aboutsummaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2024-07-16hw/sd/sdcard: Basis for eMMC supportPhilippe Mathieu-Daudé
Since eMMC are soldered on boards, it is not user-creatable. RCA register is initialized to 0x0001, per spec v4.3, chapter 8.5 "RCA register": The default value of the RCA register is 0x0001. The value 0x0000 is reserved to set all cards into the Stand-by State with CMD7. The CSD register is very similar to SD one, except the version announced is v4.3. eMMC CID register is slightly different from SD: - One extra PNM (5 -> 6) - MDT is only 1 byte (2 -> 1). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240712162719.88165-2-philmd@linaro.org>
2024-07-16ui/console: Remove dpy_cursor_define_supported()Akihiko Odaki
Remove dpy_cursor_define_supported() as it brings no benefit today and it has a few inherent problems. All graphical displays except egl-headless support cursor composition without DMA-BUF, and egl-headless is meant to be used in conjunction with another graphical display, so dpy_cursor_define_supported() always returns true and meaningless. Even if we add a new display without cursor composition in the future, dpy_cursor_define_supported() will be problematic as a cursor display fix for it because some display devices like virtio-gpu cannot tell the lack of cursor composition capability to the guest and are unable to utilize the value the function returns. Therefore, all non-headless graphical displays must actually implement cursor composition for correct cursor display. Another problem with dpy_cursor_define_supported() is that it returns true even if only some of the display listeners support cursor composition, which is wrong unless all display listeners that lack cursor composition is headless. Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Phil Dennis-Jordan <phil@philjordan.eu> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-ID: <20240715-cursor-v3-4-afa5b9492dbf@daynix.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16ui/console: Convert mouse visibility parameter into boolAkihiko Odaki
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: Phil Dennis-Jordan <phil@philjordan.eu> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240715-cursor-v3-2-afa5b9492dbf@daynix.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16system/cpus: Add cpu_pause() functionNicholas Piggin
This factors the CPU pause function from pause_all_vcpus() into a new cpu_pause() function, similarly to cpu_resume(). cpu_resume() is moved to keep it next to cpu_pause(). Cc: Philippe Mathieu-Daudé <philmd@linaro.org> Cc: Peter Xu <peterx@redhat.com> Cc: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Xu <peterx@redhat.com> Message-ID: <20240712120247.477133-17-npiggin@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16loader: remove load_image_gzipped function as its not used anywhereAni Sinha
load_image_gzipped() does not seem to be used anywhere. Remove it. Signed-off-by: Ani Sinha <anisinha@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240711072448.32673-1-anisinha@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16include/hw/qdev-core.h: Correct and clarify gpio doc commentsPeter Maydell
The doc comments for the functions for named GPIO inputs and outputs had a couple of problems: * some copy-and-paste errors meant the qdev_connect_gpio_out_named() doc comment had references to input GPIOs that should be to output GPIOs * it wasn't very clear that named GPIOs are arrays and so the connect functions specify a single GPIO line by giving both the name of the array and the index within that array Fix the copy-and-paste errors and slightly expand the text to say that functions are connecting one line in a named GPIO array, not a single named GPIO line. Reported-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240708153312.3109380-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16qemu/timer: Add host ticks function for LoongArchSong Gao
Signed-off-by: Song Gao <gaosong@loongson.cn> Link: https://lore.kernel.org/r/20240716031500.4193498-1-gaosong@loongson.cn Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16disas: Fix build against Capstone v6Gustavo Romero
Capstone v6 made major changes, such as renaming for AArch64, which broke programs using the old headers, like QEMU. However, Capstone v6 provides the CAPSTONE_AARCH64_COMPAT_HEADER compatibility definition allowing to build against v6 with the old definitions, so fix the QEMU build using it. We can lift that definition and switch to the new naming once our supported distros have Capstone v6 in place. Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org> Suggested-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Link: https://lore.kernel.org/r/20240715213943.1210355-1-gustavo.romero@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-16cpu: Free queued CPU workAkihiko Odaki
