summary refs log tree commit diff stats
path: root/hw (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Merge tag 'pull-aspeed-20241211' of https://github.com/legoater/qemu into ↵Peter Maydell2024-12-115-37/+106
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging aspeed queue: * Removed tacoma-bmc machine * Added support for SDHCI on AST2700 SoC * Improved functional tests * Extended SMC qtest to all Aspeed SoCs # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmdZMTQACgkQUaNDx8/7 # 7KE9dhAAw9xNULQ7KG9udSNqYPRGP2w8teO4b9YOfRlJlSJuCInbeLjg1Hw3b/bZ # rEtnwjl18f+mpmHzvasQthN4vUtcR1UwrW6SvmAjAQV8iNw059ugxWdxV9VR72hc # 1AlzsW/Hea8s448INTEUvEjosYeLRRxZQyiJt9Lf5IkU/6yLj98YssKKvRqPpkxP # Ens7PapgGPqA7cPnPYofRn2WINtHNnvX2FGlWTnCoPVp85VJzjJVFcK14kBych2U # fmNZAY7pPTBkwwqR/qoPOyqBBCLeu3Jimk7hR8VbBbfwMT/Zg3RO7TJfwJex9TEs # PIViRuM8krEppL6fmJlpDTatU2t0ffQY1SSVRWCDxJDDRpQN7iDei3vuzXOfLVAe # lLSXS5Q1f+sO6JzbqkYSufh5V7zR5De8rk4j5WszC3cko2godTZm3qyqUxEaQGcx # kjG58R+a7qLLeNMcPed5qgGjYeCPmhHay80E3faXKOezktSIM5z5b822ZPZfw3oG # gTddZ4hdTg0BxtEjSv19qqnJW0Hs+NZJQuyu34QS82dZqPeZ22dmfULtf9uQ/3oV # A/jKfTncl3sW1otfLABj6/RPVH/Sr7IM70XBjlc1+p9Ci7Es17er8umFOAyek9WL # pE/Lq23MnAPBUsPKOJRdDFClTGwdnemXJoymwY/NZS4SgV3GcD8= # =BiCq # -----END PGP SIGNATURE----- # gpg: Signature made Wed 11 Dec 2024 06:29:08 GMT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [full] # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-aspeed-20241211' of https://github.com/legoater/qemu: (24 commits) test/qtest/ast2700-smc-test: Support to test AST2700 test/qtest: Introduce a new aspeed-smc-utils.c to place common testcases test/qtest/aspeed_smc-test: Support write page command with QPI mode test/qtest/aspeed_smc-test: Support to test AST1030 test/qtest/aspeed_smc-test: Support to test AST2600 test/qtest/aspeed_smc-test: Support to test AST2500 test/qtest/aspeed_smc-test: Introducing a "page_addr" data field test/qtest/aspeed_smc-test: Support to test all CE pins test/qtest/aspeed_smc-test: Introduce a new TestData to test different BMC SOCs test/qtest/aspeed_smc-test: Move testcases to test_palmetto_bmc function tests/functional: Move debian boot test from avocado tests/functional: Introduce a specific test for rainier-bmc machine tests/functional: Introduce a specific test for ast2600 SoC tests/functional: Introduce a specific test for ast2500 SoC tests/functional: Introduce a specific test for romulus-bmc machine tests/functional: Introduce a specific test for palmetto-bmc machine tests/functional: Introduce a specific test for ast1030 SoC aspeed/soc: Support eMMC for AST2700 aspeed/soc: Support SDHCI for AST2700 hw/sd/aspeed_sdhci: Add AST2700 Support ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * aspeed/soc: Support eMMC for AST2700Jamin Lin2024-12-111-0/+15
| | | | | | | | | | | | | | | | | | | | | | Add SDHCI model for AST2700 eMMC support. The eMMC controller only support 1 slot and registers base address is start at 0x1209_0000 and its interrupt is connected to GICINT 15. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/r/20241204084453.610660-7-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * aspeed/soc: Support SDHCI for AST2700Jamin Lin2024-12-111-0/+20
| | | | | | | | | | | | | | | | | | | | | | Add SDHCI model for AST2700 SDHCI support. The SDHCI controller only support 1 slot and registers base address is start at 0x1408_0000 and its interrupt is connected to GICINT133_INTC at bit 1. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/r/20241204084453.610660-6-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/sd/aspeed_sdhci: Add AST2700 SupportJamin Lin2024-12-111-0/+14
| | | | | | | | | | | | | | | | | | | | Introduce a new ast2700 class to support AST2700. Add a new ast2700 SDHCI class init function and set the value of capability register to "0x0000000719f80080". Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/r/20241204084453.610660-5-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw:sdhci: Introduce a new "capareg" class member to set the different ↵Jamin Lin2024-12-113-6/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Capability Registers Currently, it set the hardcode value of capability registers to all ASPEED SOCs However, the value of capability registers should be different for all ASPEED SOCs. For example: the bit 28 of the Capability Register 1 should be 1 for 64-bits System Bus support for AST2700. Introduce a new "capareg" class member whose data type is uint_64 to set the different Capability Registers to all ASPEED SOCs. The value of Capability Register is "0x0000000001e80080" for AST2400 and AST2500. The value of Capability Register is "0x0000000701f80080" for AST2600. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/r/20241204084453.610660-4-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/arm/aspeed: Fix coding styleJamin Lin2024-12-111-1/+2
| | | | | | | | | | | | | | | | | | Fix coding style issues from checkpatch.pl. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/r/20241204084453.610660-3-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/sd/aspeed_sdhci: Fix coding styleJamin Lin2024-12-111-2/+4
| | | | | | | | | | | | | | | | | | Fix coding style issues from checkpatch.pl. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/r/20241204084453.610660-2-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * arm: Remove tacoma-bmc machineCédric Le Goater2024-12-111-28/+0
| | | | | | | | | | | | | | | | | | Removal was scheduled for 10.0. Use the rainier-bmc machine or the ast2600-evb as a replacement. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/r/20241119071352.515790-1-clg@redhat.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
* | 9pfs: fix regression regarding CVE-2023-2861Christian Schoenebeck2024-12-101-10/+17
