aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2023-05-18scsi-generic: fix buffer overflow on block limits inquiryPaolo Bonzini
Using linux 6.x guest, at boot time, an inquiry on a scsi-generic device makes qemu crash. This is caused by a buffer overflow when scsi-generic patches the block limits VPD page. Do the operations on a temporary on-stack buffer that is guaranteed to be large enough. Reported-by: Théo Maillart <tmaillart@freebox.fr> Analyzed-by: Théo Maillart <tmaillart@freebox.fr> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-16Merge tag 'pull-9p-20230516' of https://github.com/cschoenebeck/qemu into ↵Richard Henderson
staging 9pfs: fixes * Fixes for Xen, configure and a theoretical leak. # -----BEGIN PGP SIGNATURE----- # # iQJLBAABCgA1FiEEltjREM96+AhPiFkBNMK1h2Wkc5UFAmRjn00XHHFlbXVfb3Nz # QGNydWRlYnl0ZS5jb20ACgkQNMK1h2Wkc5WsMQ/8CxhjMyFDRR+tkQyR0Cp17Wt3 # gspnxW01ieS/J5TKmeGPLqF8OG6HKCmK47jo/ADrxs2wgBIt8UvvH/F1Dkt5F2L3 # xxTQws6TXqdk2nuCAeNgAePlindhJpkiqjAupjrAsy/b4O1OqI42obGGdE4XEYDh # XyHkQACoOj70MlN+sZ7B2FtNkLaQePOs07wzvD8OyBfjHBhfqLxg67ZcYXkKYaTq # 4zaiZKSeGvMT9pMLgXmMscwQvs1Mk6RhmQPraYSbGuDcR4vHZquJY4brVpseGBPT # ZhF/5YjAp6iRa13B9nnSk1/RlqEQPQ9Z4HDkDmtUY7as3GVC88n1N4mUzvrjrDgL # 3v8Kr6QmjLxmjfuxdP1KhvrjhYqXdIwZ02TARQBUSEPS0GbJoNqkdzl4OsbvC7o9 # toGbgyg+H/6yBzPjT22za61M1vjkWfDc1JDmowgNy1QRSOSuYjRRGl1AiwsGrfU6 # BaV7N7sSGS03/1er1U9e47dNkC0wNrbT/KBBwqWFx/Mz2NLU7CK61hONOmEAy+nu # Jn4xhWxQFxgRpRNJBY+e1sNy0rXztDStvM1o4qdeKL3l+N8egTeEStFjepLQ3tMK # Jdqxw6W/jTyaEcz/IvUuId1eCKLaxBl/xmEVPx6/N2fh5gkWD+4ldUq1G/RW1KvP # /rGR1Jbxs2jxhdPh13Y= # =p8Bg # -----END PGP SIGNATURE----- # gpg: Signature made Tue 16 May 2023 08:20:45 AM PDT # gpg: using RSA key 96D8D110CF7AF8084F88590134C2B58765A47395 # gpg: issuer "qemu_oss@crudebyte.com" # gpg: Good signature from "Christian Schoenebeck <qemu_oss@crudebyte.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: ECAB 1A45 4014 1413 BA38 4926 30DB 47C3 A012 D5F4 # Subkey fingerprint: 96D8 D110 CF7A F808 4F88 5901 34C2 B587 65A4 7395 * tag 'pull-9p-20230516' of https://github.com/cschoenebeck/qemu: configure: make clear that VirtFS is 9p 9pfs/xen: Fix segfault on shutdown tests/9p: fix potential leak in v9fs_rreaddir() Don't require libcap-ng for virtfs support Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-169pfs/xen: Fix segfault on shutdownJason Andryuk
xen_9pfs_free can't use gnttabdev since it is already closed and NULL-ed out when free is called. Do the teardown in _disconnect(). This matches the setup done in _connect(). trace-events are also added for the XenDevOps functions. Signed-off-by: Jason Andryuk <jandryuk@gmail.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Message-Id: <20230502143722.15613-1-jandryuk@gmail.com> [C.S.: - Remove redundant return in xen_9pfs_free(). - Add comment to trace-events. ] Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
2023-05-16hw/net: Move xilinx_ethlite.c to the target-independent source setThomas Huth
Now that the tswap() functions are available for target-independent code, too, we can move xilinx_ethlite.c from specific_ss to softmmu_ss to avoid that we have to compile this file multiple times. Message-Id: <20230508120314.59274-1-thuth@redhat.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-16hw/core: Move machine-qmp-cmds.c into the target independent source setThomas Huth
The only target specific code that is left in here are two spots that use TARGET_NAME. Change them to use the new target_name() wrapper function instead, so we can move the file into the common softmmu_ss source set. That way we only have to compile this file once, and not for each target anymore. Message-Id: <20230424160434.331175-4-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-16hw/core: Use a callback for target specific query-cpus-fast informationThomas Huth
For being able to create a universal QEMU binary one day, core files like machine-qmp-cmds.c must not contain any "#ifdef TARGET_..." parts. Thus let's provide the target specific function via a function pointer in CPUClass instead, as a first step towards making this file target independent. Message-Id: <20230424160434.331175-2-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-16s390x/pv: Fix spurious warning with asynchronous teardownClaudio Imbrenda
