aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2024-07-02hw/sd/sdcard: Convert PROGRAM_CID to generic_write_byte (CMD26)Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-33-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Convert WRITE_SINGLE_BLOCK to generic_write_byte (CMD24)Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-32-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Duplicate WRITE_SINGLE_BLOCK / WRITE_MULTIPLE_BLOCK casesPhilippe Mathieu-Daudé
In order to modify the WRITE_SINGLE_BLOCK case in the next commit, duplicate it first. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-31-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Introduce sd_cmd_to_receivingdata / sd_generic_write_bytePhilippe Mathieu-Daudé
All commands switching from TRANSFER state to (receiving)DATA do the same: receive stream of data from the DAT lines. Instead of duplicating the same code many times, introduce 2 helpers: - sd_cmd_to_receivingdata() on the I/O line setup the data to be received on the data[] buffer, - sd_generic_write_byte() on the DAT lines to push the data. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-30-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Convert SEND_SCR to generic_read_byte (ACMD51)Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-29-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Convert SEND_NUM_WR_BLOCKS to generic_read_byte (ACMD22)Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-28-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Convert SD_STATUS to generic_read_byte (ACMD13)Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-27-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Convert SEND_WRITE_PROT to generic_read_byte (CMD30)Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-25-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Convert SEND_TUNING_BLOCK to generic_read_byte (CMD19)Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-24-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Convert READ_SINGLE_BLOCK to generic_read_byte (CMD17)Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-23-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Duplicate READ_SINGLE_BLOCK / READ_MULTIPLE_BLOCK casesPhilippe Mathieu-Daudé
In order to modify the READ_SINGLE_BLOCK case in the next commit, duplicate it first. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-22-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Convert SEND_CSD/SEND_CID to generic_read_byte (CMD9 & 10)Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-21-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Convert SWITCH_FUNCTION to generic_read_byte (CMD6)Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-20-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Introduce sd_cmd_to_sendingdata and sd_generic_read_bytePhilippe Mathieu-Daudé
All commands switching from TRANSFER state to (sending)DATA do the same: send stream of data on the DAT lines. Instead of duplicating the same code many times, introduce 2 helpers: - sd_cmd_to_sendingdata() on the I/O line setup the data to be transferred, - sd_generic_read_byte() on the DAT lines to fetch the data. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <4c9f7f51-83ee-421a-8690-9af2e80b134b@linaro.org>
2024-07-02hw/sd/sdcard: Introduce definitions for EXT_CSD registerCédric Le Goater
Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@redhat.com> Co-Developed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240628070216.92609-18-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Extract sd_blk_len() helperPhilippe Mathieu-Daudé
Extract sd_blk_len() helper, use definitions instead of magic values. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-15-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Add direct reference to SDProto in SDStatePhilippe Mathieu-Daudé
Keep direct reference to SDProto in SDState, remove then unnecessary sd_proto(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-14-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Simplify sd_inactive_state handlingPhilippe Mathieu-Daudé
Card entering sd_inactive_state powers off, and won't respond anymore. Handle that once when entering sd_do_command(). Remove condition always true in sd_cmd_GO_IDLE_STATE(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-12-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Assign SDCardStates enum valuesPhilippe Mathieu-Daudé
SDCardStates enum values are specified, so assign them correspondingly. It will be useful later when we add states from later specs, which might not be continuous. See CURRENT_STATE bits in section 4.10.1 "Card Status". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-11-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Use READY_FOR_DATA definition instead of magic valuePhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-10-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Send NUM_WR_BLOCKS bits MSB first (ACMD22)Philippe Mathieu-Daudé