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The released fix for this CVE: f6b0de53fb8 ("9pfs: prevent opening special files (CVE-2023-2861)") caused a regression with security_model=passthrough. When handling a 'Tmknod' request there was a side effect that 'Tmknod' request could fail as 9p server was trying to adjust permissions: #6 close_if_special_file (fd=30) at ../hw/9pfs/9p-util.h:140 #7 openat_file (mode=<optimized out>, flags=2228224, name=<optimized out>, dirfd=<optimized out>) at ../hw/9pfs/9p-util.h:181 #8 fchmodat_nofollow (dirfd=dirfd@entry=31, name=name@entry=0x5555577ea6e0 "mysocket", mode=493) at ../hw/9pfs/9p-local.c:360 #9 local_set_cred_passthrough (credp=0x7ffbbc4ace10, name=0x5555577ea6e0 "mysocket", dirfd=31, fs_ctx=0x55555811f528) at ../hw/9pfs/9p-local.c:457 #10 local_mknod (fs_ctx=0x55555811f528, dir_path=<optimized out>, name=0x5555577ea6e0 "mysocket", credp=0x7ffbbc4ace10) at ../hw/9pfs/9p-local.c:702 #11 v9fs_co_mknod (pdu=pdu@entry=0x555558121140, fidp=fidp@entry=0x5555574c46c0, name=name@entry=0x7ffbbc4aced0, uid=1000, gid=1000, dev=<optimized out>, mode=49645, stbuf=0x7ffbbc4acef0) at ../hw/9pfs/cofs.c:205 #12 v9fs_mknod (opaque=0x555558121140) at ../hw/9pfs/9p.c:3711 That's because server was opening the special file to adjust permissions, however it was using O_PATH and it would have not returned the file descriptor to guest. So the call to close_if_special_file() on that branch was incorrect. Let's lift the restriction introduced by f6b0de53fb8 such that it would allow to open special files on host if O_PATH flag is supplied, not only for 9p server's own operations as described above, but also for any client 'Topen' request. It is safe to allow opening special files with O_PATH on host, because O_PATH only allows path based operations on the resulting file descriptor and prevents I/O such as read() and write() on that file descriptor. Fixes: f6b0de53fb8 ("9pfs: prevent opening special files (CVE-2023-2861)") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2337 Reported-by: Dirk Herrendorfer <d.herrendoerfer@de.ibm.com> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Tested-by: Dirk Herrendorfer <d.herrendoerfer@de.ibm.com> Message-Id: <E1tJWbk-007BH4-OB@kylie.crudebyte.com>
* Merge tag 'hw-misc-20241203' of https://github.com/philmd/qemu into stagingPeter Maydell2024-12-033-3/+25
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Misc fixes for QEMU v9.2.0 # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmdO66kACgkQ4+MsLN6t # wN4dGw//ZSVZO/cdOc1izC44mCPjnHkhSjX5i12E09QnDfNQ9cef2pG50lsndm3N # xJwunST+Hqfoh07YT4zuGSO+60BiiPsPse+ytnuHK0E4wLbIfrWzPcf1CMRDk3wf # O4IniCv8O7BRYccK1iPkFI8ZVqK84m3Bn1tQ51LOy09b6om7jIqNwlxWxGYqkWCR # l+9RxW/IKWD3OrveBATEhD1lwoUBIYPPzdm6NayEdOJXGOgnvbNbtmuRCR8dCxCS # RUH3GZu0vvRTpOYjFzeR9Xy+CE1vcOeKsZf35QwV4eX8+UKv30HgF6J8fInkS60m # EqPA+AU7fi+DN3Ua1Jx38wXHPr8mPTQoVGV6q0UB8b3B22kPQn+Mu8jHLyMOp4rK # 6JEX5cAOZuwBEk0I8VjwqeDGVYgFwnMHhVuss0N4kCvP0qQcC2JMGMW0Rk4Lxw16 # q0kwbQ0c56+qET57EOf9VW40Yb1q3Zu9t39XfNO/m3KGLkVSPfFZEu5voWD14mZW # RutPlG/ww3n878Xz06YsqYF0ED/0SiW8U1tmEzg+X9vA/7Z7/0MH0rleNb36a0Fs # 0aDq/mZBcnFLKy+9rlpy18OolY/N6LZnebCpdQe5wSRn/ioWDc4/GyIaLO9lSE5o # TFHmGtIIQ2FoeRgtwCSfVNwaA6ILgPRsgXFDOqxCUplgKv6GX2Q= # =GZ/H # -----END PGP SIGNATURE----- # gpg: Signature made Tue 03 Dec 2024 11:29:45 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'hw-misc-20241203' of https://github.com/philmd/qemu: system: Select HVF by default when no other accelerator is available tests/qtest: add test for querying balloon guest stats tests/qtest: drop 'fuzz-' prefix from virtio-balloon test hw/virtio: fix crash in processing balloon stats hw/display/vga: Do not reset 'big_endian_fb' in vga_common_reset() target/riscv: Avoid bad shift in riscv_cpu_do_interrupt() hw/core/machine: diagnose wrapping of maxmem MAINTAINERS: update email addr for Brian Cain meson: Add missing SDL dependency to system/main.c MAINTAINERS: add myself as the maintainer for LoongArch VirtMachine ui/cocoa: Temporarily ignore annoying deprecated declaration warnings hw/openrisc/openrisc_sim: keep serial@90000000 as default hw/openrisc: Fixed undercounting of TTCR in continuous mode Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/virtio: fix crash in processing balloon statsDaniel P. Berrangé2024-12-031-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | balloon_stats_get_all will iterate over guest stats upto the max VIRTIO_BALLOON_S_NR value, calling visit_type_uint64 to populate the QObject dict. The dict keys are obtained from the static array balloon_stat_names which is VIRTIO_BALLOON_S_NR in size. Unfortunately the way that array is declared results in any unassigned stats getting a NULL name, which will then cause visit_type_uint64 to trigger an assert in qobject_output_add_obj. The balloon_stat_names array was fortunately fully populated with names until recently: commit 0d2eeef77a33315187df8519491a900bde4a3d83 Author: Bibo Mao <maobibo@loongson.cn> Date: Mon Oct 28 10:38:09 2024 +0800 linux-headers: Update to Linux v6.12-rc5 pulled a change to include/standard-headers/linux/virtio_balloon.h which increased VIRTIO_BALLOON_S_NR by 6, and failed to add the new names to balloon_stat_names. This commit fills in the missing names, and uses a static assert to guarantee that any future changes to VIRTIO_BALLOON_S_NR will cause a build failure until balloon_stat_names is updated. This problem was detected by the Cockpit Project's automated integration tests on QEMU 9.2.0-rc1. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2329448 Fixes: 0d2eeef77a3 ("linux-headers: Update to Linux v6.12-rc5") Reported-by: Martin Pitt <mpitt@redhat.com> Reviewed-by: Richard W.M. Jones <rjones@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20241129135507.699030-2-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * hw/display/vga: Do not reset 'big_endian_fb' in vga_common_reset()Philippe Mathieu-Daudé2024-12-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 'pci-vga' device allow setting a 'big-endian-framebuffer' property since commit 3c2784fc864 ("vga: Expose framebuffer byteorder as a QOM property"). Similarly, the 'virtio-vga' device since commit 8be61ce2ce3 ("virtio-vga: implement big-endian-framebuffer property"). Both call vga_common_reset() in their reset handler, respectively pci_secondary_vga_reset() and virtio_vga_base_reset_hold(), which reset 'big_endian_fb', overwritting the property. This is not correct: the hardware is expected to keep its configured endianness during resets. Move 'big_endian_fb' assignment from vga_common_reset() to vga_common_init() which is called once when the common VGA state is initialized. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Message-Id: <20241129101721.17836-2-philmd@linaro.org>
