access in flexcan_mx_rx() Peter Maydell
` (14 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
Remove the unused `FlexcanRegsRXFifo` union view now that FIFO accesses
use the underlying `mbs[]` array directly.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-3-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
include/hw/net/flexcan.h | 11 -----------
1 file changed, 11 deletions(-)
diff --git a/include/hw/net/flexcan.h b/include/hw/net/flexcan.h
index 32de7b904af..d8159475e04 100644
--- a/include/hw/net/flexcan.h
+++ b/include/hw/net/flexcan.h
@@ -35,16 +35,6 @@ typedef struct FlexcanRegsMessageBuffer {
uint32_t data[2];
} FlexcanRegsMessageBuffer;
-/* RX FIFO view of message buffer registers */
-typedef struct FlexcanRegsRXFifo {
- /* 6 message buffer deep queue, queue back first */
- FlexcanRegsMessageBuffer mb_back;
- FlexcanRegsMessageBuffer mbs_queue[FLEXCAN_FIFO_DEPTH - 1];
-
- /* number of filter elements active depends on ctrl2 | FLEXCAN_CTRL2_RFFN */
- uint32_t filter_table_els[128];
-} FlexcanRegsRXFifo;
-
/* FlexCAN register in hw layout */
typedef struct FlexcanRegs {
uint32_t mcr; /* 0x00 */
@@ -78,7 +68,6 @@ typedef struct FlexcanRegs {
union { /* 0x80 - not affected by soft reset */
uint32_t mb[sizeof(FlexcanRegsMessageBuffer) * FLEXCAN_MAILBOX_COUNT];
FlexcanRegsMessageBuffer mbs[FLEXCAN_MAILBOX_COUNT];
- FlexcanRegsRXFifo fifo;
};
uint32_t _reserved4[256]; /* 0x480 */
uint32_t rximr[64]; /* 0x880 - not affected by soft reset */
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 07/20] hw/net/can/flexcan: Fix out-of-bounds access in flexcan_mx_rx()
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (5 preceding siblings ...)
2026-07-28 12:31 ` [PULL 06/20] hw/net/flexcan: Drop unused RX FIFO register overlay Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 08/20] hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_write() Peter Maydell
` (13 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
Require `last_not_free_to_receive_mbid >= 0` before indexing `mbs[]`.
This prevents a possible `-1` array index and fixes Coverity CID
1662790.
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260723070059.6332-4-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/net/can/flexcan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index 3a97edf7a4d..dd92a383373 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -1075,7 +1075,7 @@ static enum FlexcanRx flexcan_mb_rx(FlexcanState *s, const qemu_can_frame *buf)
}
}
- if (last_not_free_to_receive_mbid >= -1) {
+ if (last_not_free_to_receive_mbid >= 0) {
if (last_not_free_to_receive_locked) {
/*
* copy to temporary mailbox (SMB)
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 08/20] hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_write()
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (6 preceding siblings ...)
2026-07-28 12:31 ` [PULL 07/20] hw/net/can/flexcan: Fix out-of-bounds access in flexcan_mx_rx() Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 09/20] hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_read() Peter Maydell
` (12 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
Calculate mailbox indices from the `mbs[]` array layout instead of the
oversized raw `mb[]` view. This prevents accessing mailbox entries beyond
the valid array range and fixes Coverity CID 1662974.
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260723070059.6332-5-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/net/can/flexcan.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index dd92a383373..651904fa379 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -1151,6 +1151,8 @@ static void flexcan_mem_write(void *opaque, hwaddr addr, uint64_t val,
unsigned size)
{
FlexcanState *s = opaque;
+ const int mbid = (addr - offsetof(FlexcanRegs, mbs)) /
+ sizeof(s->regs.mbs[0]);
uint32_t write_mask = ((const uint32_t *)
&flexcan_regs_write_mask)[addr / 4];
uint32_t old_value = s->regs_raw[addr / 4];
@@ -1208,11 +1210,8 @@ static void flexcan_mem_write(void *opaque, hwaddr addr, uint64_t val,
default:
s->regs_raw[addr / 4] = (val & write_mask) | (old_value & ~write_mask);
- if (addr >= offsetof(FlexcanRegs, mb) &&
- addr < offsetof(FlexcanRegs, _reserved4)) {
+ if (0 <= mbid && mbid < ARRAY_SIZE(s->regs.mbs)) {
/* access to mailbox */
- int mbid = (addr - offsetof(FlexcanRegs, mb)) /
- sizeof(FlexcanRegsMessageBuffer);
if (s->locked_mbidx == mbid) {
flexcan_mb_unlock(s);
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 09/20] hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_read()
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (7 preceding siblings ...)
