aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2022-09-27vfio/common: Fix vfio_iommu_type1_info use after freeAlex Williamson1-17/+19
On error, vfio_get_iommu_info() frees and clears *info, but vfio_connect_container() continues to use the pointer regardless of the return value. Restructure the code such that a failure of this function triggers an error and clean up the remainder of the function, including updating an outdated comment that had drifted from its relevant line of code and using host page size for a default for better compatibility on non-4KB systems. Reported-by: Nicolin Chen <nicolinc@nvidia.com> Link: https://lore.kernel.org/all/20220910004245.2878-1-nicolinc@nvidia.com/ Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Nicolin Chen <nicolinc@nvidia.com> Tested-by: Nicolin Chen <nicolinc@nvidia.com> Link: https://lore.kernel.org/r/166326219630.3388898.12882473157184946072.stgit@omen Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2022-09-27vfio/migration: Fix incorrect initialization value for parameters in ↵Kunkun Jiang1-0/+2
VFIOMigration The structure VFIOMigration of a VFIODevice is allocated and initialized in vfio_migration_init(). "device_state" and "vm_running" are initialized to 0, indicating that VFIO device is_STOP and VM is not-running. The initialization value is incorrect. According to the agreement, default state of VFIO device is _RUNNING. And if a VFIO device is hot-plugged while the VM is running, "vm_running" should be 1. This patch fixes it. Fixes: 02a7e71b1e5b ("vfio: Add VM state change handler to know state of VM") Signed-off-by: Kunkun Jiang <jiangkunkun@huawei.com> Link: https://lore.kernel.org/r/20220711014651.1327-1-jiangkunkun@huawei.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2022-09-27Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into stagingStefan Hajnoczi4-50/+157
# -----BEGIN PGP SIGNATURE----- # Version: GnuPG v1 # # iQEcBAABAgAGBQJjMqL9AAoJEO8Ells5jWIRUKcH/iNuJpxMXG18pGteBiTu3/ut # KRR9u1nLZZXA2/02NTOYnrrHcplFQkEBXNHaEintWfctKHIP/llY8LDVriDFM+6N # 4PzwLGLe7R9S7rfgt/xMDY0nFESFph5XyVTCxAAUm3Exhm8vIg1FM8Tep8lW/taW # pliDa0K/9pQAfIN+eCnMUtH2JUttak8RwvAg5rXBg7XUx48ZTQn1o7aYYTPOAC2v # RWkX0BKc7FVK5maAhe6Ugrcf6v4R2mDIAvnr+Anvo67SfgFZ5MtCllr0liJ4h3Vd # +/PlsBDJotvht3QZVva1tn1Jk5rhN8N8lZbVOuMsklU/tX3Xrj99HJNETLXks2k= # =82t6 # -----END PGP SIGNATURE----- # gpg: Signature made Tue 27 Sep 2022 03:15:09 EDT # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [full] # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * tag 'net-pull-request' of https://github.com/jasowang/qemu: virtio: del net client if net_init_tap_one failed vdpa: Allow MQ feature in SVQ virtio-net: Update virtio-net curr_queue_pairs in vdpa backends vdpa: validate MQ CVQ commands vdpa: Add vhost_vdpa_net_load_mq vdpa: extract vhost_vdpa_net_load_mac from vhost_vdpa_net_load vdpa: Make VhostVDPAState cvq_cmd_in_buffer control ack type e1000e: set RX desc status with DD flag in a separate operation Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-27Merge tag 'm68k-for-7.2-pull-request' of https://github.com/vivier/qemu-m68k ↵Stefan Hajnoczi4-10/+19
into staging M68k pull request 20220927 Align bootinfo tags fix move from sr # -----BEGIN PGP SIGNATURE----- # # iQJGBAABCAAwFiEEzS913cjjpNwuT1Fz8ww4vT8vvjwFAmMyl5ESHGxhdXJlbnRA # dml2aWVyLmV1AAoJEPMMOL0/L748JGIQAK2xK/DCWCphFWIo9ywhRPupOJb4rEXO # JqhBBmmVx+OZcl/MPsHyQlGuvjustB/K8ZojqII50+ZeVG2ECj9lHn+nBBbU3pXT # bVkV5FWTFMvbxXpfePbZ9wrWZACVPMchEyswOu8scvsH+N9yP8ZrqNBi/MlNQaYR # RCLdHfIUJ43U/KvsOgQxNb2O+ag7wlmPbSk2cuRmGi/cYBHsKRD+kbLp6l5vTqYn # 