target/arm: Move stage_1_mmu_idx decl to internals.h
Move the decl from ptw.h to internals.h. Provide an inline
version for user-only, just as we do for arm_stage1_mmu_idx.
Move an endif down to make the definition in helper.c be
system only.
Frederic Konrad [Wed, 8 Jun 2022 18:38:48 +0000 (19:38 +0100)]
xlnx-zynqmp: fix the irq mapping for the display port and its dma
When the display port has been initially implemented the device
driver wasn't using interrupts. Now that the display port driver
waits for vblank interrupt it has been noticed that the irq mapping
is wrong. So use the value from the linux device tree and the
ultrascale+ reference manual.
Frederic Konrad [Wed, 8 Jun 2022 18:38:47 +0000 (19:38 +0100)]
xlnx_dp: fix the wrong register size
The core and the vblend registers size are wrong, they should respectively be
0x3B0 and 0x1E0 according to:
https://www.xilinx.com/htmldocs/registers/ug1087/ug1087-zynq-ultrascale-registers.html.
Let's fix that and use macros when creating the mmio region.
Peter Maydell [Wed, 8 Jun 2022 18:38:47 +0000 (19:38 +0100)]
Fix 'writeable' typos
We have about 30 instances of the typo/variant spelling 'writeable',
and over 500 of the more common 'writable'. Standardize on the
latter.
Change produced with:
sed -i -e 's/\([Ww][Rr][Ii][Tt]\)[Ee]\([Aa][Bb][Ll][Ee]\)/\1\2/g' $(git grep -il writeable)
and then hand-undoing the instance in linux-headers/linux/kvm.h.
Most of these changes are in comments or documentation; the
exceptions are:
* a local variable in accel/hvf/hvf-accel-ops.c
* a local variable in accel/kvm/kvm-all.c
* the PMCR_WRITABLE_MASK macro in target/arm/internals.h
* the EPT_VIOLATION_GPA_WRITABLE macro in target/i386/hvf/vmcs.h
(which is never used anywhere)
* the AR_TYPE_WRITABLE_MASK macro in target/i386/hvf/vmx.h
(which is never used anywhere)
Peter Maydell [Wed, 8 Jun 2022 18:38:46 +0000 (19:38 +0100)]
target/arm: Implement FEAT_DoubleFault
The FEAT_DoubleFault extension adds the following:
* All external aborts on instruction fetches and translation table
walks for instruction fetches must be synchronous. For QEMU this
is already true.
* SCR_EL3 has a new bit NMEA which disables the masking of SError
interrupts by PSTATE.A when the SError interrupt is taken to EL3.
For QEMU we only need to make the bit writable, because we have no
sources of SError interrupts.
* SCR_EL3 has a new bit EASE which causes synchronous external
aborts taken to EL3 to be taken at the same entry point as SError.
(Note that this does not mean that they are SErrors for purposes
of PSTATE.A masking or that the syndrome register reports them as
SErrors: it just means that the vector offset is different.)
* The existing SCTLR_EL3.IESB has an effective value of 1 when
SCR_EL3.NMEA is 1. For QEMU this is a no-op because we don't need
different behaviour based on IESB (we don't need to do anything to
ensure that error exceptions are synchronized).
So for QEMU the things we need to change are:
* Make SCR_EL3.{NMEA,EASE} writable
* When taking a synchronous external abort at EL3, adjust the
vector entry point if SCR_EL3.EASE is set
* Advertise the feature in the ID registers
Peter Maydell [Wed, 8 Jun 2022 18:38:46 +0000 (19:38 +0100)]
target/arm: Declare support for FEAT_RASv1p1
The architectural feature RASv1p1 introduces the following new
features:
* new registers ERXPFGCDN_EL1, ERXPFGCTL_EL1 and ERXPFGF_EL1
* new bits in the fine-grained trap registers that control traps
for these new registers
* new trap bits HCR_EL2.FIEN and SCR_EL3.FIEN that control traps
for ERXPFGCDN_EL1, ERXPFGCTL_EL1, ERXPFGP_EL1
* a larger number of the ERXMISC<n>_EL1 registers
* the format of ERR<n>STATUS registers changes
The architecture permits that if ERRIDR_EL1.NUM is 0 (as it is for
QEMU) then all these new registers may UNDEF, and the HCR_EL2.FIEN
and SCR_EL3.FIEN bits may be RES0. We don't have any ERR<n>STATUS
registers (again, because ERRIDR_EL1.NUM is 0). QEMU does not yet
implement the fine-grained-trap extension. So there is nothing we
need to implement to be compliant with the feature spec. Make the
'max' CPU report the feature in its ID registers, and document it.