2026-07-28 12:31 ` [PULL 08/20] hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_write() Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 10/20] hw/net/can/flexcan: Fix mailbox reset mask initialization Peter Maydell
` (11 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
Calculate mailbox indices from the `mbs[]` array layout instead of the
oversized raw `mb[]` view. This prevents accessing mailbox entries beyond
the valid array range and fixes Coverity CID 1662974.
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260723070059.6332-6-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/net/can/flexcan.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index 651904fa379..8d680f1832e 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -1239,14 +1239,12 @@ static void flexcan_mem_write(void *opaque, hwaddr addr, uint64_t val,
static uint64_t flexcan_mem_read(void *opqaue, hwaddr addr, unsigned size)
{
FlexcanState *s = opqaue;
+ const int mbid = (addr - offsetof(FlexcanRegs, mbs)) /
+ sizeof(s->regs.mbs[0]);
uint32_t rv = s->regs_raw[addr >> 2];
- if (addr >= offsetof(FlexcanRegs, mb) &&
- addr < offsetof(FlexcanRegs, _reserved4)) {
+ if (0 <= mbid && mbid < ARRAY_SIZE(s->regs.mbs)) {
/* reading from mailbox */
- hwaddr offset = addr - offsetof(FlexcanRegs, mb);
- int mbid = offset / sizeof(FlexcanRegsMessageBuffer);
-
if (addr % 16 == 0 && s->locked_mbidx != mbid) {
/* reading control word locks the mailbox */
flexcan_mb_unlock(s);
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 10/20] hw/net/can/flexcan: Fix mailbox reset mask initialization
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (8 preceding siblings ...)
2026-07-28 12:31 ` [PULL 09/20] hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_read() Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 11/20] hw/net/flexcan: Drop oversized 'mb[]' mailbox view Peter Maydell
` (10 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
The mailbox reset mask initialized only the first word of the raw `mb[]`
array. Fix the initialization to cover the whole mailbox, as indicated
in the field description in the header. While at it, use the `mbs[]`
view instead in order to drop the redundant and oversized `mb[]` view in
the next commit.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-7-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/net/can/flexcan.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index 8d680f1832e..f84f090a7fd 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -134,7 +134,11 @@ static const FlexcanRegs flexcan_regs_reset_mask = {
._reserved2 = 0,
.dbg1 = 0,
.dbg2 = 0,
- .mb = {0xFFFFFFFF},
+ .mbs = { [0 ... FLEXCAN_MAILBOX_COUNT - 1] = {
+ .can_ctrl = 0xFFFFFFFF,
+ .can_id = 0xFFFFFFFF,
+ .data = { 0xFFFFFFFF, 0xFFFFFFFF },
+ } },
._reserved4 = {0},
.rximr = {0xFFFFFFFF},
._reserved5 = {0},
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 11/20] hw/net/flexcan: Drop oversized 'mb[]' mailbox view
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (9 preceding siblings ...)
2026-07-28 12:31 ` [PULL 10/20] hw/net/can/flexcan: Fix mailbox reset mask initialization Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 12/20] hw/net/can/flexcan: Fix RXIMR reset mask Peter Maydell
` (9 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
As indicated in the comments, the `mb[]` a.k.a. `mbs []` views should
cover 0x400 (1024) bytes. However, the `mb[]` array covers four times
the size since `sizeof(FlexcanRegsMessageBuffer)` returns the size in
bytes instead of counting the number of uint32_t fields. This shifts the
subsequent register offsets by 0xc00 which is not intended. Fix the size
and thus the offsets by dropping the now unused `mb[]` view.
Note that the different size changes the migration layout. Since the device
model is new, no change in the version fields is needed.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-8-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
include/hw/net/flexcan.h | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/include/hw/net/flexcan.h b/include/hw/net/flexcan.h
index d8159475e04..9affdff8372 100644
--- a/include/hw/net/flexcan.h
+++ b/include/hw/net/flexcan.h
@@ -65,10 +65,8 @@ typedef struct FlexcanRegs {
uint32_t dbg1; /* 0x58, unused */
uint32_t dbg2; /* 0x5C, unused */
uint32_t _reserved3[8]; /* 0x60 */
- union { /* 0x80 - not affected by soft reset */
- uint32_t mb[sizeof(FlexcanRegsMessageBuffer) * FLEXCAN_MAILBOX_COUNT];
- FlexcanRegsMessageBuffer mbs[FLEXCAN_MAILBOX_COUNT];
- };
+ /* 0x80 - not affected by soft reset */
+ FlexcanRegsMessageBuffer mbs[FLEXCAN_MAILBOX_COUNT];
uint32_t _reserved4[256]; /* 0x480 */
uint32_t rximr[64]; /* 0x880 - not affected by soft reset */
uint32_t _reserved5[24]; /* 0x980 */
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 12/20] hw/net/can/flexcan: Fix RXIMR reset mask
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (10 preceding siblings ...)