0n/sNVo0HEL6kl3/IOUKNMpgadcIvoAMsJ8TzXarHfBRbN8baCEeO+Evlc1wkgQE # pB00jx4cyLX0KOlGhM3H7ezqRDdPJkf2nmlFlQ4Of2YE949ZWN9F27CoeptLeyrF # 7UP8MQjumibd6nq8SJSGEN8iMjRLYiTYlRTUeOe18ofoa2JTOeqhfDzWAoVl1XTi # SA/3VmdAW7k18C4Wkm6VnrZDVs6RU60bWlyjLJ9lyc6798dG9eeDZMzNhRgOaKib # J/w6+UKo0T4auEG7iOu2rt9uIWD0MJHXIYqoUYoKrRR6pwWbXQ0syljNMz2WT1y7 # kHoyC7moc5a7VTnKY41DGtZwsl0nqwSNsln+BCSwIAj2DjLkUMEZOUV9Lz9BMsEz # RyKKbdVX7iEPQYzKbztdx02sM4E3jEczh1tHOcHxPxF1wsgc1BTP2xNUzUi7ijac # MUJ9HMT++X9i # =u4p1 # -----END PGP SIGNATURE----- # gpg: Signature made Tue 27 Sep 2022 02:26:25 EDT # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * tag 'm68k-for-7.2-pull-request' of https://github.com/vivier/qemu-m68k: m68k: align bootinfo strings and data to 4 bytes target/m68k: use M68K_FEATURE_MOVEFROMSR_PRIV feature for move_from_sr privilege check target/m68k: increase size of m68k CPU features from uint32_t to uint64_t Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-27Merge tag 'pull-request-2022-09-26' of https://gitlab.com/thuth/qemu into ↵Stefan Hajnoczi53-269/+1287
staging * Fix emulation of the LZRF instruction * Fix "noexec" TCG test on s390x * Implement SHA-512 and random number generator instructions * Support for zPCI interpretation on s390x hosts * Removal of the "slirp" submodule # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmMx26URHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbUaOw/7Bu1ghYJyzjR8raXSzOP8KmyltKb0s0zd # rFpagZCeBiNGHAL2IaKHc3vw+oFy/TTWhrFLt+imDo2swDIIAWCb/bY2/snKX4c8 # feF0io7JTdNCWvS/9ng6qL/fGSNM6V2osYyN5fEm46DM7gC3GlAu5vP2TCVoIifw # AXDANd6XngoCAFBdixGNi0yxAmiLCou/1S+lJ7hCbx1oICPPTrzuGBwyQ+IELJOD # DUGFb+Dl4z+tv8OYRhdvoSTCz75IhsAXeny2+coffvW70BDSyhzIAtVeo2azVGvT # aOVRJt+g7H/mJ0vH20M/7pakdwvHs3zciw5oHUJSsEW1HzsqNgl+AEEUzXivipaN # LYp5//klqjjAu12hFQbzmbhD/vUw2+8mRgbJdKOz7rSrZ/K8f+jqIbbU5r8t1oyy # BqLo2i0EVBfAomzbHMD/kmrumiSNIlfSDwScAoIKAO6P3oy/Sg2twMhPlFRWAnI0 # 46dQS1rLuU0nV4tMCAQoXxRxjQXytCOhaF9G+qe9ogLufHG+Uy+j3IeunyAUl9GR # EcnRB0GFjWfZKeUsR9qev2pvgOZXeg4u+wpjGM7pmfpZw89nBqCj0UVAthXlSKoz # ru3HcuBJTBtxwYkSCsPMEDCk/FhJN0D+N205qg+6SY28R57WjTPFLvZPRmhkH03E # jN8rurLISAM= # =FeSy # -----END PGP SIGNATURE----- # gpg: Signature made Mon 26 Sep 2022 13:04:37 EDT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2022-09-26' of https://gitlab.com/thuth/qemu: Remove the slirp submodule (i.e. compile only with an external libslirp) s390x/s390-virtio-ccw: add zpcii-disable machine property s390x/pci: reflect proper maxstbl for groups of interpreted devices s390x/pci: let intercept devices have separate PCI groups s390x/pci: enable adapter event notification for interpreted devices s390x/pci: don't fence interpreted devices without MSI-X s390x/pci: enable for load/store interpretation s390x/pci: add routine to get host function handle from CLP info Update linux headers to v6.0-rc4 configure: Add -Wno-gnu-variable-sized-type-not-at-end target/s390x: support PRNO_TRNG instruction target/s390x: support SHA-512 extensions linux-user/host/s390: Add vector instructions to host_signal_write() s390x/tcg: Fix opcode for lzrf Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-27Merge tag 'kraxel-20220927-pull-request' of https://gitlab.com/kraxel/qemu ↵Stefan Hajnoczi31-205/+903
