summary refs log tree commit diff stats
path: root/hw (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
| * | hw/i386/pc_piix.c: inline pc_xen_hvm_init_pci() into pc_xen_hvm_init()Mark Cave-Ayland2025-08-291-9/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This helps to simplify the initialisation of the Xen hvm machine. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://lore.kernel.org/r/20250828111057.468712-5-mark.caveayland@nutanix.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | hw/i386/pc_piix.c: remove include for loader.hMark Cave-Ayland2025-08-291-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This header is not required since the loader functionality is handled separately by pc_memory_init() in pc.c. Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://lore.kernel.org/r/20250828111057.468712-4-mark.caveayland@nutanix.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | hw/i386/pc_piix.c: restrict isapc machine to 3.5G memoryMark Cave-Ayland2025-08-291-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the isapc machine is now limited to using 32-bit CPUs, add a hard restriction so that the machine cannot be started with more than 3.5G memory. This matches the default value for max_ram_below_4g if not specified and provides consistent behaviour betweem TCG and KVM accelerators. Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com> Link: https://lore.kernel.org/r/20250828111057.468712-3-mark.caveayland@nutanix.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | hw/i386/pc_piix.c: restrict isapc machine to 32-bit CPUsMark Cave-Ayland2025-08-291-0/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The isapc machine represents a legacy ISA PC with a 486 CPU. Whilst it is possible to specify any CPU via -cpu on the command line, it makes no sense to allow modern 64-bit CPUs to be used. Restrict the isapc machine to the available 32-bit CPUs, taking care to handle the case where if a user inadvertently uses either -cpu max or -cpu host then the "best" 32-bit CPU is used (in this case the pentium3). Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/r/20250828111057.468712-2-mark.caveayland@nutanix.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | | hw/arm/stm32f205_soc: Don't leak TYPE_OR_IRQ objectsPeter Maydell2025-08-301-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In stm32f250_soc_initfn() we mostly use the standard pattern for child objects of calling object_initialize_child(). However for s->adc_irqs we call object_new() and then later qdev_realize(), and we never unref the object on deinit. This causes a leak, detected by ASAN on the device-introspect-test: Indirect leak of 10 byte(s) in 1 object(s) allocated from: #0 0x5b9fc4789de3 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/qemu-system-arm+0x21f1de3) (BuildId: 267a2619a026ed91c78a07b1eb2ef15381538efe) #1 0x740de3f28b09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75) #2 0x740de3f3e4d8 in g_strdup (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x784d8) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75) #3 0x5b9fc70159e1 in g_strdup_inline /usr/include/glib-2.0/glib/gstrfuncs.h:321:10 #4 0x5b9fc70159e1 in object_property_try_add /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:1276:18 #5 0x5b9fc7015f94 in object_property_add /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:1294:12 #6 0x5b9fc701b900 in object_add_link_prop /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:2021:10 #7 0x5b9fc701b3fc in object_property_add_link /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:2037:12 #8 0x5b9fc4c299fb in qdev_init_gpio_out_named /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/core/gpio.c:90:9 #9 0x5b9fc4c29b26 in qdev_init_gpio_out /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/core/gpio.c:101:5 #10 0x5b9fc4c0f77a in or_irq_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/core/or-irq.c:70:5 #11 0x5b9fc70257e1 in object_init_with_type /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:428:9 #12 0x5b9fc700cd4b in object_initialize_with_type /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:570:5 #13 0x5b9fc700e66d in object_new_with_type /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:774:5 #14 0x5b9fc700e750 in object_new /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:789:12 #15 0x5b9fc68b2162 in stm32f205_soc_initfn /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/arm/stm32f205_soc.c:69:26 Switch to using object_initialize_child() like all our other child objects for this SoC object. Cc: qemu-stable@nongnu.org Fixes: b63041c8f6b ("STM32F205: Connect the ADC devices") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250821154229.2417453-1-peter.maydell@linaro.org
