aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-04-04esp.c: ensure esp_pdma_write() always calls esp_fifo_push()Mark Cave-Ayland
This ensures that esp_update_drq() is called via esp_fifo_push() whenever the host uses PDMA to transfer data to a SCSI device. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20240324191707.623175-17-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: update esp_fifo_{push, pop}() to call esp_update_drq()Mark Cave-Ayland
This ensures that the DRQ line is always set correctly when reading/writing single bytes to/from the FIFO. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20240324191707.623175-16-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: introduce esp_update_drq() and update esp_fifo_{push, pop}_buf() to ↵Mark Cave-Ayland
use it This new function sets the DRQ line correctly according to the current transfer mode, direction and FIFO contents. Update esp_fifo_push_buf() and esp_fifo_pop_buf() to use it so that DRQ is always set correctly when reading/writing multiple bytes to/from the FIFO. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20240324191707.623175-15-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: move esp_set_phase() and esp_get_phase() towards the beginning of the ↵Mark Cave-Ayland
file This allows these functions to be used earlier in the file without needing a separate forward declaration. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20240324191707.623175-14-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: prevent cmdfifo overflow in esp_cdb_ready()Mark Cave-Ayland
During normal use the cmdfifo will never wrap internally and cmdfifo_cdb_offset will always indicate the start of the SCSI CDB. However it is possible that a malicious guest could issue an invalid ESP command sequence such that cmdfifo wraps internally and cmdfifo_cdb_offset could point beyond the end of the FIFO data buffer. Add an extra check to fifo8_peek_buf() to ensure that if the cmdfifo has wrapped internally then esp_cdb_ready() will exit rather than allow scsi_cdb_length() to access data outside the cmdfifo data buffer. Reported-by: Chuhong Yuan <hslester96@gmail.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240324191707.623175-13-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: rework esp_cdb_length() into esp_cdb_ready()Mark Cave-Ayland
The esp_cdb_length() function is only used as part of a calculation to determine whether the cmdfifo contains an entire SCSI CDB. Rework esp_cdb_length() into a new esp_cdb_ready() function which both enables us to handle the case where scsi_cdb_length() returns -1, plus simplify the logic for its callers. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240324191707.623175-12-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: don't assert() if FIFO empty when executing non-DMA SELATNSMark Cave-Ayland
The current logic assumes that at least 1 byte is present in the FIFO when executing a non-DMA SELATNS command, but this may not be the case if the guest executes an invalid ESP command sequence. Reported-by: Chuhong Yuan <hslester96@gmail.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240324191707.623175-11-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: introduce esp_fifo_push_buf() function for pushing to the FIFOMark Cave-Ayland
Instead of pushing data into the FIFO directly with fifo8_push_all(), add a new esp_fifo_push_buf() function and use it accordingly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20240324191707.623175-10-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: change esp_fifo_pop_buf() to take ESPStateMark Cave-Ayland
Now that all users of esp_fifo_pop_buf() operate on the main FIFO there is no need to pass the FIFO explicitly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20240324191707.623175-9-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: use esp_fifo_push() instead of fifo8_push()Mark Cave-Ayland