Kernel commit 292a7d6fca33 ("KVM: s390: pv: fix asynchronous teardown for small VMs") causes the KVM_PV_ASYNC_CLEANUP_PREPARE ioctl to fail if the VM is not larger than 2GiB. QEMU would attempt it and fail, print an error message, and then proceed with a normal teardown. Avoid attempting to use asynchronous teardown altogether when the VM is not larger than 2 GiB. This will avoid triggering the error message and also avoid pointless overhead; normal teardown is fast enough for small VMs. Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com> Fixes: c3a073c610 ("s390x/pv: Add support for asynchronous teardown for reboot") Link: https://lore.kernel.org/all/20230421085036.52511-2-imbrenda@linux.ibm.com/ Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-Id: <20230510105531.30623-2-imbrenda@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> [thuth: Fix inline function parameter in pv.h] Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-16hw/pci-bridge: Fix release ordering by embedding PCIBridgeWindows within ↵Jonathan Cameron
PCIBridge The lifetime of the PCIBridgeWindows instance accessed via the windows pointer in struct PCIBridge is managed separately from the PCIBridge itself. Triggered by ./qemu-system-x86_64 -M x-remote -display none -monitor stdio QEMU monitor: device_add cxl-downstream In some error handling paths (such as the above due to attaching a cxl-downstream port anything other than a cxl-upstream port) the g_free() of the PCIBridge windows in pci_bridge_region_cleanup() is called before the final call of flatview_uref() in address_space_set_flatview() ultimately from drain_call_rcu() At one stage this resulted in a crash, currently can still be observed using valgrind which records a use after free. When present, only one instance is allocated. pci_bridge_update_mappings() can operate directly on an instance rather than creating a new one and swapping it in. Thus there appears to be no reason to not directly couple the lifetimes of the two structures by embedding the PCIBridgeWindows within the PCIBridge removing the need for the problematic separate free. Patch is same as was posted deep in the discussion. https://lore.kernel.org/qemu-devel/20230403171232.000020bb@huawei.com/ Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20230421122550.28234-1-Jonathan.Cameron@huawei.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-15Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into stagingRichard Henderson
Pull request This pull request contain's Sam Li's zoned storage support in the QEMU block layer and virtio-blk emulation. v2: - Sam fixed the CI failures. CI passes for me now. [Richard] # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCAAdFiEEhpWov9P5fNqsNXdanKSrs4Grc8gFAmRiWCgACgkQnKSrs4Gr # c8h/7gf+MMm2cGEaf376t8HMwTc6wbXVfbmAlZrge2EXPZfFvEaxj7HClcEraOgV # yJsGWeU6mOw4r68ICJ/4KhrY1cdv+VZym/LsMLMcFUTXFHnyX4pyU3am31FPOI4K # +wrDYJOJhc4DkAESWGgEWiMKpuO/uUEgBmHdW+qPFCl77Yl/eP6H5uNP6nGFn55p # QpS/l8iha7PDkc81EsrjA+e/YI0ubfNSP7+zZElhQ98354CQ0MCfmZ6h9bT+o2bu # R7SBUj80e+2X0a1b9s/2Jz/x8l4TEsl8kr48/Q1usq3GVVkbjEgqsk6wTN13Q/4g # CeIR7E61ZeYzmpb4tLFRIqK2Jw+NEQ== # =Q8xW # -----END PGP SIGNATURE----- # gpg: Signature made Mon 15 May 2023 09:04:56 AM PDT # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] * tag 'block-pull-request' of https://gitlab.com/stefanha/qemu: docs/zoned-storage:add zoned emulation use case virtio-blk: add some trace events for zoned emulation block: add accounting for zone append operation virtio-blk: add zoned storage emulation for zoned devices block: add some trace events for zone append qemu-iotests: test zone append operation block: introduce zone append write for zoned devices file-posix: add tracking of the zone write pointers docs/zoned-storage: add zoned device documentation block: add some trace events for new block layer APIs iotests: test new zone operations block: add zoned BlockDriver check to block layer block/raw-format: add zone operations to pass through requests block/block-backend: add block layer APIs resembling Linux ZonedBlockDevice ioctls block/file-posix: introduce helper functions for sysfs attributes block/block-common: add zoned device structs Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-15virtio-blk: add some trace events for zoned emulationSam Li
Signed-off-by: Sam Li <faithilikerun@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20230508051916.178322-4-faithilikerun@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-05-15block: add accounting for zone append operationSam Li
Taking account of the new zone append write operation for zoned devices, BLOCK_ACCT_ZONE_APPEND enum is introduced as other I/O request type (read, write, flush). Signed-off-by: Sam Li <faithilikerun@gmail.com> Message-id: 20230508051916.178322-3-faithilikerun@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-05-15virtio-blk: add zoned storage emulation for zoned devicesSam Li
