* [PULL 01/20] hw/intc/arm_gicv3: Fix ARM_GICV3 dependency for KVM / WHPX
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 02/20] target/arm: Add stub for define_gicv5_cpuif_regs() Peter Maydell
` (19 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
KVM and WHPX GICv3 implementations call gicv3_init_irqs_and_mmio()
which is defined in arm_gicv3_common.c, itself build when ARM_GIC
is selected. Both KVM and WHPX are conditional on ARM_GICV3,
itself selecting ARM_GIC. Only build the ARM_GICV3 accelerator
variants when ARM_GICV3 is selected.
$ git grep -w gicv3_init_irqs_and_mmio
hw/intc/arm_gicv3_common.c:314:void gicv3_init_irqs_and_mmio(GICv3State *s,
hw/intc/arm_gicv3.c:450: gicv3_init_irqs_and_mmio(s, gicv3_set_irq, gic_ops);
hw/intc/arm_gicv3_hvf.c:710: gicv3_init_irqs_and_mmio(s, hvf_gicv3_set_irq, NULL);
hw/intc/arm_gicv3_kvm.c:822: gicv3_init_irqs_and_mmio(s, kvm_arm_gicv3_set_irq, NULL);
hw/intc/arm_gicv3_whpx.c:186: gicv3_init_irqs_and_mmio(s, whpx_gicv3_set_irq, NULL);
Fixes: a7bf30342e6 ("hw/intc: Initial implementation of vGICv3")
Fixes: e4c95f78a47 ("hw, target, accel: whpx: change apic_in_platform to kernel_irqchip")
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260721122135.6288-2-philmd@oss.qualcomm.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/intc/meson.build | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index fac2d228f9b..377de78bb41 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -45,10 +45,10 @@ specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))
arm_common_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))
arm_common_ss.add(when: 'CONFIG_ARM_GICV3', if_true: files('arm_gicv3_cpuif.c'))
specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))
-specific_ss.add(when: ['CONFIG_WHPX', 'TARGET_AARCH64'], if_true: files('arm_gicv3_whpx.c'))
+specific_ss.add(when: ['CONFIG_WHPX', 'CONFIG_ARM_GICV3'], if_true: files('arm_gicv3_whpx.c'))
specific_ss.add(when: ['CONFIG_HVF', 'CONFIG_ARM_GICV3'], if_true: files('arm_gicv3_hvf.c'))
stub_ss.add(files('arm_gicv3_hvf_stub.c'))
-specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))
+specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'CONFIG_ARM_GICV3'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))
arm_common_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_nvic.c'))
specific_ss.add(when: 'CONFIG_GRLIB', if_true: files('grlib_irqmp.c'))
specific_ss.add(when: 'CONFIG_IOAPIC', if_true: files('ioapic.c'))
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 02/20] target/arm: Add stub for define_gicv5_cpuif_regs()
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
2026-07-28 12:31 ` [PULL 01/20] hw/intc/arm_gicv3: Fix ARM_GICV3 dependency for KVM / WHPX Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 03/20] target/arm: Only compile gicv5-cpuif.c when GICv5 is selected Peter Maydell
` (18 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
The common helper.c file calls define_gicv5_cpuif_regs() which
is only defined when TCG is built:
$ git grep -w define_gicv5_cpuif_regs
target/arm/internals.h:1885:void define_gicv5_cpuif_regs(ARMCPU *cpu);
target/arm/helper.c:6334: define_gicv5_cpuif_regs(cpu);
target/arm/tcg/gicv5-cpuif.c:923:void define_gicv5_cpuif_regs(ARMCPU *cpu)
This fixes when building on macOS with --disable-tcg:
Undefined symbols for architecture arm64:
"_define_gicv5_cpuif_regs", referenced from:
_register_cp_regs_for_features in target_arm_helper.c.o
Define the GICv5 stubs in their own compilation unit, otherwise
we get the following error:
duplicate symbol '_raise_exception_ra' in:
libsystem_arm.a.p/target_arm_tcg_op_helper.c.o
libstubs_arm.a[4](target_arm_tcg-stubs.c.o)
Fixes: ee0f1ce00db ("target/arm: GICv5 cpuif: Initial skeleton and GSB barrier insns")
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260721122135.6288-3-philmd@oss.qualcomm.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
target/arm/gicv5-stubs.c | 17 +++++++++++++++++
target/arm/meson.build | 1 +
target/arm/tcg-stubs.c | 4 ----
3 files changed, 18 insertions(+), 4 deletions(-)
create mode 100644 target/arm/gicv5-stubs.c
diff --git a/target/arm/gicv5-stubs.c b/target/arm/gicv5-stubs.c
new file mode 100644
index 00000000000..845626d7c6b
--- /dev/null
+++ b/target/arm/gicv5-stubs.c
@@ -0,0 +1,17 @@
+/*
+ * QEMU ARM stubs for GICv5 TCG helper functions
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "internals.h"
+
+void define_gicv5_cpuif_regs(ARMCPU *cpu)
+{
+ g_assert_not_reached();
+}
+
+void gicv5_update_ppi_state(CPUARMState *env, int ppi, bool level)
+{
+}
diff --git a/target/arm/meson.build b/target/arm/meson.build
index 4412fde065f..f6ae8934d1b 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -37,6 +37,7 @@ arm_system_ss.add(when: 'CONFIG_HVF', if_true: files('hyp_gdbstub.c'))
arm_user_ss.add(files('cpu.c'))
arm_stubs_ss.add(files(
'cpu32-stubs.c',
+ 'gicv5-stubs.c',
'kvm-stub.c'
))
arm_user_ss.add(files(
diff --git a/target/arm/tcg-stubs.c b/target/arm/tcg-stubs.c
index 8d97449cfc6..aeeede80661 100644
--- a/target/arm/tcg-stubs.c
+++ b/target/arm/tcg-stubs.c
@@ -43,7 +43,3 @@ void vfp_clear_float_status_exc_flags(CPUARMState *env)
void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
{
}
-
-void gicv5_update_ppi_state(CPUARMState *env, int ppi, bool level)
-{
-}
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 03/20] target/arm: Only compile gicv5-cpuif.c when GICv5 is selected
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
