summary refs log tree commit diff stats
path: root/hw (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* | Merge tag 'ipmi-for-qemu-10.0' of https://github.com/cminyard/qemu into stagingStefan Hajnoczi2025-04-2310-46/+155
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some minor fixes for various things # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEE/Q1c5nzg9ZpmiCaGYfOMkJGb/4EFAmgAQuQACgkQYfOMkJGb # /4G9EQ//do2GgBjj2NChR7G8CV7DyAA7rnhYx1txD8I4F1cyvMAW0flc8qE5MaC8 # pJpfvQwYJs60WQbg5RELEEPFubtMPz/OPgfZfpGsXBRwqbpl2c3JGrEpVnDpsqdW # VXd24gFEuHyFKLoa4VMeJ40TvCsHsndkFTb7v12mneiH52YJyYDdb6ywkbeJS34F # 1sX745LtgQbC/piFzcuwX/NvSPlk3O9FT84k4AdfUPpBJNicQ6aKeQB/kuXmecEU # 6i6j8E/oCzZM9yLXWFFg3Fit5F24CBK9uDpFLE1ctoOW0lsVaQ+e8ogprvY7KMlO # zZVu2CPOZPf6IwUC/nmvWukey1BHpJSpEwZPZJao3Bt+qxK3hEl2FNPQIBVLNsJ9 # /6f6VtdgYSkkMed3G11eVS+p5QwX+4GEg+rhV8HDMYPecpaSePR3DIomAUKTc9je # t89ooW3iy6egONcbZSlFILPRmfRHv2h6aLOSMAAFXgx4aKt1I9b0EpjqBvDgTIxZ # 3ehn2jnwG8jTYaJdkiXFvvYNn2A8qEJc1Hifud1skJchqFXn7e6mjneLuOWO4uYZ # /VnOljqu+KwyDWxCnMfkLuOd+PNnHvB9fctqRvYJpsyc+WyjmRhH+YlbG2yt/FZj # fmCjZWKrZR2e6GaUPQSTEpahbuySf4QV4B9sP+YOcSQFy3N8ocU= # =V8+d # -----END PGP SIGNATURE----- # gpg: Signature made Wed 16 Apr 2025 19:53:08 EDT # gpg: using RSA key FD0D5CE67CE0F59A6688268661F38C90919BFF81 # gpg: Good signature from "Corey Minyard <cminyard@mvista.com>" [unknown] # gpg: aka "Corey Minyard <corey@minyard.net>" [unknown] # gpg: aka "Corey Minyard <minyard@mvista.com>" [unknown] # gpg: aka "Corey Minyard <minyard@acm.org>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: FD0D 5CE6 7CE0 F59A 6688 2686 61F3 8C90 919B FF81 * tag 'ipmi-for-qemu-10.0' of https://github.com/cminyard/qemu: ipmi/bmc-sim: add error handling for 'Set BMC Global Enables' command ipmi/bmc-sim: implement watchdog dont log flag ipmi/bmc-sim: Add 'Get Channel Info' command ipmi: add fwinfo to pci ipmi devices ipmi/pci-ipmi-bt: Rename copy-paste variables hw/ipmi: Move vmsd registration to device class Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * ipmi/bmc-sim: add error handling for 'Set BMC Global Enables' commandNicholas Piggin2025-04-111-1/+9
| | | | | | | | | | | | | | | | | | | | Mask out unsupported bits and return failure if attempting to set any. This is not required by the IPMI spec, but it does require that system software not change bits it isn't aware of. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <20250401140153.685523-6-npiggin@gmail.com> Signed-off-by: Corey Minyard <corey@minyard.net>
| * ipmi/bmc-sim: implement watchdog dont log flagNicholas Piggin2025-04-111-9/+17
| | | | | | | | | | | | | | | | | | | | If the dont-log flag is set in the 'timer use' field for the 'set watchdog' command, a watchdog timeout will not get logged as a timer use expiration. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <20250401140153.685523-5-npiggin@gmail.com> Signed-off-by: Corey Minyard <corey@minyard.net>
| * ipmi/bmc-sim: Add 'Get Channel Info' commandNicholas Piggin2025-04-113-2/+69
| | | | | | | | | | | | | | | | Linux issues this command when booting a powernv machine. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <20250401140153.685523-4-npiggin@gmail.com> Signed-off-by: Corey Minyard <corey@minyard.net>
| * ipmi: add fwinfo to pci ipmi devicesNicholas Piggin2025-04-116-2/+33
| | | | | | | | | | | | | | | | | | | | | | | | This requires some adjustments to callers to avoid possible behaviour changes for PCI devices. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <20250401140153.685523-3-npiggin@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> [Rename pci_ipmi_bt_get_fwinfo to pci_ipmi_kcs_get_fwinfo in the pci_ipmi_kcs.c file.] Signed-off-by: Corey Minyard <corey@minyard.net>
| * ipmi/pci-ipmi-bt: Rename copy-paste variablesNicholas Piggin2025-04-111-19/+19
| | | | | | | | | | | | | | | | | | | | | | IPMI drivers use p/k suffix in variable names depending on bt or kcs. The pci bt driver must have come from the kcs driver because it's still using k suffixes in some cases. Rename. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <20250401140153.685523-2-npiggin@gmail.com> Signed-off-by: Corey Minyard <corey@minyard.net>
| * hw/ipmi: Move vmsd registration to device classCorey Minyard2025-04-114-13/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's the right way to do it now, and it handles multiple instances properly. I need multiple instances for some testing I'm doing so this is the right thing to do. Tested by doing: (qemu) migrate -d exec:cat>filen.mig before and after the fix, then: scripts/analyze-migration.py -d desc -f file1.mig >file1.json scripts/analyze-migration.py -d desc -f file2.mig >file2.json diff file1.json file2.json with no differences. Signed-off-by: Corey Minyard <corey@minyard.net> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Fabiano Rosas <farosas@suse.de>
* | Revert "virtio-net: Copy received header to buffer"Antoine Damhet2025-04-151-47/+40