2026-07-28 12:31 ` [PULL 11/20] hw/net/flexcan: Drop oversized 'mb[]' mailbox view Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 13/20] hw/net/can/flexcan: Remove RX SMB raw view Peter Maydell
` (8 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
The RXIMR registers are not affected by soft reset, so their reset mask
must preserve all entries. Set the mask for the entire array instead of
only the first register.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-9-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/net/can/flexcan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index f84f090a7fd..205d0d64134 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -140,7 +140,7 @@ static const FlexcanRegs flexcan_regs_reset_mask = {
.data = { 0xFFFFFFFF, 0xFFFFFFFF },
} },
._reserved4 = {0},
- .rximr = {0xFFFFFFFF},
+ .rximr = { [0 ... 63] = 0xFFFFFFFF },
._reserved5 = {0},
.gfwr_mx6 = 0,
._reserved6 = {0},
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 13/20] hw/net/can/flexcan: Remove RX SMB raw view
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (11 preceding siblings ...)
2026-07-28 12:31 ` [PULL 12/20] hw/net/can/flexcan: Fix RXIMR reset mask Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 14/20] docs/system/arm: Update Nuvoton OpenBMC image guidance Peter Maydell
` (7 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
Use the existing `rx_smb0` message buffer view for register masks instead
of the raw register array. Since all accesses now use the structured view,
remove the redundant `rx_smb0_raw` union member.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-10-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/net/can/flexcan.c | 12 ++++++++++--
include/hw/net/flexcan.h | 5 +----
2 files changed, 11 insertions(+), 6 deletions(-)
diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index 205d0d64134..a8bad83cb87 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -106,7 +106,11 @@ static const FlexcanRegs flexcan_regs_write_mask = {
.gfwr_mx6 = 0xFFFFFFFF,
._reserved6 = {0},
._reserved8 = {0},
- .rx_smb0_raw = {0, 0, 0, 0},
+ .rx_smb0 = {
+ .can_ctrl = 0,
+ .can_id = 0,
+ .data = { 0, 0 },
+ },
.rx_smb1 = {0, 0, 0, 0},
};
static const FlexcanRegs flexcan_regs_reset_mask = {
@@ -145,7 +149,11 @@ static const FlexcanRegs flexcan_regs_reset_mask = {
.gfwr_mx6 = 0,
._reserved6 = {0},
._reserved8 = {0},
- .rx_smb0_raw = {0, 0, 0, 0},
+ .rx_smb0 = {
+ .can_ctrl = 0,
+ .can_id = 0,
+ .data = { 0, 0 },
+ },
.rx_smb1 = {0, 0, 0, 0},
};
diff --git a/include/hw/net/flexcan.h b/include/hw/net/flexcan.h
index 9affdff8372..eee70bad422 100644
--- a/include/hw/net/flexcan.h
+++ b/include/hw/net/flexcan.h
@@ -81,10 +81,7 @@ typedef struct FlexcanRegs {
uint32_t _rx14mask; /* 0xAA8 */
uint32_t _rx15mask; /* 0xAAC */
uint32_t tx_smb[4]; /* 0xAB0 */
- union { /* 0xAC0, used for SMB emulation */
- uint32_t rx_smb0_raw[4];
- FlexcanRegsMessageBuffer rx_smb0;
- };
+ FlexcanRegsMessageBuffer rx_smb0; /* 0xAC0, used for SMB emulation */
uint32_t rx_smb1[4]; /* 0xAD0 */
uint32_t mecr; /* 0xAE0 */
uint32_t erriar; /* 0xAE4 */
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 14/20] docs/system/arm: Update Nuvoton OpenBMC image guidance
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (12 preceding siblings ...)