This patch extends virtio-blk emulation to handle zoned device commands by calling the new block layer APIs to perform zoned device I/O on behalf of the guest. It supports Report Zone, four zone oparations (open, close, finish, reset), and Append Zone. The VIRTIO_BLK_F_ZONED feature bit will only be set if the host does support zoned block devices. Regular block devices(conventional zones) will not be set. The guest os can use blktests, fio to test those commands on zoned devices. Furthermore, using zonefs to test zone append write is also supported. Signed-off-by: Sam Li <faithilikerun@gmail.com> Message-id: 20230508051916.178322-2-faithilikerun@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-05-15hw/intc: Add NULL pointer check on LoongArch ipi deviceSong Gao
When ipi mailbox is used, cpu_index is decoded from iocsr register. cpu maybe does not exist. This patch adds NULL pointer check on ipi device. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Song Gao <gaosong@loongson.cn> Message-Id: <20230512100421.1867848-4-gaosong@loongson.cn>
2023-05-15hw/loongarch/virt: Set max 256 cpus support on loongarch virt machineSong Gao
Add separate macro EXTIOI_CPUS for extioi interrupt controller, extioi only supports 4 cpu. And set macro LOONGARCH_MAX_CPUS as 256 so that loongarch virt machine supports more cpus. Interrupts from external devices can only be routed cpu 0-3 because of extioi limits, cpu internal interrupt such as timer/ipi can be triggered on all cpus. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Song Gao <gaosong@loongson.cn> Message-Id: <20230512100421.1867848-3-gaosong@loongson.cn>
2023-05-15hw/loongarch/virt: Modify ipi as percpu deviceSong Gao
ipi is used to communicate between cpus, this patch modified loongarch ipi device as percpu device, so that there are 2 MemoryRegions with ipi device, rather than 2*cpus MemoryRegions, which may be large than QDEV_MAX_MMIO if more cpus are added on loongarch virt machine. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Song Gao <gaosong@loongson.cn> Message-Id: <20230512100421.1867848-2-gaosong@loongson.cn>
2023-05-15loongarch: mark loongarch_ipi_iocsr re-entrnacy safeAlexander Bulekov
loongarch_ipi_iocsr MRs rely on re-entrant IO through the ipi_send function. As such, mark these MRs re-entrancy-safe. Fixes: a2e1753b80 ("memory: prevent dma-reentracy issues") Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Song Gao <gaosong@loongson.cn> Message-Id: <20230506112145.3563708-1-alxndr@bu.edu> Signed-off-by: Song Gao <gaosong@loongson.cn>
2023-05-12hw/mips/malta: Fix minor dead code issuePeter Maydell
Coverity points out (in CID 1508390) that write_bootloader has some dead code, where we assign to 'p' and then in the following line assign to it again. This happened as a result of the refactoring in commit cd5066f8618b. Fix the dead code by removing the 'void *v' variable entirely and instead adding a cast when calling bl_setup_gt64120_jump_kernel(), as we do at its other callsite in write_bootloader_nanomips(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-05-10Merge tag 'pull-testing-updates-100523-1' of https://gitlab.com/stsquad/qemu ↵Richard Henderson
into staging Testing updates: - fix up xtensa docker container base to current Debian - document breakpoint and watchpoint support - clean up the ansible scripts for Ubuntu 22.04 - add a minimal device profile - drop https on mipsdistros URL - fix Kconfig bug for XLNX_VERSAL # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEEZoWumedRZ7yvyN81+9DbCVqeKkQFAmRbspsACgkQ+9DbCVqe # KkSBowf+JjcVxZMb2kS8pV8WEdAq+fceBYI7mDBSEu0DFqZF+w0XSM+T+VZHyZ8+ # QmPeE+McKBUXvq/V4osPnDVVZfBKmwzFN548M6qIMLUbHjbDp94DtudNkAZ0ejhc # +Ack73vzTiTWsGmBaqQxZlcYkZNZiZAhQsTF6cPwna74cDkcRghvd/Zxzy831rVB # gVWhbEkk7SBQhJ+PqRIeso60DbWvCaVDMrkPc2WX8kup6QltbUpoayS/eNOtBkfA # C557eOBxoM8s0cu33O780K5mCPCyk1IaIynvZtmkty0DXUSd5y9SNpsofhAY7BGy # 4QdlolLygDgEC3s4bMULGy04nzaylw== # =a+97 # -----END PGP SIGNATURE----- # gpg: Signature made Wed 10 May 2023 04:04:59 PM BST # gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44 # gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44 * tag 'pull-testing-updates-100523-1' of https://gitlab.com/stsquad/qemu: hw/arm: Select XLNX_USB_SUBSYS for xlnx-zcu102 machine tests/avocado: use http for mipsdistros.mips.com gitlab: enable minimal device profile for aarch64 --disable-tcg gitlab: add ubuntu-22.04-aarch64-without-defaults scripts/ci: clean-up the 20.04/22.04 confusion in ansible scripts/ci: add gitlab-runner to kvm group docs: document breakpoint and watchpoint support tests/docker: bump the xtensa base to debian:11-slim Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-10hw/arm: Select XLNX_USB_SUBSYS for xlnx-zcu102 machineFabiano Rosas