* | | hw/arm: add static NVDIMMs in device treeManos Pitsidianakis2025-08-302-3/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | NVDIMM is used for fast rootfs with EROFS, for example by kata containers. To allow booting with static NVDIMM memory, add them to the device tree in arm virt machine. This allows users to boot directly with nvdimm memory devices without having to rely on ACPI and hotplug. Verified to work with command invocation: ./qemu-system-aarch64 \ -M virt,nvdimm=on \ -cpu cortex-a57 \ -m 4G,slots=2,maxmem=8G \ -object memory-backend-file,id=mem1,share=on,mem-path=/tmp/nvdimm,size=4G,readonly=off \ -device nvdimm,id=nvdimm1,memdev=mem1,unarmed=off \ -drive file=./debian-12-nocloud-arm64-commited.qcow2,format=qcow2 \ -kernel ./vmlinuz-6.1.0-13-arm64 \ -append "root=/dev/vda1 console=ttyAMA0,115200 acpi=off" -initrd ./initrd.img-6.1.0-13-arm64 \ -nographic \ -serial mon:stdio Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Message-id: 20250807-nvdimm_arm64_virt-v2-1-b8054578bea8@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | | hw/intc/arm_gicv3_kvm: preserve pending interrupts during cprSteve Sistare2025-08-301-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Close a race condition that causes cpr-transfer to lose VFIO interrupts on ARM. CPR stops VCPUs but does not disable VFIO interrupts, which may continue to arrive throughout the transition to new QEMU. CPR calls kvm_irqchip_remove_irqfd_notifier_gsi in old QEMU to force future interrupts to the producer eventfd, where they are preserved. Old QEMU then destroys the old KVM instance. However, interrupts may already be pending in KVM state. To preserve them, call ioctl KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES to flush them to guest RAM, where they will be picked up when the new KVM+VCPU instance is created. Cc: qemu-stable@nongnu.org Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Message-id: 1754936384-278328-1-git-send-email-steven.sistare@oracle.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | | Merge tag 'pull-lu-20250830' of https://gitlab.com/rth7680/qemu into stagingRichard Henderson2025-08-301-5/+16
|\ \ \ | |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | linux-user: Finish elfload.c split linux-user: Drop deprecated -p option linux-user: Tidy print_socket_protocol hw/core: Dump cpu_reset in the reset.exit phase hw/core: Use qemu_log_trylock/unlock in cpu_common_reset_exit # -----BEGIN PGP SIGNATURE----- # # iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmiyKFIdHHJpY2hhcmQu # aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV/LBggAgMBSVMz1BwkPvckY # paakdAwuOqRE5yF2YxQAHALJa3aH18Vqk06ENqM9R5iyqvHBGnvrw8fshIBVZnDP # eQDjNFwnCtSrXuSMdfr0r8jZc+y9R8foQKs9j+KL0ESOi+4VNhORfzFe/yrIEu0y # XM5XhBjBH0kK9+S20uy5x3WXhRkfqq2CZiUt1izqTOwtbdzYENxdvDj8iDk48FwL # fkrXUSnlBBsdsltQCsjbrUbWi1Wqj7skswRIzI8KXsj+psy0JJL2kHthaWzm8tTS # KIXVaOtxtU7LQWhTaknmpcNIkHpnjmEw2ZijxYT29V8WnZtstihVoqqCLbCv6u+7 # JwwQhQ== # =kHx+ # -----END PGP SIGNATURE----- # gpg: Signature made Sat 30 Aug 2025 08:23:14 AM AEST # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [ultimate] * tag 'pull-lu-20250830' of https://gitlab.com/rth7680/qemu: (91 commits) linux-user: Remove target_pt_regs from target_syscall.h linux-user/sparc: Create target_ptrace.h linux-user: Remove a.out declarations from elfload.c linux-user: Move arch_parse_elf_property to aarch64/elfload.c linux-user: Remove MAP_DENYWRITE from elfload.c linux-user: Remove ELIBBAD from elfload.c linux-user: Rename elf_check_arch linux-user: Standardize on ELF_MACHINE not ELF_ARCH linux-user: Move elf parameters to hexagon/target_elf.h linux-user: Move elf parameters to xtensa/target_elf.h linux-user: Move elf parameters to hppa/target_elf.h linux-user: Move elf parameters to riscv/target_elf.h linux-user: Move elf parameters to s390x/target_elf.h linux-user: Move elf parameters to alpha/target_elf.h linux-user: Move elf parameters to m68k/target_elf.h linux-user: Move elf parameters to sh4/target_elf.h linux-user: Move elf parameters to openrisc/target_elf.h linux-user: Move elf parameters to microblaze/target_elf.h linux-user: Move elf parameters to {mips,mips64}/target_elf.h linux-user: Move elf parameters to loongarch64/target_elf.h ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | hw/core: Use qemu_log_trylock/unlock in cpu_common_reset_exitRichard Henderson2025-08-301-3/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | Ensure that the "CPU Reset" message won't be separated from the cpu_dump_state output. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | hw/core: Dump cpu_reset in the reset.exit phaseRichard Henderson2025-08-301-5/+11
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During reset.hold, the cpu is in an inconsistent state, where the leaf class has not had a chance to initialize state at all. This is visible as a SIGSEGV in "qemu-system-sparc64 -d cpu_reset". Move the dump to the exit phase, where all initialization is certain to be complete. Reported-by: Henk van der Laak <henk@laaksoft.nl> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* / hw/intc/loongarch_pch_pic: Fix ubsan warning and endianness issueThomas Huth2025-08-281-7/+8
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When booting the Linux kernel from tests/functional/test_loongarch64_virt.py with a QEMU that has been compiled with --enable-ubsan, there is a warning like this: .../hw/intc/loongarch_pch_pic.c:171:46: runtime error: index 512 out of bounds for type 'uint8_t[64]' (aka 'unsigned char[64]') SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior .../hw/intc/loongarch_pch_pic.c:171:46 .../hw/intc/loongarch_pch_pic.c:175:45: runtime error: index 256 out of bounds for type 'uint8_t[64]' (aka 'unsigned char[64]') SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior .../hw/intc/loongarch_pch_pic.c:175:45 It happens because "addr" is added first before substracting the base (PCH_PIC_HTMSI_VEC or PCH_PIC_ROUTE_ENTRY). Additionally, this code looks like it is not endianness safe, since it uses a 64-bit pointer to write values into an array of 8-bit values. Thus rework the code to use the stq_le_p / ldq_le_p helpers here and make sure that we do not create pointers with undefined behavior by accident. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Song Gao <gaosong@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