2026-07-28 12:31 ` [PULL 01/20] hw/intc/arm_gicv3: Fix ARM_GICV3 dependency for KVM / WHPX Peter Maydell
2026-07-28 12:31 ` [PULL 02/20] target/arm: Add stub for define_gicv5_cpuif_regs() Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 04/20] target/arm: Build TCG stubs as stub library Peter Maydell
` (17 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Only compile gicv5-cpuif.c when ARM_GICV5 is Kconfig-selected,
otherwise we get when building with --without-default-devices:
Undefined symbols for architecture arm64:
"_gicv5_activate", referenced from:
_gicr_cdia_read in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_deactivate", referenced from:
_gic_cddi_write in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_get_hppi", referenced from:
_gic_hppi in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_request_config", referenced from:
_gic_cdrcfg_write in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_set_enabled", referenced from:
_gic_cddis_write in target_arm_tcg_gicv5-cpuif.c.o
_gic_cden_write in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_set_handling", referenced from:
_gic_cdhm_write in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_set_pending", referenced from:
_gic_cdpend_write in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_set_priority", referenced from:
_gic_cdpri_write in target_arm_tcg_gicv5-cpuif.c.o
"_gicv5_set_target", referenced from:
_gic_cdaff_write in target_arm_tcg_gicv5-cpuif.c.o
Fixes: ee0f1ce00db ("target/arm: GICv5 cpuif: Initial skeleton and GSB barrier insns")
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260721122135.6288-4-philmd@oss.qualcomm.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
target/arm/tcg/meson.build | 3 +++
1 file changed, 3 insertions(+)
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index 227e674ae2f..cbfac0036e7 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -91,6 +91,9 @@ arm_common_system_ss.add(files(
'tlb_helper.c',
'tlb-insns.c',
))
+arm_common_system_ss.add(when: 'CONFIG_ARM_GICV5', if_true: files(
+ 'gicv5-cpuif.c',
+))
arm_user_ss.add(files(
'tlb_helper.c',
))
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 04/20] target/arm: Build TCG stubs as stub library
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (2 preceding siblings ...)
2026-07-28 12:31 ` [PULL 03/20] target/arm: Only compile gicv5-cpuif.c when GICv5 is selected Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 05/20] hw/net/can/flexcan: Use mbs[] array for FIFO pop Peter Maydell
` (16 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Use the stub library introduced in commit 0da978cdbc6 ("target/arm:
define stub library") to prevent symbol conflicts.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260721122135.6288-5-philmd@oss.qualcomm.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
target/arm/meson.build | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/target/arm/meson.build b/target/arm/meson.build
index f6ae8934d1b..0369f96b4cc 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -38,7 +38,8 @@ arm_user_ss.add(files('cpu.c'))
arm_stubs_ss.add(files(
'cpu32-stubs.c',
'gicv5-stubs.c',
- 'kvm-stub.c'
+ 'kvm-stub.c',
+ 'tcg-stubs.c',
))
arm_user_ss.add(files(
'el2-stubs.c',
@@ -65,8 +66,6 @@ subdir('whpx')
if 'CONFIG_TCG' in config_all_accel
subdir('tcg')
-else
- arm_common_system_ss.add(files('tcg-stubs.c'))
endif
arm_user_ss.add_all(arm_common_user_system_ss)
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 05/20] hw/net/can/flexcan: Use mbs[] array for FIFO pop
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (3 preceding siblings ...)
2026-07-28 12:31 ` [PULL 04/20] target/arm: Build TCG stubs as stub library Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 06/20] hw/net/flexcan: Drop unused RX FIFO register overlay Peter Maydell
` (15 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
Implement FIFO entry shifting using the underlying `mbs[]` array instead
of the overlapping `fifo` union view. This makes it explicit that the
operation copies within a contiguous mailbox array and avoids Coverity
CID 1662971.
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-2-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/net/can/flexcan.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index da36d10bd33..3a97edf7a4d 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -879,22 +879,22 @@ static bool flexcan_can_receive(CanBusClientState *client)
*/
static void flexcan_fifo_pop(FlexcanState *s)
{
- if (s->regs.fifo.mb_back.can_ctrl != 0) {
+ if (s->regs.mbs[0].can_ctrl != 0) {
/* move queue elements forward */
- memmove(&s->regs.fifo.mb_back, &s->regs.fifo.mbs_queue[0],
- sizeof(s->regs.fifo.mbs_queue));
+ memmove(&s->regs.mbs[0], &s->regs.mbs[1],
+ sizeof(s->regs.mbs[0]) * (FLEXCAN_FIFO_DEPTH - 1));
/* clear the first-in slot */
memset(&s->regs.mbs[FLEXCAN_FIFO_DEPTH - 1], 0,
sizeof(FlexcanRegsMessageBuffer));
trace_flexcan_fifo_pop(DEVICE(s)->canonical_path, 1,
- s->regs.fifo.mb_back.can_ctrl != 0);
+ s->regs.mbs[0].can_ctrl != 0);
} else {
trace_flexcan_fifo_pop(DEVICE(s)->canonical_path, 0, 0);
}
- if (s->regs.fifo.mb_back.can_ctrl != 0) {
+ if (s->regs.mbs[0].can_ctrl != 0) {
flexcan_irq_iflag_set(s, I_FIFO_AVAILABLE);
} else {
flexcan_irq_iflag_clear(s, I_FIFO_AVAILABLE);
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 06/20] hw/net/flexcan: Drop unused RX FIFO register overlay
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (4 preceding siblings ...)
