summary refs log tree commit diff stats
path: root/hw (follow)
Commit message (Collapse)AuthorAgeFilesLines
* hw/core/machine: diagnose wrapping of maxmemDaniel P. Berrangé2024-12-031-1/+9
| | | | | | | | | | | | | | | | The 'maxmem' parameter parsed on the command line is held in uint64_t and then assigned to the MachineState field that is 'ram_addr_t'. This assignment will wrap on 32-bit hosts, silently changing the user's config request if it were over-sized. Improve the existing diagnositics for validating 'size', and add the same diagnostics for 'maxmem' Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Tested-by: Ani Sinha <anisinha@redhat.com> Reviewed-by: Ani Sinha <anisinha@redhat.com> Message-ID: <20241127114057.255995-1-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* hw/openrisc/openrisc_sim: keep serial@90000000 as defaultAhmad Fatoum2024-12-031-6/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We used to only have a single UART on the platform and it was located at address 0x90000000. When the number of UARTs was increased to 4, the first UART remained at it's location, but instead of being the first one to be registered, it became the last. This caused QEMU to pick 0x90000300 as the default UART, which broke software that hardcoded the address of 0x90000000 and expected it's output to be visible when the user configured only a single console. This caused regressions[1] in the barebox test suite when updating to a newer QEMU. As there seems to be no good reason to register the UARTs in inverse order, let's register them by ascending address, so existing software can remain oblivious to the additional UART ports. Changing the order of uart registration alone breaks Linux which was choosing the UART at 0x90000300 as the default for ttyS0. To fix Linux we fix three things in the device tree: 1. Define stdout-path only one time for the first registered UART instead of incorrectly defining for each UART. 2. Change the UART alias name from 'uart0' to 'serial0' as almost all Linux tty drivers look for an alias starting with "serial". 3. Add the UART nodes so they appear in the final DTB in the order starting with the lowest address and working upwards. In summary these changes mean that the QEMU default UART (serial_hd(0)) is now setup where: * serial_hd(0) is the lowest-address UART * serial_hd(0) is listed first in the DTB * serial_hd(0) is the /chosen/stdout-path one * the /aliases/serial0 alias points at serial_hd(0) [1]: https://lore.barebox.org/barebox/707e7c50-aad1-4459-8796-0cc54bab32e2@pengutronix.de/T/#m5da26e8a799033301489a938b5d5667b81cef6ad [stafford: Change to serial0 alias and update change message, reverse uart registration order] Fixes: 777784bda468 ("hw/openrisc: support 4 serial ports in or1ksim") Cc: qemu-stable@nongnu.org Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Signed-off-by: Stafford Horne <shorne@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-ID: <20241203110536.402131-2-shorne@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* hw/openrisc: Fixed undercounting of TTCR in continuous modeJoel Holdsworth2024-12-031-11/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In the existing design, TTCR is prone to undercounting when running in continuous mode. This manifests as a timer interrupt appearing to trigger a few cycles prior to the deadline set in SPR_TTMR_TP. When the timer triggers, the virtual time delta in nanoseconds between the time when the timer was set, and when it triggers is calculated. This nanoseconds value is then divided by TIMER_PERIOD (50) to compute an increment of cycles to apply to TTCR. However, this calculation rounds down the number of cycles causing the undercounting. A simplistic solution would be to instead round up the number of cycles, however this will result in the accumulation of timing error over time. This patch corrects the issue by calculating the time delta in nanoseconds between when the timer was last reset and the timer event. This approach allows the TTCR value to be rounded up, but without accumulating error over time. Signed-off-by: Joel Holdsworth <jholdsworth@nvidia.com> [stafford: Incremented version in vmstate_or1k_timer, checkpatch fixes] Signed-off-by: Stafford Horne <shorne@gmail.com> Message-ID: <20241203110536.402131-3-shorne@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingPeter Maydell2024-11-292-15/+7
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * amd_iommu: fix clang failure on non-KVM targets * target/i386/hvf: fix advertised 1G page support * megasas: fix CDB length # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmdIokMUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroOpbAf/dxoD/vCFfuMPanIbP4quQGWFTKAo # x4qlis07s730EWoNzdT42eER+GWcZiT4LhSwAt3EPqjANpnNwcoOGsc5hlJp8emI # /UbJII90AKLhoJV2gj1xGbRwN1vBJmuBrUQSrLC+5tEr5gFLdHixnlH4pjXGfuF6 # 9eAutgxjRzMiYczsPCev5gbtnvetodP2u9okeQwpQd7N9siCbKx+pB6a67KdvOYn # tmH0se4ai5w9J4Xnagus/goA5VK5dli6ukvYhLps/LQHj2r7XT6AcPMO7KwFlJkW # INW0qEzYqa95iH5pNW2lgmJcCn3rp7g1WFVCCocpecp1WpsweVyzMRhGsA== # =DHEO # -----END PGP SIGNATURE----- # gpg: Signature made Thu 28 Nov 2024 17:02:59 GMT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: scsi: megasas: Internal cdbs have 16-byte length hvf: complete 1G page support amd_iommu: Fix kvm_enable_x2apic link error with clang in non-KVM builds Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * scsi: megasas: Internal cdbs have 16-byte lengthGuenter Roeck2024-11-281-12/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Host drivers do not necessarily set cdb_len in megasas io commands. With commits 6d1511cea0 ("scsi: Reject commands if the CDB length exceeds buf_len") and fe9d8927e2 ("scsi: Add buf_len parameter to scsi_req_new()"), this results in failures to boot Linux from affected SCSI drives because cdb_len is set to 0 by the host driver. Set the cdb length to its actual size to solve the problem. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Fiona Ebner <f.ebner@proxmox.com> Link: https://lore.kernel.org/r/20230228171129.4094709-1-linux@roeck-us.net Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * amd_iommu: Fix kvm_enable_x2apic link error with clang in non-KVM buildsSairaj Kodilkar2024-11-281-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit b12cb3819 (amd_iommu: Check APIC ID > 255 for XTSup) throws linking error for the `kvm_enable_x2apic` when kvm is disabled and Clang is used for compilation. This issue comes up because Clang does not remove the function callsite (kvm_enable_x2apic in this case) during optimization when if condition have variable. Intel IOMMU driver solves this issue by creating separate if condition for checking variables, which causes call site being optimized away by virtue of `kvm_irqchip_is_split()` being defined as 0. Implement same solution for the AMD driver. Fixes: b12cb3819baf (amd_iommu: Check APIC ID > 255 for XTSup) Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com> Signed-off-by: Santosh Shukla <santosh.shukla@amd.com> Tested-by: Phil Dennis-Jordan <phil@philjordan.eu> Link: https://lore.kernel.org/r/20241114114509.15350-1-sarunkod@amd.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | 9pfs: fix 'Tgetattr' after unlinkChristian Schoenebeck2024-11-281-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With a valid file ID (FID) of an open file, it should be possible to send a 'Tgettattr' 9p request and successfully receive a 'Rgetattr' response, even if the file has been removed in the meantime. Currently this would fail with ENOENT. I.e. this fixes the following misbehaviour with a 9p Linux client: open("/home/tst/filename", O_RDWR|O_CREAT|O_EXCL, 0600) = 3 unlink("/home/tst/filename") = 0 fstat(3, 0x23aa1a8) = -1 ENOENT (No such file or directory) Expected results: open("/home/tst/filename", O_RDWR|O_CREAT|O_EXCL, 0600) = 3 unlink("/home/tst/filename") = 0 fstat(3, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 This is because 9p server is always using a path name based lstat() call which fails as soon as the file got removed. So to fix this, use fstat() whenever we have an open file descriptor already. Fixes: 00ede4c2529b ("virtio-9p: getattr server implementation...") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/103 Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <4c41ad47f449a5cc8bfa9285743e029080d5f324.1732465720.git.qemu_oss@crudebyte.com>
* | 9pfs: remove obsolete comment in v9fs_getattr()Christian Schoenebeck2024-11-281-4/+0
| | | | | | | | | | | | | | | | | | | | The comment claims that we'd only support basic Tgetattr fields. This is no longer true, so remove this comment. Fixes: e06a765efbe3 ("hw/9pfs: Add st_gen support in getattr reply") Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <fb364d12045217a4c6ccd0dd6368103ddb80698b.1732465720.git.qemu_oss@crudebyte.com>
* | 9pfs: cleanup V9fsFidStateChristian Schoenebeck2024-11-281-1/+0
|/ | | | | | | | | | | Drop V9fsFidState's 'next' member, which is no longer used since: f5265c8f917e ('9pfs: use GHashTable for fid table') Fixes: f5265c8f917e ('9pfs: use GHashTable for fid table') Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <E1tE4v2-0051EH-Ni@kylie.crudebyte.com>
* Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Peter Maydell2024-11-285-61/+46
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging virtio,pc,pci: bug fixes, new test Some small bug fixes, notably a fix for a regression in cpu hotplug after migration. I also included a new test, just to help make sure we don't regress cxl. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmdHJRIPHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRpTkQIAJYFpFTPRnO8mA6gurfheB7Jt0ywAMrjKWfg # uEkfZXXSQeCS8NBNPoZt7S8AE6xHE2a4b5lNWiS4a4coFmgTjtKPM8YsU01riyRk # EasRxynGua2XGUWGK93r9L27v9zGz/vRC0Lujmw3VAUKGeL7a17KzmxwXLXe+DzS # PgcI/H5hqoCDalT8aF6wOEDaWIHeo4dauDubYavW/+yaPtUvmy9MBkXbIV4iYqT5 # V6geeYIKW/yE/GHxxXOw/RE1FgpiZhebtQP26jPTSk0z/JaV5S0DNYs07joXmbaU # fW5LSLgH3+oDI/GIhvsZ6hP87rVXBdaAogeJqT8SsuChBR55TpY= # =B7KB # -----END PGP SIGNATURE----- # gpg: Signature made Wed 27 Nov 2024 13:56:34 GMT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: vhost: fail device start if iotlb update fails bios-tables-test: Add data for complex numa test (GI, GP etc) bios-tables-test: Add complex SRAT / HMAT test for GI GP bios-tables-test: Allow for new acpihmat-generic-x test data. qapi/qom: Change Since entry for AcpiGenericPortProperties to 9.2 hw/acpi: Fix size of HID in build_append_srat_acpi_device_handle() qapi: fix device-sync-config since-version hw/cxl: Check for zero length features in cmd_features_set_feature() tests/acpi: update expected blobs Revert "hw/acpi: Make CPUs ACPI `presence` conditional during vCPU hot-unplug" Revert "hw/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug states" qtest: allow ACPI DSDT Table changes vhost_net: fix assertion triggered by batch of host notifiers processing Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * vhost: fail device start if iotlb update failsPrasad Pandit2024-11-261-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While starting a vhost device, updating iotlb entries via 'vhost_device_iotlb_miss' may return an error. qemu-kvm: vhost_device_iotlb_miss: 700871,700871: Fail to update device iotlb Fail device start when such an error occurs. Signed-off-by: Prasad Pandit <pjp@fedoraproject.org> Message-Id: <20241107113247.46532-1-ppandit@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