into staging usb: make usbnet work with xhci. audio: add sndio backend. misc bugfixes for console, xhci, audio, ati-vga and virtio-gpu. # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmMyse8ACgkQTLbY7tPo # cTiLrRAAltoyd++jsmhg2wXuJsfekfec3kOro7T+eSznDWfBRvm7VxJ+gswYBYga # HbEkHjII0yPbOP9WDMhhHx33g2nYdbhDLPKXHdK8MjHTTPxtYP7XmsWkEVpuuzTx # WqeYvGSmUri6QOUz7fd07IhiBT1aQvUQ/vWQ6OhyRVPy41bR8kIbGx3iV0JDxWvz # n3xUZALGLz3QAM0lXRzXPYT9JB/RqdbpMM35HNTpN9/xaZmgFWsyuQXSSm61pTtb # PS+lILDPjgZeYsfsZRyhZaSZrp2f6WOGm1ZdtSM0rvmRKezOzYnG8fm4fqZQLYSj # nrAqUs38sKaM71a3QbpXhDjbv4cpj0K3iSNLmlUq4pgvPiMgwPlgSwwCGlkNDaRo # IA1KON1pMH2A5vvtXEUt5RTkbXxHAAKPdpl5sS6kgbs7dgoKDqzaIPFQELam259Z # 9nbMBqz/d6gm2CFT5ogrY0q511IC5hWtsmbQZkOZeBd5SvhvyJ59DIabFDcw05fG # ixZVapewXYtzFUde2lb8X5qyneUVeGY5D2OJ2uUykHgR2Qz4d3CjXlhnRkLIkMcd # Uu6N1LTkjyuuB86BoTSZxk0iz94OvmyDiXpqwmRaCGcdnTOTj0dKrbRrtHdC2vCo # cBpUAIdyJvDJSm0X8ZWvvv1sMJCAJ7lofFf/P/jUKlacC2ipgXQ= # =QBLK # -----END PGP SIGNATURE----- # gpg: Signature made Tue 27 Sep 2022 04:18:55 EDT # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * tag 'kraxel-20220927-pull-request' of https://gitlab.com/kraxel/qemu: (24 commits) virtio-gpu: update scanout if there is any area covered by the rect hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) audio: remove abort() in audio_bug() Revert "audio: Log context for audio bug" audio: Add sndio backend usbnet: Report link-up via interrupt endpoint in CDC-ECM mode usbnet: Detect short packets as sent by the xHCI controller usbnet: Accept mandatory USB_CDC_SET_ETHERNET_PACKET_FILTER request usbnet: Add missing usb_wakeup() call in usbnet_receive() hcd-xhci: drop operation with secondary stream arrays enabled usb/msd: add usb_msd_fatal_error() and fix guest-triggerable assert usb/msd: move usb_msd_packet_complete() hcd-ohci: Drop ohci_service_iso_td() if ed->head & OHCI_DPTR_MASK is zero hw/usb/hcd-xhci: Check whether DMA accesses fail ui/console: fix three double frees in png_save() ui/vdagent: fix serial reset of guest agent ui/clipboard: reset the serial state on reset ui/vdagent: always reset the clipboard serial on caps ui/clipboard: fix serial priority ui: add some vdagent related traces ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-27Merge tag 'pull-riscv-to-apply-20220927' of ↵Stefan Hajnoczi22-282/+531
https://github.com/alistair23/qemu into staging Second RISC-V PR for QEMU 7.2 * Fixup typos and register addresses for Ibex SPI * Cleanup the RISC-V virt machine documentation * Remove the sideleg and sedeleg CSR macros * Fix the CSR check for cycle{h}, instret{h}, time{h}, hpmcounter3-31{h} * Remove fixed numbering from GDB xml feature files * Allow setting the resetvec for the OpenTitan machine * Check the correct exception cause in vector GDB stub * Fix inheritance of SiFiveEState * Improvements to the RISC-V debugger spec * Simplify some vector code # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCAAdFiEE9sSsRtSTSGjTuM6PIeENKd+XcFQFAmMymHIACgkQIeENKd+X # cFQPxwf8DhYeJ+Ctsi9/fFTIHLAE3ciZ15Hf/BJGc5maeVGupYG64+9Cs0fGX4bY # CBlmE5xqn8hanEQXTQxmbC3AoNyykRV+arUrdawlUrJR5hQy/PNVq4yTxFPHcEjJ # bOsQxkMvMzZiWbJfG8SZObXfFZ+6HjWd2qjbCUwyVAa5mWDHsuPy22/RDcaR9KSV # Sb217kNIY3a2WkDUrY84zqOfks3NDFA1GuCge7EcQGV9iPxH06KO3ANpGvCE/31i # FnfA9qUu7ts+ls2lSj+2ARsZUzMciZuC3ggTRYIKbyf0QNTK6fILuzlMPPvf0ORZ # vbq8rSTDPrWzmrLskba1jADbWPtiXA== # =b3zl # -----END PGP SIGNATURE----- # gpg: Signature made Tue 27 Sep 2022 02:30:10 EDT # gpg: using RSA key F6C4AC46D4934868D3B8CE8F21E10D29DF977054 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: F6C4 AC46 D493 4868 D3B8 CE8F 21E1 0D29 DF97 7054 * tag 'pull-riscv-to-apply-20220927' of https://github.com/alistair23/qemu: (22 commits) target/riscv: rvv-1.0: vf[w]redsum distinguish between ordered/unordered target/riscv: rvv-1.0: Simplify vfwredsum code target/riscv: debug: Add initial support of type 6 trigger target/riscv: debug: Check VU/VS modes for type 2 trigger target/riscv: debug: Create common