Generally we expect a PMBus sensor to issue writes after all pending
reads have completed. If a data read needs to be resumed, this state can
be tracked in the device model and the pending data placed in the output
buffer.
Signed-off-by: Titus Rwantare <titusr@google.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260706230056.1888992-4-titusr@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
In the linear stream table mode (FMT = 0), if the guest programs
SMMU_STRTAB_BASE_CFG.LOG2SIZE (8 bits) to something bigger than 58,
MAKE_64BIT_MASK() will overflow. So cap the mask length to 64. We
still comply with the spec ADDR alignment computation:
ADDR[LOG2SIZE + 5:0] = 0.
In the 2 level stream table mode (FMT = 1), we don't have this risk
anymore since SPLIT is sanitized and equals to 6 at minimum.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Message-id: 20260707085028.165557-4-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
The stream table base address needs to be aligned to its size.
With FMT == 0 (linear stream table), the table size is log2size *
STE_SIZE (2^6). So the spec says the base address
must have ADDR[LOG2SIZE + 5:0] = 0.
With FMT == 1 (2 level stream table), the table size is
(log2size - split) * L1STD_SIZE (2^3) So the spec days
the effective base address is aligned by the SMMU to the larger of
64 bytes or the first-level table size:
ADDR[MAX(5, (LOG2SIZE - SPLIT - 1 + 3)):0] = 0.
MAKE_64BIT_MASK() second argument is a size and not a shift, so
fix this off-by-one computation.
Subsequent patches will fix the risk of overflow in MAKE_64BIT_MASK()
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Message-id: 20260707085028.165557-2-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
When a guest hits a command error, the hardware sets GERROR and the guest
acknowledges it by writing GERRORN to match. These registers use toggle
semantics, and since GERROR is read-only, both GERROR and GERRORN may
remain set after an error has been handled. As long as they stay equal
there is no pending error, so a subsequent VM is unaffected.
When a new VM starts, QEMU allocates the hardware VCMDQ and flushes its
cached GERRORN of zero, while the hardware may still have both GERROR and
GERRORN set from an error the previous guest acknowledged. This makes them
differ again, so the hardware sees a pending error and stall the VCMDQ,
leading to CMD_SYNC timeouts.
Do not sync GERRORN when allocating a hardware VCMDQ.
Fixes: 1d0f775354 ("hw/arm/tegra241-cmdqv: Route allocated VCMDQ Page0 accesses to the mmap'd host VINTF page0")
Suggested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20260707112450.111178-1-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Aliases are not handled, and that's why tests used them
are skipped, like this:
PYTHONPATH=python:tests/functional \
QEMU_TEST_QEMU_BINARY=$PWD/build/qemu-system-x86_64 \
MESON_BUILD_ROOT=$PWD/build \
./build/pyvenv/bin/python3 tests/functional/x86_64/test_hotplug_blk.py
TAP version 13
ok 1 test_hotplug_blk.HotPlugBlk.test # SKIP no support for machine q35
1..1
Fixes: 0e7aa78b0b ("tests/functional: use QMP to query available machines")
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20260710090317.498350-1-vsementsov@yandex-team.ru>
Signed-off-by: Thomas Huth <th.huth@posteo.eu>
Merge tpm 2026/07/10 v1
# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEuBi5yt+QicLVzsZrda1lgCoLQhEFAmpRAe4ACgkQda1lgCoL
# QhGL0gf9HIR8FclQjPEi4qEYylE0hD7CXEpOkxmiX3dIP8fVn/FX8fYjSetgcJdb
# DINIiph2ypTRv+ZUtAC+s8UaYMCYUV9CM5Fs3TnwEayAvVNuuIRfz5gi00eZyprE
# RxL4b6LMoucTm9HnBre8SYlGzlb25MgstHy86s0vl4O9LuLZ9PgJq8aONp99YvCK
# IdAIbyOoL3wAyzpK55igRa1Ld6uxLGALByWWXZOKyLnutog/V8yOhV2uo70h8u6j
# DhFeAVNTZHDRwFvONO1n0M97mY21tWaU4QQ3gmznEknfpnbB66y503LhuKwmlOgg
# FdOSO+cB93wECvXi7uK7nR9VYHMDsg==
# =WrOS
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 10 Jul 2026 16:30:06 CEST
# gpg: using RSA key B818B9CADF9089C2D5CEC66B75AD65802A0B4211
# gpg: Good signature from "Stefan Berger <stefanb@linux.vnet.ibm.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B818 B9CA DF90 89C2 D5CE C66B 75AD 6580 2A0B 4211
* tag 'pull-tpm-2026-07-10-1' of https://github.com/stefanberger/qemu-tpm:
hw/core/machine: disable tpm-tis-device PPI for machine type <= 11.0
hw/tpm: gate PPI support on tpm-tis-device behind a device property
hw/core/platform-bus: guard platform_bus_get_mmio_addr() against NULL
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Merge the PT_LOAD loop with the PT_INTERP loop, as the XXX
comment suggests. Pass the probed range to probe_guest_base.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Prepare to share probe_guest_base with bsd-user.
