aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2022-09-27e1000e: set RX desc status with DD flag in a separate operationDing Hui
Like commit 034d00d48581 ("e1000: set RX descriptor status in a separate operation"), there is also same issue in e1000e, which would cause lost packets or stop sending packets to VM with DPDK. Do similar fix in e1000e. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/402 Signed-off-by: Ding Hui <dinghui@sangfor.com.cn> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-27virtio-gpu: update scanout if there is any area covered by the rectDongwon Kim
The scanout is currently updated only if the whole rect is inside the scanout space. This is not a correct condition because the scanout should be updated even a small area in the scanout space is covered by the rect. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220909014052.7297-1-dongwon.kim@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638)Philippe Mathieu-Daudé
When building QEMU with DEBUG_ATI defined then running with '-device ati-vga,romfile="" -d unimp,guest_errors -trace ati\*' we get: ati_mm_write 4 0x16c0 DP_CNTL <- 0x1 ati_mm_write 4 0x146c DP_GUI_MASTER_CNTL <- 0x2 ati_mm_write 4 0x16c8 DP_MIX <- 0xff0000 ati_mm_write 4 0x16c4 DP_DATATYPE <- 0x2 ati_mm_write 4 0x224 CRTC_OFFSET <- 0x0 ati_mm_write 4 0x142c DST_PITCH_OFFSET <- 0xfe00000 ati_mm_write 4 0x1420 DST_Y <- 0x3fff ati_mm_write 4 0x1410 DST_HEIGHT <- 0x3fff ati_mm_write 4 0x1588 DST_WIDTH_X <- 0x3fff3fff ati_2d_blt: vram:0x7fff5fa00000 addr:0 ds:0x7fff61273800 stride:2560 bpp:32 rop:0xff ati_2d_blt: 0 0 0, 0 127 0, (0,0) -> (16383,16383) 16383x16383 > ^ ati_2d_blt: pixman_fill(dst:0x7fff5fa00000, stride:254, bpp:8, x:16383, y:16383, w:16383, h:16383, xor:0xff000000) Thread 3 "qemu-system-i38" received signal SIGSEGV, Segmentation fault. (gdb) bt #0 0x00007ffff7f62ce0 in sse2_fill.lto_priv () at /lib64/libpixman-1.so.0 #1 0x00007ffff7f09278 in pixman_fill () at /lib64/libpixman-1.so.0 #2 0x0000555557b5a9af in ati_2d_blt (s=0x631000028800) at hw/display/ati_2d.c:196 #3 0x0000555557b4b5a2 in ati_mm_write (opaque=0x631000028800, addr=5512, data=1073692671, size=4) at hw/display/ati.c:843 #4 0x0000555558b90ec4 in memory_region_write_accessor (mr=0x631000039cc0, addr=5512, ..., size=4, ...) at softmmu/memory.c:492 Commit 584acf34cb0 ("ati-vga: Fix reverse bit blts") introduced the local dst_x and dst_y which adjust the (x, y) coordinates depending on the direction in the SRCCOPY ROP3 operation, but forgot to address the same issue for the PATCOPY, BLACKNESS and WHITENESS operations, which also call pixman_fill(). Fix that now by using the adjusted coordinates in the pixman_fill call, and update the related debug printf(). Reported-by: Qiang Liu <qiangliu@zju.edu.cn> Fixes: 584acf34cb0 ("ati-vga: Fix reverse bit blts") Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Mauro Matteo Cascella <mcascell@redhat.com> Message-Id: <20210906153103.1661195-1-philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27usbnet: Report link-up via interrupt endpoint in CDC-ECM modeMichael Brown
Signed-off-by: Michael Brown <mcb30@ipxe.org> Message-Id: <20220906183053.3625472-5-mcb30@ipxe.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27usbnet: Detect short packets as sent by the xHCI controllerMichael Brown
The xHCI controller will ignore the endpoint MTU and so may deliver packets of any length. Detect short packets as being any packet that has a length of zero or a length that is not a multiple of the MTU. Signed-off-by: Michael Brown <mcb30@ipxe.org> Message-Id: <20220906183053.3625472-4-mcb30@ipxe.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27usbnet: Accept mandatory USB_CDC_SET_ETHERNET_PACKET_FILTER requestMichael Brown
The USB_CDC_SET_ETHERNET_PACKET_FILTER request is mandatory for CDC-ECM devices. Accept this request, ignoring the actual filter value (to match the existing behaviour for RNDIS). Signed-off-by: Michael Brown <mcb30@ipxe.org> Message-Id: <20220906183053.3625472-3-mcb30@ipxe.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27usbnet: Add missing usb_wakeup() call in usbnet_receive()Michael Brown