This machine hardcodes initialization of the USB device, so select the corresponding Kconfig. It is not enough to have it as "default y if XLNX_VERSAL" at usb/Kconfig because building --without-default-devices disables the default selection resulting in: $ ./qemu-system-aarch64 -M xlnx-zcu102 qemu-system-aarch64: missing object type 'usb_dwc3' Aborted (core dumped) Signed-off-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20230208192654.8854-8-farosas@suse.de> Message-Id: <20230503091244.1450613-8-alex.bennee@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-10aio-wait: avoid AioContext lock in aio_wait_bh_oneshot()Stefan Hajnoczi
There is no need for the AioContext lock in aio_wait_bh_oneshot(). It's easy to remove the lock from existing callers and then switch from AIO_WAIT_WHILE() to AIO_WAIT_WHILE_UNLOCKED() in aio_wait_bh_oneshot(). Document that the AioContext lock should not be held across aio_wait_bh_oneshot(). Holding a lock across aio_poll() can cause deadlock so we don't want callers to do that. This is a step towards getting rid of the AioContext lock. Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20230404153307.458883-1-stefanha@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Emanuele Giuseppe Esposito <eesposit@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2023-05-09vfio/pci: Static Resizable BAR capabilityAlex Williamson
The PCI Resizable BAR (ReBAR) capability is currently hidden from the VM because the protocol for interacting with the capability does not support a mechanism for the device to reject an advertised supported BAR size. However, when assigned to a VM, the act of resizing the BAR requires adjustment of host resources for the device, which absolutely can fail. Linux does not currently allow us to reserve resources for the device independent of the current usage. The only writable field within the ReBAR capability is the BAR Size register. The PCIe spec indicates that when written, the device should immediately begin to operate with the provided BAR size. The spec however also notes that software must only write values corresponding to supported sizes as indicated in the capability and control registers. Writing unsupported sizes produces undefined results. Therefore, if the hypervisor were to virtualize the capability and control registers such that the current size is the only indicated available size, then a write of anything other than the current size falls into the category of undefined behavior, where we can essentially expose the modified ReBAR capability as read-only. This may seem pointless, but users have reported that virtualizing the capability in this way not only allows guest software to expose related features as available (even if only cosmetic), but in some scenarios can resolve guest driver issues. Additionally, no regressions in behavior have been reported for this change. A caveat here is that the PCIe spec requires for compatibility that devices report support for a size in the range of 1MB to 512GB, therefore if the current BAR size falls outside that range we revert to hiding the capability. Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/r/20230505232308.2869912-1-alex.williamson@redhat.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2023-05-09vfio/migration: Skip log_sync during migration SETUP stateAvihai Horon
Currently, VFIO log_sync can be issued while migration is in SETUP state. However, doing this log_sync is at best redundant and at worst can fail. Redundant -- all RAM is marked dirty in migration SETUP state and is transferred only after migration is set to ACTIVE state, so doing log_sync during migration SETUP is pointless. Can fail -- there is a time window, between setting migration state to SETUP and starting dirty tracking by RAM save_live_setup handler, during which dirty tracking is still not started. Any VFIO log_sync call that is issued during this time window will fail. For example, this error can be triggered by migrating a VM when a GUI is active, which constantly calls log_sync. Fix it by skipping VFIO log_sync while migration is in SETUP state. Fixes: 758b96b61d5c ("vfio/migrate: Move switch of dirty tracking into vfio_memory_listener") Signed-off-by: Avihai Horon <avihaih@nvidia.com> Link: https://lore.kernel.org/r/20230403130000.6422-1-avihaih@nvidia.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2023-05-09vfio/pci: add support for VF tokenMinwoo Im
VF token was introduced [1] to kernel vfio-pci along with SR-IOV support [2]. This patch adds support VF token among PF and VF(s). To passthu PCIe VF to a VM, kernel >= v5.7 needs this. It can be configured with UUID like: -device vfio-pci,host=DDDD:BB:DD:F,vf-token=<uuid>,... [1] https://lore.kernel.org/linux-pci/158396393244.5601.10297430724964025753.stgit@gimli.home/ [2] https://lore.kernel.org/linux-pci/158396044753.5601.14804870681174789709.stgit@gimli.home/ Cc: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Minwoo Im <minwoo.im@samsung.com> Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Link: https://lore.kernel.org/r/20230320073522epcms2p48f682ecdb73e0ae1a4850ad0712fd780@epcms2p4 Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2023-05-06Merge tag 'pull-loongarch-20230506' of https://gitlab.com/gaosong/qemu into ↵Richard Henderson