Running qemu-system-aarch64 -M virt -nographic and terminating it will result in a LeakSanitizer error due to remaining queued CPU work so free it. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Link: https://lore.kernel.org/r/20240714-cpu-v1-1-19c2f8de2055@daynix.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-11Merge tag 'nvme-next-pull-request' of https://gitlab.com/birkelund/qemu into ↵Richard Henderson
staging hw/nvme patches # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmaQHpQACgkQTeGvMW1P # DemukQf+Pqcq75cflBqIyVN84/0eThJxmpoTP0ynGNMKJp+K+oecb5pdgTeDI3Kh # esDOjL8m849r5LFjrjmySrTX8znHPFXdBdqCaOp/MZlgz3NML1guB5EYsizZJ+L6 # K4IRLE/8gzfZHY4yWGmUBuL1VBs8XZV0bXYYlA0xKlO638O0KgVQ/2YpC/44l93J # rEnefSeXIi+/tCYEaX7t2dA+Qfm/qUrcEZBgvhCREi8t8hTzKGHsl2LVKrsFdA5I # QZtTFcqeoJThtzWmxGKqbfFb/qeirBlCfhvTEmUWXlS1z9VNzy0ZuqA2l0Sy05ls # eARbl+JnvV6ic6PikZd8dMSrILjNkQ== # =dLKH # -----END PGP SIGNATURE----- # gpg: Signature made Thu 11 Jul 2024 11:04:04 AM PDT # gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9 # gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown] # gpg: aka "Klaus Jensen <k.jensen@samsung.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838 # Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9 * tag 'nvme-next-pull-request' of https://gitlab.com/birkelund/qemu: hw/nvme: Expand VI/VQ resource to uint32 hw/nvme: Allocate sec-ctrl-list as a dynamic array hw/nvme: separate identify data for sec. ctrl list hw/nvme: add Identify Endurance Group List hw/nvme: fix BAR size mismatch of SR-IOV VF hw/nvme: fix number of PIDs for FDP RUH update hw/nvme: Add support for setting the MQES for the NVMe emulation Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-11hw/nvme: add Identify Endurance Group ListMinwoo Im
Commit 73064edfb864 ("hw/nvme: flexible data placement emulation") intorudced NVMe FDP feature to nvme-subsys and nvme-ctrl with a single endurance group #1 supported. This means that controller should return proper identify data to host with Identify Endurance Group List (CNS 19h). But, yes, only just for the endurance group #1. This patch allows host applications to ask for which endurance group is available and utilize FDP through that endurance group. Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Signed-off-by: Minwoo Im <minwoo.im@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2024-07-11hw/misc: In STM32L4x5 EXTI, consolidate 2 constantsInès Varhol
Up until now, the EXTI implementation had 16 inbound GPIOs connected to the 16 outbound GPIOs of STM32L4x5 SYSCFG. The EXTI actually handles 40 lines (namely 5 from STM32L4x5 USART devices which are already implemented in QEMU). In order to connect USART devices to EXTI, this commit consolidates constants `EXTI_NUM_INTERRUPT_OUT_LINES` (40) and `EXTI_NUM_GPIO_EVENT_IN_LINES` (16) into `EXTI_NUM_LINES` (40). Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240707085927.122867-2-ines.varhol@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-07-11accel/tcg: Make TCGCPUOps::cpu_exec_halt mandatoryPeter Maydell
Now that all targets set TCGCPUOps::cpu_exec_halt, we can make it mandatory and remove the fallback handling that calls cpu_has_work. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-09Merge tag 'pull-aspeed-20240709' of https://github.com/legoater/qemu into ↵Richard Henderson
staging aspeed queue: * support AST2700 network # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmaNJCcACgkQUaNDx8/7 # 7KF7pw//So48XdPJhdQukO/PDLGSYL8rRjDfZbQFLLw10MozcZZ/Nz/BCzrNxJRg # rHP/shyO3XL1YZ6U1LNXk6E845giVriSpRRjGX9CuK4fypM9xom6qAIOtOLeH7hG # iTMW++IxN/JgVmVOKYn3C+2+odiq6NzZxFrblVtGPUDtNkkC9BaYGHnccMsl5zQh # LOSPJxqLiiuDjZPqdwa4fMbtEeNTU3A0WLlWxX7yPfJt2T20a4wE6bdWVGcI6fiV # QbCmLLrMXhuZFx+uT4B2hbHi+hGS5H+F3QBOefum6z+i9NEbfAZSyusd8/qTEify # fSBqxL4LD6K4WKL1Hg9959cBcm5zWgPXk7znus4E/TZuUTdSHaPC7clESIcYqWPS # veEAppmHneO4cdmK1m+Gv4gpWD/adS4ZfV7O+C3z149ms0gL4JrK6QndPdE5QuIW # u47PhIT3oIM0WznnMusoCndFxs6Gl/GBkzdxW0gdoJKBRfymbsroWeZamAWTznbV # mL8Td8bEP/NcV40cm1PtpZyl7j0MzxcKDUHKv9ioQTXLUpkl5LSsIGmd1m78WRlE # J6bUJ3jqQT6/s5i3TVqTGe7xuqMkg+9Er8rn5nAWgSronsf4nprAfOU8Lj+b06BM # YRroGgU2lAQrv17liQExrG3Tj1SH+oEp1q0qEq7qo824HlGjBkI= # =UygB # -----END PGP SIGNATURE----- # gpg: Signature made Tue 09 Jul 2024 04:51:03 AM PDT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@kaod.org>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-aspeed-20240709' of https://github.com/legoater/qemu: machine_aspeed.py: update to test network for AST2700 machine_aspeed.py: update to test ASPEED OpenBMC SDK v09.02 for AST2700 hw/block: m25p80: support quad mode for w25q01jvq aspeed/soc: set dma64 property for AST2700 ftgmac100 hw/net:ftgmac100: update TX and RX packet buffers address to 64 bits hw/net:ftgmac100: introduce TX and RX ring base address high registers to support 64 bits hw/net:ftgmac100: update ring base address to 64 bits hw/net:ftgmac100: update memory region size to 64KB Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-09memory: remove IOMMU MR iommu_set_page_size_mask() callbackEric Auger
