When the guest writes to the RTC, the write is intercepted and emulated
by Xen and the time difference is broadcasted as a TIMEOFFSET ioreq.
Emit an RTC_CHANGE QMP event when this happens rather than ignoring it
so that something can make use of the information (e.g. the toolstack
can persist it between VM starts).
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Message-ID: <20260108135406.1879210-1-ross.lagerwall@citrix.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
Signed-off-by: Anthony PERARD <anthony.perard@vates.tech>
It is possible for a guest to relocate the linear framebuffer by writing
to the VGA device's BAR. This causes QEMU to report an error and if the
VM is migrated, the destination QEMU hits an assertion.
The problem is that updating the BAR causes the PCI core code to call
the del region callback followed by the add region callback but the
xen-hvm code ignores the del region call and therefore the subsequent
call to xen_relocate_memory() during the add region callback fails
because the source address is not correct.
Fix it by calling in to xen_remove_from_physmap() in response to a
del region callback for the linear framebuffer so that the subsequent
add region callback succeeds.
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
Message-ID: <20260108132514.1862552-1-ross.lagerwall@citrix.com>
Signed-off-by: Anthony PERARD <anthony.perard@vates.tech>
When the '--enable-trace-backends=syslog' build option is configured,
the following compilation error is encountered.
In file included from /usr/include/sys/syslog.h:207,
from /usr/include/syslog.h:1,
from ./trace/trace-hw_xen.h:224,
from ../hw/xen/trace.h:1,
from ../hw/xen/xen-bus-helper.c:13:
In function ‘syslog’,
inlined from ‘_nocheck__trace_xs_node_read’ at ../hw/xen/trace-events:41:9,
inlined from ‘trace_xs_node_read’ at trace/trace-hw_xen.h:903:9,
inlined from ‘xs_node_read’ at ../hw/xen/xen-bus-helper.c:154:5:
/usr/include/bits/syslog.h:45:3: error: ‘%s’ directive argument is null [-Werror=format-overflow=]
45 | __syslog_chk (__pri, __USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ());
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Add a check that 'value' is not null before passing it to trace_xs_node_read().
Fixes: e6cdeee959 ("hw/xen: Add xs_node_read() helper function")
Signed-off-by: Liam Merwick <liam.merwick@oracle.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
Acked-by: David Woodhouse <dwmw@amazon.co.uk>
Message-ID: <20250523160134.218997-1-liam.merwick@oracle.com>
Signed-off-by: Anthony PERARD <anthony.perard@vates.tech>
- Remove versioned machines released in QEMU 3.0
- Build various stubs and ACPI objects once
- Pair of bug fixes in ATI VGA model
- Cleanups in 16550A UART model
- Clarify PA-RISC CPU models (adding the PA-8500)
- Various memory leaks / overflows fixed
- MAINTAINERS updates
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmmt+RQACgkQ4+MsLN6t
wN6Xkg//bSmLBV1gZKx83GqYzebs+EwEau38XNQ7gl3yp13pU8di+Hfem+Lv8Lk+
ZMMsFCLPQ5xPeggiefxpOu7bUG6YukIA85/XD4fwB8MWddu7qN2jJJuQHHFk8e1A