| * hw/acpi: Fix size of HID in build_append_srat_acpi_device_handle()Jonathan Cameron2024-11-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The size should always be 8 so hard code that. By coincidience the incorrect use of sizeof(char *) is 8 on 64 bit hosts, but was caught by CI testing with i686 as the host. Reported-by: Michael S. Tsirkin <mst@redhat.com> Closes: https://lore.kernel.org/qemu-devel/20241104110025-mutt-send-email-mst@kernel.org/ Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241107123446.902801-2-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
| * hw/cxl: Check for zero length features in cmd_features_set_feature()Jonathan Cameron2024-11-261-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Zero length data for features doesn't make any sense so exclude that case early. This fixes the undefined behavior reported by coverity for a zero length memcpy(). Resolves CID 1564900 and 1564901 Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241108175814.1248278-1-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * Revert "hw/acpi: Make CPUs ACPI `presence` conditional during vCPU hot-unplug"Igor Mammedov2024-11-261-14/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 2d6cfbaf174b91dfa9a50065f7494634afb39c23. The patch is supposed to be part of ARM CPU hotplug series and has not value on its own without it. The series however is still in RFC stage and outside of scope 9.2 release. On top of that it introduces not needed callback that pokes directly into CPU state without any need for that. Instead properties and AML generator option should be used to configure static platform depended vCPU presence state. Drop the patch so that corrected version could be posted along with ARM CPU hotplug series and properly reviewed in relevant context. That also helps us to keep history cleaner with new patch being against original code vs a string of fixups on top of current mess. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20241112170258.2996640-4-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * Revert "hw/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug states"Igor Mammedov2024-11-261-34/+4
| | | | | | | | | | | | | | | | | | | | | | This reverts commit bf1ecc8dad6061914730a2a2d57af6b37c3a4f8d which broke cpu hotplug in x86 after migration to older QEMU Fixes: bf1ecc8dad606 (w/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug states) Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20241112170258.2996640-3-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * vhost_net: fix assertion triggered by batch of host notifiers processingzuoboqun2024-11-261-11/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the backend of vhost_net restarts during the vm is running, vhost_net is stopped and started. The virtio_device_grab_ioeventfd() fucntion in vhost_net_enable_notifiers() will result in a call to virtio_bus_set_host_notifier()(assign=false). And now virtio_device_grab_ioeventfd() is batched in a single transaction with virtio_bus_set_host_notifier()(assign=true). This triggers the following assertion: kvm_mem_ioeventfd_del: error deleting ioeventfd: Bad file descriptor This patch moves virtio_device_grab_ioeventfd() out of the batch to fix this problem. To be noted that the for loop to release ioeventfd should start from i+1, not i, because the i-th ioeventfd has already been released in vhost_dev_disable_notifiers_nvqs(). Fixes: 6166799f6 ("vhost_net: configure all host notifiers in a single MR transaction") Signed-off-by: Zuo Boqun <zuoboqun@baidu.com> Reported-by: Gao Shiyuan <gaoshiyuan@baidu.com> Message-Id: <20241115080312.3184-1-zuoboqun@baidu.com> Acked-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | hw/ppc/pegasos2: Fix IRQ routing from pci.0BALATON Zoltan2024-11-272-1/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The MV64361 has two PCI buses one of which is used for AGP on PegasosII. So far we only emulated the PCI bus on pci.1 but some graphics cards are only recognised by some guests when connected to pci.0 corresponding to the AGP port. So far the interrupts were not routed from pci.0 so this patch fixes that allowing the use of both PCI buses. On real board only INTA and INTB are connected for AGP but to avoid surprises we connect all 4 PCI interrupt lines so pci.0 can be used for all PCI cards as well. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
* | ppc/spapr: fix drc index mismatch for partially enabled vcpusHarsh Prateek Bora2024-11-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In case when vcpus are explicitly enabled/disabled in a non-consecutive order within a libvirt xml, it results in a drc index mismatch during vcpu hotplug later because the existing logic uses vcpu id to derive the corresponding drc index which is not correct. Use env->core_index to derive a vcpu's drc index as appropriate to fix this issue. For ex, for the given libvirt xml config: <vcpus> <vcpu id='0' enabled='yes' hotpluggable='no'/> <vcpu id='1' enabled='yes' hotpluggable='yes'/> <vcpu id='2' enabled='no' hotpluggable='yes'/> <vcpu id='3' enabled='yes' hotpluggable='yes'/> <vcpu id='4' enabled='no' hotpluggable='yes'/> <vcpu id='5' enabled='yes' hotpluggable='yes'/> <vcpu id='6' enabled='no' hotpluggable='yes'/> <vcpu id='7' enabled='no' hotpluggable='yes'/> </vcpus> We see below error on guest console with "virsh setvcpus <domain> 5" : pseries-hotplug-cpu: CPU with drc index 10000002 already exists This patch fixes the issue by using correct drc index for explicitly enabled vcpus during init. Reported-by: Anushree Mathur <anushree.mathur@linux.vnet.ibm.com> Tested-by: Anushree Mathur <anushree.mathur@linux.vnet.ibm.com> Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com> Reviewed-by: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
