summary refs log tree commit diff stats
path: root/docs/devel/secure-coding-practices.rst (unfollow)
Commit message (Collapse)AuthorFilesLines
2025-05-06meson, cargo: require Rust 1.77.0Paolo Bonzini3-5/+5
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-06lcitool: use newer Rust for Debian and UbuntuPaolo Bonzini15-17/+29
On Debian, the rustc-web package provides a newer Rust compiler (1.78) for all architectures except mips64el. On Ubuntu, Rust versions up to 1.80 (?) are available as of this writing for both Jammy (22.04) and Noble (24.04). However, the path to rustc and rustdoc must be provided by hand to the configure script using either command line arguments or environment variables. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-059pfs: fix 'total_open_fd' decrementationChristian Schoenebeck3-3/+21
According to 'man 2 close' errors returned by close() should only be used for either diagnostic purposes or for catching data loss due to a previous write error, as an error result of close() usually indicates a deferred error of a previous write operation. Therefore not decrementing 'total_open_fd' on a close() error is wrong and would yield in a higher open file descriptor count than actually the case, leading to 9p server reclaiming open file descriptors too soon. Based-on: <20250312152933.383967-7-groug@kaod.org> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <E1tvEyJ-004dMa-So@kylie.crudebyte.com>
2025-05-05tests/9p: Test `Tsetattr` can truncate unlinked fileGreg Kurz1-0/+14
Enhance the `use-after-unlink` test with a new check for the case where the client wants to alter the size of an unlinked file for which it still has an active fid. Suggested-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <20250312152933.383967-7-groug@kaod.org> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
2025-05-05tests/9p: add 'Tsetattr' request to test clientChristian Schoenebeck3-0/+84
Add and implement functions to 9pfs test client for sending a 9p2000.L 'Tsetattr' request and receiving its 'Rsetattr' response counterpart. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <20250312152933.383967-6-groug@kaod.org>
2025-05-059pfs: Introduce futimens file opGreg Kurz7-1/+46
Add an futimens operation to the fs driver and use if when a fid has a valid file descriptor. This is required to support more cases where the client wants to do an action on an unlinked file which it still has an open file decriptor for. Only 9P2000.L was considered. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <20250312152933.383967-5-groug@kaod.org> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
2025-05-059pfs: Introduce ftruncate file opGreg Kurz6-1/+44
Add an ftruncate operation to the fs driver and use if when a fid has a valid file descriptor. This is required to support more cases where the client wants to do an action on an unlinked file which it still has an open file decriptor for. Only 9P2000.L was considered. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <20250312152933.383967-4-groug@kaod.org> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
2025-05-059pfs: Don't use file descriptors in core codeGreg Kurz4-3/+21
v9fs_getattr() currently peeks into V9fsFidOpenState to know if a fid has a valid file descriptor or directory stream. Even though the fields are accessible, this is an implementation detail of the local backend that should not be manipulated directly by the server code. Abstract that with a new has_valid_file_handle() backend operation. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <20250312152933.383967-3-groug@kaod.org> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
2025-05-059pfs: local : Introduce local_fid_fd() helperGreg Kurz1-13/+10
Factor out duplicated code to a single helper. More users to come. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <20250312152933.383967-2-groug@kaod.org> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
2025-05-059pfs: fix FD leak and reduce latency of v9fs_reclaim_fd()Christian Schoenebeck1-9/+20