T/kQZTIGvpItLQfBPqnXIgElGhmMSgzeHvjKUbXJXI8ZpQPlmBM1HJb363P/GbAy
8PIyOcQRfgTen3gQWqoGmft/dWi5XeUsQhB7PIAbB6X9Ix/EOgF+u7SYXnTO6UZY
xJcjgsWpaVgMh1+gU4w/riZpcr8gJCcbN80lX3hzsBNKwgXCD+v3VMYldQYl5XwR
R7tpt91gNvTWEnCbIHBFtkdGPD4TZ/kwH1ZrvofCWjx1ogaVrrt0oey713hfszVV
e3moNlHvK3N4GeOXsV7JqMqFWAlyU6+6A1Dbe6+FV1pa9cxemIE9zyCuGQDjLjG8
/3NK3S9ncNdw5hEfxz4kZWa4f3egrwULtTSBgpa8dIO3OW8CJUThccrjiKj+F9VT
rog7XRvmqUFgkAzHqCnXCTk3gCcHbXaDRXQWP7gBwqaDanMgd7wHwofsr4bKWppd
zFx8FoHRiYvOYe8eRwYtTwYtg/0JfsfOSq9/G6YIs5nqt1OWqHhXpzoIgGpDi1LD
8+u0rBpa4dgLPICu5iaaX05Hgyst2sbpnUXZZaV4HMi/qc1PydY=
=s6PL
-----END PGP SIGNATURE-----
Merge tag 'hw-misc-20260308' of https://github.com/philmd/qemu into staging
Misc HW patches
- Remove versioned machines released in QEMU 3.0
- Build various stubs and ACPI objects once
- Pair of bug fixes in ATI VGA model
- Cleanups in 16550A UART model
- Clarify PA-RISC CPU models (adding the PA-8500)
- Various memory leaks / overflows fixed
- MAINTAINERS updates
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmmt+RQACgkQ4+MsLN6t
# wN6Xkg//bSmLBV1gZKx83GqYzebs+EwEau38XNQ7gl3yp13pU8di+Hfem+Lv8Lk+
# ZMMsFCLPQ5xPeggiefxpOu7bUG6YukIA85/XD4fwB8MWddu7qN2jJJuQHHFk8e1A
# T/kQZTIGvpItLQfBPqnXIgElGhmMSgzeHvjKUbXJXI8ZpQPlmBM1HJb363P/GbAy
# 8PIyOcQRfgTen3gQWqoGmft/dWi5XeUsQhB7PIAbB6X9Ix/EOgF+u7SYXnTO6UZY
# xJcjgsWpaVgMh1+gU4w/riZpcr8gJCcbN80lX3hzsBNKwgXCD+v3VMYldQYl5XwR
# R7tpt91gNvTWEnCbIHBFtkdGPD4TZ/kwH1ZrvofCWjx1ogaVrrt0oey713hfszVV
# e3moNlHvK3N4GeOXsV7JqMqFWAlyU6+6A1Dbe6+FV1pa9cxemIE9zyCuGQDjLjG8
# /3NK3S9ncNdw5hEfxz4kZWa4f3egrwULtTSBgpa8dIO3OW8CJUThccrjiKj+F9VT
# rog7XRvmqUFgkAzHqCnXCTk3gCcHbXaDRXQWP7gBwqaDanMgd7wHwofsr4bKWppd
# zFx8FoHRiYvOYe8eRwYtTwYtg/0JfsfOSq9/G6YIs5nqt1OWqHhXpzoIgGpDi1LD
# 8+u0rBpa4dgLPICu5iaaX05Hgyst2sbpnUXZZaV4HMi/qc1PydY=
# =s6PL
# -----END PGP SIGNATURE-----
# gpg: Signature made Sun Mar 8 22:32:52 2026 GMT
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE
* tag 'hw-misc-20260308' of https://github.com/philmd/qemu: (49 commits)
hw/char: Drop disable property of Diva GSP card
hw/hppa: Avoid leaking a diva-gsp device
audio/jack: Fix use of qemu_thread_set_name() on macOS
hw/m68k/mcf_intc: Use qdev input gpios for input IRQs
ati-vga: Allow setting EDID parameters directly
hppa: Use 44 bit physical addresses for PA-8700
hppa: Get physical address space bits from HPPACPUDef
hppa: Introduce HPPACPUDef
hw/char/serial: Avoid implicit conversion when tracing
hw/char/serial: Remove redundant reset
hw/char/serial: Add constants for Line Control Register
hw/char/serial: Remove unhelpful comment
hw/char/serial: Reuse fifo8_num_used()
hw/char/serial: Prefer fifo8 methods over open-coding
hw/char/serial: Remove explicit cast from void pointer
util/fifo8: Make all read-only methods const-correct
hw/arm/aspeed_ast27x0-{ssp, tsp}: Do not access SerialMM internals directly
hw/char/{diva-gsp, serial-pci-multi}: Fix deinitialization order
hw/arm/Kconfig: Fix serial selection for NPCM8XX
MAINTAINERS: Update the maintainer for the CHRP NVRAM section
...