2026-07-28 12:31 ` [PULL 05/20] hw/net/can/flexcan: Use mbs[] array for FIFO pop Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 07/20] hw/net/can/flexcan: Fix out-of-bounds access in flexcan_mx_rx() Peter Maydell
` (14 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
Remove the unused `FlexcanRegsRXFifo` union view now that FIFO accesses
use the underlying `mbs[]` array directly.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-3-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
include/hw/net/flexcan.h | 11 -----------
1 file changed, 11 deletions(-)
diff --git a/include/hw/net/flexcan.h b/include/hw/net/flexcan.h
index 32de7b904af..d8159475e04 100644
--- a/include/hw/net/flexcan.h
+++ b/include/hw/net/flexcan.h
@@ -35,16 +35,6 @@ typedef struct FlexcanRegsMessageBuffer {
uint32_t data[2];
} FlexcanRegsMessageBuffer;
-/* RX FIFO view of message buffer registers */
-typedef struct FlexcanRegsRXFifo {
- /* 6 message buffer deep queue, queue back first */
- FlexcanRegsMessageBuffer mb_back;
- FlexcanRegsMessageBuffer mbs_queue[FLEXCAN_FIFO_DEPTH - 1];
-
- /* number of filter elements active depends on ctrl2 | FLEXCAN_CTRL2_RFFN */
- uint32_t filter_table_els[128];
-} FlexcanRegsRXFifo;
-
/* FlexCAN register in hw layout */
typedef struct FlexcanRegs {
uint32_t mcr; /* 0x00 */
@@ -78,7 +68,6 @@ typedef struct FlexcanRegs {
union { /* 0x80 - not affected by soft reset */
uint32_t mb[sizeof(FlexcanRegsMessageBuffer) * FLEXCAN_MAILBOX_COUNT];
FlexcanRegsMessageBuffer mbs[FLEXCAN_MAILBOX_COUNT];
- FlexcanRegsRXFifo fifo;
};
uint32_t _reserved4[256]; /* 0x480 */
uint32_t rximr[64]; /* 0x880 - not affected by soft reset */
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 07/20] hw/net/can/flexcan: Fix out-of-bounds access in flexcan_mx_rx()
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (5 preceding siblings ...)
2026-07-28 12:31 ` [PULL 06/20] hw/net/flexcan: Drop unused RX FIFO register overlay Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 08/20] hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_write() Peter Maydell
` (13 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
Require `last_not_free_to_receive_mbid >= 0` before indexing `mbs[]`.
This prevents a possible `-1` array index and fixes Coverity CID
1662790.
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260723070059.6332-4-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/net/can/flexcan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index 3a97edf7a4d..dd92a383373 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -1075,7 +1075,7 @@ static enum FlexcanRx flexcan_mb_rx(FlexcanState *s, const qemu_can_frame *buf)
}
}
- if (last_not_free_to_receive_mbid >= -1) {
+ if (last_not_free_to_receive_mbid >= 0) {
if (last_not_free_to_receive_locked) {
/*
* copy to temporary mailbox (SMB)
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 08/20] hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_write()
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (6 preceding siblings ...)
2026-07-28 12:31 ` [PULL 07/20] hw/net/can/flexcan: Fix out-of-bounds access in flexcan_mx_rx() Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 09/20] hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_read() Peter Maydell
` (12 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
Calculate mailbox indices from the `mbs[]` array layout instead of the
oversized raw `mb[]` view. This prevents accessing mailbox entries beyond
the valid array range and fixes Coverity CID 1662974.
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260723070059.6332-5-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/net/can/flexcan.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index dd92a383373..651904fa379 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -1151,6 +1151,8 @@ static void flexcan_mem_write(void *opaque, hwaddr addr, uint64_t val,
unsigned size)
{
FlexcanState *s = opaque;
+ const int mbid = (addr - offsetof(FlexcanRegs, mbs)) /
+ sizeof(s->regs.mbs[0]);
uint32_t write_mask = ((const uint32_t *)
&flexcan_regs_write_mask)[addr / 4];
uint32_t old_value = s->regs_raw[addr / 4];
@@ -1208,11 +1210,8 @@ static void flexcan_mem_write(void *opaque, hwaddr addr, uint64_t val,
default:
s->regs_raw[addr / 4] = (val & write_mask) | (old_value & ~write_mask);
- if (addr >= offsetof(FlexcanRegs, mb) &&
- addr < offsetof(FlexcanRegs, _reserved4)) {
+ if (0 <= mbid && mbid < ARRAY_SIZE(s->regs.mbs)) {
/* access to mailbox */
- int mbid = (addr - offsetof(FlexcanRegs, mb)) /
- sizeof(FlexcanRegsMessageBuffer);
if (s->locked_mbidx == mbid) {
flexcan_mb_unlock(s);
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 09/20] hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_read()
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (7 preceding siblings ...)
2026-07-28 12:31 ` [PULL 08/20] hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_write() Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 10/20] hw/net/can/flexcan: Fix mailbox reset mask initialization Peter Maydell
` (11 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
Calculate mailbox indices from the `mbs[]` array layout instead of the
oversized raw `mb[]` view. This prevents accessing mailbox entries beyond
the valid array range and fixes Coverity CID 1662974.