2026-07-28 12:31 ` [PULL 13/20] hw/net/can/flexcan: Remove RX SMB raw view Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 15/20] hw/misc/mps2-scc.c: fix cfg7 write Peter Maydell
` (6 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bin Meng <bin.meng@processmission.com>
Describe the current OpenBMC target naming and release status for
Nuvoton machines. The latest 2.18.0 release no longer includes GSJ,
so point users at older 2.14.0 sources and explain how to find
Jenkins MTD artifacts.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Message-id: 20260627063208.33642-1-bin.meng@processmission.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
docs/system/arm/nuvoton.rst | 54 +++++++++++++++++++++++++++++++++----
1 file changed, 49 insertions(+), 5 deletions(-)
diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
index e4827fb43a1..51d36b2bc0b 100644
--- a/docs/system/arm/nuvoton.rst
+++ b/docs/system/arm/nuvoton.rst
@@ -94,16 +94,60 @@ Boot options
------------
The Nuvoton machines can boot from an OpenBMC firmware image, or directly into
-a kernel using the ``-kernel`` option. OpenBMC images for ``quanta-gsj`` and
-possibly others can be downloaded from the OpenBMC jenkins :
+a kernel using the ``-kernel`` option. OpenBMC machine names do not always
+match QEMU machine names. Check the OpenBMC supported-machine list and Jenkins
+for currently available source and pre-built images.
+
+Known OpenBMC (v2.18.0) target names for QEMU Nuvoton machines per:
+
+ https://github.com/openbmc/openbmc/blob/2.18.0/meta-phosphor/docs/supported-machines.md
+
+.. list-table::
+ :header-rows: 1
+
+ * - QEMU machine
+ - OpenBMC machine
+ * - ``npcm750-evb``
+ - ``evb-npcm750``
+ * - ``npcm845-evb``
+ - ``evb-npcm845``
+ * - ``quanta-gbs-bmc``
+ - ``gbs``
+ * - ``kudo-bmc``
+ - ``kudo``
+ * - ``mori-bmc``
+ - ``mori``
+
+As of June 2026, the latest OpenBMC release, ``2.18.0``, no longer lists a
+``gsj`` machine. To build an image for QEMU's ``quanta-gsj`` machine, use an
+older OpenBMC release that still contains ``meta-quanta/meta-gsj``. The
+``2.14.0`` release contains the ``gsj`` machine:
+
+ https://github.com/openbmc/openbmc/tree/2.14.0/meta-quanta/meta-gsj
+
+Some pre-built OpenBMC images for QEMU Nuvoton machines may be available on
+Jenkins:
https://jenkins.openbmc.org/
-The firmware image should be attached as an MTD drive. Example :
+To find a pre-built MTD image on Jenkins, start from the Jenkins home page and
+open the ``latest-master`` job. Select the matrix configuration whose
+``target`` matches the OpenBMC machine name, for example
+``label=docker-builder,target=gbs``, then open its latest successful build's
+artifacts. The MTD image is usually published under
+``openbmc/build/tmp/deploy/images/<machine>/`` as
+``obmc-phosphor-image-<machine>-<timestamp>.static.mtd``. If Jenkins does not
+list a matching target, or the build artifacts do not include an MTD image,
+there is no current pre-built MTD image for that machine.
+
+The firmware image should be attached as an MTD drive. Example:
.. code-block:: bash
- $ qemu-system-arm -machine quanta-gsj -nographic \
- -drive file=image-bmc,if=mtd,bus=0,unit=0,format=raw
+ $ qemu-system-arm -machine quanta-gbs-bmc -nographic \
+ -drive file=obmc-phosphor-image-gbs-xxxxxx.static.mtd,if=mtd,bus=0,unit=0,format=raw
The default root password for test images is usually ``0penBmc``.
+
+For other machines that don't have pre-built images on Jenkins, build an image
+from source by following the OpenBMC build documentation.
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 15/20] hw/misc/mps2-scc.c: fix cfg7 write
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (13 preceding siblings ...)
2026-07-28 12:31 ` [PULL 14/20] docs/system/arm: Update Nuvoton OpenBMC image guidance Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 16/20] hw/misc/mps2-scc.c: fix scc_partno field width Peter Maydell
` (5 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Simon Xu <simonxhy0404@gmail.com>
Change the CFG7 write function to modify the correct variable. This only
affects the an536 machine currently as only it uses cfg7 to store the
core 1 vector table base address.
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260724160943.52509-2-simonxhy0404@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/misc/mps2-scc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c
index 7877b31479c..1ecb2879e32 100644
--- a/hw/misc/mps2-scc.c
+++ b/hw/misc/mps2-scc.c
@@ -299,7 +299,7 @@ static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value,
goto bad_offset;
}
/* AN536: Core 1 vector table base address */
- s->cfg6 = value;
+ s->cfg7 = value;
break;
case A_CFGDATA_OUT:
s->cfgdata_out = value;
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 16/20] hw/misc/mps2-scc.c: fix scc_partno field width
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (14 preceding siblings ...)