|/ | | | | | | | | | | | | | | | | This reverts commit 7987d2be5a8bc3a502f89ba8cf3ac3e09f64d1ce. The goal was to remove the need to patch the (const) input buffer with a recomputed UDP checksum by copying headers to a RW region and inject the checksum there. The patch computed the checksum only from the header fields (missing the rest of the payload) producing an invalid one and making guests fail to acquire a DHCP lease. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2727 Cc: qemu-stable@nongnu.org Signed-off-by: Antoine Damhet <adamhet@scaleway.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20250408145345.142947-1-adamhet@scaleway.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* Merge tag 'hw-misc-20250408' of https://github.com/philmd/qemu into stagingStefan Hajnoczi2025-04-098-17/+54
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Misc HW patches - Fix overrun when parsing SMBIOS OEM string (Daan) - Correctly call handle_machine_dumpdtb() callback (Joel) - List HVF as supported for virt machine (Zhang) - Correct UFS segment/alloc size comments (Keoseong) - Do not expose unimplemented devices in i.MX8mp DTB (Guenter & Bernhard) - Attach NVMe private namespaces to proper controller (Klaus) - Fix typo in SDPX license checker script (Zhao) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmf1cOAACgkQ4+MsLN6t # wN5ZERAAttyD+ZJwIOeTmrVyIhYNAKVKBWzUnqce+k+1NUG0kT/+FXN7rmP4lFhM # 2VasfWG8UVBpOcd2FfjimDadYEZ48WtE6z4txf7Fk3rDYOtC7U8l2dvGRhrvdnv+ # NaClU7+PZwpaS2KE/rGTRXm+QC4gc9GnMz6PPwTcBybVWh6342L7EUcbv0AYhTmn # S1w/jQIwX6OKYkjHdR3WRacx3skKf9PCDoaZkQxxHPCPDzkpf8pJhojScvwg+CBz # PoT9OqKm9vS9UXLxTUFsdW7SWKc7xAJwFWZS/QXtUV5X+D/w1eQ3qEBEwShPecxl # XehwNfaO5YqI6oiSGm+XZlz4Hk7bmoRMv4cl9JZ+ifiU/RronlYiMjRL79lqWXCL # Yp0q553YwdAIFlwzOE3Zblf/4H3iZ0dbc1wSRJLGE+pFvslUb0uch8WqkLQ+FX0q # kUBTJx8bvy0pmV0w/n6aY8gCygBZoK8hK5NZJ7Iq38y8UQ4vjLAlycd6XocA7aQk # PdyFjXvY4ofVldmLMaJdX4pQTgi1/GVSNa7G/cTrF5tcxwIcmVbvpqtZwB3+YxGu # pwQnD1eR5u9ZLsXNoRM2RRCBRB/h7k6HavSJ3JFtNjbQU07C3oFoQ9VePcKLl1Xl # wmHRBq3twgx/ZZAnYZyPQL2mmTcmo125kT3ZFVgl77UzzA/piD0= # =0xrJ # -----END PGP SIGNATURE----- # gpg: Signature made Tue 08 Apr 2025 14:54:24 EDT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'hw-misc-20250408' of https://github.com/philmd/qemu: scripts/checkpatch: Fix typo in SPDX-License-Identifier keyword hw/nvme: fix attachment of private namespaces hw/arm/imx8mp-evk: Temporarily remove unimplemented imx8mp-fspi node from devicetree hw/arm/imx8mp-evk: Remove unimplemented cpu-idle-states properties from devicetree hw/ufs: Fix incorrect comment for segment_size and allocation_unit_size docs/arm: Add apple HVF host for supported guest CPU type hw/core/machine: Fix -machine dumpdtb=file.dtb smbios: Fix buffer overrun when using path= option Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * hw/nvme: fix attachment of private namespacesKlaus Jensen2025-04-084-9/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix regression when attaching private namespaces that gets attached to the wrong controller. Keep track of the original controller "owner" of private namespaces, and only attach if this matches on controller enablement. Fixes: 6ccca4b6bb9f ("hw/nvme: rework csi handling") Reported-by: Alan Adamson <alan.adamson@oracle.com> Suggested-by: Alan Adamson <alan.adamson@oracle.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Tested-by: Alan Adamson <alan.adamson@oracle.com> Reviewed-by: Alan Adamson <alan.adamson@oracle.com> Reviewed-by: Keith Busch <kbusch@kernel.org> Message-ID: <20250408-fix-private-ns-v1-1-28e169b6b60b@samsung.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * hw/arm/imx8mp-evk: Temporarily remove unimplemented imx8mp-fspi node from ↵Guenter Roeck2025-04-081-1/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | devicetree The nxp,imx8mp-fspi node triggers a warning backtrace. Remove it from the devicetree file. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Inspired-by: commit bf1da4b308 ("hw/arm/raspi4b: Temporarily disable unimplemented rpi4b devices") Signed-off-by: Bernhard Beschow <shentey@gmail.com> [Bernhard: split patch, adapt commit message] Message-ID: <20250405214900.7114-4-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * hw/arm/imx8mp-evk: Remove unimplemented cpu-idle-states properties from ↵Guenter Roeck2025-04-081-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | devicetree The cpu-idle-states property causes a hard boot hang. Rather than documenting the workaround, perform the removal from the devicetree automatically. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Bernhard Beschow <shentey@gmail.com> [Bernhard: split patch, update documentation, adapt commit message] Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-ID: <20250405214900.7114-3-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * hw/ufs: Fix incorrect comment for segment_size and allocation_unit_sizeKeoseong Park2025-04-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The comments for segment_size and allocation_unit_size incorrectly described them as 4KB. According to the UFS specification, segment_size is expressed in units of 512 bytes. Given segment_size = 0x2000 (8192), the actual size is 4MB. Similarly, allocation_unit_size = 1 means 1 segment = 4MB. This patch updates the comments to reflect the correct size. Signed-off-by: Keoseong Park <keosung.park@samsung.com> Reviewed-by: Jeuk Kim <jeuk20.kim@samsung.com> Message-ID: <20250403092140epcms2p355a7f039871b3e5b409754ef450b9158@epcms2p3> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * hw/core/machine: Fix -machine dumpdtb=file.dtbJoel Stanley2025-04-081-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In commit 8fd2518ef2f8 ("hw: Centralize handling of -machine dumpdtb option") the call to dump was moved with respect to the init of the machine. This resulted in the device tree missing parts of the machine description, depending on how they construct their device tree. The arm virt machine is missing some PSCI nodes, while the riscv one is missing most of its content. Move the dump to after the notifiers have been run, allowing virt_machine_done to be called and the device tree to be fully populated. Fixes: 8fd2518ef2f8 ("hw: Centralize handling of -machine dumpdtb option") Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250401041509.719153-1-joel@jms.id.au> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * smbios: Fix buffer overrun when using path= optionDaan De Meyer2025-04-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We have to make sure the array of bytes read from the path= file is null-terminated, otherwise we run into a buffer overrun later on. Fixes: bb99f4772f54017490e3356ecbb3df25c5d4537f ("hw/smbios: support loading OEM strings values from a file") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2879 Signed-off-by: Daan De Meyer <daan.j.demeyer@gmail.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Tested-by: Valentin David <valentin.david@canonical.com> Message-ID: <20250323213622.2581013-1-daan.j.demeyer@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* | Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into stagingStefan Hajnoczi2025-04-081-14/+25
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Block layer patches - scsi-disk: Apply error policy for host_status errors again - qcow2: Fix qemu-img info crash with missing crypto header - qemu-img bench: Fix division by zero for zero-sized images - test-bdrv-drain: Fix data races # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmf1HdQRHGt3b2xmQHJl # ZGhhdC5jb20ACgkQfwmycsiPL9Z9QxAAlKjkXt5mshcMPPNAIFkBarvF318T8azh # 5A4soABMpgZBceXaadWMEkBiYGW7jvoBwRVivVNB7jLfar3jchfW8xEAerLXMpAE # O6n6vwXQz5fy1w5VqJuA/lA/5ZGdt8P7NvvOGcd00GySo6df2lOBtCbDjtwT5t6a # 0w6b5d/qSIsfm7wEIh7Vh8HjQ88WoOXSti9xQppyd48onNRT+6p2XtyXD75EeZi+ # uYS/NNwViNVRD2df3q4Thi3Q9AMhlDn8yZUqgMpwupbZcXNgjdfMNMPUUmRTNDrO # 33byZu+nrrq+Qz5xTSekD9anV4M1yJ+aWYxL7BI2RP87u4OgcZuCgNcFHzZ2j9BJ # xrV0wPdh1xdY8kn/5+X27/gC5cjb5AYoiA4SGZJsZpcvYnBz/jRIMoUY9HVc1Y+N # hW/endbNTpQYlEzmTb6RRccV7gTsD8V+Dc5TOg/RLgpdxahiZg0JAxT4sUkb52Ij # CH5kPRkEsluSXf86qFyDitMlE/SCl4bL9xoHnydgeaMJovMRAT6I/UpUdLkgsacL # ul6snvKPRXXP6PnM8hKHJmZwzKyzJVaVnQSG4TefNQTLIro3ZgVKzUek4dmpIHmg # hn9GOqENeS3soKg1vyniWEsNdg/t6YvEfFutJk5LJVRb5F18sht9IIYWNJKdWxuV # S7S3kAlMXow= # =Dv5w # -----END PGP SIGNATURE----- # gpg: Signature made Tue 08 Apr 2025 09:00:04 EDT # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * tag 'for-upstream' of https://repo.or.cz/qemu/kevin: test-bdrv-drain: Fix data races scsi-disk: Apply error policy for host_status errors again qcow2: Don't crash qemu-img info with missing crypto header qemu-img: fix division by zero in bench_cb() for zero-sized images Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * | scsi-disk: Apply error policy for host_status errors againKevin Wolf2025-04-081-14/+25
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Originally, all failed SG_IO requests called scsi_handle_rw_error() to apply the configured error policy. However, commit f3126d65, which was supposed to be a mere refactoring for scsi-disk.c, broke this and accidentally completed the SCSI request without considering the error policy any more if the error was signalled in the host_status field. Apart from the commit message not describing the change as intended, errors indicated in host_status are also obviously backend errors and not something the guest must deal with independently of the error policy. This behaviour means that some recoverable errors (such as a path error in multipath configurations) were reported to the guest anyway, which might not expect it and might consider its disk broken. Make sure that we apply the error policy again for host_status errors, too. This addresses an existing FIXME comment and allows us to remove some comments warning that callbacks weren't always called. With this fix, they are called in all cases again. The return value passed to the request callback doesn't have more free values that could be used to indicate host_status errors as well as SAM status codes and negative errno. Store the value in the host_status field of the SCSIRequest instead and use -ENODEV as the return value (if a path hasn't been reachable for a while, blk_aio_ioctl() will return -ENODEV instead of just setting host_status, so just reuse it here - it's not necessarily entirely accurate, but it's as good as any errno). Cc: qemu-stable@nongnu.org Fixes: f3126d65b393 ('scsi: move host_status handling into SCSI drivers') Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20250407155949.44736-1-kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Hanna Czenczek <hreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* | hw/loongarch/virt: Replace destination error with error_abortBibo Mao2025-04-081-32/+7