This patch fixes two different bugs in v9fs_reclaim_fd(): 1. Reduce latency: This function calls v9fs_co_close() and v9fs_co_closedir() in a loop. Each one of the calls adds two thread hops (between main thread and a fs driver background thread). Each thread hop adds latency, which sums up in function's loop to a significant duration. Reduce overall latency by open coding what v9fs_co_close() and v9fs_co_closedir() do, executing those and the loop itself altogether in only one background thread block, hence reducing the total amount of thread hops to only two. 2. Fix file descriptor leak: The existing code called v9fs_co_close() and v9fs_co_closedir() to close file descriptors. Both functions check right at the beginning if the 9p request was cancelled: if (v9fs_request_cancelled(pdu)) { return -EINTR; } So if client sent a 'Tflush' message, v9fs_co_close() / v9fs_co_closedir() returned without having closed the file descriptor and v9fs_reclaim_fd() subsequently freed the FID without its file descriptor being closed, hence leaking those file descriptors. This 2nd bug is fixed by this patch as well by open coding v9fs_co_close() and v9fs_co_closedir() inside of v9fs_reclaim_fd() and not performing the v9fs_request_cancelled(pdu) check there. Fixes: 7a46274529c ('hw/9pfs: Add file descriptor reclaim support') Fixes: bccacf6c792 ('hw/9pfs: Implement TFLUSH operation') Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <5747469d3f039c53147e850b456943a1d4b5485c.1741339452.git.qemu_oss@crudebyte.com>
2025-05-059pfs: fix concurrent v9fs_reclaim_fd() callsChristian Schoenebeck2-0/+11
Even though this function is serialized to be always called from main thread, v9fs_reclaim_fd() is dispatching the coroutine to a worker thread in between via its v9fs_co_*() calls, hence leading to the situation where v9fs_reclaim_fd() is effectively executed multiple times simultaniously, which renders its LRU algorithm useless and causes high latency. Fix this by adding a simple boolean variable to ensure this function is only called once at a time. No synchronization needed for this boolean variable as this function is only entered and returned on main thread. Fixes: 7a46274529c ('hw/9pfs: Add file descriptor reclaim support') Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <5c622067efd66dd4ee5eca740dcf263f41db20b2.1741339452.git.qemu_oss@crudebyte.com>
2025-05-05docs: Add support for ast2700fc machineSteven Lee1-3/+66
- Updated Aspeed family boards list to include `ast2700fc`. - Added boot instructions for the `ast2700fc` machine. - Detailed the configuration and loading of firmware for the Cortex-A35 and Cortex-M4 processors. Signed-off-by: Steven Lee <steven_lee@aspeedtech.com> Change-Id: Id41312e9c7cf79bc55c6f24a87a7ad9993dc7261 Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-10-steven_lee@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05tests/function/aspeed: Add functional test for ast2700fcSteven Lee3-2/+139
Introduce a new test suite for ast2700fc machine. Rename the original test_aarch64_aspeed.py to test_aarch64_aspeed_ast2700.py. Signed-off-by: Steven Lee <steven_lee@aspeedtech.com> Change-Id: I3855f55c9f6e5cca1270c179445f549f8d81f36c Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250505030618.3612042-1-steven_lee@aspeedtech.com [ clg: Added new tests in meson.build ] Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05hw/arm: Introduce ASPEED AST2700 A1 full core machineSteven Lee2-1/+195
- Added new machine type `ast2700fc` with full core support. - Defined `Ast2700FCState` structure for the new machine type. - Implemented initialization functions for CA35, SSP, and TSP components. - Updated `ast2700fc_types` to include the new machine type. - Set machine class properties for `ast2700fc`. Test Step: - Download ast2700-default-obmc.tar.gz from AspeedTech-BMC OpenBmc release page. - Run the following QEMU command: ``` IMGDIR=~/path/to/image UBOOT_SIZE=$(stat --format=%s -L ${IMGDIR}/u-boot-nodtb.bin) ./qemu-system-aarch64 -machine ast2700fc \ -device loader,force-raw=on,addr=0x400000000,file=${IMGDIR}/u-boot-nodtb.bin \ -device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \ -device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \ -device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/tee-raw.bin \ -device loader,cpu-num=0,addr=0x430000000 \ -device loader,cpu-num=1,addr=0x430000000 \ -device loader,cpu-num=2,addr=0x430000000 \ -device loader,cpu-num=3,addr=0x430000000 \ -device loader,file=${IMGDIR}/ast2700-ssp.elf,cpu-num=4 \ -device loader,file=${IMGDIR}/ast2700-tsp.elf,cpu-num=5 \ -drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \ -serial pty -serial pty -serial pty \ -snapshot \ -S -nographic ``` - After starting QEMU, serial devices will be redirected: char device redirected to /dev/pts/51 (label serial0) char device redirected to /dev/pts/52 (label serial1) char device redirected to /dev/pts/53 (label serial2) - serial0 is the console for the four Cortex-A35 primary processors, serial1 and serial2 are the consoles for the two Cortex-M4 coprocessors. - Connect to the consoles using a terminal emulator. Signed-off-by: Steven Lee <steven_lee@aspeedtech.com> Change-Id: I32447b9372a78eb53a07135afef59c2a19202328 Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-8-steven_lee@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05hw/arm/aspeed_ast27x0-tsp: Introduce AST27x0 A1 TSP SoCSteven Lee3-0/+307
AST2700 TSP(Tertiary Service Processor) is a Cortex-M4 coprocessor The patch adds support for TSP with following update: - Introduce Aspeed27x0TSPSoCState structure in aspeed_soc.h - Implement initialization and realization functions - Add support for UART, INTC, and SCU devices - Map unimplemented devices for IPC and SCUIO - Defined memory map and IRQ maps for AST27x0 A1 TSP SoC The IRQ mapping is similar to AST2700 CA35 SoC, featuring a two-level interrupt controller. Difference from AST2700: - AST2700 - Support GICINT128 to GICINT136 in INTC - The INTCIO GIC_192_201 has 10 output pins, mapped as follows: Bit 0 -> GIC 192 Bit 1 -> GIC 193 Bit 2 -> GIC 194 Bit 3 -> GIC 195 Bit 4 -> GIC 196 - AST2700-tsp - Support TSPINT128 to TSPINT136 in INTC - The INTCIO TSPINT_160_169 has 10 output pins, mapped as follows: Bit 0 -> TSPINT 160 Bit 1 -> TSPINT 161 Bit 2 -> TSPINT 162 Bit 3 -> TSPINT 163 Bit 4 -> TSPINT 164 Signed-off-by: Steven Lee <steven_lee@aspeedtech.com> Change-Id: I69eec2b68b26ef04187b2922c5f2e584b9076c66 Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-7-steven_lee@aspeedtech.com [ clg: removed local 'Error* err' in aspeed_soc_ast27x0tsp_realize() ] Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05hw/arm/aspeed_ast27x0-ssp: Introduce AST27x0 A1 SSP SoCSteven Lee3-0/+309
The AST2700 SSP (Secondary Service Processor) is a Cortex-M4 coprocessor. This patch adds support for A1 SSP with the following updates: - Introduce Aspeed27x0SSPSoCState structure in aspeed_soc.h - Define memory map and IRQ map for AST27x0 A1 SSP SoC - Implement initialization and realization functions - Add support for UART, INTC, and SCU devices - Map unimplemented devices for IPC and SCUIO The IRQ mapping is similar to AST2700 CA35 SoC, featuring a two-level interrupt controller. Difference from AST2700: - AST2700 - Support GICINT128 to GICINT136 in INTC - The INTCIO GIC_192_201 has 10 output pins, mapped as follows: Bit 0 -> GIC 192 Bit 1 -> GIC 193 Bit 2 -> GIC 194 Bit 3 -> GIC 195 Bit 4 -> GIC 196 - AST2700-ssp - Support SSPINT128 to SSPINT136 in INTC - The INTCIO SSPINT_160_169 has 10 output pins, mapped as follows: Bit 0 -> SSPINT 160 Bit 1 -> SSPINT 161 Bit 2 -> SSPINT 162 Bit 3 -> SSPINT 163 Bit 4 -> SSPINT 164 Signed-off-by: Steven Lee <steven_lee@aspeedtech.com> Change-Id: I924bf1a657f1e83f9e16d6673713f4a06ecdb496 Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-6-steven_lee@aspeedtech.com [ clg: removed local 'Error* err' in aspeed_soc_ast27x0ssp_realize() ] Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05hw/intc/aspeed: Add support for AST2700 TSP INTCSteven Lee2-2/+209
- Define new types for ast2700tsp INTC and INTCIO - Add register definitions for TSP INTC and INTCIO - Implement write handlers for TSP INTC and INTCIO - Register new types in aspeed_intc_register_types The design of the TSP INTC and INTCIO controllers is similar to AST2700, with the following differences: - AST2700 Support GICINT128 to GICINT136 in INTC The INTCIO GIC_192_201 has 10 output pins, mapped as follows: Bit 0 -> GIC 192 Bit 1 -> GIC 193 Bit 2 -> GIC 194 Bit 3 -> GIC 195 Bit 4 -> GIC 196 - AST2700-tsp Support TSPINT128 to TSPINT136 in INTC The INTCIO TSPINT_160_169 has 10 output pins, mapped as follows: Bit 0 -> TSPINT 160 Bit 1 -> TSPINT 161 Bit 2 -> TSPINT 162 Bit 3 -> TSPINT 163 Bit 4 -> TSPINT 164 Signed-off-by: Steven Lee <steven_lee@aspeedtech.com> Change-Id: I3f3aca4b90129640369cf4a92deb4b9a12df5b70 Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-5-steven_lee@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05hw/intc/aspeed: Add support for AST2700 SSP INTCSteven Lee2-0/+214