2026-07-28 12:31 ` [PULL 15/20] hw/misc/mps2-scc.c: fix cfg7 write Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 17/20] hw/i2c/bcm2835_i2c: Correct CLKT register offset Peter Maydell
` (4 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Simon Xu <simonxhy0404@gmail.com>
Increase the extract32 length from 8 to 12. The Primary part number is
defined as bits[15:4] by the "SSE-310 with M85 and U55 FPGA"
documentation. For example for the mps3-an547, 0x547 is 12 bits but we
only return 8 bits right now.
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260724160943.52509-3-simonxhy0404@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/misc/mps2-scc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c
index 1ecb2879e32..554b504c720 100644
--- a/hw/misc/mps2-scc.c
+++ b/hw/misc/mps2-scc.c
@@ -57,7 +57,7 @@ REG32(ID, 0xFFC)
static int scc_partno(MPS2SCC *s)
{
/* Return the partno field of the SCC_ID (0x524, 0x511, etc) */
- return extract32(s->id, 4, 8);
+ return extract32(s->id, 4, 12);
}
/* Is CFG_REG2 present? */
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 17/20] hw/i2c/bcm2835_i2c: Correct CLKT register offset
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (15 preceding siblings ...)
2026-07-28 12:31 ` [PULL 16/20] hw/misc/mps2-scc.c: fix scc_partno field width Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 18/20] hw/display/exynos4210_fimd: Factor out finding screen width/height Peter Maydell
` (3 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: botszhuang <huang.botsz@gmail.com>
The Clock Stretch Timeout (CLKT) register for the BCM2835 I2C
controller is actually located at offset 0x1c, not 0x20.
Update the BCM2835_I2C_CLKT macro to match the hardware
specification.
Since QEMU's implementation ignores whatever value the guest
writes to this register, and Linux only writes to CLKT and
doesn't read it back, the main effect of this fix is to
avoid an incorrect GUEST_ERROR log.
Cc: qemu-stable@nongnu.org
Fixes: 9cf3bc65afdb63 ("hw/i2c: Implement Broadcom Serial Controller (BSC)")
Signed-off-by: botszhuang <botszhuang@gmail.com>
Tested-by: Nick Huang <sef1548@gmail.com>
Message-id: 20260724124220.24152-1-22925483+botszhuang@users.noreply.github.com
[PMM: removed commit message paragraph about effects which I think
is incorrect, substituted a different one]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
include/hw/i2c/bcm2835_i2c.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/hw/i2c/bcm2835_i2c.h b/include/hw/i2c/bcm2835_i2c.h
index 45f876df224..519c65f7652 100644
--- a/include/hw/i2c/bcm2835_i2c.h
+++ b/include/hw/i2c/bcm2835_i2c.h
@@ -38,7 +38,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(BCM2835I2CState, BCM2835_I2C)
#define BCM2835_I2C_FIFO 0x10 /* FIFO */
#define BCM2835_I2C_DIV 0x14 /* Clock Divider */
#define BCM2835_I2C_DEL 0x18 /* Data Delay */
-#define BCM2835_I2C_CLKT 0x20 /* Clock Stretch Timeout */
+#define BCM2835_I2C_CLKT 0x1c /* Clock Stretch Timeout */
#define BCM2835_I2C_C_I2CEN BIT(15) /* I2C enable */
#define BCM2835_I2C_C_INTR BIT(10) /* Interrupt on RXR */
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 18/20] hw/display/exynos4210_fimd: Factor out finding screen width/height
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (16 preceding siblings ...)
2026-07-28 12:31 ` [PULL 17/20] hw/i2c/bcm2835_i2c: Correct CLKT register offset Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 19/20] hw/display/exynos4210_fimd: Pass width to draw_line functions Peter Maydell
` (2 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
Currently we hard-code the expressions for getting the global screen
width and height out of the VIDTCON2 register where we need them.
Use functions instead. Make the global_width variable in
exynos4210_fimd_update() uint32_t for consistency. (The values are
clamped to well below INT_MAX, so there is no overflow risk here.)
Stable CC because this is a prerequisite for an upcoming bugfix
commit.