* Merge tag 'pull-lu-20250828' of https://gitlab.com/rth7680/qemu into stagingRichard Henderson2025-08-281-4/+0
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | linux-user: do not print IP socket options by default linux-user: Add strace for rseq linux-user: Move get_elf_cpu_model to target/elfload.c linux-user: Move get_elf_hwcap to target/elfload.c linux-user: Move get_elf_hwcap2 to target/elfload.c linux-user: Move get_elf_platform to target/elfload.c linux-user: Move get_elf_base_platform to target/elfload.c linux-user: Create init_main_thread in target/cpu_loop.c semihosting: Retrieve stack top from image_info semihosting: Initialize heap once per process # -----BEGIN PGP SIGNATURE----- # # iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmive68dHHJpY2hhcmQu # aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV+LwwgAsjSjc5Bjal0mc+UI # Qmb7qbNM7YDhJ4o9eJoT7AfEo3AlR8vhA01/ayfBEKMxYStl4tkZU1jthb7LLTyS # TfPBsZEBF/ZuTYLV56dfQ/6AJZ2g5OhqJbeVeD8Ef93JK60qgBerCK/D5SfphSfh # TQtOG0LU2BXzGt8K3WghFxsFQeYcTrNeT5JdtIXYrmGQmDnPh3dOnQrFcO1leFLa # khUfj7l7bE1Rgqo5h5pveaee4AD3VndYe10zvSVKHKjBL4Zd3hxf3MypNRpDFC0v # ua9xt4qXtWgEYSkKPj/mipcd9fsb+RKs6kPA3oojwb8DCkFAZ0UogIwmd9/7lz8u # FMp+iQ== # =Nu63 # -----END PGP SIGNATURE----- # gpg: Signature made Thu 28 Aug 2025 07:42:07 AM AEST # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [ultimate] * tag 'pull-lu-20250828' of https://gitlab.com/rth7680/qemu: (46 commits) linux-user: do not print IP socket options by default linux-user: Add strace for rseq linux-user: Remove do_init_main_thread linux-user/hexagon: Create init_main_thread linux-user/xtensa: Create init_main_thread linux-user/hppa: Create init_main_thread linux-user/riscv: Create init_main_thread linux-user/s390x: Create init_main_thread linux-user/alpha: Create init_main_thread linux-user/m68k: Create init_main_thread linux-user/sh4: Create init_main_thread linux-user/openrisc: Create init_main_thread linux-user/microblaze: Create init_main_thread linux-user/mips: Create init_main_thread linux-user/loongarch64: Create init_main_thread linux-user/ppc: Create init_main_thread linux-user/sparc: Create init_main_thread linux-user/aarch64: Create init_main_thread linux-user/arm: Remove a.out startup remenents linux-user/arm: Create init_main_thread ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * linux-user: Move ppc uabi/asm/elf.h workaround to osdep.hRichard Henderson2025-08-281-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | Move the workaround out of linux-user/elfload.c, so that we don't have to replicate it in many places. Place it immediately after the include of <signal.h>, which draws in the relevant symbols. Note that ARCH_DLINFO is not defined by the kernel header, and so there's no need to undef it either. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* | Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson2025-08-281-1/+1
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * rust: declare self as qemu_api for proc-macros * rust/qemu-api-macros: make derive(Object) friendly when missing parent * x86/loader: Don't update kernel header for CoCo VMs * target/i386: Add support for save/load of exception error code * i386/tcg/svm: fix incorrect canonicalization * scripts/minikconf.py: small fixes # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmivPVYUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroNi/wf/VvAfmXDNgiffoXl91cF8kx2zSs8L # D+pd/ufVEkFYsU1EnHUsGJKK0XrjHp/beCGkWZr9nTP448n1t5MiTYgI9z5Lkult # hwBQMZsxbOLw4BItbh9obWC5HrfHqgpy88hsfy+RfiSU31ae4drzottDm3/VbaFY # 2d0x9ai8lvaTk+GqBV8EeeCT210tS/Cb/8HC22o+vC2O2/cztnuCj6wtD43ocDEk # lhT00edP8jUX4EoPAx18Qkv/zzPL/p9jWVAFCcE/IZ/e4LSrgA61aUyoP9vvrjWh # U+f8C4MV2o8oZ1lM9FC5hJ0LdQbeq1kxqqukQIKYlRiFXjD3LZ+3wJueHQ== # =XEsN # -----END PGP SIGNATURE----- # gpg: Signature made Thu 28 Aug 2025 03:16:06 AM AEST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [unknown] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [unknown] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: rust: move dependencies to rust/Cargo.toml rust: declare self as qemu_api for proc-macros rust/qemu-api-macros: make derive(Object) friendly when missing parent subprojects: update proc-macro2 and syn rust: qemu-api-macros: support matching more than one error rust: disable borrow_as_ptr warning kvm/kvm-all: make kvm_park/unpark_vcpu local to kvm-all.c i386/tcg/svm: fix incorrect canonicalization x86/loader: Don't update kernel header for CoCo VMs MAINTAINERS: add a few more files to "Top Level Makefile and configure" python: mkvenv: fix messages printed by mkvenv scripts/minikconf.py: s/Error/KconfigParserError scripts/minikconf.py: fix invalid attribute access target/i386: Add support for save/load of exception error code Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * x86/loader: Don't update kernel header for CoCo VMsXiaoyao Li2025-08-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update the header makes it different from the original kernel that user provides via "-kernel", which leads to a different hash and breaks the attestation, e.g., for TDX. We already skip it for SEV VMs. Instead of adding another check of is_tdx_vm() to cover the TDX case, check machine->cgs to cover all the confidential computing case for x86. Reported-by: Vikrant Garg <vikrant1garg@gmail.com> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://lore.kernel.org/r/20250814092111.2353598-1-xiaoyao.li@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | hw: add compat machines for 10.2Cornelia Huck2025-08-278-9/+70