Everything is now in place to use the Host IOMMU Device callbacks to retrieve the page size mask usable with a given assigned device. This new method brings the advantage to pass the info much earlier to the virtual IOMMU and before the IOMMU MR gets enabled. So let's remove the call to memory_region_iommu_set_page_size_mask in vfio common.c and remove the single implementation of the IOMMU MR callback in the virtio-iommu.c Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-09HostIOMMUDevice: Introduce get_page_size_mask() callbackEric Auger
This callback will be used to retrieve the page size mask supported along a given Host IOMMU device. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-09HostIOMMUDevice : remove Error handle from get_iova_ranges callbackEric Auger
The error handle argument is not used anywhere. let's remove it. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-09vfio-container-base: Introduce vfio_container_get_iova_ranges() helperEric Auger
Introduce vfio_container_get_iova_ranges() to retrieve the usable IOVA regions of the base container and use it in the Host IOMMU device implementations of get_iova_ranges() callback. We also fix a UAF bug as the list was shallow copied while g_list_free_full() was used both on the single call site, in virtio_iommu_set_iommu_device() but also in vfio_container_instance_finalize(). Instead use g_list_copy_deep. Fixes: cf2647a76e ("virtio-iommu: Compute host reserved regions") Signed-off-by: Eric Auger <eric.auger@redhat.com> Suggested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-09hw/net:ftgmac100: introduce TX and RX ring base address high registers to ↵Jamin Lin
support 64 bits ASPEED AST2700 SOC is a 64 bits quad core CPUs (Cortex-a35) And the base address of dram is "0x4 00000000" which is 64bits address. It have "Normal Priority Transmit Ring Base Address Register High(0x17C)", "High Priority Transmit Ring Base Address Register High(0x184)" and "Receive Ring Base Address Register High(0x18C)" to save the high part physical address of descriptor manager. Ex: TX descriptor manager address [34:0] The "Normal Priority Transmit Ring Base Address Register High(0x17C)" bits [2:0] which corresponds the bits [34:32] of the 64 bits address of the TX ring buffer address. The "Normal Priority Transmit Ring Base Address Register(0x20)" bits [31:0] which corresponds the bits [31:0] of the 64 bits address of the TX ring buffer address. Introduce a new sub region which size is 0x100 for the set of new registers and map it at 0x100 in the container region. This sub region range is from 0x100 to 0x1ff. Introduce a new property and object attribute to activate the region for new registers. Introduce a new memop handlers for the new register read and write. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com>
2024-07-09hw/net:ftgmac100: update ring base address to 64 bitsJamin Lin
Update TX and RX ring base address data type to uint64_t for 64 bits dram address DMA support. Both "Normal Priority Transmit Ring Base Address Register(0x20)" and "Receive Ring Base Address Register (0x24)" are used for saving the low part physical address of descriptor manager. Therefore, changes to set TX and RX descriptor manager address bits [31:0] in ftgmac100_read and ftgmac100_write functions. Incrementing the version of vmstate to 2. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com>
2024-07-09hw/net:ftgmac100: update memory region size to 64KBJamin Lin
According to the datasheet of ASPEED SOCs, one MAC controller owns 128KB of register space for AST2500. However, one MAC controller only owns 64KB of register space for AST2600 and AST2700. It set the memory region size 128KB and it occupied another controllers Address Spaces. Update one MAC controller memory region size to 0x1000 because AST2500 did not use register spaces over than 64KB. Introduce a new container region size to 0x1000 and its range is from 0 to 0xfff. This container is mapped a sub region for the current set of register. This sub region range is from 0 to 0xff. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com>
2024-07-05hw/sd/sdcard: Introduce set_csd/set_cid handlersPhilippe Mathieu-Daudé
In preparation of introducing eMMC support which have different CSD/CID structures, introduce a pair of handlers in SDCardClass. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-82-philmd@linaro.org>
2024-07-05hw/sd/sdcard: Remove sd_none enum from sd_cmd_type_tPhilippe Mathieu-Daudé
All handlers using the 'sd_none' enum got converted, remove it. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-76-philmd@linaro.org>
2024-07-05gdbstub: Pass CPU context to command handlerGustavo Romero
Allow passing the current CPU context to command handlers via user_ctx when the handler requires it. Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org> Message-Id: <20240628050850.536447-9-gustavo.romero@linaro.org> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-38-alex.bennee@linaro.org>
2024-07-05gdbstub: Make hex conversion function non-internalGustavo Romero