- Define new types for ast2700ssp INTC and INTCIO - Add register definitions for SSP INTC and INTCIO - Implement write handlers for SSP INTC and INTCIO - Register new types in aspeed_intc_register_types The design of the SSP INTC and INTCIO controllers is similar to AST2700, with the following differences: - AST2700 Support GICINT128 to GICINT136 in INTC The INTCIO GIC_192_201 has 10 output pins, mapped as follows: Bit 0 -> GIC 192 Bit 1 -> GIC 193 Bit 2 -> GIC 194 Bit 3 -> GIC 195 Bit 4 -> GIC 196 - AST2700-ssp Support SSPINT128 to SSPINT136 in INTC The INTCIO SSPINT_160_169 has 10 output pins, mapped as follows: Bit 0 -> SSPINT 160 Bit 1 -> SSPINT 161 Bit 2 -> SSPINT 162 Bit 3 -> SSPINT 163 Bit 4 -> SSPINT 164 Signed-off-by: Steven Lee <steven_lee@aspeedtech.com> Change-Id: Ib8cb0e264505cef48e17f173e057f3b2d1ea35c4 Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-4-steven_lee@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05aspeed: ast27x0: Correct hex notation for device addressesSteven Lee1-14/+14
Corrected the hexadecimal notation for several device addresses in the aspeed_soc_ast2700_memmap array by changing the uppercase 'X' to lowercase 'x'. Signed-off-by: Steven Lee <steven_lee@aspeedtech.com> Change-Id: I45426e18ea8e68d7ccdf9b60c4ea235c4da33cc3 Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-3-steven_lee@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05aspeed: ast27x0: Map unimplemented devices in SoC memorySteven Lee2-7/+51
Maps following unimplemented devices in SoC memory - dpmcu - iomem - iomem0 - iomem1 - ltpi Iomem, Iomem0 and Iomem1 include unimplemented controllers in the memory ranges 0x0 - 0x1000000, 0x120000000 - 0x121000000 and 0x14000000 - 0x141000000. For instance: - USB hub at 0x12010000 - eSPI at 0x14C5000 - PWM at 0x140C0000 DPMCU stands for Display Port MCU controller. LTPI is used to connect to AST1700. AST1700 is an I/O expander that supports the DC-SCM 2.1 LTPI protocol. It provides AST2700 with additional GPIO, UART, I3C, and other interfaces. Signed-off-by: Steven Lee <steven_lee@aspeedtech.com> Change-Id: Iae4db49a4818af3e2c43c16a27fc76329d2405d6 Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-2-steven_lee@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05docs/system/arm/aspeed: Support vbootrom for AST2700Jamin Lin1-1/+28
Using the vbootrom image support and the boot ROM binary is now passed via the -bios option, using the image located in pc-bios/ast27x0_bootrom.bin. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Nabih Estefan <nabihestefan@google.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250424075135.3715128-7-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05docs/system/arm/aspeed: move AST2700 content to new sectionJamin Lin1-7/+63
Moved AST2700-related content from the general Aspeed board list into a dedicated section for Aspeed 2700 family boards. Improves clarity and readability. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250424075135.3715128-6-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05tests/functional/aspeed: Add to test vbootrom for AST2700Jamin Lin1-0/+26
Add the AST2700 functional test to boot using the vbootrom image instead of manually loading boot components with -device loader. The boot ROM binary is now passed via the -bios option, using the image located in pc-bios/ast27x0_bootrom.bin. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250424075135.3715128-5-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05hw/arm/aspeed: Add support for loading vbootrom image via "-bios"Jamin Lin2-0/+37
Introduce "aspeed_load_vbootrom()" to support loading a virtual boot ROM image into the vbootrom memory region, using the "-bios" command-line option. Introduce a new "vbootrom" field in the AspeedMachineClass to indicate whether a machine supports the virtual boot ROM region. Set this field to true by default for the AST2700-A0 and AST2700-A1 EVB machines. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Nabih Estefan <nabihestefan@google.com> Tested-by: Nabih Estefan <nabihestefan@google.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250424075135.3715128-4-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05hw/arm/aspeed_ast27x0 Introduce vbootrom memory regionJamin Lin2-0/+11