|/ | | | | | | | | | Add 10.2 machine types for arm/i440fx/m68k/q35/s390x/spapr. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20250805095616.1168905-1-cohuck@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* Merge tag 'uefi-20250812-pull-request' of https://gitlab.com/kraxel/qemu ↵Stefan Hajnoczi2025-08-133-3/+8
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging hw/uefi: last-minute bug fixes for the uefi variable store [for 10.1] # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmibENYACgkQTLbY7tPo # cTi2vQ/9FlAPZTZ/z/D5dfDHLhB06esVe6qd7LuI7rV3/6bUB+g+LYwoJI40SVMq # Q5YDsQGX0muhzsE343XYMXIcz8yxUEvALpvFVW6e5pg92Q2g1aeHeJaxsaiPdbo2 # gG9WU3paCOQzRK488fUe8ed6Gkqmu6SLDwuAtQ5D9UXZ7qCSfy2Rr8/Li9Qs5JCJ # StLccRvK6G72S+ESYDo/O1Q1P0CdpgJXuOV+75NdYZn4e7G0GUXN52l1U3fH0JZZ # sSqoo4TgMjrchEhE4YrXNm/UFrhLpn+uv1Xhyv6UuLpLLWlSU/5EeARS7mGjMGbp # z3Np11LrqtbB9fxxrxf75OLzya2aKBVUlmuh/HCP1wLNx7kxYpT4yyjsywXkksQ3 # TV2dMknDHm0JRf/i2DJuS6bDZlbehfu+1KkR25+0h/QSd2tK9Ct/ZxO59QcR02Kt # ecvSzRfFG8+jTVorwVguftDyRe4b/qpFn4X7KujlkKvLiOA4lZ8NZsIFi0x2FGeA # efdLRVEaDRJBmblcykPR+NYAyxcwGdHYerOsbf/vnRlCAsNQw1oofqTSU6qxnjnH # hDF+fGBVQ2drjTfb5aFdLpQ4Fq9yD+x9fdpshT8IzqIdsJDKrlPYZK4ueSBF4A3V # 32N2ZumxH17bvE44WkclJ0aog25M2+dgs5OJvqjcYY5VllEMTis= # =Ntwr # -----END PGP SIGNATURE----- # gpg: Signature made Tue 12 Aug 2025 06:00:54 EDT # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * tag 'uefi-20250812-pull-request' of https://gitlab.com/kraxel/qemu: hw/uefi: open json file in binary mode hw/uefi: check access for first variable hw/uefi: return success for notifications hw/uefi: clear uefi-vars buffer in uefi_vars_write callback Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * hw/uefi: open json file in binary modeGerd Hoffmann2025-08-121-1/+1
| | | | | | | | | | | | | | | | | | | | Fixes file length discrepancies due to line ending conversions on windows hosts. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3058 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20250811130110.820958-4-kraxel@redhat.com>
| * hw/uefi: check access for first variableGerd Hoffmann2025-08-121-0/+3
| | | | | | | | | | | | | | | | | | | | When listing variables (via get-next-variable-name) only the names of variables which can be accessed will be returned. That check was missing for the first variable though. Add it. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20250811130110.820958-3-kraxel@redhat.com>
| * hw/uefi: return success for notificationsGerd Hoffmann2025-08-121-0/+2
| | | | | | | | | | | | | | | | | | Set status to SUCCESS for ready-to-boot and exit-boot-services notification calls. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20250811130110.820958-2-kraxel@redhat.com>
| * hw/uefi: clear uefi-vars buffer in uefi_vars_write callbackMauro Matteo Cascella2025-08-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is invoked. The function allocates a heap buffer without zeroing the memory, leaving the buffer filled with residual data from prior allocations. When the guest later reads from register UEFI_VARS_REG_PIO_BUFFER_TRANSFER, the .read callback `uefi_vars_read` returns leftover metadata or other sensitive process memory from the previously allocated buffer, leading to an information disclosure vulnerability. Fixes: CVE-2025-8860 Fixes: 90ca4e03c27d ("hw/uefi: add var-service-core.c") Reported-by: ZDI <zdi-disclosures@trendmicro.com> Suggested-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Message-ID: <20250811101128.17661-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | hw/sd/ssi-sd: Return noise (dummy byte) when no card connectedPhilippe Mathieu-Daudé2025-08-121-0/+4
|/ | | | | | | | | | | | | | | | | | | Commit 1585ab9f1ba ("hw/sd/sdcard: Fill SPI response bits in card code") exposed a bug in the SPI adapter: if no SD card is plugged, we are returning "there is a card with an error". This is wrong, we shouldn't return any particular packet response, but the noise shifted on the MISO line. Return the dummy byte, otherwise we get: qemu-system-riscv64: ../hw/sd/ssi-sd.c:160: ssi_sd_transfer: Assertion `s->arglen > 0' failed. Reported-by: Guenter Roeck <linux@roeck-us.net> Fixes: 775616c3ae8 ("Partial SD card SPI mode support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250812140415.70153-2-philmd@linaro.org>
* Merge tag 'pull-nvme-20250811' of https://gitlab.com/birkelund/qemu into stagingStefan Hajnoczi2025-08-111-15/+28
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nvme queue # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmiZmYQACgkQTeGvMW1P # DenI0wf9GPov0a82A2F23UTU+R8NC/NASBovEfPRTz7/J9fGL844ID3G6uT4emFP # wAilGmMbNuPHKAtII4holCximP/7yosVZJIIdjLsRBBP9AZqpMHkr27VBny9rklZ # X7TW6zI8INIjdqvRlIBevH5t5By/qLiaDc6GzRWJ3PoeXE6SKACDi0lNBsn75xah # IbcHi72c96CwYJCEtOHXBs+zECo1yGDhK0OPvs/s7OykuRcOumF21IzuY958bVs/ # 7dJZkTL+oarZHIvKiUrErKK3gWfSrLeaWrR6sW1QNuOhzEeNHk47w86p+CEQ7CrU # w0ioEaZ9awXk7wnZeY//CpUKFbsmwQ== # =Qfvu # -----END PGP SIGNATURE----- # gpg: Signature made Mon 11 Aug 2025 03:19:32 EDT # gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9 # gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown] # gpg: aka "Klaus Jensen <k.jensen@samsung.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838 # Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9 * tag 'pull-nvme-20250811' of https://gitlab.com/birkelund/qemu: hw/nvme: cap MDTS value for internal limitation hw/nvme: revert CMIC behavior hw/nvme: fix namespace attachment Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * hw/nvme: cap MDTS value for internal limitationKeith Busch2025-08-111-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The emulated device had let the user set whatever max transfers size they wanted, including no limit. However the device does have an internal limit of 1024 segments. NVMe doesn't report max segments, though. This is implicitly inferred based on the MDTS and MPSMIN values. IOV_MAX is currently 1024 which 4k PRPs can exceed with 2MB transfers. Don't allow MDTS values that can exceed this, otherwise users risk seeing "internal error" status to their otherwise protocol compliant commands. Signed-off-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