Merge tag 'pull-tpm-2022-06-07-1' of https://github.com/stefanberger/qemu-tpm into staging
Merge tpm 2022/06/07 v1
# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCAAdFiEEuBi5yt+QicLVzsZrda1lgCoLQhEFAmKf8HgACgkQda1lgCoL
# QhHx8Qf/QB2z+0B1xKKn8NqrWbZ+FaVlnPu/3hX4kraCY5zAYV9e64kdWhuIKRbM
# 74/KARGMpkme6Y8rUSK6mVeiY+ul+egfVMnKyfhsM1jhAQT/DzSlht/XZzbn3Mg+
# FFXQBMqcvcNWH53q9zi9GJYqH4tcxUku3ejgodU4+SO2wB5S59pS/tD+i5H06Vy5
# Iw1kW6I11gYhJGETxVgb6F2Jfyu6uPWFhIg7eN06XwNExFc45E8GjrpIs2rO78GN
# OzMBjwAG+C+/PU+UZDOd5Zhq5qv+8DcvDQuPXyqksxPcFvouvLghQvQL/h7neMlM
# jOwHS153ay0EAT/t2lZafsBwqKQxvQ==
# =b9Qe
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 07 Jun 2022 05:42:32 PM PDT
# gpg: using RSA key B818B9CADF9089C2D5CEC66B75AD65802A0B4211
# gpg: Good signature from "Stefan Berger <[email protected]>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B818 B9CA DF90 89C2 D5CE C66B 75AD 6580 2A0B 4211
* tag 'pull-tpm-2022-06-07-1' of https://github.com/stefanberger/qemu-tpm:
tpm_crb: mark command buffer as dirty on request completion
hw/tpm/tpm_tis_common.c: Assert that locty is in range
Anthony PERARD [Mon, 11 Apr 2022 14:47:49 +0000 (15:47 +0100)]
tpm_crb: mark command buffer as dirty on request completion
At the moment, there doesn't seems to be any way to know that QEMU
made modification to the command buffer. This is potentially an issue
on Xen while migrating a guest, as modification to the buffer after
the migration as started could be ignored and not transfered to the
destination.
Mark the memory region of the command buffer as dirty once a request
is completed.
Xiaojuan Yang [Mon, 6 Jun 2022 12:43:32 +0000 (20:43 +0800)]
tests/tcg/loongarch64: Add hello/memory test in loongarch64 system
- We write a very minimal softmmu harness.
- This is a very simple smoke test with no need to run a full Linux/kernel.
- The Makefile.softmmu-target record the rule to run.
Xiaojuan Yang [Mon, 6 Jun 2022 12:43:27 +0000 (20:43 +0800)]
hw/loongarch: Add some devices support for 3A5000.
1.Add uart,virtio-net,vga and usb for 3A5000.
2.Add irq set and map for the pci host. Non pci device
use irq 0-16, pci device use 16-64.
3.Add some unimplented device to emulate guest unused
memory space.
Xiaojuan Yang [Mon, 6 Jun 2022 12:43:20 +0000 (20:43 +0800)]
hw/loongarch: Add support loongson3 virt machine type.
Emulate a 3A5000 board use the new loongarch instruction.
3A5000 belongs to the Loongson3 series processors.
The board consists of a 3A5000 cpu model and the virt
bridge. The host 3A5000 board is really complicated and
contains many functions.Now for the tcg softmmu mode
only part functions are emulated.