usbnet_receive() does not currently wake up the USB endpoint, leading to a dead RX datapath when used with a host controller such as xHCI that relies on being woken up. Fix by adding a call to usb_wakeup() at the end of usbnet_receive(). Signed-off-by: Michael Brown <mcb30@ipxe.org> Message-Id: <20220906183053.3625472-2-mcb30@ipxe.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27hcd-xhci: drop operation with secondary stream arrays enabledQiang Liu
The abort() in xhci_find_stream() can be triggered via enabling the secondary stream arrays by setting linear stream array (LSA) bit (in endpoint context) to 0. We may show warnings and drop this operation. Fixes: 024426acc0a2 ("usb-xhci: usb3 streams") Reported-by: Qiang Liu <cyruscyliu@gmail.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1192 Signed-off-by: Qiang Liu <cyruscyliu@gmail.com> Message-Id: <20220904125926.2141607-1-cyruscyliu@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27usb/msd: add usb_msd_fatal_error() and fix guest-triggerable assertGerd Hoffmann
Add handler for fatal errors. Moves device into error state where it stops responding until the guest resets it. Guest can send illegal requests where scsi command and usb packet transfer directions are inconsistent. Use the new usb_msd_fatal_error() function instead of assert() in that case. Reported-by: Qiang Liu <cyruscyliu@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Qiang Liu <cyruscyliu@gmail.com> Message-Id: <20220830063827.813053-3-kraxel@redhat.com>
2022-09-27usb/msd: move usb_msd_packet_complete()Gerd Hoffmann
Change ordering to avoid adding forward declarations in following patches. Fix comment code style while being at it. No functional change. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20220830063827.813053-2-kraxel@redhat.com>
2022-09-26m68k: align bootinfo strings and data to 4 bytesJason A. Donenfeld
Various tools, such as kexec-tools and m68k-bootinfo, expect each bootinfo entry to be aligned to 4 bytes, not 2 bytes. So adjust the padding to fill this out as such. Also, break apart the padding additions from the other field length additions, so that it's more clear why these magic numbers are being added, and comment them too. Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20220926113900.1256630-2-Jason@zx2c4.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-09-27hw/riscv: opentitan: Expose the resetvec as a SoC propertyAlistair Francis
On the OpenTitan hardware the resetvec is fixed at the start of ROM. In QEMU we don't run the ROM code and instead just jump to the next stage. This means we need to be a little more flexible about what the resetvec is. This patch allows us to set the resetvec from the command line with something like this: -global driver=riscv.lowrisc.ibex.soc,property=resetvec,value=0x20000400 This way as the next stage changes we can update the resetvec. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220914101108.82571-4-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27hw/riscv: opentitan: Fixup resetvecAlistair Francis
The resetvec for the OpenTitan machine ended up being set to an out of date value, so let's fix that and bump it to the correct start address (after the boot ROM) Fixes: bf8803c64d75 "hw/riscv: opentitan: bump opentitan version" Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20220914101108.82571-3-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27hw/ssi: ibex_spi: update reg addrWilfred Mallawa
Updates the `EVENT_ENABLE` register to offset `0x34` as per OpenTitan spec [1]. [1] https://docs.opentitan.org/hw/ip/spi_host/doc/#Reg_event_enable Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20220823061201.132342-5-wilfred.mallawa@opensource.wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27hw/ssi: ibex_spi: fixup typos in ibex_spi_hostWilfred Mallawa
This patch fixes up minor typos in ibex_spi_host Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Andrew Jones <ajones@ventanamicro.com> Message-Id: <20220823061201.132342-2-wilfred.mallawa@opensource.wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-26Merge tag 'pull-target-arm-20220922' of ↵Stefan Hajnoczi