| * hw/nvme: revert CMIC behaviorKlaus Jensen2025-08-111-13/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit cd59f50ab017 ("hw/nvme: always initialize a subsystem") causes the controller to always set the CMIC.MCTRS ("Multiple Controllers") bit. While spec-compliant, this is a deviation from the previous behavior where this was only set if an nvme-subsys device was explicitly created (to configure a subsystem with multiple controllers/namespaces). Revert the behavior to only set CMIC.MCTRS if an nvme-subsys device is created explicitly. Reported-by: Alan Adamson <alan.adamson@oracle.com> Fixes: cd59f50ab017 ("hw/nvme: always initialize a subsystem") Reviewed-by: Alan Adamson <alan.adamson@oracle.com> Tested-by: Alan Adamson <alan.adamson@oracle.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
| * hw/nvme: fix namespace attachmentKlaus Jensen2025-08-111-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 6ccca4b6bb9f ("hw/nvme: rework csi handling") introduced a bug in Namespace Attachment, causing it to a) not allow a controller to attach namespaces to other controllers b) assert if a valid non-attached namespace is detached This fixes both issues. Fixes: 6ccca4b6bb9f ("hw/nvme: rework csi handling") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2976 Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
* | vfio: Document 'use-legacy-x86-rom' propertyCédric Le Goater2025-08-091-0/+3
| | | | | | | | | | | | | | | | | | | | | | Commit 350785d41d8b ("ramfb: Add property to control if load the romfile") introduced the `use-legacy-x86-rom` property for the `vfio-pci-nohotplug` device. Add documentation for the property. Fixes: d5fcf0d960d8 ("hw/i386: Add the ramfb romfile compatibility") Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/qemu-devel/20250805065543.120091-1-clg@redhat.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
* | vfio/pci: preserve pending interruptsSteve Sistare2025-08-093-0/+94
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | cpr-transfer may lose a VFIO interrupt because the KVM instance is destroyed and recreated. If an interrupt arrives in the middle, it is dropped. To fix, stop pending new interrupts during cpr save, and pick up the pieces. In more detail: Stop the VCPUs. Call kvm_irqchip_remove_irqfd_notifier_gsi --> KVM_IRQFD to deassign the irqfd gsi that routes interrupts directly to the VCPU and KVM. After this call, interrupts fall back to the kernel vfio_msihandler, which writes to QEMU's kvm_interrupt eventfd. CPR already preserves that eventfd. When the route is re-established in new QEMU, the kernel tests the eventfd and injects an interrupt to KVM if necessary. Deassign INTx in a similar manner. For both MSI and INTx, remove the eventfd handler so old QEMU does not consume an event. If an interrupt was already pended to KVM prior to the completion of kvm_irqchip_remove_irqfd_notifier_gsi, it will be recovered by the subsequent call to cpu_synchronize_all_states, which pulls KVM interrupt state to userland prior to saving it in vmstate. Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Link: https://lore.kernel.org/qemu-devel/1752689169-233452-3-git-send-email-steven.sistare@oracle.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
* | vfio/pci: augment set_handlerSteve Sistare2025-08-093-4/+14
|/ | | | | | | | | | Extend vfio_pci_msi_set_handler() so it can set or clear the handler. Add a similar accessor for INTx. No functional change. Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/1752689169-233452-2-git-send-email-steven.sistare@oracle.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
* hw/i386/microvm: Explicitly select ACPI_PCIEric Auger2025-08-051-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With a microvm-only build based on a custom device config, we get a link failure due to undefined reference to build_pci_host_bridge_osc_method() which is defined in hw/acpi/pci.c and whose compilation depends on CONFIG_ACPI_PCI. Although CONFIG_ACPI and CONFIG_PCI are set with such configuration, implied CONFIG_ACPI_PCI in config PCI_EXPRESS_GENERIC_BRIDGE is not selected as expected. It Looks like CONFIG_ACPI_PCI must be enforced and this patch selects CONFIG_ACPI_PCI in MICROVM config directly as done for PC config. Reproducer: ../configure \ --without-default-features \ --target-list=x86_64-softmmu \ --enable-kvm --disable-tcg \ --enable-pixman \ --enable-vnc \ --audio-drv-list="" \ --without-default-devices \ --with-devices-x86_64=microvm \ --enable-vhost-user with configs/devices/x86_64-softmmu/microvm.mak: CONFIG_PCI_DEVICES=n CONFIG_MICROVM=y CONFIG_VIRTIO_BLK=y CONFIG_VIRTIO_SERIAL=y CONFIG_VIRTIO_INPUT=y CONFIG_VIRTIO_INPUT_HOST=y CONFIG_VHOST_USER_INPUT=y CONFIG_VIRTIO_NET=y CONFIG_VIRTIO_SCSI=y CONFIG_VIRTIO_RNG=y CONFIG_VIRTIO_CRYPTO=y CONFIG_VIRTIO_BALLOON=y CONFIG_VIRTIO_GPU=y CONFIG_VHOST_USER_GPU=y FAILED: qemu-system-x86_64 cc -m64 @qemu-system-x86_64.rsp /usr/bin/ld: libsystem.a.p/hw_pci-host_gpex-acpi.c.o: in function `acpi_dsdt_add_host_bridge_methods': hw/pci-host/gpex-acpi.c:83:(.text+0x274): undefined reference to `build_pci_host_bridge_osc_method' collect2: error: ld returned 1 exit status Fixes: af151d50eac24 "hw/pci-host/gpex-acpi: Use build_pci_host_bridge_osc_method" Signed-off-by: Eric Auger <eric.auger@redhat.com> Reported-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20250804152008.247673-1-eric.auger@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* hw/sd/sdcard: Remove SDState::mode fieldPhilippe Mathieu-Daudé2025-08-052-20/+19