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260723070059.6332-6-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/net/can/flexcan.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index 651904fa379..8d680f1832e 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -1239,14 +1239,12 @@ static void flexcan_mem_write(void *opaque, hwaddr addr, uint64_t val,
static uint64_t flexcan_mem_read(void *opqaue, hwaddr addr, unsigned size)
{
FlexcanState *s = opqaue;
+ const int mbid = (addr - offsetof(FlexcanRegs, mbs)) /
+ sizeof(s->regs.mbs[0]);
uint32_t rv = s->regs_raw[addr >> 2];
- if (addr >= offsetof(FlexcanRegs, mb) &&
- addr < offsetof(FlexcanRegs, _reserved4)) {
+ if (0 <= mbid && mbid < ARRAY_SIZE(s->regs.mbs)) {
/* reading from mailbox */
- hwaddr offset = addr - offsetof(FlexcanRegs, mb);
- int mbid = offset / sizeof(FlexcanRegsMessageBuffer);
-
if (addr % 16 == 0 && s->locked_mbidx != mbid) {
/* reading control word locks the mailbox */
flexcan_mb_unlock(s);
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 10/20] hw/net/can/flexcan: Fix mailbox reset mask initialization
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (8 preceding siblings ...)
2026-07-28 12:31 ` [PULL 09/20] hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_read() Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 11/20] hw/net/flexcan: Drop oversized 'mb[]' mailbox view Peter Maydell
` (10 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
The mailbox reset mask initialized only the first word of the raw `mb[]`
array. Fix the initialization to cover the whole mailbox, as indicated
in the field description in the header. While at it, use the `mbs[]`
view instead in order to drop the redundant and oversized `mb[]` view in
the next commit.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-7-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/net/can/flexcan.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index 8d680f1832e..f84f090a7fd 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -134,7 +134,11 @@ static const FlexcanRegs flexcan_regs_reset_mask = {
._reserved2 = 0,
.dbg1 = 0,
.dbg2 = 0,
- .mb = {0xFFFFFFFF},
+ .mbs = { [0 ... FLEXCAN_MAILBOX_COUNT - 1] = {
+ .can_ctrl = 0xFFFFFFFF,
+ .can_id = 0xFFFFFFFF,
+ .data = { 0xFFFFFFFF, 0xFFFFFFFF },
+ } },
._reserved4 = {0},
.rximr = {0xFFFFFFFF},
._reserved5 = {0},
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 11/20] hw/net/flexcan: Drop oversized 'mb[]' mailbox view
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (9 preceding siblings ...)
2026-07-28 12:31 ` [PULL 10/20] hw/net/can/flexcan: Fix mailbox reset mask initialization Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 12/20] hw/net/can/flexcan: Fix RXIMR reset mask Peter Maydell
` (9 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
As indicated in the comments, the `mb[]` a.k.a. `mbs []` views should
cover 0x400 (1024) bytes. However, the `mb[]` array covers four times
the size since `sizeof(FlexcanRegsMessageBuffer)` returns the size in
bytes instead of counting the number of uint32_t fields. This shifts the
subsequent register offsets by 0xc00 which is not intended. Fix the size
and thus the offsets by dropping the now unused `mb[]` view.
Note that the different size changes the migration layout. Since the device
model is new, no change in the version fields is needed.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-8-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
include/hw/net/flexcan.h | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/include/hw/net/flexcan.h b/include/hw/net/flexcan.h
index d8159475e04..9affdff8372 100644
--- a/include/hw/net/flexcan.h
+++ b/include/hw/net/flexcan.h
@@ -65,10 +65,8 @@ typedef struct FlexcanRegs {
uint32_t dbg1; /* 0x58, unused */
uint32_t dbg2; /* 0x5C, unused */
uint32_t _reserved3[8]; /* 0x60 */
- union { /* 0x80 - not affected by soft reset */
- uint32_t mb[sizeof(FlexcanRegsMessageBuffer) * FLEXCAN_MAILBOX_COUNT];
- FlexcanRegsMessageBuffer mbs[FLEXCAN_MAILBOX_COUNT];
- };
+ /* 0x80 - not affected by soft reset */
+ FlexcanRegsMessageBuffer mbs[FLEXCAN_MAILBOX_COUNT];
uint32_t _reserved4[256]; /* 0x480 */
uint32_t rximr[64]; /* 0x880 - not affected by soft reset */
uint32_t _reserved5[24]; /* 0x980 */
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 12/20] hw/net/can/flexcan: Fix RXIMR reset mask
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (10 preceding siblings ...)
2026-07-28 12:31 ` [PULL 11/20] hw/net/flexcan: Drop oversized 'mb[]' mailbox view Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 13/20] hw/net/can/flexcan: Remove RX SMB raw view Peter Maydell
` (8 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
The RXIMR registers are not affected by soft reset, so their reset mask
must preserve all entries. Set the mask for the entire array instead of
only the first register.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-9-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/net/can/flexcan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index f84f090a7fd..205d0d64134 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -140,7 +140,7 @@ static const FlexcanRegs flexcan_regs_reset_mask = {
.data = { 0xFFFFFFFF, 0xFFFFFFFF },
} },
._reserved4 = {0},
- .rximr = {0xFFFFFFFF},
+ .rximr = { [0 ... 63] = 0xFFFFFFFF },
._reserved5 = {0},
.gfwr_mx6 = 0,
._reserved6 = {0},
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 13/20] hw/net/can/flexcan: Remove RX SMB raw view
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (11 preceding siblings ...)