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * hw/net/can: fix Xilinx ZynqMP CAN RX FIFO logic * Fix alignment for Neon VLD4.32 * Refactoring of page-table-walk code * hw/acpi: Add ospm_status hook implementation for acpi-ged * hw/net/lan9118: Signal TSFL_INT flag when TX FIFO reaches specified level * chardev/baum: avoid variable-length arrays * io/channel-websock: avoid variable-length arrays * hw/net/e1000e_core: Use definition to avoid dynamic stack allocation * hw/ppc/pnv: Avoid dynamic stack allocation * hw/intc/xics: Avoid dynamic stack allocation * hw/i386/multiboot: Avoid dynamic stack allocation * hw/usb/hcd-ohci: Use definition to avoid dynamic stack allocation * ui/curses: Avoid dynamic stack allocation * tests/unit/test-vmstate: Avoid dynamic stack allocation * configure: fix various shellcheck-spotted issues and nits # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmMsjocZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3s0vEACuUs7nGGX5vd96EPN+sO5s # HstP16G6/Xnlw2z0BaXi0MMWapQRhSQJ+MIeDJmqIyZKQ3geJGP7pbFTxI3zreYM # UTKjdI/wWRYMKPYfxlIBZ8TPugj4a4paFJlyqmpHXtkwiWRv6rF70HQ9Yku5id93 # FN9js/dyF74S2AaDppBuTWp31cM1k6kBTg/v5tXSxE8kDUKkO+HZ1VujOqIG/4nJ # 6urNJ7jlHSiFdXya2QiR+CAkyXyy551rLETeO8VJg9tOO7Ys7Olj7lqv6kHJY/X1 # 01RbN5A5WXhqCvTLM3UYTvFHmbZtS/C5iUhHRtlZkOoeSv2jS6IRDB8BrBtIbOwF # XKpaYf1jyFLFwX++hpvySD9Vbcu8KgKId8iKTuDcxjQlEjL3fTbt1ulKo4y+rJ8O # 6G1k4yZc8/nAvttNoKCn7/Jr1dC+HsANa+1s1L+6w+f1gARV0VXs4gqsveNnbe1+ # WzzaHvHt+hCaiWkSZlyisyw3fbEXMrEyKewi+SZu3c8PvJ6DHa+rYjkhem7muBVF # iR48FRTjFiS+o402KMwXfMdiGjXyZFi09yn5diowlVjkNAaZVZfgu/wUMD5QBhbh # fNDSw7LpXGUHML/O98MiXznkgGvTEQNxZdp2qIQrTiinUgmV4ZRLR23ZpEibdJPX # kiOkr46SbWvksCXnRlTf8w== # =hec8 # -----END PGP SIGNATURE----- # gpg: Signature made Thu 22 Sep 2022 12:34:15 EDT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20220922' of https://git.linaro.org/people/pmaydell/qemu-arm: (39 commits) configure: Avoid use of 'local' as it is non-POSIX configure: Check mkdir result directly, not via $? configure: Remove use of backtick `...` syntax configure: Add './' on front of glob of */config-devices.mak.d configure: Add missing quoting for some easy cases configure: Remove unused meson_args variable configure: Remove unused python_version variable tests/unit/test-vmstate: Avoid dynamic stack allocation ui/curses: Avoid dynamic stack allocation hw/usb/hcd-ohci: Use definition to avoid dynamic stack allocation hw/i386/multiboot: Avoid dynamic stack allocation hw/intc/xics: Avoid dynamic stack allocation hw/ppc/pnv: Avoid dynamic stack allocation hw/net/e1000e_core: Use definition to avoid dynamic stack allocation io/channel-websock: Replace strlen(const_str) by sizeof(const_str) - 1 chardev/baum: Avoid dynamic stack allocation chardev/baum: Use definitions to avoid dynamic stack allocation chardev/baum: Replace magic values by X_MAX / Y_MAX definitions hw/net/lan9118: Signal TSFL_INT flag when TX FIFO reaches specified level hw/acpi: Add ospm_status hook implementation for acpi-ged ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-26s390x/s390-virtio-ccw: add zpcii-disable machine propertyMatthew Rosato
The zpcii-disable machine property can be used to force-disable the use of zPCI interpretation facilities for a VM. By default, this setting will be off for machine 7.2 and newer. Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Message-Id: <20220902172737.170349-9-mjrosato@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> [thuth: Fix contextual conflict in ccw_machine_7_1_instance_options()] Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-09-26s390x/pci: reflect proper maxstbl for groups of interpreted devicesMatthew Rosato
The maximum supported store block length might be different depending on whether the instruction is interpretively executed (firmware-reported maximum) or handled via userspace intercept (host kernel API maximum). Choose the best available value during group creation. Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Pierre Morel <pmorel@linux.ibm.com> Message-Id: <20220902172737.170349-8-mjrosato@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-09-26s390x/pci: let intercept devices have separate PCI groupsMatthew Rosato