| * hw/core/machine: diagnose wrapping of maxmemDaniel P. Berrangé2024-12-031-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 'maxmem' parameter parsed on the command line is held in uint64_t and then assigned to the MachineState field that is 'ram_addr_t'. This assignment will wrap on 32-bit hosts, silently changing the user's config request if it were over-sized. Improve the existing diagnositics for validating 'size', and add the same diagnostics for 'maxmem' Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Tested-by: Ani Sinha <anisinha@redhat.com> Reviewed-by: Ani Sinha <anisinha@redhat.com> Message-ID: <20241127114057.255995-1-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * hw/openrisc/openrisc_sim: keep serial@90000000 as defaultAhmad Fatoum2024-12-031-6/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We used to only have a single UART on the platform and it was located at address 0x90000000. When the number of UARTs was increased to 4, the first UART remained at it's location, but instead of being the first one to be registered, it became the last. This caused QEMU to pick 0x90000300 as the default UART, which broke software that hardcoded the address of 0x90000000 and expected it's output to be visible when the user configured only a single console. This caused regressions[1] in the barebox test suite when updating to a newer QEMU. As there seems to be no good reason to register the UARTs in inverse order, let's register them by ascending address, so existing software can remain oblivious to the additional UART ports. Changing the order of uart registration alone breaks Linux which was choosing the UART at 0x90000300 as the default for ttyS0. To fix Linux we fix three things in the device tree: 1. Define stdout-path only one time for the first registered UART instead of incorrectly defining for each UART. 2. Change the UART alias name from 'uart0' to 'serial0' as almost all Linux tty drivers look for an alias starting with "serial". 3. Add the UART nodes so they appear in the final DTB in the order starting with the lowest address and working upwards. In summary these changes mean that the QEMU default UART (serial_hd(0)) is now setup where: * serial_hd(0) is the lowest-address UART * serial_hd(0) is listed first in the DTB * serial_hd(0) is the /chosen/stdout-path one * the /aliases/serial0 alias points at serial_hd(0) [1]: https://lore.barebox.org/barebox/707e7c50-aad1-4459-8796-0cc54bab32e2@pengutronix.de/T/#m5da26e8a799033301489a938b5d5667b81cef6ad [stafford: Change to serial0 alias and update change message, reverse uart registration order] Fixes: 777784bda468 ("hw/openrisc: support 4 serial ports in or1ksim") Cc: qemu-stable@nongnu.org Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Signed-off-by: Stafford Horne <shorne@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-ID: <20241203110536.402131-2-shorne@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * hw/openrisc: Fixed undercounting of TTCR in continuous modeJoel Holdsworth2024-12-031-11/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the existing design, TTCR is prone to undercounting when running in continuous mode. This manifests as a timer interrupt appearing to trigger a few cycles prior to the deadline set in SPR_TTMR_TP. When the timer triggers, the virtual time delta in nanoseconds between the time when the timer was set, and when it triggers is calculated. This nanoseconds value is then divided by TIMER_PERIOD (50) to compute an increment of cycles to apply to TTCR. However, this calculation rounds down the number of cycles causing the undercounting. A simplistic solution would be to instead round up the number of cycles, however this will result in the accumulation of timing error over time. This patch corrects the issue by calculating the time delta in nanoseconds between when the timer was last reset and the timer event. This approach allows the TTCR value to be rounded up, but without accumulating error over time. Signed-off-by: Joel Holdsworth <jholdsworth@nvidia.com> [stafford: Incremented version in vmstate_or1k_timer, checkpatch fixes] Signed-off-by: Stafford Horne <shorne@gmail.com> Message-ID: <20241203110536.402131-3-shorne@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* | Merge tag 'pull-or1k-20241203' of https://github.com/stffrdhrn/qemu into stagingPeter Maydell2024-12-032-17/+35