There are still a few places that use fifo8_push() instead of esp_fifo_push() in order to push a value into the FIFO. Update those places to use esp_fifo_push() instead. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20240324191707.623175-8-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: change esp_fifo_pop() to take ESPStateMark Cave-Ayland
Now that all users of esp_fifo_pop() operate on the main FIFO there is no need to pass the FIFO explicitly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20240324191707.623175-7-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: change esp_fifo_push() to take ESPStateMark Cave-Ayland
Now that all users of esp_fifo_push() operate on the main FIFO there is no need to pass the FIFO explicitly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20240324191707.623175-6-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: replace cmdfifo use of esp_fifo_pop() in do_message_phase()Mark Cave-Ayland
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20240324191707.623175-5-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: replace esp_fifo_pop_buf() with esp_fifo8_pop_buf() in do_message_phase()Mark Cave-Ayland
The aim is to restrict the esp_fifo_*() functions so that they only operate on the hardware FIFO. When reading from cmdfifo in do_message_phase() use the underlying esp_fifo8_pop_buf() function directly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240324191707.623175-4-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: replace esp_fifo_pop_buf() with esp_fifo8_pop_buf() in do_command_phase()Mark Cave-Ayland
The aim is to restrict the esp_fifo_*() functions so that they only operate on the hardware FIFO. When reading from cmdfifo in do_command_phase() use the underlying esp_fifo8_pop_buf() function directly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240324191707.623175-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04esp.c: move esp_fifo_pop_buf() internals to new esp_fifo8_pop_buf() functionMark Cave-Ayland
Update esp_fifo_pop_buf() to be a simple wrapper onto the new esp_fifo8_pop_buf() function. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240324191707.623175-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2024-04-04block/virtio-blk: Fix memory leak from virtio_blk_zone_reportZheyu Ma
This modification ensures that in scenarios where the buffer size is insufficient for a zone report, the function will now properly set an error status and proceed to a cleanup label, instead of merely returning. The following ASAN log reveals it: ==1767400==ERROR: LeakSanitizer: detected memory leaks Direct leak of 312 byte(s) in 1 object(s) allocated from: #0 0x64ac7b3280cd in malloc llvm/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 #1 0x735b02fb9738 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5e738) #2 0x64ac7d23be96 in virtqueue_split_pop hw/virtio/virtio.c:1612:12 #3 0x64ac7d23728a in virtqueue_pop hw/virtio/virtio.c:1783:16 #4 0x64ac7cfcaacd in virtio_blk_get_request hw/block/virtio-blk.c:228:27 #5 0x64ac7cfca7c7 in virtio_blk_handle_vq hw/block/virtio-blk.c:1123:23 #6 0x64ac7cfecb95 in virtio_blk_handle_output hw/block/virtio-blk.c:1157:5 Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> Message-id: 20240404120040.1951466-1-zheyuma97@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2024-04-03Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingPeter Maydell
* lsi53c895a: fix assertion failure with invalid Block Move * vga: fix assertion failure with 4- and 16-color modes * remove unnecessary assignment # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmYNKboUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroNMDgf/Wgw+qNkNooAhEH1V5l0xdyiF4QQU # stz4kcKdWkQB5dsVy8utC3nN2baRFPgj6Utr2e8FqzxGuY8qYL3olh8k1ygiFiFz # joSOxAlBuRUOsJq90EJUyGeFykJ/F/neJ2n6VjOtKyry9c8PnInjmuNMFYsxeLow # j1VF6defALut/8wvxPm5WmfFzS1Hv3I9k/GqKSlAjNpY2COlibshEoNFuZZtpfeI # JnUL5oB+sICoZH2/mM5a9Nv2z0NCHAwKF7alXVjfHWvdaRQO6bLlraDmPXmh0ZMY # MsoULMQaeZCtC0vfc8XJZj/C/s2iO14gfqA23/mfGCLalyo7l1yh4e6JyQ== # =xDOl # -----END PGP SIGNATURE----- # gpg: Signature made Wed 03 Apr 2024 11:04:42 BST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: pc_q35: remove unnecessary m->alias assignment lsi53c895a: avoid out of bounds access to s->msg[] vga: do not treat horiz pel panning value of 8 as "enabled" vga: adjust dirty memory region if pel panning is active vga: move computation of dirty memory region later vga: merge conditionals on shift control register Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-04-02Update version for v9.0.0-rc2 releasev9.0.0-rc2Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-04-02pc_q35: remove unnecessary m->alias assignmentPaolo Bonzini