2026-07-28 12:31 ` [PULL 12/20] hw/net/can/flexcan: Fix RXIMR reset mask Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 14/20] docs/system/arm: Update Nuvoton OpenBMC image guidance Peter Maydell
` (7 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bernhard Beschow <shentey@gmail.com>
Use the existing `rx_smb0` message buffer view for register masks instead
of the raw register array. Since all accesses now use the structured view,
remove the redundant `rx_smb0_raw` union member.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260723070059.6332-10-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/net/can/flexcan.c | 12 ++++++++++--
include/hw/net/flexcan.h | 5 +----
2 files changed, 11 insertions(+), 6 deletions(-)
diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index 205d0d64134..a8bad83cb87 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -106,7 +106,11 @@ static const FlexcanRegs flexcan_regs_write_mask = {
.gfwr_mx6 = 0xFFFFFFFF,
._reserved6 = {0},
._reserved8 = {0},
- .rx_smb0_raw = {0, 0, 0, 0},
+ .rx_smb0 = {
+ .can_ctrl = 0,
+ .can_id = 0,
+ .data = { 0, 0 },
+ },
.rx_smb1 = {0, 0, 0, 0},
};
static const FlexcanRegs flexcan_regs_reset_mask = {
@@ -145,7 +149,11 @@ static const FlexcanRegs flexcan_regs_reset_mask = {
.gfwr_mx6 = 0,
._reserved6 = {0},
._reserved8 = {0},
- .rx_smb0_raw = {0, 0, 0, 0},
+ .rx_smb0 = {
+ .can_ctrl = 0,
+ .can_id = 0,
+ .data = { 0, 0 },
+ },
.rx_smb1 = {0, 0, 0, 0},
};
diff --git a/include/hw/net/flexcan.h b/include/hw/net/flexcan.h
index 9affdff8372..eee70bad422 100644
--- a/include/hw/net/flexcan.h
+++ b/include/hw/net/flexcan.h
@@ -81,10 +81,7 @@ typedef struct FlexcanRegs {
uint32_t _rx14mask; /* 0xAA8 */
uint32_t _rx15mask; /* 0xAAC */
uint32_t tx_smb[4]; /* 0xAB0 */
- union { /* 0xAC0, used for SMB emulation */
- uint32_t rx_smb0_raw[4];
- FlexcanRegsMessageBuffer rx_smb0;
- };
+ FlexcanRegsMessageBuffer rx_smb0; /* 0xAC0, used for SMB emulation */
uint32_t rx_smb1[4]; /* 0xAD0 */
uint32_t mecr; /* 0xAE0 */
uint32_t erriar; /* 0xAE4 */
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 14/20] docs/system/arm: Update Nuvoton OpenBMC image guidance
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (12 preceding siblings ...)
2026-07-28 12:31 ` [PULL 13/20] hw/net/can/flexcan: Remove RX SMB raw view Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 15/20] hw/misc/mps2-scc.c: fix cfg7 write Peter Maydell
` (6 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Bin Meng <bin.meng@processmission.com>
Describe the current OpenBMC target naming and release status for
Nuvoton machines. The latest 2.18.0 release no longer includes GSJ,
so point users at older 2.14.0 sources and explain how to find
Jenkins MTD artifacts.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Message-id: 20260627063208.33642-1-bin.meng@processmission.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
docs/system/arm/nuvoton.rst | 54 +++++++++++++++++++++++++++++++++----
1 file changed, 49 insertions(+), 5 deletions(-)
diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
index e4827fb43a1..51d36b2bc0b 100644
--- a/docs/system/arm/nuvoton.rst
+++ b/docs/system/arm/nuvoton.rst
@@ -94,16 +94,60 @@ Boot options
------------
The Nuvoton machines can boot from an OpenBMC firmware image, or directly into
-a kernel using the ``-kernel`` option. OpenBMC images for ``quanta-gsj`` and
-possibly others can be downloaded from the OpenBMC jenkins :
+a kernel using the ``-kernel`` option. OpenBMC machine names do not always
+match QEMU machine names. Check the OpenBMC supported-machine list and Jenkins
+for currently available source and pre-built images.
+
+Known OpenBMC (v2.18.0) target names for QEMU Nuvoton machines per:
+
+ https://github.com/openbmc/openbmc/blob/2.18.0/meta-phosphor/docs/supported-machines.md
+
+.. list-table::
+ :header-rows: 1
+
+ * - QEMU machine
+ - OpenBMC machine
+ * - ``npcm750-evb``
+ - ``evb-npcm750``
+ * - ``npcm845-evb``
+ - ``evb-npcm845``
+ * - ``quanta-gbs-bmc``
+ - ``gbs``
+ * - ``kudo-bmc``
+ - ``kudo``
+ * - ``mori-bmc``
+ - ``mori``
+
+As of June 2026, the latest OpenBMC release, ``2.18.0``, no longer lists a
+``gsj`` machine. To build an image for QEMU's ``quanta-gsj`` machine, use an
+older OpenBMC release that still contains ``meta-quanta/meta-gsj``. The
+``2.14.0`` release contains the ``gsj`` machine:
+
+ https://github.com/openbmc/openbmc/tree/2.14.0/meta-quanta/meta-gsj
+
+Some pre-built OpenBMC images for QEMU Nuvoton machines may be available on
+Jenkins:
https://jenkins.openbmc.org/
-The firmware image should be attached as an MTD drive. Example :
+To find a pre-built MTD image on Jenkins, start from the Jenkins home page and
+open the ``latest-master`` job. Select the matrix configuration whose
+``target`` matches the OpenBMC machine name, for example
+``label=docker-builder,target=gbs``, then open its latest successful build's
+artifacts. The MTD image is usually published under
+``openbmc/build/tmp/deploy/images/<machine>/`` as
+``obmc-phosphor-image-<machine>-<timestamp>.static.mtd``. If Jenkins does not
+list a matching target, or the build artifacts do not include an MTD image,
+there is no current pre-built MTD image for that machine.