Make gdb_hextomem non-internal so it's not confined to use only in gdbstub.c. Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240628050850.536447-8-gustavo.romero@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-37-alex.bennee@linaro.org>
2024-07-05gdbstub: Add support for target-specific stubsGustavo Romero
Currently, it's not possible to have stubs specific to a given target, even though there are GDB features which are target-specific, like, for instance, memory tagging. This commit introduces gdb_extend_qsupported_features, gdb_extend_query_table, and gdb_extend_set_table functions as interfaces to extend the qSupported string, the query handler table, and the set handler table, allowing target-specific stub implementations. Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240628050850.536447-4-gustavo.romero@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-33-alex.bennee@linaro.org>
2024-07-05gdbstub: Move GdbCmdParseEntry into a new header fileGustavo Romero
Move GdbCmdParseEntry and its associated types into a separate header file to allow the use of GdbCmdParseEntry and other gdbstub command functions outside of gdbstub.c. Since GdbCmdParseEntry and get_param are now public, kdoc GdbCmdParseEntry and rename get_param to gdb_get_cmd_param. This commit also makes gdb_put_packet public since is used in gdbstub command handling. Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240628050850.536447-3-gustavo.romero@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-32-alex.bennee@linaro.org>
2024-07-05plugins: Free CPUPluginState before destroying vCPU statePhilippe Mathieu-Daudé
cpu::plugin_state is allocated in cpu_common_initfn() when the vCPU state is created. Release it in cpu_common_finalize() when we are done. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240606124010.2460-3-philmd@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-29-alex.bennee@linaro.org>
2024-07-03Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Richard Henderson
into staging virtio: features,fixes A bunch of improvements: - vhost dirty log is now only scanned once, not once per device - virtio and vhost now support VIRTIO_F_NOTIFICATION_DATA - cxl gained DCD emulation support - pvpanic gained shutdown support - beginning of patchset for Generic Port Affinity Structure - s3 support - friendlier error messages when boot fails on some illegal configs - for vhost-user, VHOST_USER_SET_LOG_BASE is now only sent once - part of vhost-user support for any POSIX system - not yet enabled due to qtest failures - sr-iov VF setup code has been reworked significantly - new tests, particularly for risc-v ACPI - bugfixes Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmaF068PHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRp+DMIAMC//mBXIZlPprfhb5cuZklxYi31Acgu5TUr # njqjCkN+mFhXXZuc3B67xmrQ066IEPtsbzCjSnzuU41YK4tjvO1g+LgYJBv41G16 # va2k8vFM5pdvRA+UC9li1CCIPxiEcszxOdzZemj3szWLVLLUmwsc5OZLWWeFA5m8 # vXrrT9miODUz3z8/Xn/TVpxnmD6glKYIRK/IJRzzC4Qqqwb5H3ji/BJV27cDUtdC # w6ns5RYIj5j4uAiG8wQNDggA1bMsTxFxThRDUwxlxaIwAcexrf1oRnxGRePA7PVG # BXrt5yodrZYR2sR6svmOOIF3wPMUDKdlAItTcEgYyxaVo5rAdpc= # =p9h4 # -----END PGP SIGNATURE----- # gpg: Signature made Wed 03 Jul 2024 03:41:51 PM PDT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [undefined] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (85 commits) hw/pci: Replace -1 with UINT32_MAX for romsize pcie_sriov: Register VFs after migration pcie_sriov: Remove num_vfs from PCIESriovPF pcie_sriov: Release VFs failed to realize pcie_sriov: Reuse SR-IOV VF device instances pcie_sriov: Ensure VF function number does not overflow pcie_sriov: Do not manually unrealize hw/ppc/spapr_pci: Do not reject VFs created after a PF hw/ppc/spapr_pci: Do not create DT for disabled PCI device hw/pci: Rename has_power to enabled virtio-iommu: Clear IOMMUDevice when VFIO device is unplugged virtio: remove virtio_tswap16s() call in vring_packed_event_read() hw/cxl/events: Mark cxl-add-dynamic-capacity and cxl-release-dynamic-capcity unstable hw/cxl/events: Improve QMP interfaces and documentation for add/release dynamic capacity. tests/data/acpi/rebuild-expected-aml.sh: Add RISC-V pc-bios/meson.build: Add support for RISC-V in unpack_edk2_blobs meson.build: Add RISC-V to the edk2-target list tests/data/acpi/virt: Move ARM64 ACPI tables under aarch64/${machine} path tests/data/acpi: Move x86 ACPI tables under x86/${machine} path tests/qtest/bios-tables-test.c: Set "arch" for x86 tests ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-03pcie_sriov: Register VFs after migrationAkihiko Odaki
pcie_sriov doesn't have code to restore its state after migration, but igb, which uses pcie_sriov, naively claimed its migration capability. Add code to register VFs after migration and fix igb migration. Fixes: 3a977deebe6b ("Intrdocue igb device emulation") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-reuse-v10-9-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-03pcie_sriov: Remove num_vfs from PCIESriovPFAkihiko Odaki