The assignment is already inherited from pc-q35-8.2. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-02lsi53c895a: avoid out of bounds access to s->msg[]Paolo Bonzini
If no bytes are there to process in the message in phase, the input data latch (s->sidl) is set to s->msg[-1]. Just do nothing since no DMA is performed. Reported-by: Chuhong Yuan <hslester96@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-02vga: do not treat horiz pel panning value of 8 as "enabled"Paolo Bonzini
Horizontal pel panning bit 3 is only used in text mode. In graphics mode, it can be treated as if it was zero, thus not extending the dirty memory region. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-02vga: adjust dirty memory region if pel panning is activePaolo Bonzini
When pel panning is active, one more byte is read from each of the VGA memory planes. This has to be accounted in the computation of region_end, otherwise vga_draw_graphic() fails an assertion: qemu-system-i386: ../system/physmem.c:946: cpu_physical_memory_snapshot_get_dirty: Assertion `start + length <= snap->end' failed. Reported-by: Helge Konetzka <hk@zapateado.de> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2244 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-02vga: move computation of dirty memory region laterPaolo Bonzini
Move the computation of region_start and region_end after the value of "bits" is known. This makes it possible to distinguish modes that support horizontal pel panning from modes that do not. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-02vga: merge conditionals on shift control registerPaolo Bonzini
There are two sets of conditionals using the shift control bits: one to verify the palette and adjust disp_width, one to compute the "v" and "bits" variables. Merge them into one, with the extra benefit that we now have the "bits" value available early and can use it to compute region_end. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-02Merge tag 'hw-misc-20240402' of https://github.com/philmd/qemu into stagingPeter Maydell
Misc HW patch queue - MAINTAINERS updates (Zhao, Glenn) - Replace incorrect mentions of 'softmmu' by 'system' (Phil) - Avoid using inlined functions with external linkage (Phil) - Restrict CXL to x86 PC PCI-based machines (Phil) - Remove unnecessary NULL check in bdrv_pad_request (Kevin) - Fix a pair of -Werror=maybe-uninitialized (Marc-André) - Initialize variable in xen_evtchn_soft_reset (Artem) - Do not access virtio-net tx queue until vhost is started (Yajun) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmYMFMgACgkQ4+MsLN6t # wN4wNA/+Pr4Qvt7xZ3ai5Ss4LUdFYw+qaw6di9KvHIkti8MlySHdniPraV7Uw2VR # jrnI5sN488l6yjFQh3VIurrAvql6MruRR1/Pa3bIC4uGzydNVS75B7CA2pmIQ5hl # Qiy4uQdgMk0dHiKdBjTVSnZaEkJ1+CNYvRK0aQcLUh3Dp/S+oGp6iyq2kWDhhgc6 # wYWDnfUICuYiz+ButXKaeGOhX3kJ6x4XQWKehF7G/DWxj2TWdoo8AchVM0jFe9/w # W+EiOrdH8dHqJ3vKhsZnE/FuN4SObt1LuzLaNUVz8GVfeDcmek6U/5J6iCoqiRsG # PbhBSlr87yoz8w4YPXVSGkq/1g1lU5QuK68tAEo0tjx+ipJz9i23QKUGF42YJH9R # yruyp+cA0KfgyoaOsaXyWFzHRH6N13sIakBUF39B53d/pb5MqSwMjwcFDa6za+bY # W4DS4T+5gRSmfjgFtdvaFdGJXa51blRttcBbwjcCmpg/1WCRBZoQv2bYNijil1F4 # jL+hrO60eJlaLrdyLDuXNvuOk4QE2qedxJo59oJO1DyGR8jzSN4a92xpasKIaazT # vlZbRE1S2HPMQhfQIwa1yx2ul+tSXbvdtMyFPzKKNIIqFJcG/7VZLM+zvuFWn82I # GDExQYJugFSEg9MGvwMeIXDzp5LiuxnIqyMw7GjSUdtsCFXfaDI= # =Y4gO # -----END PGP SIGNATURE----- # gpg: Signature made Tue 02 Apr 2024 15:23:04 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'hw-misc-20240402' of https://github.com/philmd/qemu: hw/net/virtio-net: fix qemu set used ring flag even vhost started hw/xen_evtchn: Initialize