Branch: refs/heads/staging
  Home:   https://github.com/qemu/qemu
  Commit: 8dcfb54090330c877ad5a05be5e555714eeb870c
      
https://github.com/qemu/qemu/commit/8dcfb54090330c877ad5a05be5e555714eeb870c
  Author: Philippe Mathieu-Daudé <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/arm/armv7m.c

  Log Message:
  -----------
  hw/arm/armv7m: Expose and access System Control Space as little endian

We only build ARM system emulators using little
endianness, so the MO_TE definition always expands to
MO_LE, and DEVICE_TARGET_ENDIAN to DEVICE_LITTLE_ENDIAN.

Replace the definitions by their expanded value, making
it closer to the Armv7-M Architecture Reference Manual
(ARM DDI 0403E) description:

  The System Control Space (SCS, address range 0xE000E000 to
  0xE000EFFF) is a memory-mapped 4KB address space that provides
  32-bit registers for configuration, status reporting and control.
  All accesses to the SCS are little endian.

Fixes: d5d680cacc ("memory: Access MemoryRegion with endianness")
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <[email protected]>


  Commit: 02e521462405d9fd84b49787f6d8ae9b93d9b13c
      
https://github.com/qemu/qemu/commit/02e521462405d9fd84b49787f6d8ae9b93d9b13c
  Author: Bernhard Beschow <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/arm/imx8mp-evk.c

  Log Message:
  -----------
  hw/arm/imx8mp-evk: Fix reference count of SoC object

TYPE_FSL_IMX8MP is created using object_new(), so must be realized with
qdev_realize_and_unref() to keep the reference counting intact.

Fixes: a4eefc69b237 "hw/arm: Add i.MX 8M Plus EVK board"
Signed-off-by: Bernhard Beschow <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>


  Commit: 26c1c41e8ca2d510a3bdb888d9341a07ab13b20c
      
https://github.com/qemu/qemu/commit/26c1c41e8ca2d510a3bdb888d9341a07ab13b20c
  Author: Bernhard Beschow <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/arm/fsl-imx8mp.c
    M hw/arm/imx8mp-evk.c
    M include/hw/arm/fsl-imx8mp.h

  Log Message:
  -----------
  hw/arm/fsl-imx8mp: Derive struct FslImx8mpState from TYPE_SYS_BUS_DEVICE

Deriving from TYPE_SYS_BUS_DEVICE fixes the SoC object to be reset upon machine
reset. It also makes the SoC implementation not user-creatable which can trigger
the following crash:

  $ ./qemu-system-aarch64  -M virt -device fsl-imx8mp
  **
  ERROR:../../devel/qemu/tcg/tcg.c:1006:tcg_register_thread: assertion failed:
  (n < tcg_max_ctxs)
  Bail out! ERROR:../../devel/qemu/tcg/tcg.c:1006:tcg_register_thread:
  assertion failed: (n < tcg_max_ctxs)
  Aborted (core dumped)

Fixes: a4eefc69b237 "hw/arm: Add i.MX 8M Plus EVK board"
Reported-by: Thomas Huth <[email protected]>
Suggested-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Bernhard Beschow <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>


  Commit: f32d678252134779d1f129d80435e827877136f5
      
https://github.com/qemu/qemu/commit/f32d678252134779d1f129d80435e827877136f5
  Author: Bernhard Beschow <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M include/hw/arm/fsl-imx8mp.h

  Log Message:
  -----------
  hw/arm/fsl-imx8mp: Remove unused define

The SoC has three SPI controllers, not four.
Remove the extra define of an SPI IRQ.

Fixes: 06908a84f036 "hw/arm/fsl-imx8mp: Add SPI controllers"
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Bernhard Beschow <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>


  Commit: 581ca58246c1906701680292dfa04af1d129308d
      
https://github.com/qemu/qemu/commit/581ca58246c1906701680292dfa04af1d129308d
  Author: Richard Henderson <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M include/hw/core/cpu.h
    M target/sparc/cpu.h
    M target/sparc/mmu_helper.c

  Log Message:
  -----------
  hw/core/cpu: Use size_t for memory_rw_debug len argument

Match the prototype of cpu_memory_rw_debug().

Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Pierrick Bouvier <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>


  Commit: 82bdce7b9453df2ede67d2b7f01b6e9e4491f408
      
https://github.com/qemu/qemu/commit/82bdce7b9453df2ede67d2b7f01b6e9e4491f408
  Author: Philippe Mathieu-Daudé <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/block/m25p80.c

  Log Message:
  -----------
  hw/block/m25p80: Categorize and add description

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Message-Id: <[email protected]>


  Commit: 43b815eae1bd7ef11a5985e1f52fe65ea698f75d
      
https://github.com/qemu/qemu/commit/43b815eae1bd7ef11a5985e1f52fe65ea698f75d
  Author: Philippe Mathieu-Daudé <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/display/dm163.c

  Log Message:
  -----------
  hw/display/dm163: Add description

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Message-Id: <[email protected]>


  Commit: c0a1dabd0b5ea8da520957c23ebdb243d955991d
      
https://github.com/qemu/qemu/commit/c0a1dabd0b5ea8da520957c23ebdb243d955991d
  Author: Philippe Mathieu-Daudé <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/dma/i82374.c

  Log Message:
  -----------
  hw/dma/i82374: Categorize and add description

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Message-Id: <[email protected]>


  Commit: facfc943cb943ae05997a22642334558751c2bdb
      
https://github.com/qemu/qemu/commit/facfc943cb943ae05997a22642334558751c2bdb
  Author: Thomas Huth <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M docs/about/deprecated.rst

  Log Message:
  -----------
  hw/mips: Mark the "mipssim" machine as deprecated

We are not aware of anybody still using this machine, support for it
has been withdrawn from the Linux kernel (i.e. there also won't be
any future development anymore), and we are not aware of any binaries
online that could be used for regression testing to avoid that the
machine bitrots ... thus let's mark it as deprecated now.

Signed-off-by: Thomas Huth <[email protected]>
Acked-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>


  Commit: 2542d5cf471a38c4ceb9717708178938b96ded47
      
https://github.com/qemu/qemu/commit/2542d5cf471a38c4ceb9717708178938b96ded47
  Author: Heinrich Schuchardt <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/rtc/goldfish_rtc.c

  Log Message:
  -----------
  hw/rtc/goldfish: keep time offset when resetting

Currently resetting the leads to resynchronizing the Goldfish RTC
with the system clock of the host. In real hardware an RTC reset
would not change the wall time. Other RTCs like pl031 do not show
this behavior.

Move the synchronization of the RTC with the system clock to the
instance realization.

Cc: [email protected]
Reported-by: Frederik Du Toit Lotter <[email protected]>
Fixes: 9a5b40b8427 ("hw: rtc: Add Goldfish RTC device")
Signed-off-by: Heinrich Schuchardt <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>


  Commit: 490aaae935b6461cfe30660e819317521b255321
      
https://github.com/qemu/qemu/commit/490aaae935b6461cfe30660e819317521b255321
  Author: Philippe Mathieu-Daudé <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/misc/bcm2835_cprman.c
    M hw/misc/npcm_clk.c
    M hw/misc/stm32l4x5_rcc.c

  Log Message:
  -----------
  hw/misc/pll: Do not expose as user-creatable

All these devices are part of SoC components and can not
be created manually.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Message-Id: <[email protected]>


  Commit: b2e72fadc8119aa1ad3de9528d991be4d348cca5
      
https://github.com/qemu/qemu/commit/b2e72fadc8119aa1ad3de9528d991be4d348cca5
  Author: Philippe Mathieu-Daudé <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/nvram/xlnx-efuse.c

  Log Message:
  -----------
  hw/nvram/xlnx-efuse: Do not expose as user-creatable

This device is part of SoC components thus can not
be created manually.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Message-Id: <[email protected]>


  Commit: 48ca224250444150f21cbded5745a0e36703b5e7
      
https://github.com/qemu/qemu/commit/48ca224250444150f21cbded5745a0e36703b5e7
  Author: Zheng Huang <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/scsi/lsi53c895a.c

  Log Message:
  -----------
  hw/scsi/lsi53c895a: fix memory leak in lsi_scsi_realize()

Address a memory leak bug in the usages of timer_del().