num_vfs is not migrated so use PCI_SRIOV_CTRL_VFE and PCI_SRIOV_NUM_VF instead. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-reuse-v10-8-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-03pcie_sriov: Reuse SR-IOV VF device instancesAkihiko Odaki
Disable SR-IOV VF devices by reusing code to power down PCI devices instead of removing them when the guest requests to disable VFs. This allows to realize devices and report VF realization errors at PF realization time. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-reuse-v10-6-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-03pcie_sriov: Ensure VF function number does not overflowAkihiko Odaki
pci_new() aborts when creating a VF with a function number equals to or is greater than PCI_DEVFN_MAX. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-reuse-v10-5-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-03hw/pci: Rename has_power to enabledAkihiko Odaki
The renamed state will not only represent powering state of PFs, but also represent SR-IOV VF enablement in the future. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-reuse-v10-1-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-03hw/virtio: Fix the de-initialization of vhost-user devicesThomas Huth
The unrealize functions of the various vhost-user devices are calling the corresponding vhost_*_set_status() functions with a status of 0 to shut down the device correctly. Now these vhost_*_set_status() functions all follow this scheme: bool should_start = virtio_device_should_start(vdev, status); if (vhost_dev_is_started(&vvc->vhost_dev) == should_start) { return; } if (should_start) { /* ... do the initialization stuff ... */ } else { /* ... do the cleanup stuff ... */ } The problem here is virtio_device_should_start(vdev, 0) currently always returns "true" since it internally only looks at vdev->started instead of looking at the "status" parameter. Thus once the device got started once, virtio_device_should_start() always returns true and thus the vhost_*_set_status() functions return early, without ever doing any clean-up when being called with status == 0. This causes e.g. problems when trying to hot-plug and hot-unplug a vhost user devices multiple times since the de-initialization step is completely skipped during the unplug operation. This bug has been introduced in commit 9f6bcfd99f ("hw/virtio: move vm_running check to virtio_device_started") which replaced should_start = status & VIRTIO_CONFIG_S_DRIVER_OK; with should_start = virtio_device_started(vdev, status); which later got replaced by virtio_device_should_start(). This blocked the possibility to set should_start to false in case the status flag VIRTIO_CONFIG_S_DRIVER_OK was not set. Fix it by adjusting the virtio_device_should_start() function to only consider the status flag instead of vdev->started. Since this function is only used in the various vhost_*_set_status() functions for exactly the same purpose, it should be fine to fix it in this central place there without any risk to change the behavior of other code. Fixes: 9f6bcfd99f ("hw/virtio: move vm_running check to virtio_device_started") Buglink: https://issues.redhat.com/browse/RHEL-40708 Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20240618121958.88673-1-thuth@redhat.com> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-02Merge tag 'pull-request-2024-07-02' of https://gitlab.com/thuth/qemu into ↵Richard Henderson
staging * Fix interrupt controller migration on s390x with TCG and enable qtest * Fix memory leaks in qtests * Use a proper qom-tree parent for s390x virtio-net devices * Add hotplug avocado test for virtio-blk * Fix Travis jobs (need python3-tomli now) # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmaD1qsRHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbWOtg//a+6nRcV8crCGzMaxhH32NxcjvV7TPiAI # FioqOsomKfKKTMIDlbjsgQiQWqGrN/mdnxSzasypxZrC3eoDYJCIUyQfR2iGe4t2 # JJ4gQhQGuXkSstGErj8yw83UnG1drG+XuZ/psSij4/R2ft6Me8miFSh3cCgIm541 # 0DtffV6rAXIEqA+bswKsPq+7bq6ZCxZjaWgKhzfP5RNnpjPvHYMDDPZt9a2Fk9xC # d3TILh/0djuVr8nZNUkQJBT5EU6dxVDb1JMqn4G6e6kWtiDBh/XwvMtC0KHVCJH1 # tHDz7n+FpwBfpo1cz0Y/Bn9pTW4K9KZ+GVlLOihfbh7Eaix0+RPzLKCigLVg1v8I # HaNFr70FxF5Xzmvie36arEKf0CwQCinxvfM9USBD0uP3tOzSZwX2XxM0+FBIjUf3 # fYIY8qV1hQZM5tXFxtU5LW4A64pVGwEHlEIcodxo8mY/DnZUdIvB5L5C4rxATnVr # t2eWc23sGdMZgKxUtlG0PIr80ImkYBWFOLztUmDPOff6igiyw2ZxaLQHyERPEc0O # 1CL4K4K5FKNtJgjSwJyU1NquGKk85vUSjiUW1JOvInUFjRECIQ7+R41p6FU+eTHO # l50cKaf2TCWqDOwMOjFYOHj6TWZGXnTmkSN60g0OLioy3UY+Kghd2Zq+aTK5ptyh # 1BhcvTin9Zg= # =lLG3 # -----END PGP SIGNATURE----- # gpg: Signature made Tue 02 Jul 2024 03:30:03 AM PDT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] * tag 'pull-request-2024-07-02' of https://gitlab.com/thuth/qemu: pc-bios/s390-ccw: Remove duplicated LDFLAGS .travis.yml: Install python3-tomli in all build jobs tests/avocado: add hotplug_blk test hw/s390x: Attach default virtio-net devices to the /machine/virtual-css-bridge docs: add precision about capstone for execlog plugin tests/qtest: Free GThread tests/qtest: Free paths tests/qtest: Free old machine variable name tests/qtest: Free unused QMP response tests/qtest: Use qtest_add_data_func_full() tests/qtest/migration-test: enable on s390x with TCG hw/intc/s390_flic: Fix interrupt controller migration on s390x with TCG Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-02Merge tag 'sdmmc-20240702' of https://github.com/philmd/qemu into stagingRichard Henderson