| | | | | | | | | | | | SD card mode is a superset of its state (SDState::state), no need to migrate it. Use sd_mode() to get the SDCardModes from the SDCardStates. Fixes: 50a5be6c3d5 ("hw/sd.c: add SD card save/load support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-11-philmd@linaro.org>
* hw/sd/sdcard: Disable checking STBY mode in SPI SEND_CSD/CIDPhilippe Mathieu-Daudé2025-08-051-0/+11
| | | | | | | | | | | | | | | The card should be in STANDBY mode to process SEND_CSD or SEND_CID, but is still in IDLE mode. Unfortunately I don't have enough time to keep debugging this issue, so disable the check for the time being and the next release, as it blocks Linux. I'll keep looking. Reported-by: Guenter Roeck <linux@roeck-us.net> Reported-by: Ben Dooks <ben.dooks@codethink.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-10-philmd@linaro.org>
* hw/sd/sdcard: Factor spi_cmd_SEND_CxD() outPhilippe Mathieu-Daudé2025-08-051-9/+10
| | | | | | | | | spi_cmd_SEND_CSD() and spi_cmd_SEND_CID() are very similar. Factor the common code as spi_cmd_SEND_CxD(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-9-philmd@linaro.org>
* hw/sd/sdcard: Allow using SWITCH_FUNCTION in more SPI statesPhilippe Mathieu-Daudé2025-08-051-2/+8
| | | | | | | | | | In SPI mode, SWITCH_FUNCTION is valid in all mode (except the IDLE one). Fixes: 775616c3ae8 ("Partial SD card SPI mode support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-8-philmd@linaro.org>
* hw/sd/sdcard: Use complete SEND_OP_COND implementation in SPI modePhilippe Mathieu-Daudé2025-08-051-10/+5
| | | | | | | | | | | While spi_cmd_SEND_OP_COND() is incomplete, sd_cmd_SEND_OP_COND() is, except it doesn't return the correct value in SPI mode. Correct and use, removing the need for spi_cmd_SEND_OP_COND(). Fixes: 775616c3ae8 ("Partial SD card SPI mode support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-7-philmd@linaro.org>
* hw/sd/sdcard: Implement SPI R2 return valuePhilippe Mathieu-Daudé2025-08-052-6/+35
| | | | | | | | | | | | In SPI mode, R2 is a 2-byte value. Implement in spi_response_r2_make() and return SPI R2 in the SEND_STATUS commands. Reported-by: Guenter Roeck <linux@roeck-us.net> Fixes: 775616c3ae8 ("Partial SD card SPI mode support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-6-philmd@linaro.org>
* hw/sd/sdcard: Fill SPI response bits in card codePhilippe Mathieu-Daudé2025-08-052-84/+35
| | | | | | | | | | | | | | ssi-sd.c contains the SPI link layer adaptation, while sd.c contains all the SD card internal details. We already handle the response values in sd.c, but missed the SPI case. Complete them (fill R1, prepend R1 in R3/R7 and always return something in SPI mode). Remove all the duplication in ssi-sd.c. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-5-philmd@linaro.org>
* hw/sd/sdbus: Provide buffer size to sdbus_do_command()Philippe Mathieu-Daudé2025-08-058-28/+26
| | | | | | | | | | | | | | | | | We provide to sdbus_do_command() a pointer to a buffer to be filled with a varying number of bytes. By not providing the buffer size, the callee can not check the buffer is big enough. Pass the buffer size as argument to follow good practices. sdbus_do_command() doesn't return any error, only the size filled in the buffer. Convert the returned type to unsigned and remove the few unreachable lines in callers. This allow to check for possible overflow in sd_do_command(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-4-philmd@linaro.org>
* hw/sd/sdcard: Factor sd_response_size() outPhilippe Mathieu-Daudé2025-08-051-7/+29
| | | | | | | | | | Set @rsplen once before switching to fill the response buffer. This will allow to assert in a single place that the buffer is big enough to be filled with the response. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-3-philmd@linaro.org>
* hw/sd/sdcard: Do not ignore errors in sd_cmd_to_sendingdata()Philippe Mathieu-Daudé2025-08-051-1/+1
| | | | | | | | | | Unfortunately when adding sd_cmd_to_sendingdata() in commit f486bf7d109 we neglected to return any possible error. Fix. Fixes: f486bf7d109 ("hw/sd/sdcard: Introduce sd_cmd_to_sendingdata and sd_generic_read_byte") Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20250804133406.17456-2-philmd@linaro.org>
* Merge tag 'pull-aspeed-20250804' of https://github.com/legoater/qemu into ↵Stefan Hajnoczi2025-08-041-1/+2