Let's use the reserved pool of simulated PCI groups to allow intercept devices to have separate groups from interpreted devices as some group values may be different. If we run out of simulated PCI groups, subsequent intercept devices just get the default group. Furthermore, if we encounter any PCI groups from hostdevs that are marked as simulated, let's just assign them to the default group to avoid conflicts between host simulated groups and our own simulated groups. Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Pierre Morel <pmorel@linux.ibm.com> Message-Id: <20220902172737.170349-7-mjrosato@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-09-26s390x/pci: enable adapter event notification for interpreted devicesMatthew Rosato
Use the associated kvm ioctl operation to enable adapter event notification and forwarding for devices when requested. This feature will be set up with or without firmware assist based upon the 'forwarding_assist' setting. Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Message-Id: <20220902172737.170349-6-mjrosato@linux.ibm.com> [thuth: Rename "forwarding_assist" property to "forwarding-assist"] Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-09-26s390x/pci: don't fence interpreted devices without MSI-XMatthew Rosato
Lack of MSI-X support is not an issue for interpreted passthrough devices, so let's let these in. This will allow, for example, ISM devices to be passed through -- but only when interpretation is available and being used. Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Pierre Morel <pmorel@linux.ibm.com> Message-Id: <20220902172737.170349-5-mjrosato@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-09-26s390x/pci: enable for load/store interpretationMatthew Rosato
If the ZPCI_OP ioctl reports that is is available and usable, then the underlying KVM host will enable load/store intepretation for any guest device without a SHM bit in the guest function handle. For a device that will be using interpretation support, ensure the guest function handle matches the host function handle; this value is re-checked every time the guest issues a SET PCI FN to enable the guest device as it is the only opportunity to reflect function handle changes. By default, unless interpret=off is specified, interpretation support will always be assumed and exploited if the necessary ioctl and features are available on the host kernel. When these are unavailable, we will silently revert to the interception model; this allows existing guest configurations to work unmodified on hosts with and without zPCI interpretation support, allowing QEMU to choose the best support model available. Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Acked-by: Thomas Huth <thuth@redhat.com> Message-Id: <20220902172737.170349-4-mjrosato@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-09-26s390x/pci: add routine to get host function handle from CLP infoMatthew Rosato
In order to interface with the underlying host zPCI device, we need to know its function handle. Add a routine to grab this from the vfio CLP capabilities chain. Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Pierre Morel <pmorel@linux.ibm.com> Message-Id: <20220902172737.170349-3-mjrosato@linux.ibm.com> [thuth: Replace free(info) with g_free(info)] Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-09-23target/s390x: support SHA-512 extensionsJason A. Donenfeld
In order to fully support MSA_EXT_5, we have to support the SHA-512 special instructions. So implement those. The implementation began as something TweetNacl-like, and then was adjusted to be useful here. It's not very beautiful, but it is quite short and compact, which is what we're going for. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> [ restructure, add missing exception, add comments, fixup CPU model ] Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20220922153820.221811-1-david@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-09-23hcd-ohci: Drop ohci_service_iso_td() if ed->head & OHCI_DPTR_MASK is zeroQiang Liu