Introduce a new vbootrom memory region. The region is mapped at address "0x00000000" and has a size of 128KB, identical to the SRAM region size. This memory region is intended for loading a vbootrom image file as part of the boot process. The vbootrom registered in the SoC's address space using the ASPEED_DEV_VBOOTROM index. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Nabih Estefan <nabihestefan@google.com> Tested-by: Nabih Estefan <nabihestefan@google.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250424075135.3715128-2-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05tests/functional/aspeed: extract boot and login sequence into helper functionJamin Lin1-5/+7
Extracted repeated boot and login steps into a new helper function. No change in functional behavior. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250423072350.541742-10-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05tests/functional/aspeed: Update test ASPEED SDK v09.06Jamin Lin1-10/+10
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250423072350.541742-9-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05tests/functional/aspeed: Move I2C test into shared helper for AST2700 reuseJamin Lin1-13/+15
Move the I2C test case into a common helper function (do_ast2700_i2c_test) so it can be reused across multiple AST2700-based test cases. This reduces duplication and improves maintainability. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Nabih Estefan <nabihestefan@google.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250423072350.541742-8-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05hw/arm/aspeed_ast27x0: Rename variable sram_name to name in ast2700 realizeJamin Lin1-4/+4
The variable "sram_name" was only used for naming the SRAM memory region. Rename it to "name" for consistency with similar code and avoid unnecessary new local variable declarations. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Nabih Estefan <nabihestefan@google.com> Link: https://lore.kernel.org/qemu-devel/20250423072350.541742-2-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05tests/functional/aspeed: Update test ASPEED SDK v03.00 for AST1030Jamin Lin1-5/+5
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250423014008.147542-4-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05tests/functional/aspeed: Update test ASPEED SDK v09.06 for AST2600Jamin Lin1-7/+8
Update test for AST2600 production revision A3. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250423014008.147542-3-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05tests/functional/aspeed: Update test ASPEED SDK v09.06 for AST2500Jamin Lin1-4/+4
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250423014008.147542-2-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05hw/ssi/aspeed_smc: Allow 64-bit wide flash accessesJoe Komlodi1-2/+2
cde3247651dc998da5dc1005148302a90d72f21f fixed atomicity for LDRD, which ends up making accesses 64-bits wide. However, the AST2600 bootloader can sometimes compile with LDRD instructions, which causes the acceses to fail when accessing the memory-mapped SPI flash. To fix this, increase the MMIO region valid access size to allow for 64-bit accesses. Signed-off-by: Joe Komlodi <komlodi@google.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250422002747.2593465-1-komlodi@google.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-05hw/arm: ast27x0: Wire up EHCI controllersTroy Lee2-1/+31
AST27x0 has 4 EHCI controllers, where each CPU and I/O die has 2 instances. This patch use existing TYPE_PLATFORM_EHCI. After wiring up the EHCI controller, the ast2700a1-evb can find up to 4 USB EHCI interfaces. ehci-platform 12061000.usb: EHCI Host Controller ehci-platform 12061000.usb: new USB bus registered, assigned bus number 2 ehci-platform 12063000.usb: EHCI Host Controller ehci-platform 12063000.usb: new USB bus registered, assigned bus number 3 ehci-platform 12061000.usb: irq 88, io mem 0x12061000 ehci-platform 12063000.usb: irq 90, io mem 0x12063000 ehci-platform 14121000.usb: EHCI Host Controller ehci-platform 14123000.usb: EHCI Host Controller ehci-platform 12061000.usb: USB 2.0 started, EHCI 1.00 ehci-platform 14121000.usb: new USB bus registered, assigned bus number 5 ehci-platform 14123000.usb: new USB bus registered, assigned bus number 