flush_kvm_routes gpio/pca955x: Update maintainer email address hw/nvme: fix -Werror=maybe-uninitialized plugins: fix -Werror=maybe-uninitialized false-positive block: Remove unnecessary NULL check in bdrv_pad_request() hw/i386/pc: Restrict CXL to PCI-based machines MAINTAINERS: Fix error-report.c entry qtest/libqos: Reduce size_to_prdtl() declaration scope accel/hvf: Un-inline hvf_arch_supports_guest_debug() hw/arm/smmu: Avoid using inlined functions with external linkage again target/ppc: Rename init_excp_4xx_softmmu() -> init_excp_4xx() gdbstub/system: Rename 'user_ctx' argument as 'ctx' gdbstub: Correct invalid mentions of 'softmmu' by 'system' accel/tcg/plugin: Remove CONFIG_SOFTMMU_GATE definition Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-04-02hw/net/virtio-net: fix qemu set used ring flag even vhost startedYajun Wu
When vhost-user or vhost-kernel is handling virtio net datapath, QEMU should not touch used ring. But with vhost-user socket reconnect scenario, in a very rare case (has pending kick event). VRING_USED_F_NO_NOTIFY is set by QEMU in following code path: #0 virtio_queue_split_set_notification (vq=0x7ff5f4c920a8, enable=0) at ../hw/virtio/virtio.c:511 #1 0x0000559d6dbf033b in virtio_queue_set_notification (vq=0x7ff5f4c920a8, enable=0) at ../hw/virtio/virtio.c:576 #2 0x0000559d6dbbbdbc in virtio_net_handle_tx_bh (vdev=0x559d703a6aa0, vq=0x7ff5f4c920a8) at ../hw/net/virtio-net.c:2801 #3 0x0000559d6dbf4791 in virtio_queue_notify_vq (vq=0x7ff5f4c920a8) at ../hw/virtio/virtio.c:2248 #4 0x0000559d6dbf79da in virtio_queue_host_notifier_read (n=0x7ff5f4c9211c) at ../hw/virtio/virtio.c:3525 #5 0x0000559d6d9a5814 in virtio_bus_cleanup_host_notifier (bus=0x559d703a6a20, n=1) at ../hw/virtio/virtio-bus.c:321 #6 0x0000559d6dbf83c9 in virtio_device_stop_ioeventfd_impl (vdev=0x559d703a6aa0) at ../hw/virtio/virtio.c:3774 #7 0x0000559d6d9a55c8 in virtio_bus_stop_ioeventfd (bus=0x559d703a6a20) at ../hw/virtio/virtio-bus.c:259 #8 0x0000559d6d9a53e8 in virtio_bus_grab_ioeventfd (bus=0x559d703a6a20) at ../hw/virtio/virtio-bus.c:199 #9 0x0000559d6dbf841c in virtio_device_grab_ioeventfd (vdev=0x559d703a6aa0) at ../hw/virtio/virtio.c:3783 #10 0x0000559d6d9bde18 in vhost_dev_enable_notifiers (hdev=0x559d707edd70, vdev=0x559d703a6aa0) at ../hw/virtio/vhost.c:1592 #11 0x0000559d6d89a0b8 in vhost_net_start_one (net=0x559d707edd70, dev=0x559d703a6aa0) at ../hw/net/vhost_net.c:266 #12 0x0000559d6d89a6df in vhost_net_start (dev=0x559d703a6aa0, ncs=0x559d7048d890, data_queue_pairs=31, cvq=0) at ../hw/net/vhost_net.c:412 #13 0x0000559d6dbb5b89 in virtio_net_vhost_status (n=0x559d703a6aa0, status=15 '\017') at ../hw/net/virtio-net.c:311 #14 0x0000559d6dbb5e34 in virtio_net_set_status (vdev=0x559d703a6aa0, status=15 '\017') at ../hw/net/virtio-net.c:392 #15 0x0000559d6dbb60d8 in virtio_net_set_link_status (nc=0x559d7048d890) at ../hw/net/virtio-net.c:455 #16 0x0000559d6da64863 in qmp_set_link (name=0x559d6f0b83d0 "hostnet1", up=true, errp=0x7ffdd76569f0) at ../net/net.c:1459 #17 0x0000559d6da7226e in net_vhost_user_event (opaque=0x559d6f0b83d0, event=CHR_EVENT_OPENED) at ../net/vhost-user.c:301 #18 0x0000559d6ddc7f63 in chr_be_event (s=0x559d6f2ffea0, event=CHR_EVENT_OPENED) at ../chardev/char.c:62 #19 0x0000559d6ddc7fdc in qemu_chr_be_event (s=0x559d6f2ffea0, event=CHR_EVENT_OPENED) at ../chardev/char.c:82 This issue causes guest kernel stop kicking device and traffic stop. Add vhost_started check in virtio_net_handle_tx_bh to fix this wrong VRING_USED_F_NO_NOTIFY set. Signed-off-by: Yajun Wu <yajunw@nvidia.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20240402045109.97729-1-yajunw@nvidia.com> [PMD: Use unlikely()] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-04-02hw/xen_evtchn: Initialize flush_kvm_routesArtem Chernyshev
In xen_evtchn_soft_reset() variable flush_kvm_routes can be used before being initialized. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Oleg Sviridov <oleg.sviridov@red-soft.ru> Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240329113939.257033-1-artem.chernyshev@red-soft.ru> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-04-02gpio/pca955x: Update maintainer email addressGlenn Miles