An abort happens in ohci_frame_boundary() when ohci->done is 0 [1]. ``` c static void ohci_frame_boundary(void *opaque) { // ... if (ohci->done_count == 0 && !(ohci->intr_status & OHCI_INTR_WD)) { if (!ohci->done) abort(); <----------------------------------------- [1] ``` This was reported in https://bugs.launchpad.net/qemu/+bug/1911216/, https://lists.gnu.org/archive/html/qemu-devel/2021-06/msg03613.html, and https://gitlab.com/qemu-project/qemu/-/issues/545. I can still reproduce it with the latest QEMU. This happends due to crafted ED with putting ISO_TD at physical address 0. Suppose ed->head & OHCI_DPTR_MASK is 0 [2], and we memset 0 to the phyiscal memory from 0 to sizeof(ohci_iso_td). Then, starting_frame [3] and frame_count [4] are both 0. As we can control the value of ohci->frame_number (0 to 0x1f, suppose 1), we then control the value of relative_frame_number to be 1 [6]. The control flow goes to [7] where ohci->done is 0. Have returned from ohci_service_iso_td(), ohci_frame_boundary() will abort() [1]. ``` c static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed) { // ... addr = ed->head & OHCI_DPTR_MASK; // <--------------------- [2] if (ohci_read_iso_td(ohci, addr, &iso_td)) { // <-------- [3] // ... starting_frame = OHCI_BM(iso_td.flags, TD_SF); // <-------- [4] frame_count = OHCI_BM(iso_td.flags, TD_FC); // <-------- [5] relative_frame_number = USUB(ohci->frame_number, starting_frame); // <-------- [6] if (relative_frame_number < 0) { return 1; } else if (relative_frame_number > frame_count) { // ... ohci->done = addr; // <-------- [7] // ... } ``` As only (afaik) a guest root user can manipulate ED, TD and the physical memory, this assertion failure is not a security bug. The idea to fix this issue is to drop ohci_service_iso_td() if ed->head & OHCI_DPTR_MASK is 0, which is similar to the drop operation for ohci_service_ed_list() when head is 0. Probably, a similar issue is in ohci_service_td(). I drop ohci_service_td() if ed->head & OHCI_DPTR_MASK is 0. Fixes: 7bfe577702 ("OHCI USB isochronous transfers support (Arnon Gilboa)") Reported-by: Gaoning Pan <pgn@zju.edu.cn> Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Qiang Liu <cyruscyliu@gmail.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/545 Buglink: https://lists.gnu.org/archive/html/qemu-devel/2021-06/msg03613.html Buglink: https://bugs.launchpad.net/qemu/+bug/1911216 Signed-off-by: Qiang Liu <cyruscyliu@gmail.com> Message-Id: <20220826051557.119570-1-cyruscyliu@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-23hw/usb/hcd-xhci: Check whether DMA accesses failThomas Huth
If a guest sets up bad descriptors, it could force QEMU to access non-existing memory regions. Thus we should check the return value of dma_memory_read/write() to make sure that these errors don't go unnoticed. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20220817160016.49752-1-thuth@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-22Merge tag 'edgar/xilinx-next-2022-09-21.for-upstream' of ↵Stefan Hajnoczi
https://github.com/edgarigl/qemu into staging Xilinx queue # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEErET+3BT38evtv0FRKcWWeA9ryoMFAmMraeQACgkQKcWWeA9r # yoOUUwgAz/GPBURkdzYcFbOa4VEBrCaJxCu2WvyBdj6kjEgw/ZmdXbDHfeKTr2Rl # 8mo7UWugfj1KTMqo5Tmte6+3EeNcuB9qA/flKj7wfKwLX1S0V6EFNGJn8sdNe+1r # c6fYm0bUBk9FKauUT4t3U1Zl9SGJ2Pwa8JvztVgBvvZG6G+J0bkVmw2mMXb3jaaV # skzmBuvDT0G8JkxWnpEXwznrPSHSjivqawVlBfjC5JmCjZ16bz05okju+cckfzTJ # 0VF7/27MWfVCpMtWjRSA6p+3gwLziz7xOhPe9excSVsDyAs4WdcuI+/42/MBBUIn # rlg7pNIslI9r8eP5Jyk6LcSmBsPDMA== # =GZsl # -----END PGP SIGNATURE----- # gpg: Signature made Wed 21 Sep 2022 15:45:40 EDT # gpg: using RSA key AC44FEDC14F7F1EBEDBF415129C596780F6BCA83 # gpg: Good signature from "Edgar E. Iglesias (Xilinx key) <edgar.iglesias@xilinx.com>" [unknown] # gpg: aka "Edgar E. Iglesias <edgar.iglesias@gmail.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: AC44 FEDC 14F7 F1EB EDBF 4151 29C5 9678 0F6B CA83 * tag 'edgar/xilinx-next-2022-09-21.for-upstream' of https://github.com/edgarigl/qemu: hw/microblaze: pass random seed to fdt Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-22hw/usb/hcd-ohci: Use definition to avoid dynamic stack allocationPhilippe Mathieu-Daudé
The compiler isn't clever enough to figure 'width' is a constant, so help it by using a definitions instead. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20220819153931.3147384-10-peter.maydell@linaro.org
2022-09-22hw/i386/multiboot: Avoid dynamic stack allocationPhilippe Mathieu-Daudé
Use autofree heap allocation instead of variable-length array on the stack. Replace the snprintf() call by g_strdup_printf(). Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20220819153931.3147384-9-peter.maydell@linaro.org
2022-09-22hw/intc/xics: Avoid dynamic stack allocationPhilippe Mathieu-Daudé