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Add a machine property to enable/disable the mapcache.
Default it to enabled for backwards compatibility.
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Add a mapcache argument to xen_register_ioreq() allowing
the caller to optionally disable the mapcache.
All callers still call it with mapcache = true so there's no
functional change yet.
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Conditionalize use of the mapcache. This is in preparation
to optionally disable the mapcache at runtime.
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Acked-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Add function to check if the mapcache is enabled.
No functional change.
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Assert that the mapcache was created prior to being used.
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
The "disable" property is not used, so drop it.
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Message-ID: <20260307195243.8813-3-deller@kernel.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Create a Diva-gsp unconditionally on all 64-bit PCI machines.
The A400 usually comes with a Diva card. The C3700 has a built-in
SUPERIO chip, which we haven't implemented yet, so running with an
emulated Diva is the best we can do for now.
Signed-off-by: Helge Deller <deller@gmx.de>
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20260307195243.8813-2-deller@kernel.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Since commit 8f68a33ad4 we get on macOS:
Audio backends
CoreAudio support : YES
PipeWire support : NO
JACK support : YES 1.9.22
../audio/jackaudio.c:654:12: error: unused function 'qjack_thread_creator' [-Werror,-Wunused-function]
654 | static int qjack_thread_creator(jack_native_thread_t *thread,
| ^~~~~~~~~~~~~~~~~~~~
This is simply due to a missing #ifdef'ry change. Update
so we can use the new qemu_thread_set_name() exposed by
commit 46255cc2be.
Fixes: 8f68a33ad4 ("audio: make jackaudio use qemu_thread_set_name")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Message-Id: <20260307114923.75394-1-philmd@linaro.org>
The m68k mcf_intc interrupt controller currently implements its
inbound IRQ lines by calling qemu_allocate_irqs() in mcf_intc_init().
This results in leaks like this:
Direct leak of 2944 byte(s) in 46 object(s) allocated from:
#0 0x5cf95ec15323 in malloc (/home/pm215/qemu/build/san/qemu-system-m68k+0xf9e323) (BuildId: 18d55ef8ea9856e68ee30802078af5050b8b06c5)
#1 0x7637c65c5ac9 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62ac9) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
#2 0x5cf95f6b2f27 in object_new_with_type /home/pm215/qemu/build/san/../../qom/object.c:767:15
#3 0x5cf95f6aa62e in qemu_allocate_irq /home/pm215/qemu/build/san/../../hw/core/irq.c:91:25
#4 0x5cf95f6aa62e in qemu_extend_irqs /home/pm215/qemu/build/san/../../hw/core/irq.c:79:16
#5 0x5cf95f5f6d99 in mcf5208evb_init /home/pm215/qemu/build/san/../../hw/m68k/mcf5208.c:310:11
This isn't an important leak, as it is memory we allocate once at
QEMU startup and that has to stay live for the lifetime of the
system. However it does point at a code improvement.
Modernise this to have the device itself create inbound GPIOs with
qdev_init_gpio_in() that the board can then refer to and wire up
individually.
As the device is used in only a single board, we can update device
and board in a single patch rather than having to try to figure out
some way to change the API more piecemeal.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <th.huth+qemu@posteo.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260306190425.3047580-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
The EDID generation has some parameters that can be set via properties
but since ati-vga uses i2c-ddc it is only accessible with -global
option. Expose these properties so users can more easily set it via
e.g. -device ati-vga,xres=1024,yres=768.
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <20260305233717.1D08F5969F6@zero.eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
This is in line with the PA-8700 specification which demands 44 bits.
However, this change breaks the SeaBIOS functional tests as the firmware
assumes 40 bit physical addresses. Therefore, change the functional
tests to instead run on an A400 which has the expected physical address
space size.