staging Add LoongArch LSX instructions. # -----BEGIN PGP SIGNATURE----- # # iLMEAAEIAB0WIQS4/x2g0v3LLaCcbCxAov/yOSY+3wUCZFXxGwAKCRBAov/yOSY+ # 39EoA/0Uy2DPz6g7J5+9tcIRk9jLrp36aYQJ9J8zRJd226YFvHSfiBWSIteMFOEX # Z0Jx1bL6N97KK/HA74Nx++x0kVuplEGp1s5cO/odL3gYy8RaJm23p9iaDa0D/UaB # ygLvXtuzN4unDFP5EF/wa9zRkDb7qX2iBBvc8OIal7eT4dDX+g== # =gyVU # -----END PGP SIGNATURE----- # gpg: Signature made Sat 06 May 2023 07:18:03 AM BST # gpg: using RSA key B8FF1DA0D2FDCB2DA09C6C2C40A2FFF239263EDF # gpg: Good signature from "Song Gao <m17746591750@163.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: B8FF 1DA0 D2FD CB2D A09C 6C2C 40A2 FFF2 3926 3EDF * tag 'pull-loongarch-20230506' of https://gitlab.com/gaosong/qemu: (45 commits) hw/intc: don't use target_ulong for LoongArch ipi target/loongarch: CPUCFG support LSX target/loongarch: Use {set/get}_gpr replace to cpu_fpr target/loongarch: Implement vldi target/loongarch: Implement vld vst target/loongarch: Implement vilvl vilvh vextrins vshuf target/loongarch: Implement vreplve vpack vpick target/loongarch: Implement vinsgr2vr vpickve2gr vreplgr2vr target/loongarch: Implement vbitsel vset target/loongarch: Implement vfcmp target/loongarch: Implement vseq vsle vslt target/loongarch: Implement LSX fpu fcvt instructions target/loongarch: Implement LSX fpu arith instructions target/loongarch: Implement vfrstp target/loongarch: Implement vbitclr vbitset vbitrev target/loongarch: Implement vpcnt target/loongarch: Implement vclo vclz target/loongarch: Implement vssrlrn vssrarn target/loongarch: Implement vssrln vssran target/loongarch: Implement vsrlrn vsrarn ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-06hw/intc: don't use target_ulong for LoongArch ipiAlex Bennée
The calling function is already working with hwaddr and uint64_t so lets avoid bringing target_ulong in if we don't need to. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Song Gao <gaosong@loongson.cn> Message-Id: <20230404132711.2563638-1-alex.bennee@linaro.org> Signed-off-by: Song Gao <gaosong@loongson.cn>
2023-05-05hw/ppc/Kconfig: NVDIMM is a hard requirement for the pseries machineThomas Huth
When building QEMU with "--without-default-devices", the pseries machine fails to start even when running with the --nodefaults option: $ ./qemu-system-ppc64 --nodefaults -M pseries Type 'spapr-nvdimm' is missing its parent 'nvdimm' Aborted (core dumped) Looks like NVDIMM is a hard requirement for this machine nowadays. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20230504180521.220404-1-thuth@redhat.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-05ppc: spapr: cleanup cr get/set with helpers.Harsh Prateek Bora
The bits in cr reg are grouped into eight 4-bit fields represented by env->crf[8] and the related calculations should be abstracted to keep the calling routines simpler to read. This is a step towards cleaning up the related/calling code for better readability. Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230503093619.2530487-2-harshpb@linux.ibm.com> [danielhb: add 'const' modifier to fix linux-user build] Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-05hw/display/sm501: Remove unneeded increment from loopBALATON Zoltan
As Coverity points out (CID 1508621) the calculation to increment i in the fill fallback loop is ineffective as it is overwritten in next statement. This was left there by mistake from a previous version but is not needed in the current approach so remove the superfluous increment statement. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230405161234.6EF0A74633D@zero.eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-05hw/intc/riscv_aplic: Zero init APLIC internal stateIvan Klokov
Since g_new is used to initialize the RISCVAPLICState->state structure, in some case we get behavior that is not as expected. This patch changes this to g_new0, which allows to initialize the APLIC in the correct state. Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Anup Patel <anup@brainfault.org> Message-Id: <20230413133432.53771-1-ivan.klokov@syntacore.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2023-05-05hw/riscv: Add signature dump function for spike to run ACT testsWeiwei Li