More detailed info you can see
https://github.com/loongson/LoongArch-Documentation
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging
* prepare to expand usage of test venv
* fix CPUID when passing through host cache information
* a20 fix
* SGX fix
* generate per-target modinfo
* replay cleanups and simplifications
* "make modules" target
# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmKeCV0UHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroNVWQgArVaF9Q/RWd1jJ2EUoWhy/GKsrdBs
# CHmSzrYzF/0cqD4OtrjTRyUP72Kywf4/aP4GYtLsjSYRUyriqS4nm5yEkDsME+pH
# 0adATIumtGHBPjVJyPUux3H1cbPUmsxbE03ZIWUK65M/IM2m46hmPDTWVx6ZSXMN
# VnSQdTUeZdxY26D8zfLp+oufqmfgaPT19zURcMZlvWFJ830t+1spfZwH0RGjDlfZ
# ffNVMPcco1qreNFggNIV9sKtoLb8A9PxpFJPV9OtBONA5UGxZ7xhjjZY9jCI4Bxa
# xAd60nXeoAwiOP7LE2bEwXbPku3xgy2e0LNXhqblMGNGOjdlRlwfL/FhFw==
# =C9N3
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 06 Jun 2022 07:04:13 AM PDT
# gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg: issuer "[email protected]"
# gpg: Good signature from "Paolo Bonzini <[email protected]>" [undefined]
# gpg: aka "Paolo Bonzini <[email protected]>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1
# Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83
* tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (29 commits)
meson: qga: do not use deprecated meson.build_root()
configure: remove reference to removed option
regenerate meson-buildoptions.sh
tests: run 'device-crash-test' from tests/venv
tests: add python3-venv to debian10.docker
tests: use tests/venv to run basevm.py-based scripts
tests: install "qemu" namespace package into venv
tests: add quiet-venv-pip macro
tests: silence pip upgrade warnings during venv creation
tests: use python3 as the python executable name
tests: add "TESTS_PYTHON" variable to Makefile
python: update for mypy 0.950
x86: cpu: fixup number of addressable IDs for logical processors sharing cache
x86: cpu: make sure number of addressable IDs for processor cores meets the spec
tests/Makefile.include: Fix 'make check-help' output
tests/avocado: add replay Linux test for Aarch64 machines
tests/avocado: add replay Linux tests for virtio machine
tests/avocado: update replay_linux test
docs: move replay docs to docs/system/replay.rst
docs: convert docs/devel/replay page to rst
...
Paolo Bonzini [Mon, 6 Jun 2022 14:03:38 +0000 (16:03 +0200)]
meson: qga: do not use deprecated meson.build_root()
The function will return the build root of the parent project if called from a
subproject; that is irrelevant for QEMU's usage but rarely desirable, and
therefore the function was deprecated and replaced by two functions
project_build_root() and global_build_root(). Replace it with the former.
John Snow [Thu, 26 May 2022 00:09:21 +0000 (20:09 -0400)]
tests: run 'device-crash-test' from tests/venv
Remove the sys.path hacking from device-crash-test, and add in a little
user-friendly message for anyone who was used to running this script
directly from the source tree.
Modify the GitLab job recipes to create the tests/venv first, then run
device-crash-test from that venv.
John Snow [Thu, 26 May 2022 00:09:19 +0000 (20:09 -0400)]
tests: use tests/venv to run basevm.py-based scripts
This patch co-opts the virtual environment being used by avocado tests
to also run the basevm.py tests. This is being done in preparation for
for the qemu.qmp package being removed from qemu.git.
As part of the change, remove any sys.path() hacks and treat "qemu" as a
normal third-party import.
John Snow [Thu, 26 May 2022 00:09:18 +0000 (20:09 -0400)]
tests: install "qemu" namespace package into venv
This patch adds the "qemu" namespace package to the $build/tests/venv
directory. It does so in "editable" mode, which means that changes to
the source python directory will actively be reflected by the venv.