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Anton Johansson <anjo@rev.ng>
Message-ID: <20260305-hppa-c3600-v6-3-d51526e5269c@rev.ng>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260305-hppa-c3600-v6-2-d51526e5269c@rev.ng>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Restructures the CPU class heirarchy to clarify model names and allow
for per-model configuration options via HPPACPUDef. 32-bit HPPA is
assumed to run a PA-7300LC, and 64-bit assumed to run a PA-8700.
A new PA-8500 model is added, which will later be used by the A400
machine. All CPU models are made into children of the now abstract
TYPE_HPPA_CPU base class.
Two fields are added to HPPACPUDef describing the size of the physical
address space, and whether or not the CPU uses the PA-RISC 2.0
architecture. The latter was previously a field in CPUHPPAState.
phys_addr_bits is currently set but unused, and will be used in the
following commit. Likewise, PA-8700 is moved to use 44 bit physical
addresses in a followup commit to not break bisection.
References to "hppa/hppa64" models in test cases are also updated.
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260305-hppa-c3600-v6-1-d51526e5269c@rev.ng>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
On 64 bit targets, the MemoryRegion API passes an address and a value as
uint64_t, so use that for tracing. Keep the uint8_t for reading since
this is what the device model produces. On targets with less than 64
bits, uint64_t is wide enough to avoid narrowing.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-ID: <20260305220911.131508-12-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
There is no need to invoke the reset method in realize since the reset
framework will do so anyway before the machine starts.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20260305220911.131508-11-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Substitute some magic numbers by named constants for slightly improved
readability.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20260305220911.131508-10-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
There is no "is_load" flag and one can tell from the method name what
the method does. Remove this unhelpful comment.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20260305220911.131508-9-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Avoids accessing private fields of struct Fifo8. Now, TYPE_SERIAL only
accesses struct Fifo8 through its methods.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260305220911.131508-8-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Use fifo8_is_empty() and fifo8_is_full() to improve readability of the
code.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260305220911.131508-7-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
A void pointer asks for being casted, so C allows for omitting the
explicit cast. Take advantage of that.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260305220911.131508-6-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Allows these methods to be used in const contexts, i.e. where the parent
of the fifo itself is const. This is in particular useful for Rust code.
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260305220911.131508-5-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
SerialMM inherits from SysBusDevice and exposes the memory region by
means of sysbus_mmio_get_region(). Use that in order to avoid accessing
implementation details of SerialMM.
Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-ID: <20260305220911.131508-4-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
The memory region is owned by the device being unrealized, so must be
removed from the mapping before unrealizing.
Fixes: d66bbea4e0 ("serial: add 2x + 4x pci variant")
Fixes: 2740747084 ("hw/char: Add emulation of Diva GSP PCI management boards")
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-ID: <20260305220911.131508-3-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
CONFIG_SERIAL selects the internal TYPE_SERIAL device which is akin to
an "IP block" that needs to be integrated with glue logic. In case of
NPCM8XX this glue logic is TYPE_SERIAL_MM which the code uses already.
Fix Kconfig to select CONFIG_SERIAL_MM which matches TYPE_SERIAL_MM.
Fixes: ae0c4d1a12 ("hw/arm: Add NPCM8XX SoC")
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20260305220911.131508-2-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
I am not involved in the ppc machines anymore (the pseries machine was
the reason why I took over maintainership of the CHRP NVRAM code in the
past), so it does not make much sense that I'm still listed here as the
maintainer.
The CHRP NVRAM code is used by the mac99 / g3beige ppc machines and
some Sparc machines, too, where Mark is the maintainer, so I asked him
whether he would be interested in being listed as the maintainer here,
and fortunately, he agreed! Thanks, Mark!
Signed-off-by: Thomas Huth <thuth@redhat.com>
Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-ID: <20260305192223.6214-1-thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
There are other registers in the PHY model which should be partially or
entirely read-only, but this solves the immediate issue.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3297
Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-ID: <20260305-xilinx-phy-protection-v1-1-ffc9edd84e58@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Add digest to vmstate if needed. Clear digest before
loading vmstate to make sure it is initialized.