Add signature and signature-granularity properties in spike to specify the target signatrue file and the line size for signature data. Recgonize the signature section between begin_signature and end_signature symbols when loading elf of ACT tests. Then dump signature data in signature section just before the ACT tests exit. Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn> Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20230405095720.75848-2-liweiwei@iscas.ac.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2023-05-02hw/net/allwinner-sun8i-emac: Correctly byteswap descriptor fieldsPeter Maydell
In allwinner-sun8i-emac we just read directly from guest memory into a host FrameDescriptor struct and back. This only works on little-endian hosts. Reading and writing of descriptors is already abstracted into functions; make those functions also handle the byte-swapping so that TransferDescriptor structs as seen by the rest of the code are always in host-order, and fix two places that were doing ad-hoc descriptor reading without using the functions. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230424165053.1428857-3-peter.maydell@linaro.org
2023-05-02hw/sd/allwinner-sdhost: Correctly byteswap descriptor fieldsPeter Maydell
In allwinner_sdhost_process_desc() we just read directly from guest memory into a host TransferDescriptor struct and back. This only works on little-endian hosts. Abstract the reading and writing of descriptors into functions that handle the byte-swapping so that TransferDescriptor structs as seen by the rest of the code are always in host-order. This fixes a failure of one of the avocado tests on s390. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230424165053.1428857-2-peter.maydell@linaro.org
2023-05-02hw/intc/allwinner-a10-pic: Don't use set_bit()/clear_bit()Peter Maydell
The Allwinner PIC model uses set_bit() and clear_bit() to update the values in its irq_pending[] array when an interrupt arrives. However it is using these functions wrongly: they work on an array of type 'long', and it is passing an array of type 'uint32_t'. Because the code manually figures out the right array element, this works on little-endian hosts and on 32-bit big-endian hosts, where bits 0..31 in a 'long' are in the same place as they are in a 'uint32_t'. However it breaks on 64-bit big-endian hosts. Remove the use of set_bit() and clear_bit() in favour of using deposit32() on the array element. This fixes a bug where on big-endian 64-bit hosts the guest kernel would hang early on in bootup. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230424152833.1334136-1-peter.maydell@linaro.org
2023-05-02hw/arm/raspi: Use arm_write_bootloader() to write boot codePeter Maydell
When writing the secondary-CPU stub boot loader code to the guest, use arm_write_bootloader() instead of directly calling rom_add_blob_fixed(). This fixes a bug on big-endian hosts, because arm_write_bootloader() will correctly byte-swap the host-byte-order array values into the guest-byte-order to write into the guest memory. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230424152717.1333930-4-peter.maydell@linaro.org
2023-05-02hw/arm/aspeed: Use arm_write_bootloader() to write the bootloaderCédric Le Goater
When writing the secondary-CPU stub boot loader code to the guest, use arm_write_bootloader() instead of directly calling rom_add_blob_fixed(). This fixes a bug on big-endian hosts, because arm_write_bootloader() will correctly byte-swap the host-byte-order array values into the guest-byte-order to write into the guest memory. Cc: qemu-stable@nongnu.org Signed-off-by: Cédric Le Goater <clg@kaod.org> Tested-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230424152717.1333930-3-peter.maydell@linaro.org [PMM: Moved the "make arm_write_bootloader() function public" part to its own patch; updated commit message to note that this fixes an actual bug; adjust to the API changes noted in previous commit] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-02hw/arm/boot: Make write_bootloader() public as arm_write_bootloader()Cédric Le Goater
The arm boot.c code includes a utility function write_bootloader() which assists in writing a boot-code fragment into guest memory, including handling endianness and fixing it up with entry point addresses and similar things. This is useful not just for the boot.c code but also in board model code, so rename it to arm_write_bootloader() and make it globally visible. Since we are making it public, make its API a little neater: move the AddressSpace* argument to be next to the hwaddr argument, and allow the fixupcontext array to be const, since we never modify it in this function. Cc: qemu-stable@nongnu.org Signed-off-by: Cédric Le Goater <clg@kaod.org> Tested-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230424152717.1333930-2-peter.maydell@linaro.org [PMM: Split out from another patch by Cédric, added doc comment] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-02hw/net/msf2-emac: Don't modify descriptor in-place in emac_store_desc()Peter Maydell