| | | | | | | | | | | | | | | | | | | | | | In function virt_cpu_plug() and virt_cpu_unplug(), the error is impossile. Destination error is not propagated and replaced with error_abort. With this, the logic is simple. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Acked-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20250324030145.3037408-3-maobibo@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
* | hw/loongarch/virt: Fix cpuslot::cpu set at last in virt_cpu_plug()Bibo Mao2025-04-081-2/+2
|/ | | | | | | | | | | | In function virt_cpu_plug(), Object cpuslot::cpu is set at last only when there is no any error, otherwise it is problematic that cpuslot::cpu is set in advance however it returns because of error. Fixes: ab9935d2991e (hw/loongarch/virt: Implement cpu plug interface) Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20250324030145.3037408-2-maobibo@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
* Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Stefan Hajnoczi2025-04-042-0/+3
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging virtio,pc: fixes A couple of fixes for 10.0. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmfu+r0PHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRp/3IH+gNzJadzc1O6xHClVsJeVY0HOfDYgPtdKxWZ # bu4JQXtrvF3avP9Mp1r2wInnEX1Pdjy36i7RaVsq8TB9Mdn6F6uiSSqu14Pn/Od6 # NNDXJgy+vFixKrGryESuI9Wp2XR2Haiwnj51qvswlQKNqx6arHVGWpUvKTvlb+8I # +Yu2GmFTEMHl+TuQ/qDEJLSvek704zyrFBRx7WzmvLfJjSFUpZUe26J0X7YdpqKh # 9o+tjb46W3bPgSa+fTFboD60pKsc+NOmFkpsC1romeNlXX0iyDupRN8+LumzDrhx # zrs8RQ0TAQ4nceAHmcvDxenGF9/Uzl3zs0D80Q/JPLkovCGpo5c= # =S0jX # -----END PGP SIGNATURE----- # gpg: Signature made Thu 03 Apr 2025 17:16:45 EDT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: hw/i386/amd_iommu: Assign pci-id 0x1419 for the AMD IOMMU device virtio-net: Fix num_buffers for version 1 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * hw/i386/amd_iommu: Assign pci-id 0x1419 for the AMD IOMMU deviceSuravee Suthikulpanit2025-04-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, the QEMU-emulated AMD IOMMU device use PCI vendor id 0x1022 (AMD) with device id zero (undefined). Eventhough this does not cause any functional issue for AMD IOMMU driver since it normally uses information in the ACPI IVRS table to probe and initialize the device per recommendation in the AMD IOMMU specification, the device id zero causes the Windows Device Manager utility to show the device as an unknown device. Since Windows only recognizes AMD IOMMU device with device id 0x1419 as listed in the machine.inf file, modify the QEMU AMD IOMMU model to use the id 0x1419 to avoid the issue. This advertise the IOMMU as the AMD IOMMU device for Family 15h (Models 10h-1fh). Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com> Message-Id: <20250325021140.5676-1-suravee.suthikulpanit@amd.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * virtio-net: Fix num_buffers for version 1Akihiko Odaki2025-04-021-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The specification says the device MUST set num_buffers to 1 if VIRTIO_NET_F_MRG_RXBUF has not been negotiated. Fixes: df91055db5c9 ("virtio-net: enable virtio 1.0") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20250108-buffers-v1-1-a0c85ff31aeb@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Lei Yang <leiyang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | Merge tag 'pull-aspeed-20250401' of https://github.com/legoater/qemu into ↵Stefan Hajnoczi2025-04-011-2/+14
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging aspeed queue: * Fixed SCU access size on AST2500 and AST2600 SoCs # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmfr2DsACgkQUaNDx8/7 # 7KHlHg/8D5/maW8yAfQjUBfvy2+tzpV1SvBTKxSvv5n9tP3CFDSgNjFXfDnt06qK # xNE4YzK5I7wWQ20OKXB1LfqHqaJJXT7G1Qc44ZbmfHdiISMuaZaWDjQyzXO/TDSH # e8Svb3iV4IA2J2B6dsbPOym6XMFL9awhXurhYTxfnl9oFhkvgaP1H6Ur0/m8peOq # HELkY18nyWbpeZyIArEagXtBb1n1ucn51dwaDLq9F+D5vXAe6NN8Am5RG/gEED6X # P/o6/VphxR/EmijbIrixHUWmORnuXV4KI13xdLb3hyjIOtgjFPENQuUJTczwkK/8 # mpdTOj+m8ovGMuFGmvnGy6uyYRmXQarBOSSR19XPlMF1qlO7rUUzYPTl7M8M45C5 # UuU9Q60KNSiCHdQqimdZwy/IoI8nuEHMT6g2/Vd82OUJ6K/uR3V0dVel7LVEOvVj # 1xXtNOL8Xy5W0Z84nPLOjpD1WU8Khl8m6OZR81RWR9jTj61dX9AfggkJXSzU6G0Z # Yhv6shqYRn+LpAN/cjqUP6hR1C0iBCi+lBNG6wKq3DVCDXPCg8yEW9D+NUwVj64z # 6BMF335RP3phkmpFMniJ83Ad4yxOmKubQcIIXjLvEiAdppxvDCjQBgYkKHRXkJV0 # wVYnfDwB2quDA1oS3tLibvRf366NjhPfJhMx+yiL4RgFUQ/BvfI= # =VRwA # -----END PGP SIGNATURE----- # gpg: Signature made Tue 01 Apr 2025 08:12:43 EDT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [full] # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-aspeed-20250401' of https://github.com/legoater/qemu: hw/misc/aspeed_scu: Correct minimum access size for AST2500 / AST2600 hw/misc/aspeed_scu: Set MemoryRegionOps::impl::access_size to 32-bit Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * | hw/misc/aspeed_scu: Correct minimum access size for AST2500 / AST2600Joel Stanley2025-04-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Guest code was performing a byte load to the SCU MMIO region, leading to the guest code crashing (it should be using proper accessors, but that is not Qemu's bug). Hardware and the documentation[1] both agree that byte loads are okay, so change all of the aspeed SCU devices to accept a minimum access size of 1. [1] See the 'ARM Address Space Mapping' table in the ASPEED docs. This is section 6.1 in the ast2400 and ast2700, and 7.1 in the ast2500 and ast2600 datasheets. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2636 Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Troy Lee <leetroy@gmail.com> Message-ID: <20241118021820.4928-1-joel@jms.id.au> [PMD: Rebased, only including SCU changes] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au> Link: https://lore.kernel.org/qemu-devel/20250331230444.88295-3-philmd@linaro.org Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * | hw/misc/aspeed_scu: Set MemoryRegionOps::impl::access_size to 32-bitPhilippe Mathieu-Daudé2025-04-011-0/+12
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All MemoryRegionOps::read/write() handlers switch over a 32-bit aligned value, because converted using TO_REG(), which is defined as: #define TO_REG(offset) ((offset) >> 2) So all implementations are 32-bit. Set min/max access_size accordingly. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au> Link: https://lore.kernel.org/qemu-devel/20250331230444.88295-2-philmd@linaro.org Signed-off-by: Cédric Le Goater <clg@redhat.com>
* | target/mips: Revert TARGET_PAGE_BITS_VARYRichard Henderson2025-03-312-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Revert ee3863b9d41 and a08d60bc6c2b. The logic behind changing the system page size because of what the Loongson kernel "prefers" is flawed. In the Loongson-2E manual, section 5.5, it is clear that the cpu supports a 4k page size (along with many others). Similarly for the Loongson-3 series CPUs, the 4k page size is mentioned in the section 7.7 (PageMask Register). Therefore we must continue to support a 4k page size. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250328175526.368121-2-richard.henderson@linaro.org> [PMD: Mention Loongson-3 series CPUs] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* | hw/pci-host/designware: Fix ATU_UPPER_TARGET register accessPhilippe Mathieu-Daudé2025-03-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Fix copy/paste error writing to the ATU_UPPER_TARGET register, we want to update the upper 32 bits. Cc: qemu-stable@nongnu.org Reported-by: Joey <jeundery@gmail.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2861 Fixes: d64e5eabc4c ("pci: Add support for Designware IP block") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org> Message-Id: <20250331152041.74533-2-philmd@linaro.org>
* | hw/ufs: free irq on exitZheng Huang2025-03-311-0/+3
| | | | | | | | | | | | | | | | | | | | Fix a memory leak bug in ufs_init_pci() due to u->irq not being freed in ufs_exit(). Signed-off-by: Zheng Huang <hz1624917200@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <43ceb427-87aa-44ee-9007-dbaecc499bba@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* | hw/char/bcm2835_aux: Fix incorrect interrupt ID when RX disabledChung-Yi Chen2025-03-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix a misconfiguration issue in the read implementation of the AUX_MU_IIR_REG register. This issue can lead to a transmit interrupt being incorrectly interpreted as a receive interrupt when the receive interrupt is disabled and the receive FIFO holds valid bytes. The AUX_MU_IIR_REG register (interrupt ID bits [2:1]) indicates the status of mini UART interrupts: - 00: No interrupts - 01: Transmit FIFO is empty - 10: Receive FIFO is not empty - 11: <Not possible> When the transmit interrupt is enabled and the receive interrupt is disabled, the original code incorrectly sets the interrupt ID bits. Specifically: 1. Transmit FIFO empty, receive FIFO empty - Expected 0b01, returned 0b01 (correct) 2. Transmit FIFO empty, receive FIFO not empty - Expected 0b01, returned 0b10 (incorrect) In the second case, the code sets the interrupt ID to 0b10 (receive FIFO is not empty) even if the receive interrupt is disabled. To fix this, the patch adds additional condition for setting the interrupt ID bits to also check if the receive interrupt is enabled. Reference: BCM2835 ARM Peripherals, page 13. Available on https://datasheets.raspberrypi.com/bcm2835/bcm2835-peripherals.pdf Fixes: 97398d900ca ("bcm2835_aux: add emulation of BCM2835 AUX (aka UART1) block") Signed-off-by: Chung-Yi Chen <yeechen0207@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250328123725.94176-1-yeechen0207@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* | hw/sd/sdhci: free irq on exitZheng Huang2025-03-311-0/+2