The issue arises from the incorrect use of the ambiguous timer API
timer_del(), which does not free the timer object. The LeakSanitizer
report this issue during fuzzing. The correct API timer_free() freed
the timer object instead.

=================================================================
==2586273==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 48 byte(s) in 1 object(s) allocated from:
    #0 0x55f2afd89879 in calloc 
/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:75:3
    #1 0x7f443b93ac50 in g_malloc0 
(/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ec50)
    #2 0x55f2b053962e in timer_new include/qemu/timer.h:542:12
    #3 0x55f2b0514771 in timer_new_us include/qemu/timer.h:582:12
    #4 0x55f2b0514288 in lsi_scsi_realize hw/scsi/lsi53c895a.c:2350:24
    #5 0x55f2b0452d26 in pci_qdev_realize hw/pci/pci.c:2174:9

Signed-off-by: Zheng Huang <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>


  Commit: 1c2d03bb0889b7a9a677d53126fb035190683af4
      
https://github.com/qemu/qemu/commit/1c2d03bb0889b7a9a677d53126fb035190683af4
  Author: Zheng Huang <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/sd/sdhci-pci.c

  Log Message:
  -----------
  hw/sd/sdhci: free irq on exit

Fix a memory leak bug in sdhci_pci_realize() due to s->irq
not being freed in sdhci_pci_exit().

Signed-off-by: Zheng Huang <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
[PMD: Moved qemu_free_irq() call before sdhci_common_unrealize()]
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>


  Commit: 70fe5ae121ce3013ac3a29809ed86c3837ad43ee
      
https://github.com/qemu/qemu/commit/70fe5ae121ce3013ac3a29809ed86c3837ad43ee
  Author: Chung-Yi Chen <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/char/bcm2835_aux.c

  Log Message:
  -----------
  hw/char/bcm2835_aux: Fix incorrect interrupt ID when RX disabled

Fix a misconfiguration issue in the read implementation of the
AUX_MU_IIR_REG register. This issue can lead to a transmit interrupt
being incorrectly interpreted as a receive interrupt when the receive
interrupt is disabled and the receive FIFO holds valid bytes.

The AUX_MU_IIR_REG register (interrupt ID bits [2:1]) indicates the
status of mini UART interrupts:

    - 00: No interrupts
    - 01: Transmit FIFO is empty
    - 10: Receive FIFO is not empty
    - 11: <Not possible>

When the transmit interrupt is enabled and the receive interrupt is
disabled, the original code incorrectly sets the interrupt ID bits.
Specifically:

    1. Transmit FIFO empty, receive FIFO empty
        - Expected 0b01, returned 0b01 (correct)
    2. Transmit FIFO empty, receive FIFO not empty
        - Expected 0b01, returned 0b10 (incorrect)

In the second case, the code sets the interrupt ID to 0b10 (receive FIFO
is not empty) even if the receive interrupt is disabled.

To fix this, the patch adds additional condition for setting the
interrupt ID bits to also check if the receive interrupt is enabled.

Reference: BCM2835 ARM Peripherals, page 13. Available on
https://datasheets.raspberrypi.com/bcm2835/bcm2835-peripherals.pdf

Fixes: 97398d900ca ("bcm2835_aux: add emulation of BCM2835 AUX (aka  UART1) 
block")
Signed-off-by: Chung-Yi Chen <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>


  Commit: c458f9474d6574505ce9144ab1a90b951e69c1bd
      
https://github.com/qemu/qemu/commit/c458f9474d6574505ce9144ab1a90b951e69c1bd
  Author: Zheng Huang <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/ufs/ufs.c

  Log Message:
  -----------
  hw/ufs: free irq on exit

Fix a memory leak bug in ufs_init_pci() due to u->irq
not being freed in ufs_exit().

Signed-off-by: Zheng Huang <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>


  Commit: 04e99f9eb7920b0f0fcce65686c3bedf5e32a1f9
      
https://github.com/qemu/qemu/commit/04e99f9eb7920b0f0fcce65686c3bedf5e32a1f9
  Author: Philippe Mathieu-Daudé <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/pci-host/designware.c

  Log Message:
  -----------
  hw/pci-host/designware: Fix ATU_UPPER_TARGET register access

Fix copy/paste error writing to the ATU_UPPER_TARGET
register, we want to update the upper 32 bits.