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenRISC updates for 9.2.0 This series has 2 fixes: - Fix to keep serial@90000000 as default - Fixed undercounting of TTCR in continuous mode # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE2cRzVK74bBA6Je/xw7McLV5mJ+QFAmdO56EACgkQw7McLV5m # J+T8BRAAxZMH4ykdRJBmYiFVOsYKagcdT6GGBHL44FGeQSr1lNyoU0Rn5r6v5GHe # Nwq7DTeZlKoVji5GXki53mGrwENXr00m+xfc9ACMoWr5IM6McQUPXlQAQ/50fIGs # lzXMZH/4EdPIVkkpCi+y8FLYw02oQg61U9G0HW02lQJy4Y4mudtvQFGzJ7f3SIZ3 # EkKn5YLG0bqszq/amFNLQXlbnq3yI5zfcMHhHx0KuDsm2yNhrNA+AJP8tLI3JlxL # +0YIA+fWuxQzz8Zu9+ckc8VAV83HIgQpXVzI6rQxdSwbmRgUu9ITO09ZmxaDHZF6 # sDI6K3VouyaHJVkvu4coDajpYTjHLE26c9LAlaVBpgdnmnYy4vlndEqbfaBqOouX # n0N2wJ3IGouIw7AnB9dTaZhM/Uo09hZKDr6kCm3hLfPn2+vi3yxsbwVwLaOpH3G3 # kQ5ZFKjoA7XWOaXGOUMcmhByXkSxja+pSBppB58vJAFyVp73HYIpea3/q1Zd8S4S # noJoqxDtD2zf26bDBIe83pUEnSnL8fAcsh3rlQP8HrWYhU7ZulVSE1ZvPkPgDpkY # LVCPautTElsMp2Mg4a2oODGvSDN4/5h2dp6TaK4Qep92HHFOwPZQBQW607VwWR5N # II8dB/l8PluKkgZ3ymhP1p9JAAZFe9a2cMmegRIiM74PkPty0kk= # =guIi # -----END PGP SIGNATURE----- # gpg: Signature made Tue 03 Dec 2024 11:12:33 GMT # gpg: using RSA key D9C47354AEF86C103A25EFF1C3B31C2D5E6627E4 # gpg: Good signature from "Stafford Horne <shorne@gmail.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: D9C4 7354 AEF8 6C10 3A25 EFF1 C3B3 1C2D 5E66 27E4 * tag 'pull-or1k-20241203' of https://github.com/stffrdhrn/qemu: hw/openrisc: Fixed undercounting of TTCR in continuous mode hw/openrisc/openrisc_sim: keep serial@90000000 as default Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/openrisc: Fixed undercounting of TTCR in continuous modeJoel Holdsworth2024-12-031-11/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the existing design, TTCR is prone to undercounting when running in continuous mode. This manifests as a timer interrupt appearing to trigger a few cycles prior to the deadline set in SPR_TTMR_TP. When the timer triggers, the virtual time delta in nanoseconds between the time when the timer was set, and when it triggers is calculated. This nanoseconds value is then divided by TIMER_PERIOD (50) to compute an increment of cycles to apply to TTCR. However, this calculation rounds down the number of cycles causing the undercounting. A simplistic solution would be to instead round up the number of cycles, however this will result in the accumulation of timing error over time. This patch corrects the issue by calculating the time delta in nanoseconds between when the timer was last reset and the timer event. This approach allows the TTCR value to be rounded up, but without accumulating error over time. Signed-off-by: Joel Holdsworth <jholdsworth@nvidia.com> [stafford: Incremented version in vmstate_or1k_timer, checkpatch fixes] Signed-off-by: Stafford Horne <shorne@gmail.com>
| * | hw/openrisc/openrisc_sim: keep serial@90000000 as defaultAhmad Fatoum2024-12-031-6/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We used to only have a single UART on the platform and it was located at address 0x90000000. When the number of UARTs was increased to 4, the first UART remained at it's location, but instead of being the first one to be registered, it became the last. This caused QEMU to pick 0x90000300 as the default UART, which broke software that hardcoded the address of 0x90000000 and expected it's output to be visible when the user configured only a single console. This caused regressions[1] in the barebox test suite when updating to a newer QEMU. As there seems to be no good reason to register the UARTs in inverse order, let's register them by ascending address, so existing software can remain oblivious to the additional UART ports. Changing the order of uart registration alone breaks Linux which was choosing the UART at 0x90000300 as the default for ttyS0. To fix Linux we fix three things in the device tree: 1. Define stdout-path only one time for the first registered UART instead of incorrectly defining for each UART. 2. Change the UART alias name from 'uart0' to 'serial0' as almost all Linux tty drivers look for an alias starting with "serial". 3. Add the UART nodes so they appear in the final DTB in the order starting with the lowest address and working upwards. In summary these changes mean that the QEMU default UART (serial_hd(0)) is now setup where: * serial_hd(0) is the lowest-address UART * serial_hd(0) is listed first in the DTB * serial_hd(0) is the /chosen/stdout-path one * the /aliases/serial0 alias points at serial_hd(0) [1]: https://lore.barebox.org/barebox/707e7c50-aad1-4459-8796-0cc54bab32e2@pengutronix.de/T/#m5da26e8a799033301489a938b5d5667b81cef6ad Fixes: 777784bda468 ("hw/openrisc: support 4 serial ports in or1ksim") Cc: qemu-stable@nongnu.org Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> [stafford: Change to serial0 alias and update change message, reverse uart registration order] Signed-off-by: Stafford Horne <shorne@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
* | | hw/nvme: take a reference on the subsystem on vf realizationKlaus Jensen2024-12-031-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure we grab a reference on the subsystem when a VF is realized. Otherwise, the subsytem will be unrealized automatically when the VFs are unregistered and unreffed. This fixes a latent bug but was not exposed until commit 08f632848008 ("pcie: Release references of virtual functions"). This was then fixed (or rather, hidden) by commit c613ad25125b ("pcie_sriov: Do not manually unrealize"), but that was then reverted (due to other issues) in commit b0fdaee5d1ed, exposing the bug yet again. Cc: qemu-stable@nongnu.org Fixes: 08f632848008 ("pcie: Release references of virtual functions") Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
* | | hw/nvme: SR-IOV VFs must hardwire pci interrupt pin register to zeroKlaus Jensen2024-12-031-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | The PCI Interrupt Pin Register does not apply to VFs and MUST be hardwired to zero. Fixes: 44c2c09488db ("hw/nvme: Add support for SR-IOV") Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
* | | hw/nvme: fix use/unuse of msix vectorsKlaus Jensen2024-12-031-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | Only call msix_{un,}use_vector() when interrupts are actually enabled for a completion queue. Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
* | | hw/nvme: fix msix_uninit with exclusive barKlaus Jensen2024-12-031-1/+6