+
+The firmware image should be attached as an MTD drive. Example:
.. code-block:: bash
- $ qemu-system-arm -machine quanta-gsj -nographic \
- -drive file=image-bmc,if=mtd,bus=0,unit=0,format=raw
+ $ qemu-system-arm -machine quanta-gbs-bmc -nographic \
+ -drive file=obmc-phosphor-image-gbs-xxxxxx.static.mtd,if=mtd,bus=0,unit=0,format=raw
The default root password for test images is usually ``0penBmc``.
+
+For other machines that don't have pre-built images on Jenkins, build an image
+from source by following the OpenBMC build documentation.
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 15/20] hw/misc/mps2-scc.c: fix cfg7 write
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (13 preceding siblings ...)
2026-07-28 12:31 ` [PULL 14/20] docs/system/arm: Update Nuvoton OpenBMC image guidance Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 16/20] hw/misc/mps2-scc.c: fix scc_partno field width Peter Maydell
` (5 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Simon Xu <simonxhy0404@gmail.com>
Change the CFG7 write function to modify the correct variable. This only
affects the an536 machine currently as only it uses cfg7 to store the
core 1 vector table base address.
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260724160943.52509-2-simonxhy0404@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/misc/mps2-scc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c
index 7877b31479c..1ecb2879e32 100644
--- a/hw/misc/mps2-scc.c
+++ b/hw/misc/mps2-scc.c
@@ -299,7 +299,7 @@ static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value,
goto bad_offset;
}
/* AN536: Core 1 vector table base address */
- s->cfg6 = value;
+ s->cfg7 = value;
break;
case A_CFGDATA_OUT:
s->cfgdata_out = value;
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 16/20] hw/misc/mps2-scc.c: fix scc_partno field width
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (14 preceding siblings ...)
2026-07-28 12:31 ` [PULL 15/20] hw/misc/mps2-scc.c: fix cfg7 write Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 17/20] hw/i2c/bcm2835_i2c: Correct CLKT register offset Peter Maydell
` (4 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: Simon Xu <simonxhy0404@gmail.com>
Increase the extract32 length from 8 to 12. The Primary part number is
defined as bits[15:4] by the "SSE-310 with M85 and U55 FPGA"
documentation. For example for the mps3-an547, 0x547 is 12 bits but we
only return 8 bits right now.
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260724160943.52509-3-simonxhy0404@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/misc/mps2-scc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c
index 1ecb2879e32..554b504c720 100644
--- a/hw/misc/mps2-scc.c
+++ b/hw/misc/mps2-scc.c
@@ -57,7 +57,7 @@ REG32(ID, 0xFFC)
static int scc_partno(MPS2SCC *s)
{
/* Return the partno field of the SCC_ID (0x524, 0x511, etc) */
- return extract32(s->id, 4, 8);
+ return extract32(s->id, 4, 12);
}
/* Is CFG_REG2 present? */
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 17/20] hw/i2c/bcm2835_i2c: Correct CLKT register offset
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (15 preceding siblings ...)
2026-07-28 12:31 ` [PULL 16/20] hw/misc/mps2-scc.c: fix scc_partno field width Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 18/20] hw/display/exynos4210_fimd: Factor out finding screen width/height Peter Maydell
` (3 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
From: botszhuang <huang.botsz@gmail.com>
The Clock Stretch Timeout (CLKT) register for the BCM2835 I2C
controller is actually located at offset 0x1c, not 0x20.
Update the BCM2835_I2C_CLKT macro to match the hardware
specification.
Since QEMU's implementation ignores whatever value the guest
writes to this register, and Linux only writes to CLKT and
doesn't read it back, the main effect of this fix is to
avoid an incorrect GUEST_ERROR log.
Cc: qemu-stable@nongnu.org
Fixes: 9cf3bc65afdb63 ("hw/i2c: Implement Broadcom Serial Controller (BSC)")
Signed-off-by: botszhuang <botszhuang@gmail.com>
Tested-by: Nick Huang <sef1548@gmail.com>
Message-id: 20260724124220.24152-1-22925483+botszhuang@users.noreply.github.com
[PMM: removed commit message paragraph about effects which I think
is incorrect, substituted a different one]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
include/hw/i2c/bcm2835_i2c.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/hw/i2c/bcm2835_i2c.h b/include/hw/i2c/bcm2835_i2c.h
index 45f876df224..519c65f7652 100644
--- a/include/hw/i2c/bcm2835_i2c.h
+++ b/include/hw/i2c/bcm2835_i2c.h
@@ -38,7 +38,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(BCM2835I2CState, BCM2835_I2C)
#define BCM2835_I2C_FIFO 0x10 /* FIFO */
#define BCM2835_I2C_DIV 0x14 /* Clock Divider */
#define BCM2835_I2C_DEL 0x18 /* Data Delay */
-#define BCM2835_I2C_CLKT 0x20 /* Clock Stretch Timeout */
+#define BCM2835_I2C_CLKT 0x1c /* Clock Stretch Timeout */
#define BCM2835_I2C_C_I2CEN BIT(15) /* I2C enable */
#define BCM2835_I2C_C_INTR BIT(10) /* Interrupt on RXR */
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 18/20] hw/display/exynos4210_fimd: Factor out finding screen width/height
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (16 preceding siblings ...)
2026-07-28 12:31 ` [PULL 17/20] hw/i2c/bcm2835_i2c: Correct CLKT register offset Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 19/20] hw/display/exynos4210_fimd: Pass width to draw_line functions Peter Maydell
` (2 subsequent siblings)
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
Currently we hard-code the expressions for getting the global screen
width and height out of the VIDTCON2 register where we need them.