It was noticed that my linux.vnet.ibm.com address does not always work so dropping the vnet to see if that works better. Signed-off-by: Glenn Miles <milesg@linux.ibm.com> Message-ID: <20240328194914.2145709-1-milesg@linux.vnet.ibm.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-04-02hw/nvme: fix -Werror=maybe-uninitializedMarc-André Lureau
../hw/nvme/ctrl.c:6081:21: error: ‘result’ may be used uninitialized [-Werror=maybe-uninitialized] It's not obvious that 'result' is set in all code paths. When &result is a returned argument, it's even less clear. Looking at various assignments, 0 seems to be a suitable default value. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Message-ID: <20240328102052.3499331-18-marcandre.lureau@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-04-02plugins: fix -Werror=maybe-uninitialized false-positiveMarc-André Lureau
../plugins/loader.c:405:15: error: ‘ctx’ may be used uninitialized [-Werror=maybe-uninitialized] Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20240328102052.3499331-15-marcandre.lureau@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-04-02block: Remove unnecessary NULL check in bdrv_pad_request()Kevin Wolf
Coverity complains that the check introduced in commit 3f934817 suggests that qiov could be NULL and we dereference it before reaching the check. In fact, all of the callers pass a non-NULL pointer, so just remove the misleading check. Resolves: Coverity CID 1542668 Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Fiona Ebner <f.ebner@proxmox.com> Message-ID: <20240327192750.204197-1-kwolf@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-04-02hw/i386/pc: Restrict CXL to PCI-based machinesPhilippe Mathieu-Daudé
CXL is based on PCIe. In is pointless to initialize its context on non-PCI machines. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-ID: <20240327161642.33574-1-philmd@linaro.org>
2024-04-02MAINTAINERS: Fix error-report.c entryZhao Liu
The commit 15002f60f792 ("util: rename qemu-error.c to match its header name") renamed util/qemu-error.c to util/error-report.c but missed to change the corresponding entry. To avoid get_maintainer.pl failing, update the error-report.c entry. Fixes: 15002f60f7 ("util: rename qemu-error.c to match its header name") Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240327115539.3860270-1-zhao1.liu@linux.intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-04-02qtest/libqos: Reduce size_to_prdtl() declaration scopePhilippe Mathieu-Daudé
Since size_to_prdtl() is only used within ahci.c, declare it statically. This removes the last use of "inlined function with external linkage". See previous commit and commit 9de9fa5cf2 for rationale. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20240326171009.26696-4-philmd@linaro.org>
2024-04-02accel/hvf: Un-inline hvf_arch_supports_guest_debug()Philippe Mathieu-Daudé
See previous commit and commit 9de9fa5cf2 ("Avoid using inlined functions with external linkage") for rationale. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240313184954.42513-3-philmd@linaro.org>
2024-04-02hw/arm/smmu: Avoid using inlined functions with external linkage againPhilippe Mathieu-Daudé
Similarly to commit 9de9fa5cf2 ("hw/arm/smmu-common: Avoid using inlined functions with external linkage"): None of our code base require / use inlined functions with external linkage. Some places use internal inlining in the hot path. These two functions are certainly not in any hot path and don't justify any inlining, so these are likely oversights rather than intentional. Fix: C compiler for the host machine: clang (clang 15.0.0 "Apple clang version 15.0.0 (clang-1500.3.9.4)") ... hw/arm/smmu-common.c:203:43: error: static function 'smmu_hash_remove_by_vmid' is used in an inline function with external linkage [-Werror,-Wstatic-in-inline] g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid, &vmid); ^ include/hw/arm/smmu-common.h:197:1: note: use 'static' to give inline function 'smmu_iotlb_inv_vmid' internal linkage void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid); ^ static hw/arm/smmu-common.c:139:17: note: 'smmu_hash_remove_by_vmid' declared here static gboolean smmu_hash_remove_by_vmid(gpointer key, gpointer value, ^ Fixes: ccc3ee3871 ("hw/arm/smmuv3: Add CMDs related to stage-2") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-Id: <20240313184954.42513-2-philmd@linaro.org>