Use autofree heap allocation instead of variable-length array on the stack. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20220819153931.3147384-8-peter.maydell@linaro.org
2022-09-22hw/ppc/pnv: Avoid dynamic stack allocationPhilippe Mathieu-Daudé
Use autofree heap allocation instead of variable-length array on the stack. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-id: 20220819153931.3147384-7-peter.maydell@linaro.org
2022-09-22hw/net/e1000e_core: Use definition to avoid dynamic stack allocationPhilippe Mathieu-Daudé
The compiler isn't clever enough to figure 'min_buf_size' is a constant, so help it by using a definitions instead. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20220819153931.3147384-6-peter.maydell@linaro.org
2022-09-22hw/net/lan9118: Signal TSFL_INT flag when TX FIFO reaches specified levelLucas Dietrich
The LAN9118 allows the guest to specify a level for both the TX and RX FIFOs at which an interrupt will be generated. We implement the RSFL_INT interrupt for the RX FIFO but are missing the handling of the equivalent TSFL_INT for the TX FIFO. Add the missing test to set the interrupt if the TX FIFO has exceeded the guest-specified level. This flag is required for Micrium lan911x ethernet driver to work. Signed-off-by: Lucas Dietrich <ld.adecy@gmail.com> [PMM: Tweaked commit message and comment] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-09-22hw/acpi: Add ospm_status hook implementation for acpi-gedKeqian Zhu
Setup an ARM virtual machine of machine virt and execute qmp "query-acpi-ospm-status" causes segmentation fault with following dumpstack: #1 0x0000aaaaab64235c in qmp_query_acpi_ospm_status (errp=errp@entry=0xfffffffff030) at ../monitor/qmp-cmds.c:312 #2 0x0000aaaaabfc4e20 in qmp_marshal_query_acpi_ospm_status (args=<optimized out>, ret=0xffffea4ffe90, errp=0xffffea4ffe88) at qapi/qapi-commands-acpi.c:63 #3 0x0000aaaaabff8ba0 in do_qmp_dispatch_bh (opaque=0xffffea4ffe98) at ../qapi/qmp-dispatch.c:128 #4 0x0000aaaaac02e594 in aio_bh_call (bh=0xffffe0004d80) at ../util/async.c:150 #5 aio_bh_poll (ctx=ctx@entry=0xaaaaad0f6040) at ../util/async.c:178 #6 0x0000aaaaac00bd40 in aio_dispatch (ctx=ctx@entry=0xaaaaad0f6040) at ../util/aio-posix.c:421 #7 0x0000aaaaac02e010 in aio_ctx_dispatch (source=0xaaaaad0f6040, callback=<optimized out>, user_data=<optimized out>) at ../util/async.c:320 #8 0x0000fffff76f6884 in g_main_context_dispatch () at /usr/lib64/libglib-2.0.so.0 #9 0x0000aaaaac0452d4 in glib_pollfds_poll () at ../util/main-loop.c:297 #10 os_host_main_loop_wait (timeout=0) at ../util/main-loop.c:320 #11 main_loop_wait (nonblocking=nonblocking@entry=0) at ../util/main-loop.c:596 #12 0x0000aaaaab5c9e50 in qemu_main_loop () at ../softmmu/runstate.c:734 #13 0x0000aaaaab185370 in qemu_main (argc=argc@entry=47, argv=argv@entry=0xfffffffff518, envp=envp@entry=0x0) at ../softmmu/main.c:38 #14 0x0000aaaaab16f99c in main (argc=47, argv=0xfffffffff518) at ../softmmu/main.c:47 Fixes: ebb62075021a ("hw/acpi: Add ACPI Generic Event Device Support") Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-id: 20220816094957.31700-1-zhukeqian1@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-09-22hw/net/can: fix Xilinx ZynqMP CAN RX FIFO logicAnton Kochkov
For consistency, function "update_rx_fifo()" should use the RX FIFO register field names, not the TX FIFO ones, even if they refer to the same bit positions in the register. Signed-off-by: Anton Kochkov <anton.kochkov@proton.me> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-id: 20220817141754.2105981-1-anton.kochkov@proton.me Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1123 [PMM: tweaked commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-09-21hw/microblaze: pass random seed to fdtJason A. Donenfeld
If the FDT contains /chosen/rng-seed, then the Linux RNG will use it to initialize early. Set this using the usual guest random number generation function. This FDT node is part of the DT specification. Reviewed-by: Edgar E. Iglesias <edgar.iglesias@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
2022-09-21Merge tag 'pull-ppc-20220920' of https://gitlab.com/danielhb/qemu into stagingStefan Hajnoczi