* | ppc/pnv: Add xscom- prefix to pervasive-control region nameNicholas Piggin2024-11-271-1/+1
| | | | | | | | | | | | | | | | | | By convention, xscom regions get a xscom- prefix. Fixes: 1adf24708bf7 ("hw/ppc: Add pnv nest pervasive common chiplet model") Reviewed-by: Glenn Miles <milesg@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
* | target/ppc: Fix THREAD_SIBLING_FOREACH for multi-socketGlenn Miles2024-11-272-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | The THREAD_SIBLING_FOREACH macro wasn't excluding threads from other chips. Add chip_index field to the thread state and add a check for the new field in the macro. Fixes: b769d4c8f4c6 ("target/ppc: Add initial flags and helpers for SMT support") Signed-off-by: Glenn Miles <milesg@linux.ibm.com> [npiggin: set chip_index for spapr too] Reviewed-by: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
* | ppc/pnv: Fix direct controls quiesceNicholas Piggin2024-11-271-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | powernv CPUs have a set of control registers that can stop, start, and do other things to control a thread's execution. Using this interface to stop a thread puts it into a particular state that can be queried, and is distinguishable from other things that might stop the CPU (e.g., going idle, or being debugged via gdb, or stopped by the monitor). Add a new flag that can speficially distinguish this state where it is stopped with control registers. This solves some hangs when rebooting powernv machines when skiboot is modified to allow QEMU to use the CPU control facility (that uses controls to bring all secondaries to a known state). Fixes: c8891955086 ("ppc/pnv: Implement POWER10 PC xscom registers for direct controls") Reviewed-by: Glenn Miles <milesg@linux.ibm.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
* | Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into stagingPeter Maydell2024-11-262-0/+17
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCAAdFiEEIV1G9IJGaJ7HfzVi7wSWWzmNYhEFAmdFRyQACgkQ7wSWWzmN # YhFU1Qf/T9bBOCrbQqbZSG7eKk8QuH35zcgNU7FzFTrGeVCc1bUMNYhiioqAFmE+ # h5h/3vmkmt+01vaTuimTRumI2SJnFFwggveJDWf+ICSl9MRtCXB5+w0n71vJ6gUO # njm36pIl+aMkZIrsDc7lLewVouZkF8mAKP7mn9x53s5lX/HbXZSdPJmrkdUXtNT5 # d3nXlUkNhEWKL9dKIQ9dWYmj3l+tLfuYPiR8a+kKFMEwHlGBuFbNoVN03v5VvFyf # Dmy1P1ZFApP0SsR4SiccXg7C8AslBC6wc7Bhd0aiKpGBnlt20mE9EJSVyrU8yP1p # UTKzzB0QHN7Nnd6AcFRhWvo9C74mGg== # =qP+q # -----END PGP SIGNATURE----- # gpg: Signature made Tue 26 Nov 2024 03:57:24 GMT # gpg: using RSA key 215D46F48246689EC77F3562EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * tag 'net-pull-request' of https://github.com/jasowang/qemu: virtio-net: Add queues before loading them Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | virtio-net: Add queues before loading themAkihiko Odaki2024-11-262-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Call virtio_net_set_multiqueue() to add queues before loading their states. Otherwise the loaded queues will not have handlers and elements in them will not be processed. Cc: qemu-stable@nongnu.org Fixes: 8c49756825da ("virtio-net: Add only one queue pair when realizing") Reported-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | | Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into stagingPeter Maydell2024-11-251-18/+36
|\ \ \ | |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Block layer patches - Fix qmp_device_add() to not throw non-scalar options away (fixes iothread-vq-mapping being silently ignored in device_add) - Fix qdev property crash with integer PCI addresses and JSON -device - iotests: Fix mypy failure - parallels: Avoid potential integer overflow - ssh: libssh broke with non-blocking sessions, use a blocking one for now - Fix crash in migration_is_running() # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmdES74RHGt3b2xmQHJl # ZGhhdC5jb20ACgkQfwmycsiPL9abFQ//fGmBl3Jp99GWB1R0y49/hPhfj0166UGj # zeEmhdy+k6gKywyhVy0Fj0xLztDTb/2bGflrwtDDxYA0PBLel461QSeJUzwDsn9h # ZGLyFrosXgIPADP55RF1wJ6c+m13MX4jVy80Neh2jemhinMazjj3ADb4RdCf0B4M # XoYOy96goDFPlzZNvr08dlaDvJaD5QmPYX8nK7TaZqZOSYvdSRWMuB+QQCPj+qEf # UfpBo3beNsxedNu/1wKS1Nc6FVX7VHKoMzhDLAvxkYMBKcCg9l5lEAGrgp61O+79 # nYZmPtEG5RHsMNBCZtk8zZMIHPg2Ydxpj3jOV3eA0rF4Twk/fPrOOfBEUHT6PapX # tCS1UJtgyQA2GTULiax3vKV4yBSpmUzbhjddNwBkW7uG1md67d17nqbjkEhHVxZL # yMuauFRCx5onzE0TSgTYEMAmAgD9oawuGUqBiNCOqJlTbGZwJ9l7jtwP4Bl1gskk # pWzL/PLP8MkVf50dcP0QBPNHn85/oZOwv5yNr2Z893qNQhh/0xqCEFwqSq2SJOkg # vKd/bAusgmicoh1XD0o0+mv2ewZor/JghrU83YDPKWM1MmOwePZ8wRTx9pJtZWvq # Pnc71397zppHIw7aIWKYDoyQ3aeaoTM/oY2Q5Y7et6c/FvGW5JtFjsPCGbgm9mw+ # +6JA51ujtYU= # =oLdE # -----END PGP SIGNATURE----- # gpg: Signature made Mon 25 Nov 2024 10:04:46 GMT # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * tag 'for-upstream' of https://repo.or.cz/qemu/kevin: ssh: Do not switch session to non-blocking mode vl: use qmp_device_add() in qemu_create_cli_devices() qdev-monitor: avoid QemuOpts in QMP device_add tests/avocado/hotplug_blk: Fix addr in device_add command qdev: Fix set_pci_devfn() to visit option only once python: silence pylint raising-non-exception error python: disable too-many-positional-arguments warning iotests: correct resultclass type in ReproducibleTestRunner iotests: reflow ReproducibleTestRunner arguments parallels: fix possible int overflow Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | qdev: Fix set_pci_devfn() to visit option only onceKevin Wolf2024-11-251-18/+36