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging aspeed queue: * Fixed vbootrom build under roms/ * Updated vbootrom image to 183c9ff805 * Fixed SMC model of AST1030 SoC # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmiQkpMACgkQUaNDx8/7 # 7KFVFw//X8mpLW97oCdh2ZuelkwQh+udAn34/f8cZWu97g9/Dmi6oDNb/GmPy5t2 # lFNg4hCSBh3JcRbHSMLVieE3lZLi5XuRb/g64TSH0gzgfhFKaPsqxzaD51R5cxVF # JG9JSsGKJdbp1inWZvr1uEZsioAOdUPP4qeD+WLoTHKrhSPCrUHsjslVmReBKu/O # sbgTGHkI8RJA6knz+j5JzXgy5y7XGsfbkl3pWlI8Ni9l6VDVrgfCcSgGtjQdzF4Q # J/QtpYYjo6crJ4wbvAPhKP3RZNNl0m60oxn0BSLFzrM3fZ95VP4pGVOrkCKtZLgG # Q0KvHcDKvm3BsgLPaUeyMjYHKbku2f/U3acsY4VqfLbvLNarmsG8OtFPiEs1tKnu # Dkqb1Ac85O/8dKohyIFhxEy1nEY4iW4495iDD2CklD2lY1Ck+bFkwC2jBNfpgaO6 # xzfLPpiyyU+GbnXbV5HASHland+5AyIjxEKfYpIcARIsfuDOR0qYPl/wmPkV8utO # /X0cKHZxSZ0x3E7xiOwTo6ZIgKdYbNEljTRT0AYxChB/ZRIEByQvYnwAXaL9IqLc # qSc2GRXTy+G8WNy4z1kn2B0Sp9rENvB5uzoRGZ1PtwBySclzUHICQ653a7HKEYeH # imXU9dGNhkQ+RMdA9+bZ3B3H8ykJDtX27woK6yerlbk3CUT9ZIs= # =oAuL # -----END PGP SIGNATURE----- # gpg: Signature made Mon 04 Aug 2025 06:59:31 EDT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [full] # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-aspeed-20250804' of https://github.com/legoater/qemu: hw/ssi/aspeed_smc: Fix incorrect FMC_WDT2 register read on AST1030 pc-bios: Update vbootrom image to commit 183c9ff8056b roms/Makefile: build ast27x0_bootrom roms/vbootrom: update to 7b1eb5f7fe6a Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * hw/ssi/aspeed_smc: Fix incorrect FMC_WDT2 register read on AST1030Jamin Lin2025-08-041-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On AST1030, reading the FMC_WDT2 register always returns 0xFFFFFFFF. This issue is due to the aspeed_smc_read function, which checks for the ASPEED_SMC_FEATURE_WDT_CONTROL feature. Since AST1030 was missing this feature flag, the read operation fails and returns -1. To resolve this, add the WDT_CONTROL feature to AST1030's feature set so that FMC_WDT2 can be correctly accessed by firmware. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Fixes: 2850df6a81bcdc2e063dfdd56751ee2d11c58030 ("aspeed/smc: Add AST1030 support ") Link: https://lore.kernel.org/qemu-devel/20250804014633.512737-1-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
* | Merge tag 'pull-target-arm-20250801' of https://gitlab.com/pm215/qemu into ↵Stefan Hajnoczi2025-08-042-7/+5
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging target-arm queue: * Add missing 64-bit PMCCNTR in AArch32 mode * Reinstate bogus AArch32 DBGDTRTX register for migration compat * fix big-endian handling of AArch64 FPU registers in gdbstub * fix handling of setting SVE registers from gdbstub * hw/intc/arm_gicv3_kvm: fix writing of enable/active/pending state to KVM * hw/display/framebuffer: Add cast to force 64x64 multiply * tests/tcg: Fix run for tests with specific plugin # -----BEGIN PGP SIGNATURE----- # # iQJMBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmiM4mgZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3lH/D/iniJpHRVDVAvHcYe7vSgLl # HHfdEro/lOJJbaktQwOwkSuyl5HFy3YoIg3/5K2kX40DRkeA/M1HWkaWpwpCUReV # 6XS8fCDmxw5M0oncJsTD1cYxCAAHm/CSt2uvdwgHo6nU+vnEa85ml3Q57phLEkvl # 2R6xjXDD2FY3Xi6l2Jvqhnx/y60D5YnZVo/G9jcwRI2kIvpwTxukge5rGRTeagzL # fKwsgr8jThvWyzTJtd88n36uD8xiH8/IfHh+e0kGYfzPRjEGfN3rKh4OlyfRyv7D # AVI8qgVz0ex7DEjJTCS2nNYmNhO8hTE+cybcsH6AU2e3V7/vqg3Lh0/1cWlmvGnR # 8L0/RBy0exPI1kRABfjXPV4VtNSuByxp+F+s4LvUrxgnnbv29ldOnQNHn3BZJtZn # OuuixZNa3/tJFa+2U20fPW+q2H9uhPhvLn5fhtCx1ucYONLMrWl3Z8Q3/qwbW+5e # FR459UaVHUvqKDGL6cjnaQ3VclrsXngCbeBmLm7fDfniRf/4uIc3q6RzdwY3waj3 # t7D/+GmLwZzajEaCU1NcI+Uz+yO/wJhEXUtWAzm6xeowYfOEeZc1pRgGWSqy4qvi # L9vKmZtRW5LvwLwpMLdcoB3BOIszSDy7AylX4onSWl3Vp3GYiOhYqv9OKlQoUGtu # xjFCVDCB/0FPl9b+xoYK # =lN06 # -----END PGP SIGNATURE----- # gpg: Signature made Fri 01 Aug 2025 11:51:04 EDT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20250801' of https://gitlab.com/pm215/qemu: tests/tcg: Fix run for tests with specific plugin target/arm: Fix handling of setting SVE registers from gdb target/arm: Fix big-endian handling of NEON gdb remote debugging target/arm: Reinstate bogus AArch32 DBGDTRTX register for migration compat hw/display/framebuffer: Add cast to force 64x64 multiply hw/intc/arm_gicv3_kvm: Write all 1's to clear enable/active hw/intc/arm_gicv3_kvm: Remove writes to ICPENDR registers target/arm: add support for 64-bit PMCCNTR in AArch32 mode Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * hw/display/framebuffer: Add cast to force 64x64 multiplyPeter Maydell2025-08-011-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In framebuffer_update_display(), Coverity complains because we multiply two values of type 'int' (which will be done as a 32x32 multiply and so in theory might overflow) and then add the result to a ram_addr_t, which can be 64 bits. 4GB framebuffers are not plausible anyway, but keep Coverity happy by adding casts which force these multiplies to be done as 64x64. Coverity: CID 1487248 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Message-id: 20250710174312.1313177-1-peter.maydell@linaro.org