This patch also then removes any sys.path hacking from the avocado test
scripts directly. By doing this, the environment of where to find these
packages is managed entirely by the virtual environment and not by the
scripts themselves.
John Snow [Thu, 26 May 2022 00:09:17 +0000 (20:09 -0400)]
tests: add quiet-venv-pip macro
Factor out the "test venv pip" macro; rewrite the "check-venv" rule to
be a little more compact. Replace the "PIP" pseudo-command output with
"VENVPIP" to make it 1% more clear that we are talking about using pip
to install something into a venv.
John Snow [Thu, 26 May 2022 00:09:16 +0000 (20:09 -0400)]
tests: silence pip upgrade warnings during venv creation
Turn off the nag warning coaxing us to upgrade pip. It's not really that
interesting to see in CI logs, and as long as nothing is broken --
nothing is broken.
John Snow [Thu, 26 May 2022 00:09:14 +0000 (20:09 -0400)]
tests: add "TESTS_PYTHON" variable to Makefile
This is a convenience feature: $(PYTHON) points to the Python executable
we were instructed to use by the configure script. We use that Python to
create a virtual environment with the "check-venv" target in
tests/Makefile.include.
$(TESTS_PYTHON) points to the Python executable belonging to the virtual
environment tied to the build. This Python executable is a symlink to
the binary used to create the venv, which will be the version provided
at configure time.
Using $(TESTS_PYTHON) therefore uses the $(PYTHON) executable, but with
paths modified to use packages installed to the venv.
John Snow [Thu, 26 May 2022 00:09:13 +0000 (20:09 -0400)]
python: update for mypy 0.950
typeshed (included in mypy) recently updated to improve the typing for
WriteTransport objects. I was working around this, but now there's a
version where I shouldn't work around it.
Unfortunately this creates some minor ugliness if I want to support both
pre- and post-0.950 versions. For now, for my sanity, just disable the
unused-ignores warning.
Igor Mammedov [Tue, 24 May 2022 15:10:20 +0000 (11:10 -0400)]
x86: cpu: fixup number of addressable IDs for logical processors sharing cache
When QEMU is started with '-cpu host,host-cache-info=on', it will
passthrough host's number of logical processors sharing cache and
number of processor cores in the physical package. QEMU already
fixes up the later to correctly reflect number of configured cores
for VM, however number of logical processors sharing cache is still
comes from host CPU, which confuses guest started with:
on 2 socket Xeon 4210R host with 10 cores per socket
with CPUID[04H]:
...
--- cache 3 ---
cache type = unified cache (3)
cache level = 0x3 (3)
self-initializing cache level = true
fully associative cache = false
maximum IDs for CPUs sharing cache = 0x1f (31)
maximum IDs for cores in pkg = 0xf (15)
...
that doesn't match number of logical processors VM was
configured with and as result RHEL 9.0 guest complains:
sched: CPU #10's llc-sibling CPU #0 is not on the same node! [node: 1 != 0]. Ignoring dependency.
WARNING: CPU: 10 PID: 0 at arch/x86/kernel/smpboot.c:421 topology_sane.isra.0+0x67/0x80
...
Call Trace:
set_cpu_sibling_map+0x176/0x590
start_secondary+0x5b/0x150
secondary_startup_64_no_verify+0xc2/0xcb
Fix it by capping max number of logical processors to vcpus/socket
as it was configured, which fixes the issue.
Igor Mammedov [Tue, 24 May 2022 15:10:19 +0000 (11:10 -0400)]
x86: cpu: make sure number of addressable IDs for processor cores meets the spec
Accourding Intel's CPUID[EAX=04H] resulting bits 31 - 26 in EAX
should be:
"
**** The nearest power-of-2 integer that is not smaller than (1 + EAX[31:26]) is the number of unique
Core_IDs reserved for addressing different processor cores in a physical package. Core ID is a subset of
bits of the initial APIC ID.
"
ensure that values stored in EAX[31-26] always meets this condition.
Pavel Dovgalyuk [Fri, 27 May 2022 10:46:36 +0000 (13:46 +0300)]
docs: move replay docs to docs/system/replay.rst
This patch adds replay description page, converting prior
text from docs/replay.txt.