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pci_devfn properties accept either a string or an integer as input. To implement this, set_pci_devfn() first tries to visit the option as a string, and if that fails, it visits it as an integer instead. While the QemuOpts visitor happens to accept this, it is invalid according to the visitor interface. QObject input visitors run into an assertion failure when this is done. QObject input visitors are used with the JSON syntax version of -device on the command line: $ ./qemu-system-x86_64 -enable-kvm -M q35 -device pcie-pci-bridge,id=pci.1,bus=pcie.0 -blockdev null-co,node-name=disk -device '{ "driver": "virtio-blk-pci", "drive": "disk", "id": "virtio-disk0", "bus": "pci.1", "addr": 1 }' qemu-system-x86_64: ../qapi/qobject-input-visitor.c:143: QObject *qobject_input_try_get_object(QObjectInputVisitor *, const char *, _Bool): Assertion `removed' failed. The proper way to accept both strings and integers is using the alternate mechanism, which tells us the type of the input before it's visited. With this information, we can directly visit it as the right type. This fixes set_pci_devfn() by using the alternate mechanism. Cc: qemu-stable@nongnu.org Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20241119120353.57812-1-kwolf@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* | virtio-net: Copy received header to bufferAkihiko Odaki2024-11-251-39/+46
| | | | | | | | | | | | | | | | | | receive_header() used to cast the const qualifier of the pointer to the received packet away to modify the header. Avoid this by copying the received header to buffer. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | virtio-net: Initialize hash reporting valuesAkihiko Odaki2024-11-251-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The specification says hash_report should be set to VIRTIO_NET_HASH_REPORT_NONE if VIRTIO_NET_F_HASH_REPORT is negotiated but not configured with VIRTIO_NET_CTRL_MQ_RSS_CONFIG. However, virtio_net_receive_rcu() instead wrote out the content of the extra_hdr variable, which is not uninitialized in such a case. Fix this by zeroing the extra_hdr. Fixes: e22f0603fb2f ("virtio-net: reference implementation of hash report") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | virtio-net: Fix hash reporting when the queue changesAkihiko Odaki2024-11-251-7/+7
| | | | | | | | | | | | | | | | | | | | | | virtio_net_process_rss() fills the values used for hash reporting, but the values used to be thrown away with a recursive function call if the queue changes after RSS. Avoid the function call to keep the values. Fixes: a4c960eedcd2 ("virtio-net: Do not write hashes to peer buffer") Buglink: https://issues.redhat.com/browse/RHEL-59572 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | virtio-net: Do not check for the queue before RSSAkihiko Odaki2024-11-251-4/+4
| | | | | | | | | | | | | | | | | | | | | | virtio_net_can_receive() checks if the queue is ready, but RSS will change the queue to use so, strictly speaking, we may still be able to receive the packet even if the queue initially provided is not ready. Perform RSS before virtio_net_can_receive() to cover such a case. Fixes: 4474e37a5b3a ("virtio-net: implement RX RSS processing") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | virtio-net: Fix size check in dhclient workaroundAkihiko Odaki2024-11-251-1/+4
|/ | | | | | | | | | | | work_around_broken_dhclient() accesses IP and UDP headers to detect relevant packets and to calculate checksums, but it didn't check if the packet has size sufficient to accommodate them, causing out-of-bound access hazards. Fix this by correcting the size requirement. Fixes: 1d41b0c1ec66 ("Work around dhclient brokenness") Cc: qemu-stable@nongnu.org Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* scsi: fix allocation for s390x loadparmPaolo Bonzini2024-11-201-1/+1
| | | | | | | | | | | | | | Coverity reports a possible buffer overrun due to a non-NUL-terminated string in scsi_property_set_loadparm(). While things are not so easy, because qdev_prop_sanitize_s390x_loadparm is designed to operate on a buffer that is not NUL-terminated, in this case the string *does* have to be NUL-terminated because it is read by scsi_property_get_loadparm and s390_build_iplb. Reviewed-by: jrossi@linux.ibm.com Cc: thuth@redhat.com Fixes: 429442e52d9 ("hw: Add "loadparm" property to scsi disk devices for booting on s390x", 2024-11-18) Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/core/machine-smp: Fix error message parameterZhao Liu2024-11-191-1/+1
| | | | | | | | | | | | | | | | In the loop checking smp cache support, the error message should report the current cache level and type. Fix the parameter of error_setg() to ensure it reports the correct cache level and type. Resolves: Coverity CID 1565391 Fixes: f35c0221fef8 ("hw/core: Check smp cache topology support for machine") Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/r/20241110150901.130647-3-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/core/machine-smp: Initialize caches_bitmap before readingZhao Liu2024-11-191-0/+1