2024-04-02target/ppc: Rename init_excp_4xx_softmmu() -> init_excp_4xx()Philippe Mathieu-Daudé
Unify with other init_excp_FOO() in the same file. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20240313213339.82071-5-philmd@linaro.org>
2024-04-02gdbstub/system: Rename 'user_ctx' argument as 'ctx'Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240313213339.82071-4-philmd@linaro.org>
2024-04-02gdbstub: Correct invalid mentions of 'softmmu' by 'system'Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240313213339.82071-3-philmd@linaro.org>
2024-04-02accel/tcg/plugin: Remove CONFIG_SOFTMMU_GATE definitionPhilippe Mathieu-Daudé
The CONFIG_SOFTMMU_GATE definition was never used, remove it. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240313213339.82071-2-philmd@linaro.org>
2024-04-02Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into stagingPeter Maydell
trivial patches for 2024-04-02 # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEe3O61ovnosKJMUsicBtPaxppPlkFAmYL4EQPHG1qdEB0bHMu # bXNrLnJ1AAoJEHAbT2saaT5ZyhIH/1sz3OeyczgPeMsICXpCnkQps8cDKuzUMkHA # BHZGQ9AvFNZVw0YzgY+h1u2zPnsN0WNpWuxe8dbZODHcBjeJVZ5yOyJ6TWVVuKDn # 6TzOfhGOeaUthNphpfZaM1q7fJfwU8zW3/pe6OCsD92Czxb8Eao3T4ONzVNZVXU9 # 3KPXPD9weWnY/sozXDqPFJmwn0LDL5o6IhPz+Ypp5xFrOTC+5+C/UmgTGIsuKTcO # kQ96gVwCr3tm1YeJtEGfNOar/lt75jHHV2wbizaz2Jpwv9GHwtHXJOtQ38fIYxlm # UPZ+L982SjfgaIHLCGOtLYJWSXsK5xI31HDSK1ZIiJquocZE1jU= # =ZGw+ # -----END PGP SIGNATURE----- # gpg: Signature made Tue 02 Apr 2024 11:39:00 BST # gpg: using RSA key 7B73BAD68BE7A2C289314B22701B4F6B1A693E59 # gpg: issuer "mjt@tls.msk.ru" # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" [full] # gpg: aka "Michael Tokarev <mjt@corpit.ru>" [full] # gpg: aka "Michael Tokarev <mjt@debian.org>" [full] # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu: hmp: Add help information for watchdog action: inject-nmi Fix some typos in documentation (found by codespell) fpu/softfloat: Remove mention of TILE-Gx target usb-audio: Fix invalid values in AudioControl descriptors Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-04-02hmp: Add help information for watchdog action: inject-nmiDayu Liu
virsh qemu-monitor-command --hmp help information of watchdog_action missing inject-nmi which already supported in Commit 795dc6e4 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2247 Signed-off-by: Dayu Liu <liu.dayu@zte.com.cn> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> [Mjt: decode and word-wrap commit message and add Resolves: tag]
2024-04-02Fix some typos in documentation (found by codespell)Stefan Weil
Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-04-02Merge tag 'pull-target-arm-20240402' of ↵Peter Maydell
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * take HSTR traps of cp15 accesses to EL2, not EL1 * docs: sbsa: update specs, add dt note * hw/intc/arm_gicv3: ICC_HPPIR* return SPURIOUS if int group is disabled * tests/qtest: Fix STM32L4x5 GPIO test on 32-bit * raspi4b: Reduce RAM to 1Gb on 32-bit hosts # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmYL3J8ZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3lL9D/9ayKF76MKs+oK8+uHTOLPb # Mk71K1apgFnkzC7v9xuI76M6SzZpcKslUbieucDhkDLdVuZvlV3eUcwQGbNWu9fx # PCkx7RmD54o+nlGxacZx4wGDfgu9j3maCVik048WxNoHb03NPahfHIb/GFRyHgt/ # TTjeqfAX7GDbHzMiGuaEJi5dLuAP0/imLt7pooJv4JRDX3CMY+tzlclU4ySMBr+S # 0fs5oi6kZMayM8iolpSrPDQy/N3jZJpd5pNPPIcsnL5DEJHKodHbD11+Zetb1tQ7 # Tyw+x+hUb8Yx2WADVBaihYnbvakUVLt7ZzdgDENV534O/1Vmabzt14CBGTwq4faQ # 8Hbc4e/ulhsOUlaxCDKTCuCKDW7sub7UelSz7mX6dAwcjvEi/L99dkP1wSpl0W04 # 3uTQyjDrfCOVNJ/FMYLRp5VkjwUVacbs3u3Tpe2bgRMI+hxnKZjtIMIY09q3l7em # JrPOsiiJlVzngcQko1K0cor3p5W43HIhLUlh0RqJL/CsVhXFfHShAJowK31vGnNp # ITklT5CWKMmogHTJycQieemhwwKaALgCUBC9TrcD1dTJe/GksYXVg6Fit7IJttBI # zsPMM21Namtr1tKsV71xgtpDrkiWZkeFRpo/GrEf50bX1Mx7Dc8D/ons2RS0G2vo # S13Dyt6GBtzS9M8rKX2fsQ== # =rYVb # -----END PGP SIGNATURE----- # gpg: Signature made Tue 02 Apr 2024 11:23:27 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20240402' of https://git.linaro.org/people/pmaydell/qemu-arm: raspi4b: Reduce RAM to 1Gb on 32-bit hosts tests/qtest: Fix STM32L4x5 GPIO test on 32-bit hw/intc/arm_gicv3: ICC_HPPIR* return SPURIOUS if int group is disabled docs: sbsa: update specs, add dt note target/arm: take HSTR traps of cp15 accesses to EL2, not EL1 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-04-02raspi4b: Reduce RAM to 1Gb on 32-bit hostsCédric Le Goater
Change the board revision number and RAM size to 1Gb on 32-bit hosts. On these systems, RAM has a 2047 MB limit and this breaks the tests. Fixes: 7785e8ea2204 ("hw/arm: Introduce Raspberry PI 4 machine") Signed-off-by: Cédric Le Goater <clg@redhat.com> Message-id: 20240329150155.357043-1-clg@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-04-02tests/qtest: Fix STM32L4x5 GPIO test on 32-bitCédric Le Goater
The test mangles the GPIO address and the pin number in the qtest_add_data_func data parameter. Doing so, it assumes that the host pointer size is always 64-bit, which breaks on 32-bit : ../tests/qtest/stm32l4x5_gpio-test.c: In function ‘test_gpio_output_mode’: ../tests/qtest/stm32l4x5_gpio-test.c:272:25: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast] 272 | unsigned int pin = ((uint64_t)data) & 0xF; | ^ ../tests/qtest/stm32l4x5_gpio-test.c:273:22: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast] 273 | uint32_t gpio = ((uint64_t)data) >> 32; | ^ To fix, improve the mangling of the GPIO address and pin number fields by using GPIO_SIZE so that the resulting value fits in a 32-bit pointer. While at it, include some helpers to hide the details. Cc: Arnaud Minier <arnaud.minier@telecom-paris.fr> Cc: Inès Varhol <ines.varhol@telecom-paris.fr> Signed-off-by: Cédric Le Goater <clg@redhat.com> Message-id: 20240329092747.298259-1-clg@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-04-02hw/intc/arm_gicv3: ICC_HPPIR* return SPURIOUS if int group is disabledPeter Maydell
If the group of the highest priority pending interrupt is disabled via ICC_IGRPEN*, the ICC_HPPIR* registers should return INTID_SPURIOUS, not the interrupt ID. (See the GIC architecture specification pseudocode functions ICC_HPPIR1_EL1[] and HighestPriorityPendingInterrupt().) Make HPPIR reads honour the group disable, the way we already do when determining whether to preempt in icc_hppi_can_preempt(). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240328153333.2522667-1-peter.maydell@linaro.org
2024-04-02docs: sbsa: update specs, add dt noteMarcin Juszkiewicz
Hardware of sbsa-ref board is nowadays defined by both BSA and SBSA specifications. Then BBR defines firmware interface. Added note about DeviceTree data passed from QEMU to firmware. It is very minimal and provides only data we use in firmware. Added NUMA information to list of things reported by DeviceTree. Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> Message-id: 20240328163851.1386176-1-marcin.juszkiewicz@linaro.org Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-04-02target/arm: take HSTR traps of cp15 accesses to EL2, not EL1Peter Maydell
The HSTR_EL2 register allows the hypervisor to trap AArch32 EL1 and EL0 accesses to cp15 registers. We incorrectly implemented this so they trap to EL1 when we detect the need for a HSTR trap at code generation time. (The check in access_check_cp_reg() which we do at runtime to catch traps from EL0 is correctly routing them to EL2.) Use the correct target EL when generating the code to take the trap. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2226 Fixes: 049edada5e93df ("target/arm: Make HSTR_EL2 traps take priority over UNDEF-at-EL1") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240325133116.2075362-1-peter.maydell@linaro.org
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-14 18:10:26 +0000