ppc patch queue for 2022-09-20: This queue contains a implementation of PowerISA 3.1B hash insns, ppc TCG insns cleanups and fixes, and miscellaneus fixes in the spapr and pnv_phb models. # -----BEGIN PGP SIGNATURE----- # # iHUEABYKAB0WIQQX6/+ZI9AYAK8oOBk82cqW3gMxZAUCYyoWlAAKCRA82cqW3gMx # ZDYhAP0eQMeA4NS3hiw7WMcAVg0pei3ZJL9oEh1UE3+MfK7MhQEA0q8qExWnQJAA # a0hfnFH9pLjI+v0f/FbFK6QJBpu/bg8= # =qT+H # -----END PGP SIGNATURE----- # gpg: Signature made Tue 20 Sep 2022 15:37:56 EDT # gpg: using EDDSA key 17EBFF9923D01800AF2838193CD9CA96DE033164 # gpg: Good signature from "Daniel Henrique Barboza <danielhb413@gmail.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 17EB FF99 23D0 1800 AF28 3819 3CD9 CA96 DE03 3164 * tag 'pull-ppc-20220920' of https://gitlab.com/danielhb/qemu: hw/ppc/spapr: Fix code style problems reported by checkpatch hw/pci-host: pnv_phb{3, 4}: Fix heap out-of-bound access failure hw/ppc: spapr: Use qemu_vfree() to free spapr->htab target/ppc: Clear fpstatus flags on helpers missing it target/ppc: Zero second doubleword of VSR registers for FPR insns target/ppc: Set OV32 when OV is set target/ppc: Zero second doubleword for VSX madd instructions target/ppc: Set result to QNaN for DENBCD when VXCVI occurs target/ppc: Zero second doubleword in DFP instructions target/ppc: Remove unused xer_* macros target/ppc: Remove extra space from s128 field in ppc_vsr_t target/ppc: Merge fsqrt and fsqrts helpers target/ppc: Move fsqrts to decodetree target/ppc: Move fsqrt to decodetree target/ppc: Implement hashstp and hashchkp target/ppc: Implement hashst and hashchk target/ppc: Add HASHKEYR and HASHPKEYR SPRs Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-20Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingStefan Hajnoczi
* add help option for -audio and -audiodev * another missing memory barrier for dirty pages * target/i386: Raise #GP on unaligned m128 accesses * coverity fixes + improvements to components * add MMX and 3DNow! tests * SSE4a fixes * target/i386: TCG translation cleanups * update qboot submodule # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmMocZcUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroNV7Qf+NEoB8R0ug+ClMRe1Qqt8FXEd0eXE # nT19q4rOWfmW4/L+wI6gpxhbxrxOuLwoZ8YvD8c6rQAdexMoHoeTvA1PAca4zZTo # ISmW3bXsoHN2uGLPz4CKhjKBLCANtDkh3EWCwRFkLSRCLSRDhKPrG1Ue3fOgQ6GO # riROcxbyYzvU/4uefSW+xG/Im9gftNF6occZZ59LrK7Xd8kwlb+E+EdsmzFw5f8O # Q9irVQ8pX9ZM4BK2KiT16nZ0uSRwJqSJKbLI670nUEsj1jQCIgU3srgZHjAIvoir # yivDs6oktgS/HkPD5CQoTX+fVDgEDM1TTF6P8r7uJopPXpzz+AHswfSJmg== # =RVCS # -----END PGP SIGNATURE----- # gpg: Signature made Mon 19 Sep 2022 09:41:43 EDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (21 commits) qboot: update to latest submodule build: remove extra parentheses causing missing rebuilds target/i386: introduce insn_get_addr target/i386: REPZ and REPNZ are mutually exclusive target/i386: fix INSERTQ implementation target/i386: correctly mask SSE4a bit indices in register operands audio: add help option for -audio and -audiodev tests/tcg: remove old SSE tests tests/tcg: refine MMX support in SSE tests tests/tcg: i386: add MMX and 3DNow! tests tests/tcg: i386: fix typos in 3DNow! instructions tests: unit: add NULL-pointer check tests: test-qga: close socket on failure to connect tests: unit: simplify test-visitor-serialization list tests smbios: sanitize type from external type before checking have_fields_bitmap coverity: put NUBus under m68k component coverity: add new RISC-V component spapr_pci: fix leak in spapr_phb_vfio_get_loc_code kvm: fix memory leak on failure to read stats descriptors target/i386: Raise #GP on unaligned m128 accesses when required. ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-20hw/pci-host: pnv_phb{3, 4}: Fix heap out-of-bound access failureXuzhou Cheng
pnv_phb3_root_bus_info and pnv_phb4_root_bus_info are missing the instance_size initialization. This results in accessing out-of-bound memory when setting 'chip-id' and 'phb-id', and eventually crashes glib's malloc functionality with the following message: "qemu-system-ppc64: GLib: ../glib-2.72.3/glib/gmem.c:131: failed to allocate 3232 bytes" This issue was noticed only when running qtests with QEMU Windows 32-bit executable. Windows 64-bit, Linux 32/64-bit do not expose this bug though. Fixes: 9ae1329ee2fe ("ppc/pnv: Add models for POWER8 PHB3 PCIe Host bridge") Fixes: 4f9924c4d4cf ("ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge") Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Xuzhou Cheng <xuzhou.cheng@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20220920103159.1865256-29-bmeng.cn@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2022-09-20hw/ppc: spapr: Use qemu_vfree() to free spapr->htabXuzhou Cheng