6 ehci-platform 14121000.usb: irq 91, io mem 0x14121000 ehci-platform 14123000.usb: irq 92, io mem 0x14123000 ehci-platform 12063000.usb: USB 2.0 started, EHCI 1.00 usb usb2: Manufacturer: Linux 6.6.78-dirty-bafd2830c17c-gbafd2830c17c-dirty ehci_hcd usb usb3: Manufacturer: Linux 6.6.78-dirty-bafd2830c17c-gbafd2830c17c-dirty ehci_hcd ehci-platform 14121000.usb: USB 2.0 started, EHCI 1.00 usb usb5: Manufacturer: Linux 6.6.78-dirty-bafd2830c17c-gbafd2830c17c-dirty ehci_hcd ehci-platform 14123000.usb: USB 2.0 started, EHCI 1.00 usb usb6: Manufacturer: Linux 6.6.78-dirty-bafd2830c17c-gbafd2830c17c-dirty ehci_hcd Note that, AST27x0A0 only has 2 EHCI controllers due to hw issue. Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250317065938.1902272-2-troy_lee@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-05-02monitor: don't wake up qmp_dispatcher_co coroutine upon cleanupAndrey Drobyshev1-1/+2
Since the commit 3e6bed61 ("monitor: cleanup detection of qmp_dispatcher_co shutting down"), coroutine pointer qmp_dispatcher_co is set to NULL upon cleanup. If a QMP command is sent after monitor_cleanup() (e.g. after shutdown), this may lead to SEGFAULT on aio_co_wake(NULL). As mentioned in the comment inside monitor_cleanup(), the intention is to allow incoming requests while shutting down, but simply leave them without any response. Let's do exactly that, and if qmp_dispatcher_co coroutine pointer has already been set to NULL, let's simply skip the aio_co_wake() part. Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com> Link: https://lore.kernel.org/r/20250502214729.928380-2-andrey.drobyshev@virtuozzo.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-02rust: centralize config in workspace rootStefan Zabka5-21/+32
This commit bundles common config option in the workspace root and applies them through <config>.workspace = true Signed-off-by: Stefan Zabka <git@zabka.it> Link: https://lore.kernel.org/r/20250502212748.124953-1-git@zabka.it Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-02hw/char/serial: Remove unused prog_if compat propertyBALATON Zoltan3-17/+6
This property was added to preserve previous value when this was fixed in version 2.1 but the last machine using it was already removed when adding diva-gsp leaving this property unused and unnecessary. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Helge Deller <deller@gmx.de> Link: https://lore.kernel.org/r/20250502095524.DE1F355D264@zero.eik.bme.hu Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-02target/i386: do not block singlestep for STIPaolo Bonzini1-1/+5
STI will trigger a singlestep exception even if it has inhibit-IRQ behavior. Do not suppress single-step for all IRQ-inhibiting instructions, instead special case MOV SS and POP SS. Cc: qemu-stable@nongnu.org Fixes: f0f0136abba ("target/i386: no single-step exception after MOV or POP SS", 2024-05-25) Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-02target/i386: do not trigger IRQ shadow for LSSPaolo Bonzini2-13/+18
Because LSS need not trigger an IRQ shadow, gen_movl_seg can't just use the destination register to decide whether to inhibit IRQs. Add an argument. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-02target/i386/hvf: fix a compilation errorWei Liu1-0/+1
Include exec/target_page.h to fix the following build error. x86_64-softmmu.a.p/target_i386_hvf_hvf.c.o -c ../target/i386/hvf/hvf.c ../target/i386/hvf/hvf.c:139:49: error: use of undeclared identifier 'TARGET_PAGE_SIZE' 139 | uint64_t dirty_page_start = gpa & ~(TARGET_PAGE_SIZE - 1u); | ^ ../target/i386/hvf/hvf.c:141:45: error: use of undeclared identifier 'TARGET_PAGE_SIZE' 141 | hv_vm_protect(dirty_page_start, TARGET_PAGE_SIZE, | ^ Signed-off-by: Wei Liu <wei.liu@kernel.org> Link: https://lore.kernel.org/r/aBBws1ikCDfyC0RI@liuwe-devbox-ubuntu-v2.tail21d00.ts.net Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-02target/i386/emulate: remove rflags leftoversMagnus Kulke1-11/+6
Fixes: c901905ea670 ("target/i386/emulate: remove flags_mask") In c901905ea670 rflags have been removed from `x86_decode`, but there were some leftovers. Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com> Link: https://lore.kernel.org/r/20250429093319.5010-1-magnuskulke@linux.microsoft.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-02rust/hpet: Support migrationZhao Liu2-3/+146