SD/MMC patches queue - Deprecate SD spec v1.10 - Improve tracing - Fix endianness on DAT lines - Introduce helpers for commands transmitting data on the DAT lines - Convert most commands to new helpers - Register various optional commands - Add command {name, type, class} fields to SDProto structure # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmaDtrEACgkQ4+MsLN6t # wN7wABAAjjo+8ZYTxyh+P5oPvv4ec0SLFyTzOyDlzl/8rif9l54UP1kvBGtDYBaF # hdHM/BguTQVdomObCrjmcXLmb/+ZnQ23x8Bn8rm1mqjXmV8UvuZ9KReAhQeEgBNN # rtWClQqgtuBAbhh2uh0zNmwPhzCavSostd5nQtJXvUfCZUIyTmUBqUNFCZc+RkGy # q6kUDzlgrH7uLzVMU5M6QvmOT1LbmWGQAdV+zWXBKXEBgysxzmm6bC7wRCoN+wPQ # 9OtdHEZsxEDaIJFK7YcDu0lCOsGFzu62d8N7TA/v4nIWaxrppm4FK7kxgmsO15uY # jEq3p2PbDj6UVYrqGpuw4qMcJ0Cs6dkGEfCw9eqwYyhAPd/Y+s/NBAgc6BieZWj6 # D32goEWykLorxu9sPGgR9qNWo7gbHanMo4ps3v4++D8Qtb3CpANXDIC5H1WR9azH # tdiepDx0nW9bSo/hE32bL70TA8noqUCsrr1yIN7eydpJ2ZTa2ywMfIifLnowoOD2 # mPQ/QvUsAwJdjGXsz21loQdycOsuBmqZ4bKU45ez3bxKdq1LFC4q6xsVPeS0UVFy # 6dSj2Bi44Y+Ub/UoNij2/6WzuIfNtSKXrs47et2v2SFjuPJt0g34cv3mLCz6CQQZ # 2WFk42vyGSZ9gmWmt+G64nksQlifVWnGQP6jub9ThQ5rxqzFTU0= # =vqY+ # -----END PGP SIGNATURE----- # gpg: Signature made Tue 02 Jul 2024 01:13:37 AM PDT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'sdmmc-20240702' of https://github.com/philmd/qemu: (67 commits) hw/sd/sdcard: Add sd_acmd_SEND_SCR handler (ACMD51) hw/sd/sdcard: Add sd_acmd_SET_CLR_CARD_DETECT handler (ACMD42) hw/sd/sdcard: Add sd_acmd_SD_APP_OP_COND handler (ACMD41) hw/sd/sdcard: Add sd_acmd_SET_WR_BLK_ERASE_COUNT handler (ACMD23) hw/sd/sdcard: Add sd_acmd_SEND_NUM_WR_BLOCKS handler (ACMD22) hw/sd/sdcard: Add sd_acmd_SD_STATUS handler (ACMD13) hw/sd/sdcard: Add sd_acmd_SET_BUS_WIDTH handler (ACMD6) hw/sd/sdcard: Add spi_cmd_CRC_ON_OFF handler (CMD59) hw/sd/sdcard: Add spi_cmd_READ_OCR handler (CMD58) hw/sd/sdcard: Add sd_cmd_APP_CMD handler (CMD55) hw/sd/sdcard: Add sd_cmd_LOCK_UNLOCK handler (CMD42) hw/sd/sdcard: Add sd_cmd_ERASE handler (CMD38) hw/sd/sdcard: Add sd_cmd_ERASE_WR_BLK_START/END handlers (CMD32 & CMD33) hw/sd/sdcard: Add sd_cmd_SEND_WRITE_PROT handler (CMD30) hw/sd/sdcard: Add sd_cmd_SET/CLR_WRITE_PROT handler (CMD28 & CMD29) hw/sd/sdcard: Add sd_cmd_PROGRAM_CSD handler (CMD27) hw/sd/sdcard: Add sd_cmd_WRITE_SINGLE_BLOCK handler (CMD24) hw/sd/sdcard: Add sd_cmd_READ_SINGLE_BLOCK handler (CMD17) hw/sd/sdcard: Add sd_cmd_SET_BLOCKLEN handler (CMD16) hw/sd/sdcard: Add sd_cmd_GO_INACTIVE_STATE handler (CMD15) ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-02Merge tag 'pull-aspeed-20240702' of https://github.com/legoater/qemu into ↵Richard Henderson
staging aspeed queue: * Coverity fixes * Deprecation of tacoma-bmc machine * Buffer overflow fix in GPIO model * Minor cleanup # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmaDs3QACgkQUaNDx8/7 # 7KEc/BAAj5AS3rLm3NPpU13y1P1hcjuSm1/PVGTJQH+m4K9UaAkJ8VhRB0Y/rdU6 # ygGhKaCHyk96+I49Csz886YU9Wg9qnxaYJAbornHZJVGNy5tuVpQKM20kfgN3XFN # ENJR3e+J6Ye7kCtR1ujcf0mydWDaDyq0i82ykURsudcQLMnGq1gBQGadYjt1hJoN # F9HDPgUJ8/wjQnG8BomsrnuvUSpRTbGNV66FNxXdQ6C6d6OTKQfNnXXqrKO+8QPK # B5XB9FjTk017DUog1jdE1SaEMowml8CmUhjMwLHOcyWhcZpEk90aMX8cQhefUs9y # O6kNin2UYEjcTHA/lyfMQJQMNDDZTE32MyP1LwRE/5ZiHqrT7ViqNvZSPBGBueUz # 9B0xiQTuYqcRqlwgyU73DvnTgrsKFdKQSldj5dXYVnWCKeKY/sCWApHMJxN9xMCA # Uw1E4QfCLkd+TM6DoJAkBHWFsgi44Aym11VU4VviGNRNTgmTptgQzmHiYGNFiGZG # OypVPM8Ti6UeVnW65l9J9f7xA0jDB+XQjhCCaoax9GlUMA4C4/Aln5OXXxIWRWFd # XA3Gn3c/S2j7rMqdfAk68xDHuAJ3wShHlw6HLRd1Xki05WFTeLj1lejLHMdfpNmr # DkQimzHShBqZzZGxc7FsO0keGY8kyIJkZhbCCbZrFXJXQGRdBao= # =LxwO # -----END PGP SIGNATURE----- # gpg: Signature made Tue 02 Jul 2024 12:59:48 AM PDT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@kaod.org>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-aspeed-20240702' of https://github.com/legoater/qemu: hw/net:ftgmac100: fix coding style aspeed/sdmc: Remove extra R_MAIN_STATUS case aspeed/soc: Fix possible divide by zero aspeed/sdmc: Check RAM size value at realize time aspeed: Deprecate the tacoma-bmc machine hw/gpio/aspeed: Add reg_table_count to AspeedGPIOClass Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-02Merge tag 'hw-misc-20240702' of https://github.com/philmd/qemu into stagingRichard Henderson