Per sections 3.6.1 (SD Bus Protocol), 4.3.4 "Data Write" and 7.3.2 (Responses): In the CMD line the Most Significant Bit is transmitted first. Use the stl_be_p() helper to store the value in big-endian. Fixes: a1bb27b1e9 ("Initial SD card emulation") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20240628070216.92609-9-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Send WRITE_PROT bits MSB first (CMD30)Philippe Mathieu-Daudé
Per sections 3.6.1 (SD Bus Protocol) and 7.3.2 (Responses): In the CMD line the Most Significant Bit is transmitted first. Use the stl_be_p() helper to store the value in big-endian. Fixes: a1bb27b1e9 ("Initial SD card emulation") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20240628070216.92609-8-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Restrict SWITCH_FUNCTION to sd_transfer_state (CMD6)Philippe Mathieu-Daudé
SWITCH_FUNCTION is only allowed in TRANSFER state (See 4.8 "Card State Transition Table). Fixes: a1bb27b1e9 ("Initial SD card emulation") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-13-philmd@linaro.org>
2024-07-02hw/s390x: Attach default virtio-net devices to the /machine/virtual-css-bridgeThomas Huth
The initial virtio-net-ccw devices currently do not have a proper parent in the QOM tree, so they show up under /machine/unattached - which is somewhat ugly. Let's attach them to /machine/virtual-css-bridge/virtual-css instead. Message-ID: <20240701200108.154271-1-thuth@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-07-02hw/sd/sdcard: Trace requested address computed by sd_req_get_address()Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Luc Michel <luc.michel@amd.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-6-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Trace block offset in READ/WRITE data accessesPhilippe Mathieu-Daudé
Useful to detect out of bound accesses. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-5-philmd@linaro.org>
2024-07-02hw/sd/sdcard: Track last command used to help loggingPhilippe Mathieu-Daudé
The command is selected on the I/O lines, and further processing might be done on the DAT lines via the sd_read_byte() and sd_write_byte() handlers. Since these methods can't distinct between normal and APP commands, keep the name of the current command in the SDState and use it in the DAT handlers. This fixes a bug that all normal commands were displayed as APP commands. Fixes: 2ed61fb57b ("sdcard: Display command name when tracing CMD/ACMD") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-4-philmd@linaro.org>
2024-07-02hw/intc/s390_flic: Fix interrupt controller migration on s390x with TCGThomas Huth
Migration of a s390x guest with TCG was long known to be very unstable, so the tests in tests/qtest/migration-test.c are disabled if running with TCG instead of KVM. Nicholas Piggin did a great analysis of the problem: "The flic pending state is not migrated, so if the machine is migrated while an interrupt is pending, it can be lost. This shows up in qtest migration test, an extint is pending (due to console writes?) and the CPU waits via s390_cpu_set_psw and expects the interrupt to wake it. However when the flic pending state is lost, s390_cpu_has_int returns false, so s390_cpu_exec_interrupt falls through to halting again." Thus let's finally migrate the pending state, and to be on the safe side, also the other state variables of the QEMUS390FLICState structure. Message-ID: <20240619144421.261342-1-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-07-02hw/net:ftgmac100: fix coding styleJamin Lin
Fix coding style issues from checkpatch.pl Test command: ./scripts/checkpatch.pl --no-tree -f hw/net/ftgmac100.c Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com>
2024-07-02aspeed/sdmc: Remove extra R_MAIN_STATUS caseJamin Lin
Coverity reports that the newly added 'case R_MAIN_STATUS' is DEADCODE because it can not be reached. This is because R_MAIN_STATUS is handled before in the "Unprotected registers" switch statement. Remove it. Fixes: Coverity CID 1547112 Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> [ clg: Rewrote commit log ] Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-07-02aspeed/soc: Fix possible divide by zeroJamin Lin
Coverity reports a possible DIVIDE_BY_ZERO issue regarding the "ram_size" object property. This can not happen because RAM has predefined valid sizes per SoC. Nevertheless, add a test to close the issue. Fixes: Coverity CID 1547113 Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> [ clg: Rewrote commit log ] Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-07-02aspeed/sdmc: Check RAM size value at realize timeCédric Le Goater
The RAM size of the SDMC device is validated for the SoC and set when the Aspeed machines are initialized and then later used by several SoC implementations. However, the SDMC model never checks that the RAM size has been actually set before being used. Do that at realize. Signed-off-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Jamin_lin < jamin_lin@aspeedtech.com>
2024-07-02aspeed: Deprecate the tacoma-bmc machineCédric Le Goater
The tacoma-bmc machine was a board including an AST2600 SoC based BMC and a witherspoon like OpenPOWER system. It was used for bring up of the AST2600 SoC in labs. It can be easily replaced by the rainier-bmc machine which is part of a real product offering. Signed-off-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw/gpio/aspeed: Add reg_table_count to AspeedGPIOClassZheyu Ma