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20260706173324.804340-2-peter.maydell@linaro.org
---
hw/display/exynos4210_fimd.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index 7507e4fd3ca..43ad5fa0b46 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -1195,15 +1195,25 @@ static void exynos4210_fimd_update_irq(Exynos4210fimdState *s)
}
}
+static uint32_t exynos4210_fimd_global_width(Exynos4210fimdState *s)
+{
+ return ((s->vidtcon[2] >> FIMD_VIDTCON2_HOR_SHIFT) &
+ FIMD_VIDTCON2_SIZE_MASK) + 1;
+}
+
+static uint32_t exynos4210_fimd_global_height(Exynos4210fimdState *s)
+{
+ return ((s->vidtcon[2] >> FIMD_VIDTCON2_VER_SHIFT) &
+ FIMD_VIDTCON2_SIZE_MASK) + 1;
+}
+
static void exynos4210_update_resolution(Exynos4210fimdState *s)
{
DisplaySurface *surface = qemu_console_surface(s->console);
/* LCD resolution is stored in VIDEO TIME CONTROL REGISTER 2 */
- uint32_t width = ((s->vidtcon[2] >> FIMD_VIDTCON2_HOR_SHIFT) &
- FIMD_VIDTCON2_SIZE_MASK) + 1;
- uint32_t height = ((s->vidtcon[2] >> FIMD_VIDTCON2_VER_SHIFT) &
- FIMD_VIDTCON2_SIZE_MASK) + 1;
+ uint32_t width = exynos4210_fimd_global_width(s);
+ uint32_t height = exynos4210_fimd_global_height(s);
if (s->ifb == NULL || surface_width(surface) != width ||
surface_height(surface) != height) {
@@ -1229,14 +1239,14 @@ static bool exynos4210_fimd_update(void *opaque)
bool blend = false;
uint8_t *host_fb_addr;
bool is_dirty = false;
- int global_width;
+ uint32_t global_width;
if (!s || !s->console || !s->enabled ||
surface_bits_per_pixel(qemu_console_surface(s->console)) == 0) {
return true;
}
- global_width = (s->vidtcon[2] & FIMD_VIDTCON2_SIZE_MASK) + 1;
+ global_width = exynos4210_fimd_global_width(s);
exynos4210_update_resolution(s);
surface = qemu_console_surface(s->console);
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 19/20] hw/display/exynos4210_fimd: Pass width to draw_line functions
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (17 preceding siblings ...)
2026-07-28 12:31 ` [PULL 18/20] hw/display/exynos4210_fimd: Factor out finding screen width/height Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 20/20] hw/display/exynos4210_fimd: Clamp windows to screen size Peter Maydell
2026-07-28 18:00 ` [PULL 00/20] target-arm queue Stefan Hajnoczi
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
The draw_line functions currently assume the width of the line they
need to draw is w->rightbot_x - w->lefttop_x + 1, i.e. the full
width of the guest-programmed window. We want to be able to clamp
this to the overall screen size, which we can calculate in the
calling function.
Refactor to do this calculation in the caller and pass the
width as an argument to the draw_line functions.
Stable CC because this is a prerequisite for an upcoming bugfix
commit.
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20260706173324.804340-3-peter.maydell@linaro.org
---
hw/display/exynos4210_fimd.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index 43ad5fa0b46..52f2285cf51 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -282,7 +282,7 @@ struct Exynos4210fimdWindow {
pixel_to_rgb_func *pixel_to_rgb;
void (*draw_line)(Exynos4210fimdWindow *w, uint8_t *src, uint8_t *dst,
- bool blend);
+ uint32_t width, bool blend);
uint32_t (*get_alpha)(Exynos4210fimdWindow *w, uint32_t pix_a);
uint16_t lefttop_x, lefttop_y; /* VIDOSD0 register */
uint16_t rightbot_x, rightbot_y; /* VIDOSD1 register */
@@ -784,9 +784,9 @@ exynos4210_fimd_blend_pixel(Exynos4210fimdWindow *w, rgba p_bg, rgba *ret)
/* Draw line with index in palette table in RAM frame buffer data */
#define DEF_DRAW_LINE_PALETTE(N) \
static void glue(draw_line_palette_, N)(Exynos4210fimdWindow *w, uint8_t *src, \
- uint8_t *dst, bool blend) \
+ uint8_t *dst, uint32_t width, \
+ bool blend) \
{ \
- int width = w->rightbot_x - w->lefttop_x + 1; \
uint8_t *ifb = dst; \
uint8_t swap = (w->wincon & FIMD_WINCON_SWAP) >> FIMD_WINCON_SWAP_SHIFT; \
uint64_t data; \
@@ -813,9 +813,8 @@ static void glue(draw_line_palette_, N)(Exynos4210fimdWindow *w, uint8_t *src, \
/* Draw line with direct color value in RAM frame buffer data */
#define DEF_DRAW_LINE_NOPALETTE(N) \
static void glue(draw_line_, N)(Exynos4210fimdWindow *w, uint8_t *src, \
- uint8_t *dst, bool blend) \
+ uint8_t *dst, uint32_t width, bool blend) \
{ \
- int width = w->rightbot_x - w->lefttop_x + 1; \
uint8_t *ifb = dst; \
uint8_t swap = (w->wincon & FIMD_WINCON_SWAP) >> FIMD_WINCON_SWAP_SHIFT; \