The msf2-emac ethernet controller has functions emac_load_desc() and emac_store_desc() which read and write the in-memory descriptor blocks and handle conversion between guest and host endianness. As currently written, emac_store_desc() does the endianness conversion in-place; this means that it effectively consumes the input EmacDesc struct, because on a big-endian host the fields will be overwritten with the little-endian versions of their values. Unfortunately, in all the callsites the code continues to access fields in the EmacDesc struct after it has called emac_store_desc() -- specifically, it looks at the d.next field. The effect of this is that on a big-endian host networking doesn't work because the address of the next descriptor is corrupted. We could fix this by making the callsite avoid using the struct; but it's more robust to have emac_store_desc() leave its input alone. (emac_load_desc() also does an in-place conversion, but here this is fine, because the function is supposed to be initializing the struct.) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20230424151919.1333299-1-peter.maydell@linaro.org
2023-05-02hw/arm/bcm2835_property: Implement "get command line" messageDaniel Bertalan
This query copies the kernel command line into the message buffer. It was previously stubbed out to return empty, this commit makes it reflect the arguments specified with `-append`. I observed the following peculiarities on my Pi 3B+: - If the buffer is shorter than the string, the response header gives the full length, but no data is actually copied. - No NUL terminator is added: even if the buffer is long enough to fit one, the buffer's original contents are preserved past the string's end. - The VC firmware adds the following extra parameters beside the user-supplied ones (via /boot/cmdline.txt): `video`, `vc_mem.mem_base` and `vc_mem.mem_size`. This is currently not implemented in qemu. Signed-off-by: Daniel Bertalan <dani@danielbertalan.dev> Message-id: 20230425103250.56653-1-dani@danielbertalan.dev Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: added comment about NUL and short-buffer behaviour] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-02hw/net: npcm7xx_emc: set MAC in register spacePatrick Venture
The MAC address set from Qemu wasn't being saved into the register space. Reviewed-by: Hao Wu <wuhaotsh@google.com> Signed-off-by: Patrick Venture <venture@google.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: moved variable declaration to top of function] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-02arm/Kconfig: Do not build TCG-only boards on a KVM-only buildFabiano Rosas
Move all the CONFIG_FOO=y from default.mak into "default y if TCG" statements in Kconfig. That way they won't be selected when CONFIG_TCG=n. I'm leaving CONFIG_ARM_VIRT in default.mak because it allows us to keep the two default.mak files not empty and keep aarch64-default.mak including arm-default.mak. That way we don't surprise anyone that's used to altering these files. With this change we can start building with --disable-tcg. Signed-off-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230426180013.14814-12-farosas@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-02arm/Kconfig: Always select SEMIHOSTING when TCG is presentFabiano Rosas
We are about to enable the build without TCG, so CONFIG_SEMIHOSTING and CONFIG_ARM_COMPATIBLE_SEMIHOSTING cannot be unconditionally set in default.mak anymore. So reflect the change in a Kconfig. Instead of using semihosting/Kconfig, use a target-specific file, so that the change doesn't affect other architectures which might implement semihosting in a way compatible with KVM. The selection from ARM_v7M needs to be removed to avoid a cycle during parsing. Signed-off-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230426180013.14814-11-farosas@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-02target/arm: move cpu_tcg to tcg/cpu32.cClaudio Fontana
move the module containing cpu models definitions for 32bit TCG-only CPUs to tcg/ and rename it for clarity. Signed-off-by: Claudio Fontana <cfontana@suse.de> Signed-off-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230426180013.14814-8-farosas@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-02target/arm: Move 64-bit TCG CPUs into tcg/Fabiano Rosas