| | | | | | | | | | | | | | | The caches_bitmap is defined in machine_parse_smp_cache(), but it was not initialized. Initialize caches_bitmap by clearing all its bits to zero. Resolves: Coverity CID 1565389 Fixes: 4e88e7e3403d ("qapi/qom: Define cache enumeration and properties for machine") Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/r/20241110150901.130647-2-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/i386/pc: Remove vmport value assertionKamil Szczęk2024-11-191-1/+0
| | | | | | | | | | | | | | There is no need for this assertion here, as we only use vmport value for equality/inequality checks. This was originally prompted by the following Coverity report: >>> CID 1559533: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "pcms->vmport >= 0" is always true regardless of the values of >>> its operands. This occurs as the logical first operand of "&&". Signed-off-by: Kamil Szczęk <kamil@szczek.dev> Reported-By: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/r/ZwF9ZexNs1h-uC0MrbkgGtMtdyLinROjVSmMNVzNftjGVWgOiuzdD1dSXEtzNH7OHbBFY6GVDYVFIDBgc3lhGqCOb7kaNZolSBkVyl3rNr4=@szczek.dev Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/intc/loongarch_extioi: Use set_bit32() and clear_bit32() for s->isrPeter Maydell2024-11-191-8/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In extioi_setirq() we try to operate on a bit array stored as an array of uint32_t using the set_bit() and clear_bit() functions by casting the pointer to 'unsigned long *'. This has two problems: * the alignment of 'uint32_t' is less than that of 'unsigned long' so we pass an insufficiently aligned pointer, which is undefined behaviour * on big-endian hosts the 64-bit 'unsigned long' will have its two halves the wrong way around, and we will produce incorrect results The undefined behaviour is shown by the clang undefined-behaviour sanitizer when running the loongarch64-virt functional test: /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/include/qemu/bitops.h:41:5: runtime error: store to misaligned address 0x555559745d9c for type 'unsigned long', which requires 8 byte alignment 0x555559745d9c: note: pointer points here ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ #0 0x555556fb81c4 in set_bit /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/include/qemu/bitops.h:41:9 #1 0x555556fb81c4 in extioi_setirq /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/clang/../../hw/intc/loongarch_extioi.c:65:9 #2 0x555556fb6e90 in pch_pic_irq_handler /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/clang/../../hw/intc/loongarch_pch_pic.c:75:5 #3 0x555556710265 in serial_ioport_write /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/clang/../../hw/char/serial.c Fix these problems by using set_bit32() and clear_bit32(), which work with bit arrays stored as an array of uint32_t. Cc: qemu-stable@nongnu.org Fixes: cbff2db1e92f8759 ("hw/intc: Add LoongArch extioi interrupt controller(EIOINTC)") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Bibo Mao <maobibo@loongson.cn> Message-id: 20241108135514.4006953-4-peter.maydell@linaro.org
* hw/watchdog/cmsdk_apb_watchdog: Fix INTEN issuesRoque Arcudia Hernandez2024-11-191-7/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | Current watchdog is free running out of reset, this combined with the fact that current implementation also ensures the counter is running when programing WDOGLOAD creates issues when the firmware defer the programing of WDOGCONTROL.INTEN much later after WDOGLOAD. Arm Programmer's Model documentation states that INTEN is also the counter enable: > INTEN > > Enable the interrupt event, WDOGINT. Set HIGH to enable the counter > and the interrupt, or LOW to disable the counter and interrupt. > Reloads the counter from the value in WDOGLOAD when the interrupt > is enabled, after previously being disabled. Source of the time of writing: https://developer.arm.com/documentation/ddi0479/d/apb-components/apb-watchdog/programmers-model Signed-off-by: Roque Arcudia Hernandez <roqueh@google.com> Reviewed-by: Stephen Longfield <slongfield@google.com> Reviewed-by: Joe Komlodi <komlodi@google.com> Message-id: 20241115160328.1650269-3-roqueh@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/intc/openpic: Avoid taking address of out-of-bounds array indexPeter Maydell2024-11-191-7/+8
| | | | | | | | | | | | | | | | | | | | | | | | | The clang sanitizer complains about the code in the EOI handling of openpic_cpu_write_internal(): UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1 ./build/clang/qemu-system-ppc -M mac99,graphics=off -display none -kernel day15/invaders.elf ../../hw/intc/openpic.c:1034:16: runtime error: index -1 out of bounds for type 'IRQSource[264]' (aka 'struct IRQSource[264]') SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../hw/intc/openpic.c:1034:16 in This is because we do src = &opp->src[n_IRQ]; when n_IRQ may be -1. This is in practice harmless because if n_IRQ is -1 then we don't do anything with the src pointer, but it is undefined behaviour. (This has been present since this device was first added to QEMU.) Rearrange the code so we only do the array index when n_IRQ is not -1. Cc: qemu-stable@nongnu.org Fixes: e9df014c0b ("Implement embedded IRQ controller for PowerPC 6xx/740 & 75") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-id: 20241105180205.3074071-1-peter.maydell@linaro.org
* hw/net/rocker/rocker_of_dpa.c: Remove superfluous error checkRodrigo Dias Correa2024-11-191-10/+3