Cc: [email protected]
Reported-by: Joey <[email protected]>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2861
Fixes: d64e5eabc4c ("pci: Add support for Designware IP block")
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Gustavo Romero <[email protected]>
Message-Id: <[email protected]>


  Commit: fb5bc76cae61b7c65e71ccf1c6027bf878f5b7dc
      
https://github.com/qemu/qemu/commit/fb5bc76cae61b7c65e71ccf1c6027bf878f5b7dc
  Author: Philippe Mathieu-Daudé <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M target/hppa/cpu.h

  Log Message:
  -----------
  target/hppa: Remove duplicated CPU_RESOLVING_TYPE definition

The CPU_RESOLVING_TYPE definition was added in commit
0dacec874fa ("cpu: add CPU_RESOLVING_TYPE macro"), but
then added again in commit d3ae32d4d20. Remove the
duplication.

Fixes: d3ae32d4d20 ("target/hppa: Implement cpu_list")
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <[email protected]>


  Commit: 070a500cc0da70c1b4c62a6c95e41f0a1b19dc0b
      
https://github.com/qemu/qemu/commit/070a500cc0da70c1b4c62a6c95e41f0a1b19dc0b
  Author: Richard Henderson <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M target/avr/disas.c

  Log Message:
  -----------
  target/avr: Fix buffer read in avr_print_insn

Do not unconditionally attempt to read 4 bytes, as there
may only be 2 bytes remaining in the translator cache.

Cc: [email protected]
Reviewed-by: Pierrick Bouvier <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>


  Commit: 8001d22b0c67b2fbf8f2cb7b2f44bd7b46b360c1
      
https://github.com/qemu/qemu/commit/8001d22b0c67b2fbf8f2cb7b2f44bd7b46b360c1
  Author: Philippe Mathieu-Daudé <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M target/sparc/ldst_helper.c

  Log Message:
  -----------
  target/sparc: Log unimplemented ASI load/store accesses

When the cache-controller feature is not implemented,
log potential ASI access as unimplemented.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Clément Chigot <[email protected]>
Message-Id: <[email protected]>


  Commit: fca2817fdcb00e65020c2dcfcb0b23b2a20ea3c4
      
https://github.com/qemu/qemu/commit/fca2817fdcb00e65020c2dcfcb0b23b2a20ea3c4
  Author: Richard Henderson <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M hw/mips/fuloong2e.c
    M hw/mips/loongson3_virt.c
    M target/mips/cpu-param.h
    M target/mips/tcg/system/cp0_helper.c
    M target/mips/tcg/system/tlb_helper.c

  Log Message:
  -----------
  target/mips: Revert TARGET_PAGE_BITS_VARY

Revert ee3863b9d41 and a08d60bc6c2b.  The logic behind changing
the system page size because of what the Loongson kernel "prefers"
is flawed.

In the Loongson-2E manual, section 5.5, it is clear that the cpu
supports a 4k page size (along with many others).  Similarly for
the Loongson-3 series CPUs, the 4k page size is mentioned in the
section 7.7 (PageMask Register).  Therefore we must continue to
support a 4k page size.

Signed-off-by: Richard Henderson <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
[PMD: Mention Loongson-3 series CPUs]
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>


  Commit: d89b9899babcc01d7ee75f2917da861dc2afbc27
      
https://github.com/qemu/qemu/commit/d89b9899babcc01d7ee75f2917da861dc2afbc27
  Author: Richard Henderson <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M target/mips/tcg/system/cp0_helper.c

  Log Message:
  -----------
  target/mips: Require even maskbits in update_pagemask

The number of bits set in PageMask must be even.