trigger actions function target/riscv: debug: Introduce tinfo CSR target/riscv: debug: Restrict the range of tselect value can be written target/riscv: debug: Introduce tdata1, tdata2, and tdata3 CSRs target/riscv: debug: Introduce build_tdata1() to build tdata1 register content target/riscv: debug: Determine the trigger type from tdata1.type hw/riscv/sifive_e: Fix inheritance of SiFiveEState target/riscv: Check the correct exception cause in vector GDB stub hw/riscv: opentitan: Expose the resetvec as a SoC property hw/riscv: opentitan: Fixup resetvec target/riscv: Set the CPU resetvec directly target/riscv: remove fixed numbering from GDB xml feature files target/riscv: remove fflags, frm, and fcsr from riscv-*-fpu.xml target/riscv: fix csr check for cycle{h}, instret{h}, time{h}, hpmcounter3-31{h} target/riscv: Remove sideleg and sedeleg docs/system: clean up code escape for riscv virt platform ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-27virtio: del net client if net_init_tap_one failedlu zhipeng1-6/+12
If the net tap initializes successful, but failed during network card hot-plugging, the net-tap will remains, so cleanup. Signed-off-by: lu zhipeng <luzhipeng@cestc.cn> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-27vdpa: Allow MQ feature in SVQEugenio Pérez1-0/+1
Finally enable SVQ with MQ feature. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-27virtio-net: Update virtio-net curr_queue_pairs in vdpa backendsEugenio Pérez1-11/+6
It was returned as error before. Instead of it, simply update the corresponding field so qemu can send it in the migration data. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Si-Wei Liu <si-wei.liu@oracle.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-27vdpa: validate MQ CVQ commandsEugenio Pérez1-0/+9
So we are sure we can update the device model properly before sending to the device. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-27vdpa: Add vhost_vdpa_net_load_mqEugenio Pérez1-0/+26
Same way as with the MAC, restore the expected number of queues at device's start. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-27vdpa: extract vhost_vdpa_net_load_mac from vhost_vdpa_net_loadEugenio Pérez1-22/+40
Since there may be many commands we need to issue to load the NIC state, let's split them in individual functions Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-27vdpa: Make VhostVDPAState cvq_cmd_in_buffer control ack typeEugenio Pérez1-11/+12
This allows to simplify the code. Rename to status while we're at it. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-27e1000e: set RX desc status with DD flag in a separate operationDing Hui1-1/+52
Like commit 034d00d48581 ("e1000: set RX descriptor status in a separate operation"), there is also same issue in e1000e, which would cause lost packets or stop sending packets to VM with DPDK. Do similar fix in e1000e. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/402 Signed-off-by: Ding Hui <dinghui@sangfor.com.cn> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-27virtio-gpu: update scanout if there is any area covered by the rectDongwon Kim1-3/+4
The scanout is currently updated only if the whole rect is inside the scanout space. This is not a correct condition because the scanout should be updated even a small area in the scanout space is covered by the rect. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220909014052.7297-1-dongwon.kim@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638)Philippe Mathieu-Daudé1-3/+3