The text was also updated and some sections were moved
to devel part of the docs.
Pavel Dovgalyuk [Fri, 27 May 2022 10:46:13 +0000 (13:46 +0300)]
replay: notify vCPU when BH is scheduled
vCPU execution should be suspended when new BH is scheduled.
This is needed to avoid guest timeouts caused by the long cycles
of the execution. In replay mode execution may hang when
vCPU sleeps and block event comes to the queue.
This patch adds notification which wakes up vCPU or interrupts
execution of guest code.
v2: changed first_cpu to current_cpu (suggested by Richard Henderson)
v4: moved vCPU notification to aio_bh_enqueue (suggested by Paolo Bonzini)
Message-Id: <165364837317.688121.17680519919871405281.stgit@pasha-ThinkPad-X280> Signed-off-by: Paolo Bonzini <[email protected]>
Jose R. Ziviani [Fri, 27 May 2022 22:20:35 +0000 (00:20 +0200)]
modules: generates per-target modinfo
This patch changes the way modinfo is generated and built. Instead of
one modinfo.c it generates one modinfo-<target>-softmmu.c per target. It
aims a fine-tune control of modules by configuring Kconfig.
Yang Zhong [Mon, 30 May 2022 13:18:34 +0000 (09:18 -0400)]
target/i386: Fix wrong count setting
The previous patch used wrong count setting with index value, which got wrong
value from CPUID(EAX=12,ECX=0):EAX. So the SGX1 instruction can't be exposed
to VM and the SGX decice can't work in VM.
target/i386/tcg: Fix masking of real-mode addresses with A20 bit
The correct A20 masking is done if paging is enabled (protected mode) but it
seems to have been forgotten in real mode. For example from the AMD64 APM Vol. 2
section 1.2.4:
> If the sum of the segment base and effective address carries over into bit 20,
> that bit can be optionally truncated to mimic the 20-bit address wrapping of the
> 8086 processor by using the A20M# input signal to mask the A20 address bit.
Most BIOSes will enable the A20 line on boot, but I found by disabling the A20 line
afterwards, the correct wrapping wasn't taking place.
`handle_mmu_fault' in target/i386/tcg/sysemu/excp_helper.c seems to be the culprit.
In real mode, it fills the TLB with the raw unmasked address. However, for the
protected mode, the `mmu_translate' function does the correct A20 masking.
The fix then should be to just apply the A20 mask in the first branch of the if
statement.
Merge tag 'nvme-next-pull-request' of git://git.infradead.org/qemu-nvme into staging
hw/nvme updates
# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCAAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmKaZmgACgkQTeGvMW1P
# DenI7wgAxY4QtRlUnufzaZqcoi+affFTKlKm0JYKZm/Ldxt2RtHoWxRZDLLIUp8B
# 4XAlIGJw7VwrafEtSkx4K6cSyKluMJ9Ax8pNd03sEweXBBfdhNizspPprp+Jm9P9
# hRcH8kSiBp5B451cORBlgmoHguWeWawe1r66uFLTCbEMtfQQNaxNVsTsgAsOvtwv
# XsjLVFVKGNDWXGRta+lzu4seNNuzfucsAmKWUjg5HN38rstY7XxfLVMzt8ORcwjk
# oNmQuy3JiKujdPVhE5PVgNRZkigwoDt3hDA1QTncGTBUoA/CtaB5SK9EhcJ5xJVI
# EHv99S9LQ8ng5BJC2pUSU32yRkaNOQ==
# =XTXH
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 03 Jun 2022 12:52:08 PM PDT
# gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9
# gpg: Good signature from "Klaus Jensen <[email protected]>" [unknown]
# gpg: aka "Klaus Jensen <[email protected]>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838
# Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9
* tag 'nvme-next-pull-request' of git://git.infradead.org/qemu-nvme:
hw/nvme: add new command abort case
hw/nvme: deprecate the use-intel-id compatibility parameter
hw/nvme: bump firmware revision
hw/nvme: do not report null uuid
hw/nvme: do not auto-generate uuid
hw/nvme: do not auto-generate eui64
hw/nvme: enforce common serial per subsystem
hw/nvme: fix smart aen
hw/nvme: fix copy cmd for pi enabled namespaces
hw/nvme: add missing return statement
hw/nvme: fix narrowing conversion
NVMe command set specification for end-to-end data protection formatted
namespace states:
o If the Reference Tag Check bit of the PRCHK field is set to ‘1’ and
the namespace is formatted for Type 3 protection, then the
controller:
▪ should not compare the protection Information Reference Tag
field to the computed reference tag; and
▪ may ignore the ILBRT and EILBRT fields. If a command is
aborted as a result of the Reference Tag Check bit of the
PRCHK field being set to ‘1’, then that command should be
aborted with a status code of Invalid Protection Information,
but may be aborted with a status code of Invalid Field in
Command.