| | | | | | | | | | | | | | | | of_dpa_cmd_add_acl_ip() is called from a single place, and despite the fact that it always returns ROCKER_OK, its return value is still checked by the caller. Change of_dpa_cmd_add_acl_ip() to return void and remove the superfluous check from of_dpa_cmd_add_acl(). Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2471 Signed-off-by: Rodrigo Dias Correa <r@drigo.nl> Reviewed-by: Ján Tomko <jtomko@redhat.com> Message-id: 20241114075051.404284-1-r@drigo.nl Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/timer/exynos4210_mct: fix possible int overflowDmitry Frolov2024-11-191-1/+1
| | | | | | | | | | | The product "icnto * s->tcntb" may overflow uint32_t. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Frolov <frolov@swemel.ru> Message-id: 20241106083801.219578-2-frolov@swemel.ru Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge tag 'pull-request-2024-11-18' of https://gitlab.com/thuth/qemu into ↵Peter Maydell2024-11-188-16/+84
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging * Fixes & doc updates for the new "boot order" s390x bios feature * Provide a "loadparm" property for scsi-hd & scsi-cd devices on s390x (required for the "boot order" feature) * Fix the floating-point multiply-and-add NaN rules on s390x * Raise timeout on cross-accel build jobs to 60m # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmc7ercRHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbVjyg//ZuhSDCj+oBSU6vwM7Lwh3CS6GwZvGECU # h60V3tizKypiRNtTJRXHoWcx95brXmoZgI+QQhDEXe3fFLkOEKT6AIlDhrKZRUsd # rpLPr6O8TVKO+rSE7JVJAP3X1tpOOQDxnq83uWBv53b0S+Da0VwDRtI9gcugRMmh # d58P8Q1bV344fQdcrebejstpSUG7RxSA4Plj2uSQx4mSHT7cy/hN+vA34Ha7reE3 # tcN9yfQq3Rmfvt0MV5I9Umd6JXEoDlEAwjSNsWRsCzo69jBZwiMtXSH8LyLtwRTp # C919G/MIRuhvImF74dStLVCr82sNq54YR1NP6CGcmqPH76FOH8Mx3vmx9Cxj9ckA # 6NI6SvIg++bW2O1efG2apz8p5fjbDzYXSAbHnaWTcEu3gPgH4PQ5QXoyKaDymvWV # JIh5/gXEy+twEXgIBsdWQ44A9E06lL/tNfKnqGdXK4ZYF2JIrI+Lq7AKBee7tebP # +72I4PljHLSHQ3GxdkoOeJ8ahu70IBdSz2/VEIwOWK1wIf5C5WFNBerLJyDmkyx8 # xIvIm0vlRLwPcuOC711nlaMaKqTNT+8W4DIqIY6fHs2Jy0psMdgey1uHQxYEj9Kh # fg7CvalK8n3MkGAwTqAvRJIwMFe0a4Ss6c6CaemSaYa38ud/pCNnv+IT+Eqr+mjq # 6y5PZWNrZi0= # =UaDH # -----END PGP SIGNATURE----- # gpg: Signature made Mon 18 Nov 2024 17:34:47 GMT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2024-11-18' of https://gitlab.com/thuth/qemu: .gitlab-ci.d: Raise timeout on cross-accel build jobs to 60m pc-bios: Update the s390 bios images with the recent fixes pc-bios/s390-ccw: Re-initialize receive queue index before each boot attempt pc-bios/s390x: Initialize machine loadparm before probing IPL devices pc-bios/s390x: Initialize cdrom type to false for each IPL device hw: Add "loadparm" property to scsi disk devices for booting on s390x hw/s390x: Restrict "loadparm" property to devices that can be used for booting docs/system/bootindex: Make it clear that s390x can also boot from virtio-net docs/system/s390x/bootdevices: Update loadparm documentation tests/tcg/s390x: Add the floating-point multiply-and-add test target/s390x: Fix the floating-point multiply-and-add NaN rules hw/usb: Use __attribute__((packed)) vs __packed Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw: Add "loadparm" property to scsi disk devices for booting on s390xThomas Huth2024-11-183-13/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While adding the new flexible boot order feature on s390x recently, we missed to add the "loadparm" property to the scsi-hd and scsi-cd devices. This property is required on s390x to pass the information to the boot loader about which kernel should be started or whether the boot menu should be shown. But even more serious: The missing property is now causing trouble with the corresponding libvirt patches that assume that the "loadparm" property is either settable for all bootable devices (when the "boot order" feature is implemented in QEMU), or none (meaning the behaviour of older QEMUs that only allowed one "loadparm" at the machine level). To fix this broken situation, let's implement the "loadparm" property in for the SCSI devices, too. Message-ID: <20241115141202.1877294-1-thuth@redhat.com> Acked-by: Eric Farman <farman@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
| * hw/s390x: Restrict "loadparm" property to devices that can be used for bootingThomas Huth2024-11-185-3/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit bb185de423 ("s390x: Add individual loadparm assignment to CCW device") added a "loadparm" property to all CCW devices. This was a little bit unfortunate, since this property is only useful for devices that can be used for booting, but certainly it is not useful for devices like virtio-gpu or virtio-tablet. Thus let's restrict the property to CCW devices that we can boot from (i.e. virtio-block, virtio-net and vfio-ccw devices). Message-ID: <20241113114741.681096-1-thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Jared Rossi <jrossi@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* | Merge tag 'hw-misc-20241118' of https://github.com/philmd/qemu into stagingPeter Maydell2024-11-189-102/+126