ASan detected a global-buffer-overflow error in the aspeed_gpio_read() function. This issue occurred when reading beyond the bounds of the reg_table. To enhance the safety and maintainability of the Aspeed GPIO code, this commit introduces a reg_table_count member to the AspeedGPIOClass structure. This change ensures that the size of the GPIO register table is explicitly tracked and initialized, reducing the risk of errors if new register tables are introduced in the future. Reproducer: cat << EOF | qemu-system-aarch64 -display none \ -machine accel=qtest, -m 512M -machine ast1030-evb -qtest stdio readq 0x7e780272 EOF ASAN log indicating the issue: ==2602930==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55a5da29e128 at pc 0x55a5d700dc62 bp 0x7fff096c4e90 sp 0x7fff096c4e88 READ of size 2 at 0x55a5da29e128 thread T0 #0 0x55a5d700dc61 in aspeed_gpio_read hw/gpio/aspeed_gpio.c:564:14 #1 0x55a5d933f3ab in memory_region_read_accessor system/memory.c:445:11 #2 0x55a5d92fba40 in access_with_adjusted_size system/memory.c:573:18 #3 0x55a5d92f842c in memory_region_dispatch_read1 system/memory.c:1426:16 #4 0x55a5d92f7b68 in memory_region_dispatch_read system/memory.c:1459:9 #5 0x55a5d9376ad1 in flatview_read_continue_step system/physmem.c:2836:18 #6 0x55a5d9376399 in flatview_read_continue system/physmem.c:2877:19 #7 0x55a5d93775b8 in flatview_read system/physmem.c:2907:12 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2355 Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au>
2024-07-02Remove inclusion of hw/hw.h from files that don't need itThomas Huth
hw/hw.h only contains the prototype of hw_error() nowadays, so files that don't use this function don't need to include this header. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-ID: <20240701132649.58345-1-thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw/ide/macio: switch from using qemu_allocate_irq() to qdev input GPIOsMark Cave-Ayland
This prevents the IRQs from being leaked when the macio IDE device is used. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240628160334.653168-1-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw/i386: remove obsolete manual deprecation reason string of i440fx machinesDaniel P. Berrangé
The automatic deprecation mechanism introduced in the preceeding patches will mark every i440fx machine upto and including 2.12 as deprecated. As such we can revert the manually added deprecation introduced in: commit 792b4fdd4eb8197bd6eb9e80a1dfaf0cb3b54aeb Author: Philippe Mathieu-Daudé <philmd@linaro.org> Date: Wed Feb 28 10:34:35 2024 +0100 hw/i386/pc: Deprecate 2.4 to 2.12 pc-i440fx machines Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240620165742.1711389-14-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw/ppc: remove obsolete manual deprecation reason string of spapr machinesDaniel P. Berrangé
The automatic deprecation mechanism introduced in the preceeding patches will mark every spapr machine upto and including 2.12 as deprecated. As such we can revert the manually added deprecation which was a subset: commit 1392617d35765d5d912625fbb5cab1ffbed8e140 Author: Cédric Le Goater <clg@kaod.org> Date: Tue Jan 23 16:37:02 2024 +1000 spapr: Tag pseries-2.1 - 2.11 machines as deprecated Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240620165742.1711389-13-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw: skip registration of outdated versioned machine typesDaniel P. Berrangé
This calls the MACHINE_VER_DELETION() macro in the machine type registration method, so that when a versioned machine type reaches the end of its life, it is no longer registered with QOM and thus cannot be used. The actual definition of the machine type should be deleted at this point, but experience shows that can easily be forgotten. By skipping registration the manual code deletion task can be done at any later date. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240620165742.1711389-12-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw: set deprecation info for all versioned machine typesDaniel P. Berrangé
This calls the MACHINE_VER_DEPRECATION() macro in the definition of all machine type classes which support versioning. This ensures that they will automatically get deprecation info set when they reach the appropriate point in their lifecycle. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240620165742.1711389-11-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw/i386: convert 'q35' machine definitions to use new macrosDaniel P. Berrangé
This changes the DEFINE_Q35_MACHINE macro to use the common helpers for constructing versioned symbol names and strings, bringing greater consistency across targets. The added benefit is that it avoids the need to repeat the version number thrice in three different formats in the calls to DEFINE_Q35_MACHINE. Due to the odd-ball '4.0.1' machine type version, this commit introduces a DEFINE_Q35_BUGFIX helper, to allow defining of "bugfix" machine types which have a three digit version. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240620165742.1711389-8-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw/i386: convert 'i440fx' machine definitions to use new macrosDaniel P. Berrangé