Currently qemu compares reftag in the nvme_dif_prchk function whenever
Reference Tag Check bit is set in the command. For type 3 namespaces
however, caller of nvme_dif_prchk - nvme_dif_check does not increment
reftag for each subsequent logical block. That way commands incorporating
more than one logical block for type 3 formatted namespaces with reftag
check bit set, always fail with End-to-end Reference Tag Check Error.
Comply with spec by handling case of set Reference Tag Check
bit in the type 3 formatted namespace.
Fixes: 146f720c5563 ("hw/block/nvme: end-to-end data protection") Signed-off-by: Dmitry Tikhov <[email protected]> Signed-off-by: Klaus Jensen <[email protected]>
Klaus Jensen [Tue, 19 Apr 2022 11:24:23 +0000 (13:24 +0200)]
hw/nvme: deprecate the use-intel-id compatibility parameter
Since version 5.2 commit 6eb7a071292a ("hw/block/nvme: change controller
pci id"), the emulated NVMe controller has defaulted to a non-Intel PCI
identifier.
Deprecate the compatibility parameter so we can get rid of it once and
for all.
Klaus Jensen [Fri, 29 Apr 2022 08:33:36 +0000 (10:33 +0200)]
hw/nvme: bump firmware revision
The Linux kernel quirks the QEMU NVMe controller pretty heavily because
of the namespace identifier mess. Since this is now fixed, bump the
firmware revision number to allow the quirk to be disabled for this
revision.
As of now, bump the firmware revision number to be equal to the QEMU
release version number.
Klaus Jensen [Fri, 29 Apr 2022 08:33:34 +0000 (10:33 +0200)]
hw/nvme: do not auto-generate uuid
Do not default to generate an UUID for namespaces if it is not
explicitly specified.
This is a technically a breaking change in behavior. However, since the
UUID changes on every VM launch, it is not spec compliant and is of
little use since the UUID cannot be used reliably anyway and the
behavior prior to this patch must be considered buggy.
Klaus Jensen [Fri, 29 Apr 2022 08:33:33 +0000 (10:33 +0200)]
hw/nvme: do not auto-generate eui64
We cannot provide auto-generated unique or persistent namespace
identifiers (EUI64, NGUID, UUID) easily. Since 6.1, namespaces have been
assigned a generated EUI64 of the form "52:54:00:<namespace counter>".
This is will be unique within a QEMU instance, but not globally.
Revert that this is assigned automatically and immediately deprecate the
compatibility parameter. Users can opt-in to this with the
`eui64-default=on` device parameter or set it explicitly with
`eui64=UINT64`.
Klaus Jensen [Thu, 5 May 2022 22:21:47 +0000 (00:21 +0200)]
hw/nvme: fix smart aen
Pass the right constant to nvme_smart_event(). The NVME_AER* values hold
the bit position in the SMART byte, not the shifted value that we expect
it to be in nvme_smart_event().
Fixes: c62720f137df ("hw/block/nvme: trigger async event during injecting smart warning") Acked-by: zhenwei pi <[email protected]> Signed-off-by: Klaus Jensen <[email protected]>