Misc HW patches queue - Prevent NULL deref in sPAPR network model (Oleg) - Automatic deprecation of versioned machine types (Daniel) - Correct 'dump-guest-core' property name in hint (Akihiko) - Prevent IRQ leak in MacIO IDE model (Mark) - Remove dead #ifdef'ry related to unsupported macOS 12.0 (Akihiko) - Remove "hw/hw.h" where unnecessary (Thomas) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmaDiSQACgkQ4+MsLN6t # wN4jmBAA2kxwFAGbKvokANDAZBwWmJdnuIPcqS+jdo/wCuQXOo1ROADd3NFlgQWx # z1xOv/LiAmQiUeeiP+nlA8gWCdW93PErU07og1p1+N2D1sBO6oG5QDlT/tTFuEGd # IL21jG2xWkEemd3PSN2pHKrytpS0e4S0cNZIKgTUTKdv+Mb2ZEiQi7K4zUTjcmjz # nlsSjTXdyKBmoiqNGhITWfbR2IUWjtCpzUO44ceqXd5HDpvfGhpKI7Uwun1W2xNU # yw1XrAFd64Qhd/lvc28G1DLfDdtRIoaRGxgLzQbU6621s0o50Ecs6TNHseuUAKvd # tQhOtM8IEuZ6jVw8nswCPIcJyjbeY29kjI4WmD2weF1fZbDey6Emlrf+dkJUIuCb # TximyTXw3rb1nREUVsEQLF69BKjTjE5+ETaplcTWGHCoH2+uA/5MqygalTH1Ub9W # TwVWSUwpNvIJ3RTsT20YVowkill8piF+ECldTKzJuWjqDviiJDoMm5EFdkkcUB20 # nMyhGoiXtiQ4NYU0/B6HbHOXZkqLbhWcx9G281xJ+RRwjUyVxXD3zHGR9AoOp9ls # EAo/2URJtGN95LJmzCtaD+oo0wRZ5+7lmnqHPPXkYUdwFm4bhe3dP4NggIrS0cXn # 19wvBqQuPwywxIbFEu6327YtfPRcImWIlFthWnm9lUyDmbOqDKw= # =fLCx # -----END PGP SIGNATURE----- # gpg: Signature made Mon 01 Jul 2024 09:59:16 PM PDT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'hw-misc-20240702' of https://github.com/philmd/qemu: (22 commits) Remove inclusion of hw/hw.h from files that don't need it net/vmnet: Drop ifdef for macOS versions older than 12.0 block/file-posix: Drop ifdef for macOS versions older than 12.0 audio: Drop ifdef for macOS versions older than 12.0 hvf: Drop ifdef for macOS versions older than 12.0 hw/ide/macio: switch from using qemu_allocate_irq() to qdev input GPIOs system/physmem: Fix reference to dump-guest-core docs: document special exception for machine type deprecation & removal hw/i386: remove obsolete manual deprecation reason string of i440fx machines hw/ppc: remove obsolete manual deprecation reason string of spapr machines hw: skip registration of outdated versioned machine types hw: set deprecation info for all versioned machine types include/hw: temporarily disable deletion of versioned machine types include/hw: add macros for deprecation & removal of versioned machines hw/i386: convert 'q35' machine definitions to use new macros hw/i386: convert 'i440fx' machine definitions to use new macros hw/m68k: convert 'virt' machine definitions to use new macros hw/ppc: convert 'spapr' machine definitions to use new macros hw/s390x: convert 'ccw' machine definitions to use new macros hw/arm: convert 'virt' machine definitions to use new macros ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-02hw/sd/sdcard: Store command type in SDProtoPhilippe Mathieu-Daudé
Store the command type altogether with the command handler and name. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-41-philmd@linaro.org>
2024-07-02hw/intc/s390_flic: Fix interrupt controller migration on s390x with TCGThomas Huth
Migration of a s390x guest with TCG was long known to be very unstable, so the tests in tests/qtest/migration-test.c are disabled if running with TCG instead of KVM. Nicholas Piggin did a great analysis of the problem: "The flic pending state is not migrated, so if the machine is migrated while an interrupt is pending, it can be lost. This shows up in qtest migration test, an extint is pending (due to console writes?) and the CPU waits via s390_cpu_set_psw and expects the interrupt to wake it. However when the flic pending state is lost, s390_cpu_has_int returns false, so s390_cpu_exec_interrupt falls through to halting again." Thus let's finally migrate the pending state, and to be on the safe side, also the other state variables of the QEMUS390FLICState structure. Message-ID: <20240619144421.261342-1-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-07-02hw/gpio/aspeed: Add reg_table_count to AspeedGPIOClassZheyu Ma
ASan detected a global-buffer-overflow error in the aspeed_gpio_read() function. This issue occurred when reading beyond the bounds of the reg_table. To enhance the safety and maintainability of the Aspeed GPIO code, this commit introduces a reg_table_count member to the AspeedGPIOClass structure. This change ensures that the size of the GPIO register table is explicitly tracked and initialized, reducing the risk of errors if new register tables are introduced in the future. Reproducer: cat << EOF | qemu-system-aarch64 -display none \ -machine accel=qtest, -m 512M -machine ast1030-evb -qtest stdio readq 0x7e780272 EOF ASAN log indicating the issue: ==2602930==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55a5da29e128 at pc 0x55a5d700dc62 bp 0x7fff096c4e90 sp 0x7fff096c4e88 READ of size 2 at 0x55a5da29e128 thread T0 #0 0x55a5d700dc61 in aspeed_gpio_read hw/gpio/aspeed_gpio.c:564:14 #1 0x55a5d933f3ab in memory_region_read_accessor system/memory.c:445:11 #2 0x55a5d92fba40 in access_with_adjusted_size system/memory.c:573:18 #3 0x55a5d92f842c in memory_region_dispatch_read1 system/memory.c:1426:16 #4 0x55a5d92f7b68 in memory_region_dispatch_read system/memory.c:1459:9 #5 0x55a5d9376ad1 in flatview_read_continue_step system/physmem.c:2836:18 #6 0x55a5d9376399 in flatview_read_continue system/physmem.c:2877:19 #7 0x55a5d93775b8 in flatview_read system/physmem.c:2907:12 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2355 Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au>