| * hw/intc/arm_gicv3_kvm: Write all 1's to clear enable/activeZenghui Yu2025-08-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | KVM's userspace access interface to the GICD enable and active bits is via set/clear register pairs which implement the hardware's "write 1s to the clear register to clear the 0 bits, and write 1s to the set register to set the 1 bits" semantics. We didn't get this right, because we were writing 0 to the clear register. Writing 0 to GICD_IC{ENABLE,ACTIVE}R architecturally has no effect on interrupt status (all writes are simply ignored by KVM) and doesn't comply with the intention of "first write to the clear-reg to clear all bits". Write all 1's to actually clear the enable/active status. This didn't have any adverse effects on migration because there we start with a clean VM state; it would be guest-visible when doing a system reset, but since Linux always cleans up the register state of the GIC during bootup before it enables it most users won't have run into a problem here. Cc: qemu-stable@nongnu.org Fixes: 367b9f527bec ("hw/intc/arm_gicv3_kvm: Implement get/put functions") Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev> Message-id: 20250729161650.43758-3-zenghui.yu@linux.dev Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/intc/arm_gicv3_kvm: Remove writes to ICPENDR registersZenghui Yu2025-08-011-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As per the arm-vgic-v3 kernel doc [1]: Accesses to GICD_ICPENDR register region and GICR_ICPENDR0 registers have RAZ/WI semantics, meaning that reads always return 0 and writes are always ignored. The state behind these registers (both 0 and 1 bits) is written by writing to the GICD_ISPENDR and GICR_ISPENDR0 registers, unlike some of the other set/clear register pairs. Remove the useless writes to ICPENDR registers in kvm_arm_gicv3_put(). [1] https://docs.kernel.org/virt/kvm/devices/arm-vgic-v3.html Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev> Message-id: 20250729161650.43758-2-zenghui.yu@linux.dev Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Stefan Hajnoczi2025-08-017-60/+136
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging virtio,pci,pc: bugfixes small fixes all over the place. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmiMzgoPHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRpAO4H+gKeZbkJFFPHBduwn/LyTTkBpEghy14wEp7G # 6y3knCkWXOVOnFJ/Lw1p6ZLtB6o547Ktin49msY+SKF2X33N1b6I0DmLxixnLVqP # fHMUF+/QssH7QdIMuZNTxr/nwdDzGnj6Rv4xVyrwdZlf+nQPE8GuXWPmAmyGwcXM # 1sEPTjZq30y2eRiQkKsgS7g+COqfPy+O3VeiyQWR1Q/Cb85alegGwUPBy289u3V+ # uHaBC6d73NWxRCHJM4J8CnWpY5LA+y/YgfJXys1NH8pzRLbTpiYt7gfUbfdHbIvF # IpjZraVh+ApbwXhQLmDmsHtGsyIE1zFlcZTq9pR6WUgYGUDQMpY= # =cJxn # -----END PGP SIGNATURE----- # gpg: Signature made Fri 01 Aug 2025 10:24:10 EDT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: net/vdpa: fix potential fd leak in net_init_vhost_vdpa() MAINTAINERS: add net/vhost* files under `vhost` intel_iommu: Allow both Status Write and Interrupt Flag in QI wait tests/acpi: virt: update HEST file with its current data tests/qtest/bios-tables-test: extend to also check HEST table tests/acpi: virt: add an empty HEST file hw/i386/amd_iommu: Fix event log generation hw/i386/amd_iommu: Support MMIO writes to the status register hw/i386/amd_iommu: Fix amdvi_write*() hw/i386/amd_iommu: Move IOAPIC memory region initialization to the end hw/i386/amd_iommu: Remove unused and wrongly set ats_enabled field hw/i386/amd_iommu: Fix MMIO register write tracing pcie_sriov: Fix configuration and state synchronization virtio-net: Fix VLAN filter table reset timing vhost: Do not abort on log-stop error vhost: Do not abort on log-start error virtio: fix off-by-one and invalid access in virtqueue_ordered_fill Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * | intel_iommu: Allow both Status Write and Interrupt Flag in QI waitDavid Woodhouse2025-08-011-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FreeBSD does both, and this appears to be perfectly valid. The VT-d spec even talks about the ordering (the status write should be done first, unsurprisingly). We certainly shouldn't assert() and abort QEMU if the guest asks for both. Fixes: ed7b8fbcfb88 ("intel-iommu: add supports for queued invalidation interface") Closes: https://gitlab.com/qemu-project/qemu/-/issues/3028 Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Message-Id: <0122cbabc0adcc3cf878f5fd7834d8f258c7a2f2.camel@infradead.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | hw/i386/amd_iommu: Fix event log generationSairaj Kodilkar2025-08-012-9/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Current event logging code is broken, because of following issues 1. The code uses '|' instead of '&' to test the bit field, which causes vIOMMU to generate overflow interrupt for every log entry. 2. Code does not update the eventlog tail MMIO register after adding an entry to the buffer, because of which guest cannot process new entries (as head == tail means buffer is empty). 3. Compares eventlog tail (which is byte offset in the buffer) to eventlog length (which is number of maximum entries in the buffer). This causes vIOMMU to generate only fix number of event logs, after which it keeps on generating overflow interrupts, without actually resetting the log buffer. 4. Updates ComWaitInt instead of EventLogInt bitfield in Status register. Guest checks this field to see if there are new event log entries in the buffer. 5. Does not reset event log head and tail pointers when guest writes to eventlog base register. Fix above issues, so that guest can process event log entries. Fixes: d29a09ca68428 ("hw/i386: Introduce AMD IOMMU") Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Message-Id: <20250801060507.3382-7-sarunkod@amd.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | hw/i386/amd_iommu: Support MMIO writes to the status registerSairaj Kodilkar2025-08-011-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support the writes to the status register so that guest can reset the EventOverflow, EventLogInt, ComWaitIntr, etc bits after servicing the respective interrupt. Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Message-Id: <20250801060507.3382-6-sarunkod@amd.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>