| |/ |/| | | | | | | | | | | | | | | | | | | | | Commit fa905f65c554 introduced a machine compatibility parameter to enable an exclusive bar for msix. It failed to account for this when cleaning up. Make sure that if an exclusive bar is enabled, we use the proper cleanup routine. Cc: qemu-stable@nongnu.org Fixes: fa905f65c554 ("hw/nvme: add machine compatibility parameter to enable msix exclusive bar") Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
* | Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingPeter Maydell2024-11-292-15/+7
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * amd_iommu: fix clang failure on non-KVM targets * target/i386/hvf: fix advertised 1G page support * megasas: fix CDB length # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmdIokMUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroOpbAf/dxoD/vCFfuMPanIbP4quQGWFTKAo # x4qlis07s730EWoNzdT42eER+GWcZiT4LhSwAt3EPqjANpnNwcoOGsc5hlJp8emI # /UbJII90AKLhoJV2gj1xGbRwN1vBJmuBrUQSrLC+5tEr5gFLdHixnlH4pjXGfuF6 # 9eAutgxjRzMiYczsPCev5gbtnvetodP2u9okeQwpQd7N9siCbKx+pB6a67KdvOYn # tmH0se4ai5w9J4Xnagus/goA5VK5dli6ukvYhLps/LQHj2r7XT6AcPMO7KwFlJkW # INW0qEzYqa95iH5pNW2lgmJcCn3rp7g1WFVCCocpecp1WpsweVyzMRhGsA== # =DHEO # -----END PGP SIGNATURE----- # gpg: Signature made Thu 28 Nov 2024 17:02:59 GMT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: scsi: megasas: Internal cdbs have 16-byte length hvf: complete 1G page support amd_iommu: Fix kvm_enable_x2apic link error with clang in non-KVM builds Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | scsi: megasas: Internal cdbs have 16-byte lengthGuenter Roeck2024-11-281-12/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Host drivers do not necessarily set cdb_len in megasas io commands. With commits 6d1511cea0 ("scsi: Reject commands if the CDB length exceeds buf_len") and fe9d8927e2 ("scsi: Add buf_len parameter to scsi_req_new()"), this results in failures to boot Linux from affected SCSI drives because cdb_len is set to 0 by the host driver. Set the cdb length to its actual size to solve the problem. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Fiona Ebner <f.ebner@proxmox.com> Link: https://lore.kernel.org/r/20230228171129.4094709-1-linux@roeck-us.net Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | amd_iommu: Fix kvm_enable_x2apic link error with clang in non-KVM buildsSairaj Kodilkar2024-11-281-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit b12cb3819 (amd_iommu: Check APIC ID > 255 for XTSup) throws linking error for the `kvm_enable_x2apic` when kvm is disabled and Clang is used for compilation. This issue comes up because Clang does not remove the function callsite (kvm_enable_x2apic in this case) during optimization when if condition have variable. Intel IOMMU driver solves this issue by creating separate if condition for checking variables, which causes call site being optimized away by virtue of `kvm_irqchip_is_split()` being defined as 0. Implement same solution for the AMD driver. Fixes: b12cb3819baf (amd_iommu: Check APIC ID > 255 for XTSup) Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com> Signed-off-by: Santosh Shukla <santosh.shukla@amd.com> Tested-by: Phil Dennis-Jordan <phil@philjordan.eu> Link: https://lore.kernel.org/r/20241114114509.15350-1-sarunkod@amd.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | | 9pfs: fix 'Tgetattr' after unlinkChristian Schoenebeck2024-11-281-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With a valid file ID (FID) of an open file, it should be possible to send a 'Tgettattr' 9p request and successfully receive a 'Rgetattr' response, even if the file has been removed in the meantime. Currently this would fail with ENOENT. I.e. this fixes the following misbehaviour with a 9p Linux client: open("/home/tst/filename", O_RDWR|O_CREAT|O_EXCL, 0600) = 3 unlink("/home/tst/filename") = 0 fstat(3, 0x23aa1a8) = -1 ENOENT (No such file or directory) Expected results: open("/home/tst/filename", O_RDWR|O_CREAT|O_EXCL, 0600) = 3 unlink("/home/tst/filename") = 0 fstat(3, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 This is because 9p server is always using a path name based lstat() call which fails as soon as the file got removed. So to fix this, use fstat() whenever we have an open file descriptor already. Fixes: 00ede4c2529b ("virtio-9p: getattr server implementation...") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/103 Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <4c41ad47f449a5cc8bfa9285743e029080d5f324.1732465720.git.qemu_oss@crudebyte.com>
* | | 9pfs: remove obsolete comment in v9fs_getattr()Christian Schoenebeck2024-11-281-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The comment claims that we'd only support basic Tgetattr fields. This is no longer true, so remove this comment. Fixes: e06a765efbe3 ("hw/9pfs: Add st_gen support in getattr reply") Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <fb364d12045217a4c6ccd0dd6368103ddb80698b.1732465720.git.qemu_oss@crudebyte.com>
* | | 9pfs: cleanup V9fsFidStateChristian Schoenebeck2024-11-281-1/+0
|/ / | | | | | | | | | | | | | | | | | | | | Drop V9fsFidState's 'next' member, which is no longer used since: f5265c8f917e ('9pfs: use GHashTable for fid table') Fixes: f5265c8f917e ('9pfs: use GHashTable for fid table') Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <E1tE4v2-0051EH-Ni@kylie.crudebyte.com>
* | Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Peter Maydell2024-11-285-61/+46