When building QEMU with DEBUG_ATI defined then running with '-device ati-vga,romfile="" -d unimp,guest_errors -trace ati\*' we get: ati_mm_write 4 0x16c0 DP_CNTL <- 0x1 ati_mm_write 4 0x146c DP_GUI_MASTER_CNTL <- 0x2 ati_mm_write 4 0x16c8 DP_MIX <- 0xff0000 ati_mm_write 4 0x16c4 DP_DATATYPE <- 0x2 ati_mm_write 4 0x224 CRTC_OFFSET <- 0x0 ati_mm_write 4 0x142c DST_PITCH_OFFSET <- 0xfe00000 ati_mm_write 4 0x1420 DST_Y <- 0x3fff ati_mm_write 4 0x1410 DST_HEIGHT <- 0x3fff ati_mm_write 4 0x1588 DST_WIDTH_X <- 0x3fff3fff ati_2d_blt: vram:0x7fff5fa00000 addr:0 ds:0x7fff61273800 stride:2560 bpp:32 rop:0xff ati_2d_blt: 0 0 0, 0 127 0, (0,0) -> (16383,16383) 16383x16383 > ^ ati_2d_blt: pixman_fill(dst:0x7fff5fa00000, stride:254, bpp:8, x:16383, y:16383, w:16383, h:16383, xor:0xff000000) Thread 3 "qemu-system-i38" received signal SIGSEGV, Segmentation fault. (gdb) bt #0 0x00007ffff7f62ce0 in sse2_fill.lto_priv () at /lib64/libpixman-1.so.0 #1 0x00007ffff7f09278 in pixman_fill () at /lib64/libpixman-1.so.0 #2 0x0000555557b5a9af in ati_2d_blt (s=0x631000028800) at hw/display/ati_2d.c:196 #3 0x0000555557b4b5a2 in ati_mm_write (opaque=0x631000028800, addr=5512, data=1073692671, size=4) at hw/display/ati.c:843 #4 0x0000555558b90ec4 in memory_region_write_accessor (mr=0x631000039cc0, addr=5512, ..., size=4, ...) at softmmu/memory.c:492 Commit 584acf34cb0 ("ati-vga: Fix reverse bit blts") introduced the local dst_x and dst_y which adjust the (x, y) coordinates depending on the direction in the SRCCOPY ROP3 operation, but forgot to address the same issue for the PATCOPY, BLACKNESS and WHITENESS operations, which also call pixman_fill(). Fix that now by using the adjusted coordinates in the pixman_fill call, and update the related debug printf(). Reported-by: Qiang Liu <qiangliu@zju.edu.cn> Fixes: 584acf34cb0 ("ati-vga: Fix reverse bit blts") Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Mauro Matteo Cascella <mcascell@redhat.com> Message-Id: <20210906153103.1661195-1-philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27audio: remove abort() in audio_bug()Volker Rümelin1-1/+0
Commit ab32b78cd1 "audio: Simplify audio_bug() removing old code" introduced abort() in audio_bug() for regular builds. audio_bug() was never meant to abort QEMU for the following reasons. - There's code in audio_bug() that expects audio_bug() gets called more than once with error condition true. The variable 'shown' is only 0 on first error. - All call sites test the return code of audio_bug(), print an error context message and handle the errror. - The abort() in audio_bug() enables a class of guest-triggered aborts similar to the Launchpad Bug #1910603 at https://bugs.launchpad.net/bugs/1910603. Fixes: ab32b78cd1 "audio: Simplify audio_bug() removing old code" Buglink: https://bugs.launchpad.net/bugs/1910603 Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20220917131626.7521-2-vr_qemu@t-online.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27Revert "audio: Log context for audio bug"Volker Rümelin2-24/+28
This reverts commit 8e30d39bade3010387177ca23dbc2244352ed4a3. Revert commit 8e30d39bad "audio: Log context for audio bug" to make error propagation work again. Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20220917131626.7521-1-vr_qemu@t-online.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27audio: Add sndio backendAlexandre Ratchov10-5/+632
sndio is the native API used by OpenBSD, although it has been ported to other *BSD's and Linux (packages for Ubuntu, Debian, Void, Arch, etc.). Signed-off-by: Brad Smith <brad@comstyle.com> Signed-off-by: Alexandre Ratchov <alex@caoua.org> Reviewed-by: Volker Rümelin <vr_qemu@t-online.de> Tested-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <YxibXrWsrS3XYQM3@vm1.arverb.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27usbnet: Report link-up via interrupt endpoint in CDC-ECM modeMichael Brown1-6/+21