Fixes: d40b55bc1b86 ("target/mips: Fix PageMask with variable page size")
Signed-off-by: Richard Henderson <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Cc: [email protected]


  Commit: 256ba7715b109c080c0c77a3923df9e69736ba17
      
https://github.com/qemu/qemu/commit/256ba7715b109c080c0c77a3923df9e69736ba17
  Author: Richard Henderson <[email protected]>
  Date:   2025-03-31 (Mon, 31 Mar 2025)

  Changed paths:
    M target/mips/tcg/system/cp0_helper.c
    M target/mips/tcg/system/tlb_helper.c
    M target/mips/tcg/tcg-internal.h

  Log Message:
  -----------
  target/mips: Simplify and fix update_pagemask

When update_pagemask was split from helper_mtc0_pagemask,
we failed to actually write to the new parameter but continue
to write to env->CP0_PageMask.  Thus the use within
page_table_walk_refill modifies cpu state and not the local
variable as expected.

Simplify by renaming to compute_pagemask and returning the
value directly.  No need for either env or pointer return.

Fixes: 074cfcb4dae ("target/mips: Implement hardware page table walker for 
MIPS32")
Signed-off-by: Richard Henderson <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Cc: [email protected]


  Commit: f0095c8ad93de7652aba36c4c713d9035417bea8
      
https://github.com/qemu/qemu/commit/f0095c8ad93de7652aba36c4c713d9035417bea8
  Author: Philippe Mathieu-Daudé <[email protected]>
  Date:   2025-04-01 (Tue, 01 Apr 2025)

  Changed paths:
    M hw/misc/aspeed_scu.c

  Log Message:
  -----------
  hw/misc/aspeed_scu: Set MemoryRegionOps::impl::access_size to 32-bit

All MemoryRegionOps::read/write() handlers switch over a 32-bit
aligned value, because converted using TO_REG(), which is defined
as:

  #define TO_REG(offset) ((offset) >> 2)

So all implementations are 32-bit.
Set min/max access_size accordingly.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Andrew Jeffery <[email protected]>
Link: 
https://lore.kernel.org/qemu-devel/[email protected]
Signed-off-by: Cédric Le Goater <[email protected]>


  Commit: 20ab88a9066bcacc28acbd7cbe2c617d90bfb27e
      
https://github.com/qemu/qemu/commit/20ab88a9066bcacc28acbd7cbe2c617d90bfb27e
  Author: Joel Stanley <[email protected]>
  Date:   2025-04-01 (Tue, 01 Apr 2025)

  Changed paths:
    M hw/misc/aspeed_scu.c

  Log Message:
  -----------
  hw/misc/aspeed_scu: Correct minimum access size for AST2500 / AST2600

Guest code was performing a byte load to the SCU MMIO region, leading
to the guest code crashing (it should be using proper accessors, but
that is not Qemu's bug). Hardware and the documentation[1] both agree
that byte loads are okay, so change all of the aspeed SCU devices to
accept a minimum access size of 1.

[1] See the 'ARM Address Space Mapping' table in the ASPEED docs. This
is section 6.1 in the ast2400 and ast2700, and 7.1 in the ast2500 and
ast2600 datasheets.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2636
Signed-off-by: Joel Stanley <[email protected]>
Reviewed-by: Troy Lee <[email protected]>
Message-ID: <[email protected]>
[PMD: Rebased, only including SCU changes]
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Andrew Jeffery <[email protected]>
Link: 
https://lore.kernel.org/qemu-devel/[email protected]
Signed-off-by: Cédric Le Goater <[email protected]>


  Commit: fe9d41a734822506499c0c3ed7cc5d79e20c8723
      
https://github.com/qemu/qemu/commit/fe9d41a734822506499c0c3ed7cc5d79e20c8723
  Author: Stefan Hajnoczi <[email protected]>
  Date:   2025-04-01 (Tue, 01 Apr 2025)