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging virtio,pc,pci: bug fixes, new test Some small bug fixes, notably a fix for a regression in cpu hotplug after migration. I also included a new test, just to help make sure we don't regress cxl. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmdHJRIPHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRpTkQIAJYFpFTPRnO8mA6gurfheB7Jt0ywAMrjKWfg # uEkfZXXSQeCS8NBNPoZt7S8AE6xHE2a4b5lNWiS4a4coFmgTjtKPM8YsU01riyRk # EasRxynGua2XGUWGK93r9L27v9zGz/vRC0Lujmw3VAUKGeL7a17KzmxwXLXe+DzS # PgcI/H5hqoCDalT8aF6wOEDaWIHeo4dauDubYavW/+yaPtUvmy9MBkXbIV4iYqT5 # V6geeYIKW/yE/GHxxXOw/RE1FgpiZhebtQP26jPTSk0z/JaV5S0DNYs07joXmbaU # fW5LSLgH3+oDI/GIhvsZ6hP87rVXBdaAogeJqT8SsuChBR55TpY= # =B7KB # -----END PGP SIGNATURE----- # gpg: Signature made Wed 27 Nov 2024 13:56:34 GMT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: vhost: fail device start if iotlb update fails bios-tables-test: Add data for complex numa test (GI, GP etc) bios-tables-test: Add complex SRAT / HMAT test for GI GP bios-tables-test: Allow for new acpihmat-generic-x test data. qapi/qom: Change Since entry for AcpiGenericPortProperties to 9.2 hw/acpi: Fix size of HID in build_append_srat_acpi_device_handle() qapi: fix device-sync-config since-version hw/cxl: Check for zero length features in cmd_features_set_feature() tests/acpi: update expected blobs Revert "hw/acpi: Make CPUs ACPI `presence` conditional during vCPU hot-unplug" Revert "hw/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug states" qtest: allow ACPI DSDT Table changes vhost_net: fix assertion triggered by batch of host notifiers processing Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | vhost: fail device start if iotlb update failsPrasad Pandit2024-11-261-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While starting a vhost device, updating iotlb entries via 'vhost_device_iotlb_miss' may return an error. qemu-kvm: vhost_device_iotlb_miss: 700871,700871: Fail to update device iotlb Fail device start when such an error occurs. Signed-off-by: Prasad Pandit <pjp@fedoraproject.org> Message-Id: <20241107113247.46532-1-ppandit@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
| * | hw/acpi: Fix size of HID in build_append_srat_acpi_device_handle()Jonathan Cameron2024-11-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The size should always be 8 so hard code that. By coincidience the incorrect use of sizeof(char *) is 8 on 64 bit hosts, but was caught by CI testing with i686 as the host. Reported-by: Michael S. Tsirkin <mst@redhat.com> Closes: https://lore.kernel.org/qemu-devel/20241104110025-mutt-send-email-mst@kernel.org/ Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241107123446.902801-2-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
| * | hw/cxl: Check for zero length features in cmd_features_set_feature()Jonathan Cameron2024-11-261-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Zero length data for features doesn't make any sense so exclude that case early. This fixes the undefined behavior reported by coverity for a zero length memcpy(). Resolves CID 1564900 and 1564901 Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20241108175814.1248278-1-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | Revert "hw/acpi: Make CPUs ACPI `presence` conditional during vCPU hot-unplug"Igor Mammedov2024-11-261-14/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 2d6cfbaf174b91dfa9a50065f7494634afb39c23. The patch is supposed to be part of ARM CPU hotplug series and has not value on its own without it. The series however is still in RFC stage and outside of scope 9.2 release. On top of that it introduces not needed callback that pokes directly into CPU state without any need for that. Instead properties and AML generator option should be used to configure static platform depended vCPU presence state. Drop the patch so that corrected version could be posted along with ARM CPU hotplug series and properly reviewed in relevant context. That also helps us to keep history cleaner with new patch being against original code vs a string of fixups on top of current mess. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20241112170258.2996640-4-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | Revert "hw/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug states"Igor Mammedov2024-11-261-34/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit bf1ecc8dad6061914730a2a2d57af6b37c3a4f8d which broke cpu hotplug in x86 after migration to older QEMU Fixes: bf1ecc8dad606 (w/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug states) Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20241112170258.2996640-3-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | vhost_net: fix assertion triggered by batch of host notifiers processingzuoboqun2024-11-261-11/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the backend of vhost_net restarts during the vm is running, vhost_net is stopped and started. The virtio_device_grab_ioeventfd() fucntion in vhost_net_enable_notifiers() will result in a call to virtio_bus_set_host_notifier()(assign=false). And now virtio_device_grab_ioeventfd() is batched in a single transaction with virtio_bus_set_host_notifier()(assign=true). This triggers the following assertion: kvm_mem_ioeventfd_del: error deleting ioeventfd: Bad file descriptor This patch moves virtio_device_grab_ioeventfd() out of the batch to fix this problem. To be noted that the for loop to release ioeventfd should start from i+1, not i, because the i-th ioeventfd has already been released in vhost_dev_disable_notifiers_nvqs(). Fixes: 6166799f6 ("vhost_net: configure all host notifiers in a single MR transaction") Signed-off-by: Zuo Boqun <zuoboqun@baidu.com> Reported-by: Gao Shiyuan <gaoshiyuan@baidu.com> Message-Id: <20241115080312.3184-1-zuoboqun@baidu.com> Acked-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | | hw/ppc/pegasos2: Fix IRQ routing from pci.0BALATON Zoltan2024-11-272-1/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The MV64361 has two PCI buses one of which is used for AGP on PegasosII. So far we only emulated the PCI bus on pci.1 but some graphics cards are only recognised by some guests when connected to pci.0 corresponding to the AGP port. So far the interrupts were not routed from pci.0 so this patch fixes that allowing the use of both PCI buses. On real board only INTA and INTB are connected for AGP but to avoid surprises we connect all 4 PCI interrupt lines so pci.0 can be used for all PCI cards as well. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