Move the 64-bit CPUs that are TCG-only: - cortex-a35 - cortex-a55 - cortex-a72 - cortex-a76 - a64fx - neoverse-n1 Keep the CPUs that can be used with KVM: - cortex-a57 - cortex-a53 - max - host Signed-off-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230426180013.14814-6-farosas@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-04-28Merge tag 'pull-request-2023-04-28' of https://gitlab.com/thuth/qemu into ↵Richard Henderson
staging * Prevent reentrant DMA accesses by default * Only compile hw/rdma code when necessary * Fix a potential locking issue in the vhost-user-test * Offer more registers in GDB for s390x TCG # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmRLlDkRHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbU98RAApVbehXIXMF4lm0B4/pTRlP7CEjbKvNdQ # Ca/xuqiCctjisJWQMLf8WDdymzaA02ycSYo0X9diO4uisKog4kN4uYje3VTbSJnx # 7a0MlOpUqP6AR3hZYy5y/wv1M7Yjfhnj7yTUsAo/mQYoZmvqRviNwJ6ekdIU9J4W # V2EfY+R/ebNami9VvuHTqudcZxmmR+4S5m5JipeHvjFE0DJucES0S8sN3W+iSCxG # ydqG02CUoZtoorkJZccy3FPyeTVHgvcNqJbhAA5pFBgo30L+mx0llqztzLnWnLCe # GWvpW2lZ2jC5MOg8oEpbiR807eB3ITpzCu9SX0IUOxMUHpGtl49sx1WNFrrlgD4Z # b+mZSwJx4grwkU8iD/nF0apQoqEIAH6VSyRAIq1yLAsq1H4/K4c8M+bZ/jAD+gw+ # +DujZIPJ6Gcu3BeqWgOcOY1rRol3ksmRYlU8GrHTR/zIU+q3h7Gk3aH4+Ore1qnE # hI/YzyyZlQgFMvENqakPJIS9IH+h41gCltwE8YxqJyUWIBfRs7iBMzdxQuUW+c2b # n6OPYqeDlQt4hEpq4mUtZ+aJV1ey6kyk5ESLTj8QaJiZtcT1+lmvZX2ug2oeyrJm # ys2458ulKZu0rGjXWWXNFB8u3MM9xN/PLqeD/wKShyLzkit5Nfx4azw5LPbmjrbj # Twmf1HGeUiY= # =v84A # -----END PGP SIGNATURE----- # gpg: Signature made Fri 28 Apr 2023 10:39:05 AM BST # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [undefined] # gpg: aka "Thomas Huth <thuth@redhat.com>" [undefined] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2023-04-28' of https://gitlab.com/thuth/qemu: apic: disable reentrancy detection for apic-msi raven: disable reentrancy detection for iomem bcm2835_property: disable reentrancy detection for iomem lsi53c895a: disable reentrancy detection for script RAM hw: replace most qemu_bh_new calls with qemu_bh_new_guarded checkpatch: add qemu_bh_new/aio_bh_new checks async: Add an optional reentrancy guard to the BH API memory: prevent dma-reentracy issues tests: vhost-user-test: release mutex on protocol violation hw/rdma: VMW_PVRDMA should depend on VMXNET3_PCI hw/rdma: Compile target-independent parts of the rdma code only once hw/rdma: Remove unused macros PG_DIR_SZ and PG_TBL_SZ s390x/gdb: Split s390-virt.xml Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-04-28apic: disable reentrancy detection for apic-msiAlexander Bulekov
As the code is designed for re-entrant calls to apic-msi, mark apic-msi as reentrancy-safe. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <20230427211013.2994127-9-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-04-28raven: disable reentrancy detection for iomemAlexander Bulekov
As the code is designed for re-entrant calls from raven_io_ops to pci-conf, mark raven_io_ops as reentrancy-safe. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20230427211013.2994127-8-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-04-28bcm2835_property: disable reentrancy detection for iomemAlexander Bulekov
As the code is designed for re-entrant calls from bcm2835_property to bcm2835_mbox and back into bcm2835_property, mark iomem as reentrancy-safe. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230427211013.2994127-7-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-04-28lsi53c895a: disable reentrancy detection for script RAMAlexander Bulekov
As the code is designed to use the memory APIs to access the script ram, disable reentrancy checks for the pseudo-RAM ram_io MemoryRegion. In the future, ram_io may be converted from an IO to a proper RAM MemoryRegion. Reported-by: Fiona Ebner <f.ebner@proxmox.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <20230427211013.2994127-6-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-04-28hw: replace most qemu_bh_new calls with qemu_bh_new_guardedAlexander Bulekov
This protects devices from bh->mmio reentrancy issues. Thanks: Thomas Huth <thuth@redhat.com> for diagnosing OS X test failure. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paul Durrant <paul@xen.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230427211013.2994127-5-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-04-28hw/rdma: VMW_PVRDMA should depend on VMXNET3_PCIThomas Huth
The "pvrdma" device is only usable in conjunction with the "vmxnet3" NIC - see the check for TYPE_VMXNET3 in pvrdma_realize(). By adding this dependency, the amount of total files that have to be compiled for a configuration with all targets decreases by 64 files (!), since the rdma code is marked as target specific and thus got recompiled for all targets that enable PCI so far. Message-Id: <20230419111337.651673-1-thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-16 13:34:49 +0000