  Changed paths:
    M docs/about/deprecated.rst
    M hw/arm/armv7m.c
    M hw/arm/fsl-imx8mp.c
    M hw/arm/imx8mp-evk.c
    M hw/block/m25p80.c
    M hw/char/bcm2835_aux.c
    M hw/display/dm163.c
    M hw/dma/i82374.c
    M hw/mips/fuloong2e.c
    M hw/mips/loongson3_virt.c
    M hw/misc/bcm2835_cprman.c
    M hw/misc/npcm_clk.c
    M hw/misc/stm32l4x5_rcc.c
    M hw/nvram/xlnx-efuse.c
    M hw/pci-host/designware.c
    M hw/rtc/goldfish_rtc.c
    M hw/scsi/lsi53c895a.c
    M hw/sd/sdhci-pci.c
    M hw/ufs/ufs.c
    M include/hw/arm/fsl-imx8mp.h
    M include/hw/core/cpu.h
    M target/avr/disas.c
    M target/hppa/cpu.h
    M target/mips/cpu-param.h
    M target/mips/tcg/system/cp0_helper.c
    M target/mips/tcg/system/tlb_helper.c
    M target/mips/tcg/tcg-internal.h
    M target/sparc/cpu.h
    M target/sparc/ldst_helper.c
    M target/sparc/mmu_helper.c

  Log Message:
  -----------
  Merge tag 'hw-misc-20250331' of https://github.com/philmd/qemu into staging

Misc HW patches

- Expose v7M System Control Space as little endian (Philippe)
- Deprecate MipsSim machine (Thomas)
- Improve some devices categories / descriptions (Philippe)
- Correct memory_rw_debug() prototype (Richard)
- Do not expose i.MX 8M SoC as user-creatable (Bernhard)
- Do not expose some PLL & eFuse devices as user-creatable (Philippe)
- Do not reset Goldfish RTC time on machine reset (Heinrich)
- Fix incorrect BCM2835 AUX interrupt ID when RX disabled (Chung-Yi)
- Fix DesignWare PCI host bridge ATU_UPPER_TARGET register access (Philippe)
- Memory leak fixes (Bernhard & Zheng Huang)
- Prevent out-of-bound access in avr_print_insn (Richard)
- Fixes around MIPS page mask (Richard)

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmfq8VYACgkQ4+MsLN6t
# wN4AvhAAyTWwGhLfelpPgfj6JHCNiUFUjp4R5a3Y2ROJ19UQ8pcK0RlE5jFNzA6G
# sUmy6cl4XK3ojT5EJ/FyVMlLniw9hWmOiIgHHLU+h2Ji+oCS3S2N2T2hFCs4vbT+
# SNjhN1RIdrlWnoSJZiiKM4njKcJxwvg0MCmvOgV70Njy+sVB9zu7YdA0i8yryXOy
# a0PDMS71hckF2HBizYrhYAhxPISK3oVoeLRUeGGQhZBUMmu+oZoEWp0DjeuMPoQv
# pUX0G7LAqNWCyhIXHEUYGAtSZJc08wEmoypbj1s9PDO5q6NEruCwiWyNHTBXzPsS
# ingMM66o2xPCk8BnWSRvpocTgi2QYI/nk+S9L5Gr+FWMGmCbiFAX6c7OH6t4jqz2
# HwqKDZ1FJzBnquT/5ABR5won0cvjsTGhr76oxEyeM3xrGKyysmrBXWYYXjnaidlc
# uzr4hc6UT6bYlN53SG1dZP6/aWWcK57MaqrJnjOmLi+VEUEC8p9iOjN+ED7QicBj
# Wc1TPMeE8TK7EVJoeor1PAyLHWE+oGDOb8Rcyauxge9cPcqZPWYeSp3HpwhLJb+K
# XbwFoSsQRCXT4acL70hkHyjfXtM1qu+g7dWFvEGPlqfuQMvfk4fOfwKbJVxb8UvO
# OO96TUPnhpxiC6gYxMRJ9ZwIbzyZ9+SG3loW1OVSmx3Ndth2mh8=
# =O3jG
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 31 Mar 2025 15:47:34 EDT
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <[email protected]>" 
[full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'hw-misc-20250331' of https://github.com/philmd/qemu: (23 commits)
  target/mips: Simplify and fix update_pagemask
  target/mips: Require even maskbits in update_pagemask
  target/mips: Revert TARGET_PAGE_BITS_VARY
  target/sparc: Log unimplemented ASI load/store accesses
  target/avr: Fix buffer read in avr_print_insn
  target/hppa: Remove duplicated CPU_RESOLVING_TYPE definition
  hw/pci-host/designware: Fix ATU_UPPER_TARGET register access
  hw/ufs: free irq on exit
  hw/char/bcm2835_aux: Fix incorrect interrupt ID when RX disabled
  hw/sd/sdhci: free irq on exit
  hw/scsi/lsi53c895a: fix memory leak in lsi_scsi_realize()
  hw/nvram/xlnx-efuse: Do not expose as user-creatable
  hw/misc/pll: Do not expose as user-creatable
  hw/rtc/goldfish: keep time offset when resetting
  hw/mips: Mark the "mipssim" machine as deprecated
  hw/dma/i82374: Categorize and add description
  hw/display/dm163: Add description
  hw/block/m25p80: Categorize and add description
  hw/core/cpu: Use size_t for memory_rw_debug len argument
  hw/arm/fsl-imx8mp: Remove unused define
  ...