* | | ppc/spapr: fix drc index mismatch for partially enabled vcpusHarsh Prateek Bora2024-11-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In case when vcpus are explicitly enabled/disabled in a non-consecutive order within a libvirt xml, it results in a drc index mismatch during vcpu hotplug later because the existing logic uses vcpu id to derive the corresponding drc index which is not correct. Use env->core_index to derive a vcpu's drc index as appropriate to fix this issue. For ex, for the given libvirt xml config: <vcpus> <vcpu id='0' enabled='yes' hotpluggable='no'/> <vcpu id='1' enabled='yes' hotpluggable='yes'/> <vcpu id='2' enabled='no' hotpluggable='yes'/> <vcpu id='3' enabled='yes' hotpluggable='yes'/> <vcpu id='4' enabled='no' hotpluggable='yes'/> <vcpu id='5' enabled='yes' hotpluggable='yes'/> <vcpu id='6' enabled='no' hotpluggable='yes'/> <vcpu id='7' enabled='no' hotpluggable='yes'/> </vcpus> We see below error on guest console with "virsh setvcpus <domain> 5" : pseries-hotplug-cpu: CPU with drc index 10000002 already exists This patch fixes the issue by using correct drc index for explicitly enabled vcpus during init. Reported-by: Anushree Mathur <anushree.mathur@linux.vnet.ibm.com> Tested-by: Anushree Mathur <anushree.mathur@linux.vnet.ibm.com> Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com> Reviewed-by: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
* | | ppc/pnv: Add xscom- prefix to pervasive-control region nameNicholas Piggin2024-11-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | By convention, xscom regions get a xscom- prefix. Fixes: 1adf24708bf7 ("hw/ppc: Add pnv nest pervasive common chiplet model") Reviewed-by: Glenn Miles <milesg@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
* | | target/ppc: Fix THREAD_SIBLING_FOREACH for multi-socketGlenn Miles2024-11-272-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The THREAD_SIBLING_FOREACH macro wasn't excluding threads from other chips. Add chip_index field to the thread state and add a check for the new field in the macro. Fixes: b769d4c8f4c6 ("target/ppc: Add initial flags and helpers for SMT support") Signed-off-by: Glenn Miles <milesg@linux.ibm.com> [npiggin: set chip_index for spapr too] Reviewed-by: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
* | | ppc/pnv: Fix direct controls quiesceNicholas Piggin2024-11-271-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | powernv CPUs have a set of control registers that can stop, start, and do other things to control a thread's execution. Using this interface to stop a thread puts it into a particular state that can be queried, and is distinguishable from other things that might stop the CPU (e.g., going idle, or being debugged via gdb, or stopped by the monitor). Add a new flag that can speficially distinguish this state where it is stopped with control registers. This solves some hangs when rebooting powernv machines when skiboot is modified to allow QEMU to use the CPU control facility (that uses controls to bring all secondaries to a known state). Fixes: c8891955086 ("ppc/pnv: Implement POWER10 PC xscom registers for direct controls") Reviewed-by: Glenn Miles <milesg@linux.ibm.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
* | | Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into stagingPeter Maydell2024-11-262-0/+17
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCAAdFiEEIV1G9IJGaJ7HfzVi7wSWWzmNYhEFAmdFRyQACgkQ7wSWWzmN # YhFU1Qf/T9bBOCrbQqbZSG7eKk8QuH35zcgNU7FzFTrGeVCc1bUMNYhiioqAFmE+ # h5h/3vmkmt+01vaTuimTRumI2SJnFFwggveJDWf+ICSl9MRtCXB5+w0n71vJ6gUO # njm36pIl+aMkZIrsDc7lLewVouZkF8mAKP7mn9x53s5lX/HbXZSdPJmrkdUXtNT5 # d3nXlUkNhEWKL9dKIQ9dWYmj3l+tLfuYPiR8a+kKFMEwHlGBuFbNoVN03v5VvFyf # Dmy1P1ZFApP0SsR4SiccXg7C8AslBC6wc7Bhd0aiKpGBnlt20mE9EJSVyrU8yP1p # UTKzzB0QHN7Nnd6AcFRhWvo9C74mGg== # =qP+q # -----END PGP SIGNATURE----- # gpg: Signature made Tue 26 Nov 2024 03:57:24 GMT # gpg: using RSA key 215D46F48246689EC77F3562EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * tag 'net-pull-request' of https://github.com/jasowang/qemu: virtio-net: Add queues before loading them Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | virtio-net: Add queues before loading themAkihiko Odaki2024-11-262-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Call virtio_net_set_multiqueue() to add queues before loading their states. Otherwise the loaded queues will not have handlers and elements in them will not be processed. Cc: qemu-stable@nongnu.org Fixes: 8c49756825da ("virtio-net: Add only one queue pair when realizing") Reported-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | | | Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into stagingPeter Maydell2024-11-251-18/+36