uint64_t data; \
@@ -848,11 +847,10 @@ DEF_DRAW_LINE_NOPALETTE(32)
/* Special draw line routine for window color map case */
static void draw_line_mapcolor(Exynos4210fimdWindow *w, uint8_t *src,
- uint8_t *dst, bool blend)
+ uint8_t *dst, uint32_t width, bool blend)
{
rgba p, p_old;
uint8_t *ifb = dst;
- int width = w->rightbot_x - w->lefttop_x + 1;
uint32_t map_color = w->winmap & FIMD_WINMAP_COLOR_MASK;
do {
@@ -1240,6 +1238,7 @@ static bool exynos4210_fimd_update(void *opaque)
uint8_t *host_fb_addr;
bool is_dirty = false;
uint32_t global_width;
+ uint32_t window_width;
if (!s || !s->console || !s->enabled ||
surface_bits_per_pixel(qemu_console_surface(s->console)) == 0) {
@@ -1255,6 +1254,8 @@ static bool exynos4210_fimd_update(void *opaque)
if ((w->wincon & FIMD_WINCON_ENWIN) && w->host_fb_addr) {
scrn_height = w->rightbot_y - w->lefttop_y + 1;
scrn_width = w->virtpage_width;
+ /* Number of bytes to actually draw */
+ window_width = w->rightbot_x - w->lefttop_x + 1;
/* Total width of virtual screen page in bytes */
inc_size = scrn_width + w->virtpage_offsize;
host_fb_addr = w->host_fb_addr;
@@ -1273,7 +1274,8 @@ static bool exynos4210_fimd_update(void *opaque)
last_line = line;
w->draw_line(w, host_fb_addr, s->ifb +
w->lefttop_x * RGBA_SIZE + (w->lefttop_y + line) *
- global_width * RGBA_SIZE, blend);
+ global_width * RGBA_SIZE,
+ window_width, blend);
}
host_fb_addr += inc_size;
fb_line_addr += inc_size;
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [PULL 20/20] hw/display/exynos4210_fimd: Clamp windows to screen size
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (18 preceding siblings ...)
2026-07-28 12:31 ` [PULL 19/20] hw/display/exynos4210_fimd: Pass width to draw_line functions Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 18:00 ` [PULL 00/20] target-arm queue Stefan Hajnoczi
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
In exynos4210_fimd_update(), we iterate through the enabled windows,
blitting them to the screen. We assume here that the guest has not
programmed the window's coordinates to be outside the overall LCD
screen resulation, but we never check this. This can result in the
guest being able to cause us to access outside our allocated
framebuffer backing memory.
Since all the coordinates here are unsigned, they can't be off
the left/top side of the screen, only the bottom/right. If
the top left corner of the window is out of bounds, the whole
window is invisible and we can skip it. If the bottom right
corner is out of bounds, we clamp it to the screen size so that
we only draw the visible part.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3795
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20260706173324.804340-4-peter.maydell@linaro.org
---
hw/display/exynos4210_fimd.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index 52f2285cf51..6c062a28c02 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -1237,7 +1237,7 @@ static bool exynos4210_fimd_update(void *opaque)
bool blend = false;
uint8_t *host_fb_addr;
bool is_dirty = false;
- uint32_t global_width;
+ uint32_t global_width, global_height;
uint32_t window_width;
if (!s || !s->console || !s->enabled ||
@@ -1246,16 +1246,28 @@ static bool exynos4210_fimd_update(void *opaque)
}
global_width = exynos4210_fimd_global_width(s);
+ global_height = exynos4210_fimd_global_height(s);
exynos4210_update_resolution(s);
surface = qemu_console_surface(s->console);
for (i = 0; i < NUM_OF_WINDOWS; i++) {
w = &s->window[i];
if ((w->wincon & FIMD_WINCON_ENWIN) && w->host_fb_addr) {
- scrn_height = w->rightbot_y - w->lefttop_y + 1;
+ uint32_t rightbot_x, rightbot_y;
+
+ if (w->lefttop_x >= global_width ||
+ w->lefttop_y >= global_height) {
+ /* Guest has put the window entirely offscreen: ignore */
+ continue;
+ }
+
+ /* Clamp right corner coords to be within the screen */
+ rightbot_x = MIN(w->rightbot_x, global_width - 1);
+ rightbot_y = MIN(w->rightbot_y, global_height - 1);
+ scrn_height = rightbot_y - w->lefttop_y + 1;
scrn_width = w->virtpage_width;
/* Number of bytes to actually draw */
- window_width = w->rightbot_x - w->lefttop_x + 1;
+ window_width = rightbot_x - w->lefttop_x + 1;
/* Total width of virtual screen page in bytes */
inc_size = scrn_width + w->virtpage_offsize;
host_fb_addr = w->host_fb_addr;
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* Re: [PULL 00/20] target-arm queue
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (19 preceding siblings ...)