Use functions instead. Make the global_width variable in
exynos4210_fimd_update() uint32_t for consistency. (The values are
clamped to well below INT_MAX, so there is no overflow risk here.)
Stable CC because this is a prerequisite for an upcoming bugfix
commit.
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20260706173324.804340-2-peter.maydell@linaro.org
---
hw/display/exynos4210_fimd.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index 7507e4fd3ca..43ad5fa0b46 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -1195,15 +1195,25 @@ static void exynos4210_fimd_update_irq(Exynos4210fimdState *s)
}
}
+static uint32_t exynos4210_fimd_global_width(Exynos4210fimdState *s)
+{
+ return ((s->vidtcon[2] >> FIMD_VIDTCON2_HOR_SHIFT) &
+ FIMD_VIDTCON2_SIZE_MASK) + 1;
+}
+
+static uint32_t exynos4210_fimd_global_height(Exynos4210fimdState *s)
+{
+ return ((s->vidtcon[2] >> FIMD_VIDTCON2_VER_SHIFT) &
+ FIMD_VIDTCON2_SIZE_MASK) + 1;
+}
+
static void exynos4210_update_resolution(Exynos4210fimdState *s)
{
DisplaySurface *surface = qemu_console_surface(s->console);
/* LCD resolution is stored in VIDEO TIME CONTROL REGISTER 2 */
- uint32_t width = ((s->vidtcon[2] >> FIMD_VIDTCON2_HOR_SHIFT) &
- FIMD_VIDTCON2_SIZE_MASK) + 1;
- uint32_t height = ((s->vidtcon[2] >> FIMD_VIDTCON2_VER_SHIFT) &
- FIMD_VIDTCON2_SIZE_MASK) + 1;
+ uint32_t width = exynos4210_fimd_global_width(s);
+ uint32_t height = exynos4210_fimd_global_height(s);
if (s->ifb == NULL || surface_width(surface) != width ||
surface_height(surface) != height) {
@@ -1229,14 +1239,14 @@ static bool exynos4210_fimd_update(void *opaque)
bool blend = false;
uint8_t *host_fb_addr;
bool is_dirty = false;
- int global_width;
+ uint32_t global_width;
if (!s || !s->console || !s->enabled ||
surface_bits_per_pixel(qemu_console_surface(s->console)) == 0) {
return true;
}
- global_width = (s->vidtcon[2] & FIMD_VIDTCON2_SIZE_MASK) + 1;
+ global_width = exynos4210_fimd_global_width(s);
exynos4210_update_resolution(s);
surface = qemu_console_surface(s->console);
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 19/20] hw/display/exynos4210_fimd: Pass width to draw_line functions
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (17 preceding siblings ...)
2026-07-28 12:31 ` [PULL 18/20] hw/display/exynos4210_fimd: Factor out finding screen width/height Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 12:31 ` [PULL 20/20] hw/display/exynos4210_fimd: Clamp windows to screen size Peter Maydell
2026-07-28 18:00 ` [PULL 00/20] target-arm queue Stefan Hajnoczi
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
The draw_line functions currently assume the width of the line they
need to draw is w->rightbot_x - w->lefttop_x + 1, i.e. the full
width of the guest-programmed window. We want to be able to clamp
this to the overall screen size, which we can calculate in the
calling function.
Refactor to do this calculation in the caller and pass the
width as an argument to the draw_line functions.
Stable CC because this is a prerequisite for an upcoming bugfix
commit.
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20260706173324.804340-3-peter.maydell@linaro.org
---
hw/display/exynos4210_fimd.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index 43ad5fa0b46..52f2285cf51 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -282,7 +282,7 @@ struct Exynos4210fimdWindow {
pixel_to_rgb_func *pixel_to_rgb;
void (*draw_line)(Exynos4210fimdWindow *w, uint8_t *src, uint8_t *dst,
- bool blend);
+ uint32_t width, bool blend);
uint32_t (*get_alpha)(Exynos4210fimdWindow *w, uint32_t pix_a);
uint16_t lefttop_x, lefttop_y; /* VIDOSD0 register */
uint16_t rightbot_x, rightbot_y; /* VIDOSD1 register */
@@ -784,9 +784,9 @@ exynos4210_fimd_blend_pixel(Exynos4210fimdWindow *w, rgba p_bg, rgba *ret)
/* Draw line with index in palette table in RAM frame buffer data */
#define DEF_DRAW_LINE_PALETTE(N) \
static void glue(draw_line_palette_, N)(Exynos4210fimdWindow *w, uint8_t *src, \
- uint8_t *dst, bool blend) \
+ uint8_t *dst, uint32_t width, \
+ bool blend) \
{ \
- int width = w->rightbot_x - w->lefttop_x + 1; \
uint8_t *ifb = dst; \
uint8_t swap = (w->wincon & FIMD_WINCON_SWAP) >> FIMD_WINCON_SWAP_SHIFT; \
uint64_t data; \
@@ -813,9 +813,8 @@ static void glue(draw_line_palette_, N)(Exynos4210fimdWindow *w, uint8_t *src, \
/* Draw line with direct color value in RAM frame buffer data */
#define DEF_DRAW_LINE_NOPALETTE(N) \
static void glue(draw_line_, N)(Exynos4210fimdWindow *w, uint8_t *src, \
- uint8_t *dst, bool blend) \
+ uint8_t *dst, uint32_t width, bool blend) \
{ \
- int width = w->rightbot_x - w->lefttop_x + 1; \
uint8_t *ifb = dst; \
uint8_t swap = (w->wincon & FIMD_WINCON_SWAP) >> FIMD_WINCON_SWAP_SHIFT; \
uint64_t data; \
@@ -848,11 +847,10 @@ DEF_DRAW_LINE_NOPALETTE(32)
/* Special draw line routine for window color map case */