|\ \ \ \ | |/ / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Block layer patches - Fix qmp_device_add() to not throw non-scalar options away (fixes iothread-vq-mapping being silently ignored in device_add) - Fix qdev property crash with integer PCI addresses and JSON -device - iotests: Fix mypy failure - parallels: Avoid potential integer overflow - ssh: libssh broke with non-blocking sessions, use a blocking one for now - Fix crash in migration_is_running() # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmdES74RHGt3b2xmQHJl # ZGhhdC5jb20ACgkQfwmycsiPL9abFQ//fGmBl3Jp99GWB1R0y49/hPhfj0166UGj # zeEmhdy+k6gKywyhVy0Fj0xLztDTb/2bGflrwtDDxYA0PBLel461QSeJUzwDsn9h # ZGLyFrosXgIPADP55RF1wJ6c+m13MX4jVy80Neh2jemhinMazjj3ADb4RdCf0B4M # XoYOy96goDFPlzZNvr08dlaDvJaD5QmPYX8nK7TaZqZOSYvdSRWMuB+QQCPj+qEf # UfpBo3beNsxedNu/1wKS1Nc6FVX7VHKoMzhDLAvxkYMBKcCg9l5lEAGrgp61O+79 # nYZmPtEG5RHsMNBCZtk8zZMIHPg2Ydxpj3jOV3eA0rF4Twk/fPrOOfBEUHT6PapX # tCS1UJtgyQA2GTULiax3vKV4yBSpmUzbhjddNwBkW7uG1md67d17nqbjkEhHVxZL # yMuauFRCx5onzE0TSgTYEMAmAgD9oawuGUqBiNCOqJlTbGZwJ9l7jtwP4Bl1gskk # pWzL/PLP8MkVf50dcP0QBPNHn85/oZOwv5yNr2Z893qNQhh/0xqCEFwqSq2SJOkg # vKd/bAusgmicoh1XD0o0+mv2ewZor/JghrU83YDPKWM1MmOwePZ8wRTx9pJtZWvq # Pnc71397zppHIw7aIWKYDoyQ3aeaoTM/oY2Q5Y7et6c/FvGW5JtFjsPCGbgm9mw+ # +6JA51ujtYU= # =oLdE # -----END PGP SIGNATURE----- # gpg: Signature made Mon 25 Nov 2024 10:04:46 GMT # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * tag 'for-upstream' of https://repo.or.cz/qemu/kevin: ssh: Do not switch session to non-blocking mode vl: use qmp_device_add() in qemu_create_cli_devices() qdev-monitor: avoid QemuOpts in QMP device_add tests/avocado/hotplug_blk: Fix addr in device_add command qdev: Fix set_pci_devfn() to visit option only once python: silence pylint raising-non-exception error python: disable too-many-positional-arguments warning iotests: correct resultclass type in ReproducibleTestRunner iotests: reflow ReproducibleTestRunner arguments parallels: fix possible int overflow Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | qdev: Fix set_pci_devfn() to visit option only onceKevin Wolf2024-11-251-18/+36
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pci_devfn properties accept either a string or an integer as input. To implement this, set_pci_devfn() first tries to visit the option as a string, and if that fails, it visits it as an integer instead. While the QemuOpts visitor happens to accept this, it is invalid according to the visitor interface. QObject input visitors run into an assertion failure when this is done. QObject input visitors are used with the JSON syntax version of -device on the command line: $ ./qemu-system-x86_64 -enable-kvm -M q35 -device pcie-pci-bridge,id=pci.1,bus=pcie.0 -blockdev null-co,node-name=disk -device '{ "driver": "virtio-blk-pci", "drive": "disk", "id": "virtio-disk0", "bus": "pci.1", "addr": 1 }' qemu-system-x86_64: ../qapi/qobject-input-visitor.c:143: QObject *qobject_input_try_get_object(QObjectInputVisitor *, const char *, _Bool): Assertion `removed' failed. The proper way to accept both strings and integers is using the alternate mechanism, which tells us the type of the input before it's visited. With this information, we can directly visit it as the right type. This fixes set_pci_devfn() by using the alternate mechanism. Cc: qemu-stable@nongnu.org Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20241119120353.57812-1-kwolf@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* | | virtio-net: Copy received header to bufferAkihiko Odaki2024-11-251-39/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | receive_header() used to cast the const qualifier of the pointer to the received packet away to modify the header. Avoid this by copying the received header to buffer. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | | virtio-net: Initialize hash reporting valuesAkihiko Odaki2024-11-251-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The specification says hash_report should be set to VIRTIO_NET_HASH_REPORT_NONE if VIRTIO_NET_F_HASH_REPORT is negotiated but not configured with VIRTIO_NET_CTRL_MQ_RSS_CONFIG. However, virtio_net_receive_rcu() instead wrote out the content of the extra_hdr variable, which is not uninitialized in such a case. Fix this by zeroing the extra_hdr. Fixes: e22f0603fb2f ("virtio-net: reference implementation of hash report") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | | virtio-net: Fix hash reporting when the queue changesAkihiko Odaki2024-11-251-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | virtio_net_process_rss() fills the values used for hash reporting, but the values used to be thrown away with a recursive function call if the queue changes after RSS. Avoid the function call to keep the values. Fixes: a4c960eedcd2 ("virtio-net: Do not write hashes to peer buffer") Buglink: https://issues.redhat.com/browse/RHEL-59572 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | | virtio-net: Do not check for the queue before RSSAkihiko Odaki2024-11-251-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | virtio_net_can_receive() checks if the queue is ready, but RSS will change the queue to use so, strictly speaking, we may still be able to receive the packet even if the queue initially provided is not ready. Perform RSS before virtio_net_can_receive() to cover such a case. Fixes: 4474e37a5b3a ("virtio-net: implement RX RSS processing") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | | virtio-net: Fix size check in dhclient workaroundAkihiko Odaki2024-11-251-1/+4
|/ / | | | | | | | | | | | | | | | | | | | | | | work_around_broken_dhclient() accesses IP and UDP headers to detect relevant packets and to calculate checksums, but it didn't check if the packet has size sufficient to accommodate them, causing out-of-bound access hazards. Fix this by correcting the size requirement. Fixes: 1d41b0c1ec66 ("Work around dhclient brokenness") Cc: qemu-stable@nongnu.org Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | scsi: fix allocation for s390x loadparmPaolo Bonzini2024-11-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Coverity reports a possible buffer overrun due to a non-NUL-terminated string in scsi_property_set_loadparm(). While things are not so easy, because qdev_prop_sanitize_s390x_loadparm is designed to operate on a buffer that is not NUL-terminated, in this case the string *does* have to be NUL-terminated because it is read by scsi_property_get_loadparm and s390_build_iplb. Reviewed-by: jrossi@linux.ibm.com Cc: thuth@redhat.com Fixes: 429442e52d9 ("hw: Add "loadparm" property to scsi disk devices for booting on s390x", 2024-11-18) Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>