| | | | | | | | | | | | | | | | | | | | | | Fix a memory leak bug in sdhci_pci_realize() due to s->irq not being freed in sdhci_pci_exit(). Signed-off-by: Zheng Huang <hz1624917200@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <09ddf42b-a6db-42d5-954b-148d09d8d6cc@gmail.com> [PMD: Moved qemu_free_irq() call before sdhci_common_unrealize()] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* | hw/scsi/lsi53c895a: fix memory leak in lsi_scsi_realize()Zheng Huang2025-03-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Address a memory leak bug in the usages of timer_del(). The issue arises from the incorrect use of the ambiguous timer API timer_del(), which does not free the timer object. The LeakSanitizer report this issue during fuzzing. The correct API timer_free() freed the timer object instead. ================================================================= ==2586273==ERROR: LeakSanitizer: detected memory leaks Direct leak of 48 byte(s) in 1 object(s) allocated from: #0 0x55f2afd89879 in calloc /llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:75:3 #1 0x7f443b93ac50 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ec50) #2 0x55f2b053962e in timer_new include/qemu/timer.h:542:12 #3 0x55f2b0514771 in timer_new_us include/qemu/timer.h:582:12 #4 0x55f2b0514288 in lsi_scsi_realize hw/scsi/lsi53c895a.c:2350:24 #5 0x55f2b0452d26 in pci_qdev_realize hw/pci/pci.c:2174:9 Signed-off-by: Zheng Huang <hz1624917200@outlook.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <73cd69f9-ff9b-4cd4-b8aa-265f9d6067b9@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* | hw/nvram/xlnx-efuse: Do not expose as user-creatablePhilippe Mathieu-Daudé2025-03-311-0/+2
| | | | | | | | | | | | | | | | | | This device is part of SoC components thus can not be created manually. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20250325224310.8785-10-philmd@linaro.org>
* | hw/misc/pll: Do not expose as user-creatablePhilippe Mathieu-Daudé2025-03-313-0/+18
| | | | | | | | | | | | | | | | | | All these devices are part of SoC components and can not be created manually. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20250325224310.8785-9-philmd@linaro.org>
* | hw/rtc/goldfish: keep time offset when resettingHeinrich Schuchardt2025-03-311-7/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently resetting the leads to resynchronizing the Goldfish RTC with the system clock of the host. In real hardware an RTC reset would not change the wall time. Other RTCs like pl031 do not show this behavior. Move the synchronization of the RTC with the system clock to the instance realization. Cc: qemu-stable@nongnu.org Reported-by: Frederik Du Toit Lotter <fred.lotter@canonical.com> Fixes: 9a5b40b8427 ("hw: rtc: Add Goldfish RTC device") Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250321221248.17764-1-heinrich.schuchardt@canonical.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* | hw/dma/i82374: Categorize and add descriptionPhilippe Mathieu-Daudé2025-03-311-0/+2
| | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20250325224310.8785-5-philmd@linaro.org>
* | hw/display/dm163: Add descriptionPhilippe Mathieu-Daudé2025-03-311-1/+1
| | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20250325224310.8785-4-philmd@linaro.org>
* | hw/block/m25p80: Categorize and add descriptionPhilippe Mathieu-Daudé2025-03-311-0/+2
| | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20250325224310.8785-3-philmd@linaro.org>
* | hw/arm/fsl-imx8mp: Derive struct FslImx8mpState from TYPE_SYS_BUS_DEVICEBernhard Beschow2025-03-312-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Deriving from TYPE_SYS_BUS_DEVICE fixes the SoC object to be reset upon machine reset. It also makes the SoC implementation not user-creatable which can trigger the following crash: $ ./qemu-system-aarch64 -M virt -device fsl-imx8mp ** ERROR:../../devel/qemu/tcg/tcg.c:1006:tcg_register_thread: assertion failed: (n < tcg_max_ctxs) Bail out! ERROR:../../devel/qemu/tcg/tcg.c:1006:tcg_register_thread: assertion failed: (n < tcg_max_ctxs) Aborted (core dumped) Fixes: a4eefc69b237 "hw/arm: Add i.MX 8M Plus EVK board" Reported-by: Thomas Huth <thuth@redhat.com> Suggested-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-ID: <20250318205709.28862-3-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* | hw/arm/imx8mp-evk: Fix reference count of SoC objectBernhard Beschow2025-03-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | TYPE_FSL_IMX8MP is created using object_new(), so must be realized with qdev_realize_and_unref() to keep the reference counting intact. Fixes: a4eefc69b237 "hw/arm: Add i.MX 8M Plus EVK board" Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-ID: <20250318205709.28862-2-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* | hw/arm/armv7m: Expose and access System Control Space as little endianPhilippe Mathieu-Daudé2025-03-311-7/+7
|/ | | | | | | | | | | | | | | | | | | | | We only build ARM system emulators using little endianness, so the MO_TE definition always expands to MO_LE, and DEVICE_TARGET_ENDIAN to DEVICE_LITTLE_ENDIAN. Replace the definitions by their expanded value, making it closer to the Armv7-M Architecture Reference Manual (ARM DDI 0403E) description: The System Control Space (SCS, address range 0xE000E000 to 0xE000EFFF) is a memory-mapped 4KB address space that provides 32-bit registers for configuration, status reporting and control. All accesses to the SCS are little endian. Fixes: d5d680cacc ("memory: Access MemoryRegion with endianness") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250312104821.1012-1-philmd@linaro.org>