Create a linux_probe_guest_base wrapper with the portions
of probe_guest_base that are linux specific: managing the
commpage for various targets.
Reviewed-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This interface is only used for user-only. It's more usefully
placed within common-user than util. Temporarily add stub
implementation for bsd-user.
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Introduce user/mmap-min-addr.h. Initialize the variable
from a constructor instead of main.
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This simplifies check for no commpage to a NULL pointer
check, rather than reserved values for LO_COMMPAGE and
HI_COMMPAGE.
Unify {LO,HI}_COMMPAGE into a single COMMPAGE define.
Acked-by: Warner Losh <imp@bsdimp.com>
Tested-by: Helge Deller <deller@gmx.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Since dropping 32-bit host support, a guest address cannot
overflow a host pointer. This means guest_hiaddr is unused
for relocatable images, so don't pass guest_hiaddr as size.
Reviewed-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Create a structure to hold a beginning/end range for guest virtual
addresses, for use by probe_guest_base. Use vaddr for clarity.
Reviewed-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Add a "ppi" boolean property (default: true) to tpm-tis-device.
When ppi=off the RAMBlock is never registered and the migration
stream omits "tpm-ppi", restoring backward compatibility.
Move sysbus_init_mmio() calls from instance_init to realizefn so
the memory regions are initialized before being registered. When
ppi=off, the PPI MMIO region is simply not exposed.
Fixes: 46cd2c1050 ("hw/tpm: add PPI support to tpm-tis-device for ARM64 virt")
Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260619093140.832136-3-mbawa@redhat.com
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
sysbus_mmio_get_region() returns NULL when a device has fewer MMIO
regions than the requested slot index. platform_bus_get_mmio_addr()
passes the result directly to memory_region_is_mapped() without a
NULL check, causing a SIGSEGV.
Return -1 early when the region pointer is NULL, consistent with the
existing "not mapped" path.