Fixes: db1ecfb473 ("hw/uefi: add var-service-vars.c")
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260304075954.584423-1-kraxel@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Cocoa automatically zooms for a HiDPI display like Retina and makes
the display blurry. Revert the automatic zooming.
Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260304-zoom-v2-1-2eebf2b51106@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tuxfamily.org has had many outages in the recent years and will likely
go away in the near future:
https://forum.tuxfamily.org/post/3381/#p3381
Thus replace my @tuxfamily.org address with another one that is more
reliable and hopefully will survive longer.
Signed-off-by: Thomas Huth <huth@tuxfamily.org>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20260303203044.8403-1-huth@tuxfamily.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
The xilinx_ethlite network device wasn't checking that the TX packet
size set by the guest was within the size of its dual port RAM, with
the effect that the guest could get it to read off the end of the RAM
block.
Check the length. There is no provision in this very simple device
for reporting errors, so as with various RX errors we just report via
tracepoint.
This lack of length check has been present since the device was first
introduced, though the code implementing the tx path has changed
somewhat since then.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3317
Fixes: b43848a100 ("xilinx: Add ethlite emulation")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-ID: <20260303172718.437015-1-peter.maydell@linaro.org>
[PMD: renamed size -> tx_size to avoid shadow=compatible-local error]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Both supported ROPs follow the same memory set dirty logic.
This consolidates that logic to remove the duplication.
Signed-off-by: Chad Jablonski <chad@jablonski.xyz>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <20260303024730.1489136-9-chad@jablonski.xyz>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
The Mobility M6 register reference (DST_HEIGHT_WIDTH) states that dst_y is
updated after a blit but this appears to not be the case.
Hardware testing revealed that both the R128 and R100 do not update
dst_x or dst_y after a blit, regardless of the source. This removes
the update.
Signed-off-by: Chad Jablonski <chad@jablonski.xyz>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <20260303024730.1489136-8-chad@jablonski.xyz>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Implement read and write operations on SC_TOP_LEFT, SC_BOTTOM_RIGHT,
and SRC_SC_BOTTOM_RIGHT registers. These registers are also updated
when the src and/or dst clipping fields on DP_GUI_MASTER_CNTL are set
to default clipping.
Scissor clipping is used when rendering text in X.org. The r128 driver
sends host data much wider than is necessary to draw a glyph and cuts it
down to size using clipping before rendering. The actual clipping
implementation follows in a future patch.
This also includes a very minor refactor of the combined
default_sc_bottom_right field in the registers struct to
default_sc_bottom and default_sc_right. This was done to
stay consistent with the other scissor registers and prevent repeated
masking and extraction.
Signed-off-by: Chad Jablonski <chad@jablonski.xyz>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <20260303024730.1489136-7-chad@jablonski.xyz>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
These are straightforward 32-bit register write handlers. They're
necessary for a future patch which will use them for color expansion
from monochrome host data transfers.
Signed-off-by: Chad Jablonski <chad@jablonski.xyz>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <20260303024730.1489136-6-chad@jablonski.xyz>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Hardware testing on the Rage 128 confirms that (SRC/DST)_OFFSET,
and (SRC/DST)_PITCH are latched when (SRC/DST)_PITCH_OFFSET_CNTL bits
in DP_GUI_MASTER_CNTL are set to "default".
The earlier approach looked at the state of the (SRC/DST)_PITCH_OFFSET_CNTL
bits when offset and pitch registers were used. This meant that when
(SRC/DST)_PITCH_OFFSET_CNTL was reset to "leave alone" the old values
stored in the registers would return. This is not how the real hardware
works.
Signed-off-by: Chad Jablonski <chad@jablonski.xyz>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <20260303024730.1489136-5-chad@jablonski.xyz>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
DP_GUI_MASTER_CNTL aliases several fields from DP_DATATYPE and DP_MIX.