* Merge tag 'pull-aspeed-20250323' of https://github.com/legoater/qemu into ↵Stefan Hajnoczi2025-03-242-1/+6
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging aspeed queue: * Fix AST2700 SoC model # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmfgSG0ACgkQUaNDx8/7 # 7KFIaQ//TDinoK375i/tsRxpHPVHU40mQbn2pCx8g+mDoMZubfExSWncxcOpgzbM # KM+NSOK0PBnCUHt0aWVb/USyMM7hftJHRkC6IY43HFnRIJlKxPeaS/IC73fPMMKu # sDuBYz1ALseLFM1vArCiAijA8aCQOAiOBq/GSgscuHcgmTTMJ+c0LbwEaV5/aJwO # BSIn6bRMLByl6w31NCetu7XwybCI9xCdgcGTuv7gNXtjk8poy540gB1CK02smDjc # 0uRY9QXjh2epDWXz7UqMlJsEkEUc9BZP/95a70OKFsgDKz1K6kuCxgA3QbKLRgY1 # CDlinhERQuyFta6ulsoQ6E6T6nzc9MzTRjLztSdmMWkCd/qm1j4bWVuGnWD++9WT # 1Q2IX4D5kurKNizux2+HaV02s3RafpeSjGOYMjaTpr74yqPpwa7gM2WnJhxZF1Md # MF+ee30be5dJaVcZ0doYd+m3c6M0W5S1H5tR99YTA3auwikY0zgEKHrgXoDnv+sb # 803AQroIBGZxbnxSH1OVJD4MB7Xos5CBxi0FYvpCy8E7Piaz2EGAe7QQUyHhPZjs # Eg5rKCXODToYIpTHg+JYakHEt3ooewX3/pSVa//PJzde0eR25VNc6ybl4Xklqxib # SjQ7HFqPkWrbVNK7o6j1LHLVa+sxtIT8FQtHKh5XjD7wnQwYV5U= # =AwrM # -----END PGP SIGNATURE----- # gpg: Signature made Sun 23 Mar 2025 13:44:13 EDT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [full] # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-aspeed-20250323' of https://github.com/legoater/qemu: hw/misc/aspeed_hace: Fix buffer overflow in has_padding function hw/intc/aspeed: Fix IRQ handler mask check aspeed: Fix maximum number of spi controller Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * hw/misc/aspeed_hace: Fix buffer overflow in has_padding functionJamin Lin2025-03-231-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The maximum padding size is either 64 or 128 bytes and should always be smaller than "req_len". If "padding_size" exceeds "req_len", then "req_len - padding_size" underflows due to "uint32_t" data type, leading to a large incorrect value (e.g., `0xFFXXXXXX`). This causes an out-of-bounds memory access, potentially leading to a buffer overflow. Added a check to ensure "padding_size" does not exceed "req_len" before computing "pad_offset". This prevents "req_len - padding_size" from underflowing and avoids accessing invalid memory. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Fixes: 5cd7d8564a8b563da724b9e6264c967f0a091afa ("aspeed/hace: Support AST2600 HACE ") Link: https://lore.kernel.org/qemu-devel/20250321092623.2097234-3-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/intc/aspeed: Fix IRQ handler mask checkSteven Lee2025-03-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Updated the IRQ handler mask check to AND with select variable. This ensures that the interrupt service routine is correctly triggered for the interrupts within the same irq group. For example, both `eth0` and the debug UART are handled in `GICINT132`. Without this fix, the debug console may hang if the `eth0` ISR is not handled. Signed-off-by: Steven Lee <steven_lee@aspeedtech.com> Change-Id: Ic3609eb72218dfd68be6057d78b8953b18828709 Reviewed-by: Cédric Le Goater <clg@redhat.com> Fixes: d831c5fd8682 ("aspeed/intc: Add AST2700 support") Link: https://lore.kernel.org/qemu-devel/20250320092543.4040672-2-steven_lee@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
* | Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingStefan Hajnoczi2025-03-2313-55/+70
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * exec/cpu-all: remove BSWAP_NEEDED * pl011: pad C PL011State struct to same size as Rust struct * rust: hpet: fix type of "timers" property * rust: hpet: fix functional tests (and really everything that uses it) * rust: Kconfig: Factor out whether devices are Rust or C * rust: vmstate: Fixes and tests # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmfdsUsUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroOGpwf/Qk4bAcLX7A1/nOmYT+DtWzZ9V/VS # hSOe6BruzW8rzwMyn/d7oR+aUpk3sL+v2iPBWqoZ/wh0w8kcABcUfWsqqGI8ln/K # pnTdiC+hra5z0AFH1tmjjtOI50WDOeSjh5SFvoPJtGzhEbo89QvsUWgy98HiHOMm # YFPDuhg3Pfd1XDcdoaa85sOHO1vDsj45fCEJhx6Ktib4vOlEm2I4Z9YR/JxNMT33 # vy/y09HG4cpc6bWKLPL3nqR9RchUSI+YRDZ8rlaXUowiZzH2K/wi0qJOsvG6oJF5 # awni0YWuwyFi16jmUub8NFnWk6NKjbACqw74AwoVPbNbDoCrrogXzIF2Lw== # =NzCN # -----END PGP SIGNATURE----- # gpg: Signature made Fri 21 Mar 2025 14:34:51 EDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (24 commits) rust: hpet: fix decoding of timer registers rust/vmstate: Include complete crate path of VMStateFlags in vmstate_clock rust/vmstate: Add unit test for vmstate_validate rust/vmstate: Add unit test for pointer case rust/vmstate: Add unit test for vmstate_{of|struct} macro rust/vmstate: Add unit test for vmstate_of macro rust/vmstate: Support vmstate_validate rust/vmstate: Re-implement VMState trait for timer binding rust/vmstate: Relax array check when build varray in vmstate_struct rust/vmstate: Fix unnecessary VMState bound of with_varray_flag() rust/vmstate: Fix "cannot infer type" error in vmstate_struct rust/vmstate: Fix type check for varray in vmstate_struct rust/vmstate: Fix size field of VMStateField with VMS_ARRAY_OF_POINTER flag rust/vmstate: Fix num field when varray flags are set rust/vmstate: Fix num_offset in vmstate macros rust/vmstate: Remove unnecessary unsafe exec/cpu-all: remove BSWAP_NEEDED load_aout: replace bswap_needed with big_endian rust: pl011: Check