static void draw_line_mapcolor(Exynos4210fimdWindow *w, uint8_t *src,
- uint8_t *dst, bool blend)
+ uint8_t *dst, uint32_t width, bool blend)
{
rgba p, p_old;
uint8_t *ifb = dst;
- int width = w->rightbot_x - w->lefttop_x + 1;
uint32_t map_color = w->winmap & FIMD_WINMAP_COLOR_MASK;
do {
@@ -1240,6 +1238,7 @@ static bool exynos4210_fimd_update(void *opaque)
uint8_t *host_fb_addr;
bool is_dirty = false;
uint32_t global_width;
+ uint32_t window_width;
if (!s || !s->console || !s->enabled ||
surface_bits_per_pixel(qemu_console_surface(s->console)) == 0) {
@@ -1255,6 +1254,8 @@ static bool exynos4210_fimd_update(void *opaque)
if ((w->wincon & FIMD_WINCON_ENWIN) && w->host_fb_addr) {
scrn_height = w->rightbot_y - w->lefttop_y + 1;
scrn_width = w->virtpage_width;
+ /* Number of bytes to actually draw */
+ window_width = w->rightbot_x - w->lefttop_x + 1;
/* Total width of virtual screen page in bytes */
inc_size = scrn_width + w->virtpage_offsize;
host_fb_addr = w->host_fb_addr;
@@ -1273,7 +1274,8 @@ static bool exynos4210_fimd_update(void *opaque)
last_line = line;
w->draw_line(w, host_fb_addr, s->ifb +
w->lefttop_x * RGBA_SIZE + (w->lefttop_y + line) *
- global_width * RGBA_SIZE, blend);
+ global_width * RGBA_SIZE,
+ window_width, blend);
}
host_fb_addr += inc_size;
fb_line_addr += inc_size;
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 20/20] hw/display/exynos4210_fimd: Clamp windows to screen size
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (18 preceding siblings ...)
2026-07-28 12:31 ` [PULL 19/20] hw/display/exynos4210_fimd: Pass width to draw_line functions Peter Maydell
@ 2026-07-28 12:31 ` Peter Maydell
2026-07-28 18:00 ` [PULL 00/20] target-arm queue Stefan Hajnoczi
20 siblings, 0 replies; 33+ messages in thread
From: Peter Maydell @ 2026-07-28 12:31 UTC (permalink / raw)
To: qemu-devel
In exynos4210_fimd_update(), we iterate through the enabled windows,
blitting them to the screen. We assume here that the guest has not
programmed the window's coordinates to be outside the overall LCD
screen resulation, but we never check this. This can result in the
guest being able to cause us to access outside our allocated
framebuffer backing memory.
Since all the coordinates here are unsigned, they can't be off
the left/top side of the screen, only the bottom/right. If
the top left corner of the window is out of bounds, the whole
window is invisible and we can skip it. If the bottom right
corner is out of bounds, we clamp it to the screen size so that
we only draw the visible part.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3795
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20260706173324.804340-4-peter.maydell@linaro.org
---
hw/display/exynos4210_fimd.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index 52f2285cf51..6c062a28c02 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -1237,7 +1237,7 @@ static bool exynos4210_fimd_update(void *opaque)
bool blend = false;
uint8_t *host_fb_addr;
bool is_dirty = false;
- uint32_t global_width;
+ uint32_t global_width, global_height;
uint32_t window_width;
if (!s || !s->console || !s->enabled ||
@@ -1246,16 +1246,28 @@ static bool exynos4210_fimd_update(void *opaque)
}
global_width = exynos4210_fimd_global_width(s);
+ global_height = exynos4210_fimd_global_height(s);
exynos4210_update_resolution(s);
surface = qemu_console_surface(s->console);
for (i = 0; i < NUM_OF_WINDOWS; i++) {
w = &s->window[i];
if ((w->wincon & FIMD_WINCON_ENWIN) && w->host_fb_addr) {
- scrn_height = w->rightbot_y - w->lefttop_y + 1;
+ uint32_t rightbot_x, rightbot_y;
+
+ if (w->lefttop_x >= global_width ||
+ w->lefttop_y >= global_height) {
+ /* Guest has put the window entirely offscreen: ignore */
+ continue;
+ }
+
+ /* Clamp right corner coords to be within the screen */
+ rightbot_x = MIN(w->rightbot_x, global_width - 1);
+ rightbot_y = MIN(w->rightbot_y, global_height - 1);
+ scrn_height = rightbot_y - w->lefttop_y + 1;
scrn_width = w->virtpage_width;
/* Number of bytes to actually draw */
- window_width = w->rightbot_x - w->lefttop_x + 1;
+ window_width = rightbot_x - w->lefttop_x + 1;
/* Total width of virtual screen page in bytes */
inc_size = scrn_width + w->virtpage_offsize;
host_fb_addr = w->host_fb_addr;
--
2.43.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* Re: [PULL 00/20] target-arm queue
2026-07-28 12:31 [PULL 00/20] target-arm queue Peter Maydell
` (19 preceding siblings ...)
2026-07-28 12:31 ` [PULL 20/20] hw/display/exynos4210_fimd: Clamp windows to screen size Peter Maydell
@ 2026-07-28 18:00 ` Stefan Hajnoczi
20 siblings, 0 replies; 33+ messages in thread
From: Stefan Hajnoczi @ 2026-07-28 18:00 UTC (permalink / raw)
To: Peter Maydell; +Cc: qemu-devel
[-- Attachment #1: Type: text/plain, Size: 116 bytes --]
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 33+ messages in thread