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Misc HW fixes # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmc7NwwACgkQ4+MsLN6t # wN7zBA//VTiAcjB1KYovOiHQWdhtyE7JU+ZOCzULK2aDoKCP9wZM5yZVQgKbDFX/ # +bI2yjzTfZAWknxnqdShQMxvJE3PkD25mm8D2bP22/U9agKSrX4ll9pGt1NMIHUR # Hy01gxoLYp0r/Vs0aDWVQGSU4v62hKjTNOFn30Gqg+Xu9W4glEPSwI5GicypxpWZ # nNAl88whHZ6qouadNCSt0JghwWplw6ZkV3LU4dAUhhhRh+vkPoA3NiCCr4cNqNjJ # yeGc6lLGf2M9GMpX3t2XEV6lXkBTdhUtdv0inZTzH8W2dYt/SL3n/nSKdddXU+fl # F5cfUV8vhFTxeGOTodbwjv3GHxk4BAjKXhoHCPikkCC+tdzgCoAn+ie9Q0iSp28A # kpXt099ByFpkCQ+4fu2+XjX6deC8mxKBKrqjNNEZDqhwuOuiG5Kw8lAzueQErmcZ # djPm6HqnMQFvs4kAp3VMWiqMgkpjJqwB7dfffJfLcXr3+2WF8Ts181/y9LqnkGqn # rlEjy57/dzbzTdt547j8GtKCbXmYOxUgd2a3k2sKCGBsCITtIpTjz2YsrafV84iD # gij8M1IHvt41TNhikvWNKGxJ/5ZY2cx5G/QRbRFVYdFAR14xM45Q/XYuziQgt4if # 6/g7WibP9d8Sqb5Mlj4HLqpPghY0AZ+aaIAHVCDCVYsLpbw7Ixk= # =zdCl # -----END PGP SIGNATURE----- # gpg: Signature made Mon 18 Nov 2024 12:46:04 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'hw-misc-20241118' of https://github.com/philmd/qemu: hw/watchdog/cmsdk_apb_watchdog: Fix broken link net: mark struct ip_header as QEMU_PACKED hw/net/virtio-net.c: Don't assume IP length field is aligned hw/audio/hda: fix memory leak on audio setup Revert "hw/audio/hda: fix memory leak on audio setup" hw/misc/mos6522: Fix bad class definition of the MOS6522 device hw/sd/sdhci: Fix coding style tests/qtest/migration: Fix indentations usb-hub: Fix handling port power control messages MAINTAINERS: Update my email address for COLO hw/display: check frame buffer can hold blob hw/display: factor out the scanout blob to fb conversion hw/i386/elfboot: allocate "header" in heap hw/misc/nrf51_rng: Don't use BIT_MASK() when we mean BIT() vl: fix qemu_validate_options() indention Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/watchdog/cmsdk_apb_watchdog: Fix broken linkRoque Arcudia Hernandez2024-11-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch changes the comments to point to the latest Design Kit Technical Reference Manual. Signed-off-by: Roque Arcudia Hernandez <roqueh@google.com> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20241115160328.1650269-2-roqueh@google.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * | hw/net/virtio-net.c: Don't assume IP length field is alignedPeter Maydell2024-11-181-4/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In virtio-net.c we assume that the IP length field in the packet is aligned, and we copy its address into a uint16_t* in the VirtioNetRscUnit struct which we then dereference later. This isn't a safe assumption; it will also result in compilation failures if we mark the ip_header struct as QEMU_PACKED because the compiler will not let you take the address of an unaligned struct field. Make the ip_plen field in VirtioNetRscUnit a void*, and make all the places where we read or write through that pointer instead use some new accessor functions read_unit_ip_len() and write_unit_ip_len() which account for the pointer being potentially unaligned and also do the network-byte-order conversion we were previously using htons() to perform. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20241114141619.806652-2-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * | hw/audio/hda: fix memory leak on audio setupPaolo Bonzini2024-11-181-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When SET_STREAM_FORMAT is called, the st->buft timer is overwritten, thus causing a memory leak. This was originally fixed in commit 816139ae6a5 ("hw/audio/hda: fix memory leak on audio setup", 2024-11-14) but that caused the audio to break in SPICE. Fortunately, a simpler fix is possible. The timer only needs to be reset, because the callback is always the same (st->output is set at realize time in hda_audio_init); call to timer_new_ns overkill. Replace it with timer_del and only initialize the timer once; for simplicity, do it even if use_timer is false. An even simpler fix would be to free the old time in hda_audio_setup(). However, it seems better to place the initialization of the timer close to that of st->ouput. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20241114125318.1707590-3-pbonzini@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * | Revert "hw/audio/hda: fix memory leak on audio setup"Paolo Bonzini2024-11-181-20/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 6d03242a7e47815ed56687ecd13f683d8da3f2fe, which causes SPICE audio to break. While arguably this is a SPICE bug, it is possible to fix the leak in a less heavy-handed way. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2639 Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20241114125318.1707590-2-pbonzini@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * | hw/sd/sdhci: Fix coding styleJamin Lin2024-11-181-22/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fix coding style issues from checkpatch.pl Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-ID: <20241114094839.4128404-2-jamin_lin@aspeedtech.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * | usb-hub: Fix handling port power control messagesGuenter Roeck2024-11-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ClearPortFeature control message fails for PORT_POWER because there is no break; at the end of the case statement, causing it to fall through to the failure handler. Add the missing break; to solve the problem. Fixes: 1cc403eb21 ("usb-hub: emulate per port power switching") Signed-off-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20241112170152.217664-11-linux@roeck-us.net> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * | hw/display: check frame buffer can hold blobAlex Bennée2024-11-181-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Coverity reports (CID 1564769, 1564770) that we potentially overflow by doing some 32x32 multiplies for something that ends up in a 64 bit value. Fix this by first using stride for all lines and casting input to uint64_t to ensure a 64 bit multiply is used. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com> Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Tested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Message-ID: <20241111230040.68470-3-alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>