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260619093140.832136-2-mbawa@redhat.com
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
RISC-V PR for 11.1
* Fix IOMMU fault type for spa_fetch() faults
* Check IOMMU for reserved PTE bits
* Fault when IOMMU !PTE_U and no priv access
* Fault IOMMU for non-user PTE in G_STAGE
* Check IOMMU reserved MSI PTE basic bits
* Record fault on IOMMU-generated MSI write
* Move RISC-V TCG files and fix --disable-tcg
* Check for misaligned IOMMU IOHGATP_PPN
* Update IOMMU ioval2 when faulting in spa_fetch()
* Forbid IOMMU GATE/SADE if caps.AMO_HWADD is zero
* Set IOMMU ftype and iova in riscv_iommu_ctx()
* Check PCIe DOE mailbox length for overflows
* Add extensions after v7.1-rc4 update
* Remove job building OpenSBI firmware binaries
* Correct ACPI field sequence in SPCR table
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmpQXvUACgkQr3yVEwxT
# gBPkyQ/+J3Lhx3W1Go5+m4oRBbCPxq5w4ZyV3VUPNBcwLXtcZJQNiW2YghCGegNn
# 1HJzHihA1W9YromNlmIJzcOOWM81yScf0tV29NXCQW0Si1N9cA2jr4z8Nunwcndu
# L+T5s5nLKaijwM0xnL4CtnhZ3fu+gcowS1V2ohaQvRyMVkHCHUsz9nqoHa/j6GsX
# ipItcOQt6tXcAD1n+MqD5lm1UlQ1eV1d3pMLIwTU3+WpvDJzgOGriF+t56kbVIlT
# NcyT2ShmSSVpl6nu8VqqmE8nMLkKzw7c6uAJI8QR99yCqCWeFhkCeE6boE0CWFZl
# qAsmWL3tY1FcKU1bKiSZBaeDDFJUq1lKTMzJFyTDOR6O0kuVtUi9vJvSK1BXyGza
# zBjmRvnZYVM1CPu6IE/HvVWc3L1EECv1v6LF+yIOKfSpWe5k+AM8NN82awHPBQLO
# wnsUWFziecLae9ipdOnhmf7MB2oHiYzmjyRahgr4/ZbCOvcBdUF8l43nH067iNub
# 9DXuQt61dcayEkfz281ziiHBwSqkwK6aEpuEDcG8MFXyYth98Rl6e0iz5AHp5+rv
# YVp1sKcel9ZJSIdHb2zo/yXJNh/0tG6MChpoQnaJ2xHw+KHlRs1xZjt04itJl0lK
# utEe24epJCzE2HPeRVBTPSMRRvh5KudaAMdOgj5dsPCM6cq3qEM=
# =cZmZ
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 10 Jul 2026 04:54:45 CEST
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20260710' of https://github.com/alistair23/qemu: (40 commits)
tests: update SPCR loongarch64 and riscv64 test data
hw/acpi: correct field sequence in SPCR table
tests: allow differences in SPCR
gitlab-ci: Remove job building OpenSBI firmware binaries
target/riscv/kvm: add extensions after v7.1-rc4 update
hw/pci/pcie_doe: Check mailbox length for overflows
hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx()
hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero
hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()
hw/riscv/riscv-iommu.c: check for misaligned IOHGATP_PPN
gitlab-ci.d/crossbuilds: add riscv64 KVM-only build job
target/riscv: move riscv_cpu_set_aia_ireg_rmw_cb() to riscv_imsic
target/riscv: move riscv_cpu_set_geilen() to riscv-imsic
target/riscv/tcg: remove unused riscv_cpu_get_geilen()
target/riscv: move riscv_cpu_set_rdtime_fn to riscv_aclint
target/riscv/gdbstub.c: isolate TCG only checks
hw/riscv/riscv_hart.c isolate tcg only bits
target/riscv/cpu.c: filter TCG only bits in riscv_cpu_reset_hold()
target/riscv: gate riscv_cpu_update_mip with tcg_enabled()
target/riscv/cpu.c: handle TCG bits of riscv_cpu_dump_state
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
The OpenSBI firmware build job follows the same pattern as the EDK2 job
[1] that was removed earlier [2]: it exists to produce firmware binaries
from CI artifacts, but those outputs are not consumed by the tree.
Remove the job definition and its project include to avoid maintaining
bitrotting container and firmware build logic.
[1] 71920809ce ("gitlab-ci.yml: Add jobs to build EDK2 firmware binaries")
[2] 690ceb7193 ("gitlab-ci: Remove job building EDK2 firmware binaries")
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260706161716.29488-1-bin.meng@processmission.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
It was possible that a guest could overflow the `doe_cap->write_mbox`
buffer by writing more then PCI_DOE_DW_SIZE_MAX dwords.
`doe_cap->write_mbox_len` would continue to increment and there were no
bounds checks on the length when offsetting into doe_cap->write_mbox.
This patch adds a check and reports a guest error if we would overflow.
On an overflow we also silenty discard the entire object as instructed
to do in the PCIe spec when the length specified in the header
(up to PCI_DOE_DW_SIZE_MAX dwords) doesn't match the length of the
object.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3679
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Tao Tang <tangtao1634@phytium.com.cn>
Message-ID: <20260707020750.788960-1-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