spapr->htab is allocated by qemu_memalign(), hence we should use qemu_vfree() to free it. Fixes: c5f54f3e31bf ("pseries: Move hash page table allocation to reset time") Fixes: b4db54132ffe ("target/ppc: Implement H_REGISTER_PROCESS_TABLE H_CALL"") Signed-off-by: Xuzhou Cheng <xuzhou.cheng@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220920103159.1865256-28-bmeng.cn@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2022-09-20hw/loongarch: Improve acpi dsdt tableXiaojuan Yang
Cleanup the previous pci information in acpi dsdt table. And using the common acpi_dsdt_add_gpex function to build the gpex and pci information. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Acked-by: Song Gao <gaosong@loongson.cn> Message-Id: <20220908094623.73051-10-yangxiaojuan@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2022-09-20hw/loongarch: Support memory hotplugXiaojuan Yang
Add hotplug/unplug interface for memory device. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Acked-by: Song Gao <gaosong@loongson.cn> Message-Id: <20220908094623.73051-9-yangxiaojuan@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2022-09-20hw/loongarch: Fix acpi ged irq number in dsdt tableXiaojuan Yang
In dsdt, acpi ged irq should use gsi number, and the VIRT_SCI_IRQ means it. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Acked-by: Song Gao <gaosong@loongson.cn> Message-Id: <20220908094623.73051-8-yangxiaojuan@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2022-09-20hw/loongarch: Add RAMFB to dynamic_sysbus_devices listXiaojuan Yang
Add RAMFB device to dynamic_sysbus_devices list so that it can be hotpluged to the machine. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Acked-by: Song Gao <gaosong@loongson.cn> Message-Id: <20220908094623.73051-7-yangxiaojuan@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2022-09-20hw/loongarch: Add hotplug handler for machineXiaojuan Yang
Add hotplug handler for LoongArch virt machine and now only support the dynamic sysbus device. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Acked-by: Song Gao <gaosong@loongson.cn> Message-Id: <20220908094623.73051-6-yangxiaojuan@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2022-09-20hw/loongarch: Add platform bus supportXiaojuan Yang
Add platform bus support and add the bus information such as address, size, irq number to FDT table. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Acked-by: Song Gao <gaosong@loongson.cn> Message-Id: <20220908094623.73051-5-yangxiaojuan@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2022-09-20hw/loongarch: Add interrupt information to FDT tableXiaojuan Yang
Add interrupt information to FDT table, such as interrupt controller info, compatiable info, etc. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Acked-by: Song Gao <gaosong@loongson.cn> Message-Id: <20220908094623.73051-4-yangxiaojuan@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2022-09-19hw/loongarch: Support fw_cfg dma functionXiaojuan Yang
Support fw_cfg dma function for LoongArch virt machine. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Acked-by: Song Gao <gaosong@loongson.cn> Message-Id: <20220908094623.73051-3-yangxiaojuan@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2022-09-19hw/loongarch: Remove vga device when loongarch initXiaojuan Yang
Remove the vga device when loongarch machine init and we will support other display device in the future. Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn> Acked-by: Song Gao <gaosong@loongson.cn> Message-Id: <20220908094623.73051-2-yangxiaojuan@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2022-09-18smbios: sanitize type from external type before checking have_fields_bitmapPaolo Bonzini
test_bit uses header->type as an offset; if the file incorrectly specifies a type greater than 127, smbios_entry_add will read and write garbage. To fix this, just pass the smbios data through, assuming the user knows what to do. Reported by Coverity as CID 1487255. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-15 20:29:06 +0000