Based on commit 1433e38cc8 ("hpet: do not overwrite properties on post_load"), add the basic migration support to Rust HPET. The current migration implementation introduces multiple unsafe callbacks. Before the vmstate builder, one possible cleanup approach is to wrap callbacks in the vmstate binding using a method similar to the vmstate_exist_fn macro. However, this approach would also create a lot of repetitive code (since vmstate has so many callbacks: pre_load, post_load, pre_save, post_save, needed and dev_unplug_pending). Although it would be cleaner, it would somewhat deviate from the path of the vmstate builder. Therefore, firstly focus on completing the functionality of HPET, and those current unsafe callbacks can at least clearly indicate the needed functionality of vmstate. The next step is to consider refactoring vmstate to move towards the vmstate builder direction. Additionally, update rust.rst about Rust HPET can support migration. Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20250414144943.1112885-9-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-02rust/timer: Define NANOSECONDS_PER_SECOND binding as u64Zhao Liu1-0/+2
NANOSECONDS_PER_SECOND is often used in operations with get_ns(), which currently returns a u64. Therefore, define a new NANOSECONDS_PER_SECOND binding is with u64 type to eliminate unnecessary type conversions (from u32 to u64). Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20250414144943.1112885-6-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-02rust/vmstate_test: Test varray with num field wrapped in BqlCellZhao Liu1-8/+33
Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20250414144943.1112885-4-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-02rust: assertions: Support index field wrapped in BqlCellPaolo Bonzini1-16/+9
Currently, if the `num` field of a varray is not a numeric type, such as being placed in a wrapper, the array variant of assert_field_type will fail the check. HPET currently wraps num_timers in BqlCell<>. Although BqlCell<> is not necessary from strictly speaking, it makes sense for vmstate to respect BqlCell. The failure of assert_field_type is because it cannot convert BqlCell<T> into usize for use as the index. Use a constant 0 instead for the index, by avoiding $(...)? and extracting the common parts of assert_field_type! into an internal case. Commit message based on a patch by Zhao Liu <zhao1.liu@intel.com>. Link: https://lore.kernel.org/r/20250414144943.1112885-3-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-02vmstate: support varray for vmstate_clock!Paolo Bonzini1-3/+10
Make vmstate_struct and vmstate_clock more similar; they are basically the same thing, except for the clock case having a built-in VMStateDescription. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-02rust/vmstate: Add support for field_exists checksZhao Liu1-33/+37
Unfortunately, at present it's not possible to have a const "with_exist_check" method to append test_fn after vmstate_struct (due to error on "constant functions cannot evaluate destructors" for `F`). Before the vmstate builder, the only way to support "test_fn" is to extend vmstate_struct macro to add the such new optional member (and fortunately, Rust can still parse the current expansion!). Abstract the previous callback implementation of vmstate_validate into a separate macro, and moves it before vmstate_struct for vmstate_struct to call. Note that there's no need to add any extra flag for a new test_fn added in the VMStateField. Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20250414144943.1112885-2-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-05-02scripts/vmstate-static-checker.py: Allow new name for ghes_addr_le fieldThomas Huth1-0/+1
ghes_addr_le has been renamed to hw_error_le in commit 652f6d86cbb ("acpi/ghes: better name the offset of the hardware error firmware"). Adjust the checker script to allow that changed field name. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Link: https://lore.kernel.org/r/20250429152141.294380-3-thuth@redhat.com Signed-off-by: Peter Xu <peterx@redhat.com>
2025-05-02migration/rdma: Remove qemu_rdma_broken_ipv6_kernelJack Wang1-176/+4