2024-07-02Remove inclusion of hw/hw.h from files that don't need itThomas Huth
hw/hw.h only contains the prototype of hw_error() nowadays, so files that don't use this function don't need to include this header. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-ID: <20240701132649.58345-1-thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw/ide/macio: switch from using qemu_allocate_irq() to qdev input GPIOsMark Cave-Ayland
This prevents the IRQs from being leaked when the macio IDE device is used. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240628160334.653168-1-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw: skip registration of outdated versioned machine typesDaniel P. Berrangé
This calls the MACHINE_VER_DELETION() macro in the machine type registration method, so that when a versioned machine type reaches the end of its life, it is no longer registered with QOM and thus cannot be used. The actual definition of the machine type should be deleted at this point, but experience shows that can easily be forgotten. By skipping registration the manual code deletion task can be done at any later date. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240620165742.1711389-12-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw: set deprecation info for all versioned machine typesDaniel P. Berrangé
This calls the MACHINE_VER_DEPRECATION() macro in the definition of all machine type classes which support versioning. This ensures that they will automatically get deprecation info set when they reach the appropriate point in their lifecycle. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240620165742.1711389-11-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02include/hw: temporarily disable deletion of versioned machine typesDaniel P. Berrangé
The new deprecation and deletion policy for versioned machine types is being introduced in QEMU 9.1.0. Under the new policy a number of old machine types (any prior to 2.12) would be liable for immediate deletion which would be a violation of our historical deprecation and removal policy Thus automatic deletions (by skipping QOM registration) are temporarily gated on existance of the env variable "QEMU_DELETE_MACHINES" / QEMU version number >= 10.1.0. This allows opt-in testing of the automatic deletion logic, while activating it fully in QEMU >= 10.1.0. This whole commit should be reverted in the 10.1.0 dev cycle or shortly thereafter. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20240620165742.1711389-10-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02include/hw: add macros for deprecation & removal of versioned machinesDaniel P. Berrangé
Versioned machines live for a long time to provide back compat for incoming migration and restore of saved images. To guide users away from usage of old machines, however, we want to deprecate any older than 3 years (equiv of 9 releases), and delete any older than 6 years (equiva of 18 releases). To get a standardized deprecation message and avoid having to remember to manually add it after three years, this introduces two macros to be used by targets when defining versioned machines. * MACHINE_VER_DEPRECATION(major, minor) Automates the task of setting the 'deprecation_reason' field on the machine, if-and-only-if the major/minor version is older than 3 years. * MACHINE_VER_DELETION(major, minor) Simulates the deletion of by skipping registration of the QOM type for a versioned machine, if-and-only-if the major/minor version is older than 6 years. By using these two macros there is no longer any manual work required per-release to deprecate old machines. By preventing the use of machines that have reached their deletion date, it is also not necessary to manually delete machines per-release. Deletion can be batched up once a year or whenever makes most sense. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240620165742.1711389-9-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02hw/i386: convert 'i440fx' machine definitions to use new macrosDaniel P. Berrangé
This changes the DEFINE_I440FX_MACHINE macro to use the common helpers for constructing versioned symbol names and strings, bringing greater consistency across targets. The added benefit is that it avoids the need to repeat the version number thrice in three different formats in the calls to DEFINE_I440FX_MACHINE. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240620165742.1711389-7-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-02include/hw: add helpers for defining versioned machine typesDaniel P. Berrangé
The various targets which define versioned machine types have a bunch of obfuscated macro code for defining unique function and variable names using string concatenation. This adds a couple of helpers to improve the clarity of such code macro. Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-ID: <20240620165742.1711389-2-berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>