This changes the DEFINE_I440FX_MACHINE macro to use the common helpers for constructing versioned symbol names and strings, bringing greater consistency across targets. The added benefit is that it avoids the need to repeat the version number thrice in three different formats in the calls to DEFINE_I440FX_MACHINE. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240620165742.1711389-7-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw/m68k: convert 'virt' machine definitions to use new macrosDaniel P. Berrangé
This changes the DEFINE_VIRT_MACHINE macro to use the common helpers for constructing versioned symbol names and strings, bringing greater consistency across targets. A DEFINE_VIRT_MACHINE_AS_LATEST helper is added so that it is not required to pass 'false' for every single historical machine type. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240620165742.1711389-6-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw/ppc: convert 'spapr' machine definitions to use new macrosDaniel P. Berrangé
This changes the DEFINE_SPAPR_MACHINE macro to use the common helpers for constructing versioned symbol names and strings, bringing greater consistency across targets. The added benefit is that it avoids the need to repeat the version number twice in two different formats in the calls to DEFINE_SPAPR_MACHINE. A DEFINE_SPAPR_MACHINE_AS_LATEST helper is added so that it is not required to pass 'false' for every single historical machine type. Due to the odd-ball '2.12-sxxm' machine type version, this commit introduces a DEFINE_SPAPR_MACHINE_TAGGED helper to allow defining of "tagged" machine types which have a string suffix. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-ID: <20240620165742.1711389-5-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw/s390x: convert 'ccw' machine definitions to use new macrosDaniel P. Berrangé
This changes the DEFINE_CCW_MACHINE macro to use the common helpers for constructing versioned symbol names and strings, bringing greater consistency across targets. The added benefit is that it avoids the need to repeat the version number twice in two different formats in the calls to DEFINE_CCW_MACHINE. A DEFINE_CCW_MACHINE_AS_LATEST helper is added so that it is not required to pass 'false' for every single historical machine type. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240620165742.1711389-4-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw/arm: convert 'virt' machine definitions to use new macrosDaniel P. Berrangé
This changes the DEFINE_VIRT_MACHINE macro to use the common helpers for constructing versioned symbol names and strings, bringing greater consistency across targets. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240620165742.1711389-3-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw/net/spapr: prevent potential NULL dereferenceOleg Sviridov
Pointer, returned from function 'spapr_vio_find_by_reg', may be NULL and is dereferenced immediately after. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Oleg Sviridov <oleg.sviridov@red-soft.ru> Message-ID: <20240531073636.3779559-1-oleg.sviridov@red-soft.ru> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-01hw/net/virtio-net.c: fix crash in iov_copy()Dmitry Frolov
A crash found while fuzzing device virtio-net-socket-check-used. Assertion "offset == 0" in iov_copy() fails if less than guest_hdr_len bytes were transmited. Signed-off-by: Dmitry Frolov <frolov@swemel.ru> Message-Id: <20240613143529.602591-2-frolov@swemel.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-01vhost-user: Skip unnecessary duplicated VHOST_USER_SET_LOG_BASE requestsBillXiang
The VHOST_USER_SET_LOG_BASE requests should be categorized into non-vring specific messages, and should be sent only once. If send more than once, dpdk will munmap old log_addr which may has been used and cause segmentation fault. Signed-off-by: BillXiang <xiangwencheng@dayudpu.com> Message-Id: <20240613065150.3100-1-xiangwencheng@dayudpu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-01virtio-iommu: add error check before assertManos Pitsidianakis
A fuzzer case discovered by Zheyu Ma causes an assert failure. Add a check before the assert, and respond with an error before moving on to the next queue element. To reproduce the failure: cat << EOF | \ qemu-system-x86_64 \ -display none -machine accel=qtest -m 512M -machine q35 -nodefaults \ -device virtio-iommu -qtest stdio outl 0xcf8 0x80000804 outw 0xcfc 0x06 outl 0xcf8 0x80000820 outl 0xcfc 0xe0004000 write 0x10000e 0x1 0x01 write 0xe0004020 0x4 0x00001000 write 0xe0004028 0x4 0x00101000 write 0xe000401c 0x1 0x01 write 0x106000 0x1 0x05 write 0x100001 0x1 0x60 write 0x100002 0x1 0x10 write 0x100009 0x1 0x04 write 0x10000c 0x1 0x01 write 0x100018 0x1 0x04 write 0x10001c 0x1 0x02 write 0x101003 0x1 0x01 write 0xe0007001 0x1 0x00 EOF Reported-by: Zheyu Ma <zheyuma97@gmail.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2359 Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Message-Id: <20240613-fuzz-2359-fix-v2-manos.pitsidianakis@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-15 20:24:44 +0000