2026-07-28 12:31 ` [PULL 20/20] hw/display/exynos4210_fimd: Clamp windows to screen size Peter Maydell
@ 2026-07-28 18:00 ` Stefan Hajnoczi
20 siblings, 0 replies; 33+ messages in thread
From: Stefan Hajnoczi @ 2026-07-28 18:00 UTC (permalink / raw)
To: Peter Maydell; +Cc: qemu-devel
[-- Attachment #1: Type: text/plain, Size: 116 bytes --]
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 33+ messages in thread
end of thread, other threads:[~2026-07-28 18:01 UTC | newest]
Thread overview: 33+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
2026-07-28 12:31 ` [PULL 01/20] hw/intc/arm_gicv3: Fix ARM_GICV3 dependency for KVM / WHPX Peter Maydell
2026-07-28 12:31 ` [PULL 02/20] target/arm: Add stub for define_gicv5_cpuif_regs() Peter Maydell
2026-07-28 12:31 ` [PULL 03/20] target/arm: Only compile gicv5-cpuif.c when GICv5 is selected Peter Maydell
2026-07-28 12:31 ` [PULL 04/20] target/arm: Build TCG stubs as stub library Peter Maydell
2026-07-28 12:31 ` [PULL 05/20] hw/net/can/flexcan: Use mbs[] array for FIFO pop Peter Maydell
2026-07-28 12:31 ` [PULL 06/20] hw/net/flexcan: Drop unused RX FIFO register overlay Peter Maydell
2026-07-28 12:31 ` [PULL 07/20] hw/net/can/flexcan: Fix out-of-bounds access in flexcan_mx_rx() Peter Maydell
2026-07-28 12:31 ` [PULL 08/20] hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_write() Peter Maydell
2026-07-28 12:31 ` [PULL 09/20] hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_read() Peter Maydell
2026-07-28 12:31 ` [PULL 10/20] hw/net/can/flexcan: Fix mailbox reset mask initialization Peter Maydell
2026-07-28 12:31 ` [PULL 11/20] hw/net/flexcan: Drop oversized 'mb[]' mailbox view Peter Maydell
2026-07-28 12:31 ` [PULL 12/20] hw/net/can/flexcan: Fix RXIMR reset mask Peter Maydell
2026-07-28 12:31 ` [PULL 13/20] hw/net/can/flexcan: Remove RX SMB raw view Peter Maydell
2026-07-28 12:31 ` [PULL 14/20] docs/system/arm: Update Nuvoton OpenBMC image guidance Peter Maydell
2026-07-28 12:31 ` [PULL 15/20] hw/misc/mps2-scc.c: fix cfg7 write Peter Maydell
2026-07-28 12:31 ` [PULL 16/20] hw/misc/mps2-scc.c: fix scc_partno field width Peter Maydell
2026-07-28 12:31 ` [PULL 17/20] hw/i2c/bcm2835_i2c: Correct CLKT register offset Peter Maydell
2026-07-28 12:31 ` [PULL 18/20] hw/display/exynos4210_fimd: Factor out finding screen width/height Peter Maydell
2026-07-28 12:31 ` [PULL 19/20] hw/display/exynos4210_fimd: Pass width to draw_line functions Peter Maydell
2026-07-28 12:31 ` [PULL 20/20] hw/display/exynos4210_fimd: Clamp windows to screen size Peter Maydell
2026-07-28 18:00 ` [PULL 00/20] target-arm queue Stefan Hajnoczi
-- strict thread matches above, loose matches on Subject: below --
2026-02-26 15:55 Peter Maydell
2026-02-26 17:52 ` Peter Maydell
2025-07-21 13:26 Peter Maydell
2025-07-21 18:31 ` Stefan Hajnoczi
2024-03-11 19:12 Peter Maydell
2024-03-12 13:07 ` Peter Maydell
2024-03-05 13:52 Peter Maydell
2024-03-05 15:26 ` Peter Maydell
2020-12-15 14:12 Peter Maydell
2020-12-15 21:16 ` Peter Maydell
2020-01-23 15:30 Peter Maydell
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.