Signed-off-by: Stefan Hajnoczi <[email protected]>


  Commit: d6b8cc7ee94333d028ddbc5bb16996c784bf284f
      
https://github.com/qemu/qemu/commit/d6b8cc7ee94333d028ddbc5bb16996c784bf284f
  Author: Stefan Hajnoczi <[email protected]>
  Date:   2025-04-01 (Tue, 01 Apr 2025)

  Changed paths:
    M hw/misc/aspeed_scu.c

  Log Message:
  -----------
  Merge tag 'pull-aspeed-20250401' of https://github.com/legoater/qemu into 
staging

aspeed queue:

* Fixed SCU access size on AST2500 and AST2600 SoCs

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmfr2DsACgkQUaNDx8/7
# 7KHlHg/8D5/maW8yAfQjUBfvy2+tzpV1SvBTKxSvv5n9tP3CFDSgNjFXfDnt06qK
# xNE4YzK5I7wWQ20OKXB1LfqHqaJJXT7G1Qc44ZbmfHdiISMuaZaWDjQyzXO/TDSH
# e8Svb3iV4IA2J2B6dsbPOym6XMFL9awhXurhYTxfnl9oFhkvgaP1H6Ur0/m8peOq
# HELkY18nyWbpeZyIArEagXtBb1n1ucn51dwaDLq9F+D5vXAe6NN8Am5RG/gEED6X
# P/o6/VphxR/EmijbIrixHUWmORnuXV4KI13xdLb3hyjIOtgjFPENQuUJTczwkK/8
# mpdTOj+m8ovGMuFGmvnGy6uyYRmXQarBOSSR19XPlMF1qlO7rUUzYPTl7M8M45C5
# UuU9Q60KNSiCHdQqimdZwy/IoI8nuEHMT6g2/Vd82OUJ6K/uR3V0dVel7LVEOvVj
# 1xXtNOL8Xy5W0Z84nPLOjpD1WU8Khl8m6OZR81RWR9jTj61dX9AfggkJXSzU6G0Z
# Yhv6shqYRn+LpAN/cjqUP6hR1C0iBCi+lBNG6wKq3DVCDXPCg8yEW9D+NUwVj64z
# 6BMF335RP3phkmpFMniJ83Ad4yxOmKubQcIIXjLvEiAdppxvDCjQBgYkKHRXkJV0
# wVYnfDwB2quDA1oS3tLibvRf366NjhPfJhMx+yiL4RgFUQ/BvfI=
# =VRwA
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 01 Apr 2025 08:12:43 EDT
# gpg:                using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <[email protected]>" [full]
# gpg:                 aka "Cédric Le Goater <[email protected]>" [full]
# Primary key fingerprint: A0F6 6548 F048 95EB FE6B  0B60 51A3 43C7 CFFB ECA1

* tag 'pull-aspeed-20250401' of https://github.com/legoater/qemu:
  hw/misc/aspeed_scu: Correct minimum access size for AST2500 / AST2600
  hw/misc/aspeed_scu: Set MemoryRegionOps::impl::access_size to 32-bit

Signed-off-by: Stefan Hajnoczi <[email protected]>


Compare: https://github.com/qemu/qemu/compare/0f15892acaf3...d6b8cc7ee943

To unsubscribe from these emails, change your notification settings at 
https://github.com/qemu/qemu/settings/notifications

Reply via email to