These were being written correctly but not returned on a read of
DP_GUI_MASTER_CNTL.
Signed-off-by: Chad Jablonski <chad@jablonski.xyz>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <20260303024730.1489136-4-chad@jablonski.xyz>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reading DST_PITCH and SRC_PITCH on the Rage 128 is broken. The read
handlers attempt to construct the value from pitch and tile bits in
the register state but mistakenly AND them instead of ORing them. This
means the pitch is always zero on read.
Signed-off-by: Chad Jablonski <chad@jablonski.xyz>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <20260303024730.1489136-3-chad@jablonski.xyz>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Rage 128 cards always request 64MB for their linear (framebuffer)
aperture and R100 cards always request 128MB. This is regardless
of the amount of physical VRAM on the board. The following are results
from real hardware tests:
Card VRAM PCI BAR0 CONFIG_MEMSIZE CONFIG_APER_SIZE AGP_APER_OFFSET
----------------------- ---- -------- -------------- ---------------- ---------------
Rage 128 Pro Ultra TF 32MB 64MB 0x02000000 0x02000000 0x02000000
Rage 128 RF/SG AGP 16MB 64MB 0x01000000 0x02000000 0x02000000
Radeon R100 QD [Radeon 7200] 64MB 128MB 0x04000000 0x04000000 N/A
Radeon RV100 QY [Radeon 7000/VE] 32MB 128MB 0x02000000 0x04000000 N/A
Previously the linear aperture (BAR0) would match the VRAM size.
This discrepancy caused issues with the X.org and XFree86 r128 drivers.
These drivers apply a mask of 0xfc000000 (2^26 = 64MB) to the linear
aperture address. If that address is not on a 64MB boundary the
framebuffer points to an incorrect memory location.
Testing shows that the Radeon R100 also has a BAR0 larger than VRAM
(128MB in this case) and the X.org radeon driver also masks to 64MB.
For Rage 128, CONFIG_APER_SIZE also differs from the previous value and
the behavior stated in the documentation. The Rage 128 register guide
states that it should contain the size of the VRAM + AGP memory. The cards
tested above show that this isn't the case. These tests also included
enabling/disabling AGP with 8MB of memory. It didn't change the
contents of CONFIG_APER_SIZE.
For both Rage 128 and R100 the CONFIG_APER_SIZE is half of the PCI BAR0 size.
Signed-off-by: Chad Jablonski <chad@jablonski.xyz>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <20260303024730.1489136-2-chad@jablonski.xyz>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
This is redundant since the 2.4 machine types were dropped.
Fixes: 4c82e7b34b
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260225165400.605941-1-berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
The return value of kvm_irqchip_add_irqfd_notifier_gsi() was being
ignored. Propagate the error to the caller via errp.
Also change setup_interrupt() to return bool to follow QEMU error
handling conventions, making error checks at call sites simpler.
Resolves the TODO comment at the call site.
Signed-off-by: David Hamilton <dahamilt0@gmail.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20260225121323.5395-2-dahamilt0@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
By turning the inline functions into stubs we can avoid the
use of target-specific CONFIG_DEVICES include in a hw/ header,
allowing to build the source files including it as common objects.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Farhan Ali<alifm@linux.ibm.com>
Message-Id: <20260225031658.32095-4-philmd@linaro.org>
Move stubs to the global stub_ss[] source set. These files
are now built once for all binaries, instead of one time
per system binary.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260225035739.42848-12-philmd@linaro.org>
Move stubs to the global stub_ss[] source set. These files
are now built once for all binaries, instead of one time
per system binary.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260225035739.42848-10-philmd@linaro.org>
Peter Maydell
Ross Lagerwall
Liam Merwick
Edgar E. Iglesias
Helge Deller
Philippe Mathieu-Daudé
BALATON Zoltan
Anton Johansson
Bernhard Beschow
Thomas Huth
Jim MacArthur
Gerd Hoffmann
Akihiko Odaki
Thomas Huth
Chad Jablonski
Daniel P. Berrangé
David Hamilton