I hit following error which testing migration in pure RoCE env: "-incoming rdma:[::]:8089: RDMA ERROR: You only have RoCE / iWARP devices in your systems and your management software has specified '[::]', but IPv6 over RoCE / iWARP is not supported in Linux.#012'." In our setup, we use rdma bind on ipv6 on target host, while connect from source with ipv4, remove the qemu_rdma_broken_ipv6_kernel, migration just work fine. Checking the git history, the function was added since introducing of rdma migration, which is more than 10 years ago. linux-rdma has improved support on RoCE/iWARP for ipv6 over past years. There are a few fixes back in 2016 seems related to the issue, eg: aeb76df46d11 ("IB/core: Set routable RoCE gid type for ipv4/ipv6 networks") other fixes back in 2018, eg: 052eac6eeb56 RDMA/cma: Update RoCE multicast routines to use net namespace 8d20a1f0ecd5 RDMA/cma: Fix rdma_cm raw IB path setting for RoCE 9327c7afdce3 RDMA/cma: Provide a function to set RoCE path record L2 parameters 5c181bda77f4 RDMA/cma: Set default GID type as RoCE when resolving RoCE route 3c7f67d1880d IB/cma: Fix default RoCE type setting be1d325a3358 IB/core: Set RoCEv2 MGID according to spec 63a5f483af0e IB/cma: Set default gid type to RoCEv2 So remove the outdated function and it's usage. Cc: Peter Xu <peterx@redhat.com> Cc: Li Zhijian <lizhijian@fujitsu.com> Cc: Yu Zhang <yu.zhang@ionos.com> Cc: Fabiano Rosas <farosas@suse.de> Cc: qemu-devel@nongnu.org Cc: linux-rdma@vger.kernel.org Cc: michael@flatgalaxy.com Signed-off-by: Jack Wang <jinpu.wang@ionos.com> Tested-by: Li zhijian <lizhijian@fujitsu.com> Reviewed-by: Michael Galaxy <mrgalaxy@nvidia.com> Link: https://lore.kernel.org/r/20250402051306.6509-1-jinpu.wang@ionos.com [peterx: some cosmetic changes] Signed-off-by: Peter Xu <peterx@redhat.com>
2025-05-02migration/postcopy: Spatial locality page hint for preempt modePeter Xu1-1/+96
The preempt mode postcopy has been introduced for a while. From latency POV, it should always win the vanilla postcopy. However there's one thing missing when preempt mode is enabled right now, which is the spatial locality hint when there're page requests from the destination side. In vanilla postcopy, as long as a page request was unqueued, it will update the PSS of the precopy background stream, so that after a page request the background thread will move the pages after whatever was requested. It's pretty much a natural behavior when there's only one channel anyway, and one scanner to send the pages. Preempt mode didn't follow that, because preempt mode has its own channel and its own PSS (which doesn't linearly scan the guest memory, but dedicated to resolve page requested from destination). So the page request process and the background migration process are completely separate. This patch adds the hint explicitly for preempt mode. With that, whenever the preempt mode receives a page request on the source, it will service the remote page fault in the return path, then it'll provide a hint to the background thread so that we'll start sending the pages right after the requested ones in the background, assuming the follow up pages have a higher chance to be accessed later. NOTE: since the background migration thread and return path thread run completely concurrently, it doesn't always mean the hint will be applied every single time. For example, it's possible that the return path thread receives multiple page requests in a row without the background thread getting the chance to consume one. In such case, the preempt thread only provide the hint if the previous hint has been consumed. After all, there's no point queuing hints when we only have one linear scanner. This could measureably improve the simple sequential memory access pattern during postcopy (when preempt is on). For random accesses, I can measure a slight increase of remote page fault latency from ~500us -> ~600us, that could be a trade-off to have such hint mechanism, and after all that's still greatly improved comparing to vanilla postcopy on random (~10ms). The patch is verified by our QE team in a video streaming test case, to reduce the pause of the video from ~1min to a few seconds when switching over to postcopy with preempt mode. Reported-by: Xiaohui Li <xiaohli@redhat.com> Tested-by: Xiaohui Li <xiaohli@redhat.com> Reviewed-by: Juraj Marcin <jmarcin@redhat.com> Link: https://lore.kernel.org/r/20250424220705.195544-1-peterx@redhat.com Signed-off-by: Peter Xu <peterx@redhat.com>