size of state struct at compile time hw/char/pl011: Pad PL011State struct to same size as Rust impl ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * | load_aout: replace bswap_needed with big_endianPaolo Bonzini2025-03-215-30/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Targets know whether they are big-endian more than they know if the endianness is different from the host: the former is mostly a constant, at least in machine creation code, while the latter has to be computed with TARGET_BIG_ENDIAN != HOST_BIG_ENDIAN or something like that. load_aout, however, takes a "bswap_needed" argument. Replace it with a "big_endian" argument; even though all users are big-endian, it is cheap enough to keep the optional swapping functionality even for little-endian boards. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | qdev, rust/hpet: fix type of HPET "timers" propertyPaolo Bonzini2025-03-201-0/+37
| | | | | | | | | | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | rust: Kconfig: Factor out whether HPET is Rust or CPeter Maydell2025-03-204-4/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently we require everywhere that wants to know if there is an HPET device to check for "CONFIG_HPET || CONFIG_X_HPET_RUST". Factor out whether the HPET device is Rust or C into a separate Kconfig stanza, so that CONFIG_HPET means "there is an HPET", and whether this has pulled in CONFIG_X_HPET_RUST or CONFIG_HPET_C is something the rest of QEMU can ignore. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Link: https://lore.kernel.org/r/20250319193110.1565578-3-peter.maydell@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | rust: Kconfig: Factor out whether PL011 is Rust or CPeter Maydell2025-03-203-21/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently every board that uses the PL011 duplicates the logic that selects the Rust implementation if Rust was enabled and the C implementation if it does not. Factor this out into a separate Kconfig stanza, so that boards can go back to simply doing "select PL011" and get whichever implementation is correct for the build. This fixes a compilation failure if CONFIG_VMAPPLE is enabled in a Rust build, because hw/vmapple/Kconfig didn't have the "pick the Rust PL011 if Rust is enabled" logic in it. Fixes: 59f4d65584bd33 ("hw/vmapple/vmapple: Add vmapple machine type") Reported-by: Tanish Desai <tanishdesai37@gmail.com> Analyzed-by: Tanish Desai <tanishdesai37@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/r/20250319193110.1565578-2-peter.maydell@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | | Merge tag 'pull-error-2025-03-21' of https://repo.or.cz/qemu/armbru into stagingStefan Hajnoczi2025-03-232-28/+19
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Error reporting patches for 2025-03-21 # -----BEGIN PGP SIGNATURE----- # # iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmfdeWkSHGFybWJydUBy # ZWRoYXQuY29tAAoJEDhwtADrkYZTeigQAJicOKRQPm5qCn/XP70k6OuvTXsU8Fw/ # FVXE3I1lE9MnUDVHe9RgY79piS7oQ/pR92QcPxTx/Kj22gSiFBgrH5q0bURZAOxR # /85DTxjVGuz3pAMhfXZ3rRyJGhX4MgPmYYXkvOyrz0cpHMR3DN9helIfdVfVtWAh # VTVEH2PKdd9I56gbi9irlfdeh/+Nb2+1swBbtpUWFthDPj7Cib+gHsrJQbRX7qSf # 0eEGVgqydfAuSLbMnD6SwCXbuJQ/mHg5+71QmSJFqthRzLHqXuUk6m6n8EXTgE6D # MEdwkhSZ6ksNEWkzBvv3lfO8WnAqH0jp+xkuDTJabJzZG17pC61B2HQRsrFxZxqU # Ftr4XDPccDc9ohX0GYwCpvfW2Y8ZLzjurc04dpSPoqIBZxAPySirWOmTbT7I6MFF # EVt4VdjwXi0jSLWeH0yq6NmpSiKDxC6kY78xvAx6Pr9QQWtCeH/sQKXQ+16IqqTf # aeM4zXUs8cWD+QULqkxp7aHJPg91zU+BQGopkmMCpCNGwnzJPajfJgCDsWHnn47z # jiuOISWS650bUL6D4GgC1l2pYVPqt3ybF6DZL0giDE6NPpIich/KA1SSVXDy3bVK # AGRMczC40GHvlDFKkLI0j5HM1HY8aYdn44skY28R/+SzyV0463u5oljcYmDe7oWC # iLtinF/DKCDa # =FJPm # -----END PGP SIGNATURE----- # gpg: Signature made Fri 21 Mar 2025 10:36:25 EDT # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * tag 'pull-error-2025-03-21' of https://repo.or.cz/qemu/armbru: target/loongarch: Clean up virt_cpu_irq_init() error handling target/loongarch: Remove unnecessary temporary variable assignment hw/loongarch/virt: Eliminate error_propagate() target/loongarch: Fix error handling of KVM feature checks hw/xen: Downgrade a xen_bus_realize() non-error to warning hw/xen: Fix xen_bus_realize() error handling error: Strip trailing '\n' from an error string argument cryptodev: Fix error handling in cryptodev_lkcf_execute_task() Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * | | target/loongarch: Clean up virt_cpu_irq_init() error handlingBibo Mao2025-03-201-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. virt_cpu_irq_init() is wrong that way: it passes &err to hotplug_handler_plug() twice. If both calls failed, this could trip error_setv()'s assertion. Moreover, if just one fails, the Error object leaks. Fortunately, these calls can't actually fail. Messed up in commit 50ebc3fc47f7 (hw/intc/loongarch_ipi: Notify ipi object when cpu is plugged) and commit 087a23a87c57 (hw/intc/loongarch_extioi: Use cpu plug notification). Clean this up by passing &error_abort instead. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Acked-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20250320032158.1762751-7-maobibo@loongson.cn> Signed-off-by: Markus Armbruster <armbru@redhat.com>