Signed-off-by: Michael Brown <mcb30@ipxe.org> Message-Id: <20220906183053.3625472-5-mcb30@ipxe.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27usbnet: Detect short packets as sent by the xHCI controllerMichael Brown1-1/+1
The xHCI controller will ignore the endpoint MTU and so may deliver packets of any length. Detect short packets as being any packet that has a length of zero or a length that is not a multiple of the MTU. Signed-off-by: Michael Brown <mcb30@ipxe.org> Message-Id: <20220906183053.3625472-4-mcb30@ipxe.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27usbnet: Accept mandatory USB_CDC_SET_ETHERNET_PACKET_FILTER requestMichael Brown1-0/+6
The USB_CDC_SET_ETHERNET_PACKET_FILTER request is mandatory for CDC-ECM devices. Accept this request, ignoring the actual filter value (to match the existing behaviour for RNDIS). Signed-off-by: Michael Brown <mcb30@ipxe.org> Message-Id: <20220906183053.3625472-3-mcb30@ipxe.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27usbnet: Add missing usb_wakeup() call in usbnet_receive()Michael Brown1-0/+3
usbnet_receive() does not currently wake up the USB endpoint, leading to a dead RX datapath when used with a host controller such as xHCI that relies on being woken up. Fix by adding a call to usb_wakeup() at the end of usbnet_receive(). Signed-off-by: Michael Brown <mcb30@ipxe.org> Message-Id: <20220906183053.3625472-2-mcb30@ipxe.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27hcd-xhci: drop operation with secondary stream arrays enabledQiang Liu1-1/+3
The abort() in xhci_find_stream() can be triggered via enabling the secondary stream arrays by setting linear stream array (LSA) bit (in endpoint context) to 0. We may show warnings and drop this operation. Fixes: 024426acc0a2 ("usb-xhci: usb3 streams") Reported-by: Qiang Liu <cyruscyliu@gmail.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1192 Signed-off-by: Qiang Liu <cyruscyliu@gmail.com> Message-Id: <20220904125926.2141607-1-cyruscyliu@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27usb/msd: add usb_msd_fatal_error() and fix guest-triggerable assertGerd Hoffmann3-1/+31
Add handler for fatal errors. Moves device into error state where it stops responding until the guest resets it. Guest can send illegal requests where scsi command and usb packet transfer directions are inconsistent. Use the new usb_msd_fatal_error() function instead of assert() in that case. Reported-by: Qiang Liu <cyruscyliu@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Qiang Liu <cyruscyliu@gmail.com> Message-Id: <20220830063827.813053-3-kraxel@redhat.com>
2022-09-27usb/msd: move usb_msd_packet_complete()Gerd Hoffmann1-12/+14
Change ordering to avoid adding forward declarations in following patches. Fix comment code style while being at it. No functional change. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20220830063827.813053-2-kraxel@redhat.com>
2022-09-27target/riscv: rvv-1.0: vf[w]redsum distinguish between ordered/unorderedYang Liu4-15/+31
Starting with RVV1.0, the original vf[w]redsum_vs instruction was renamed to vf[w]redusum_vs. The distinction between ordered and unordered is also more consistent with other instructions, although there is no difference in implementation between the two for QEMU. Signed-off-by: Yang Liu <liuyang22@iscas.ac.cn> Acked-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-Id: <20220817074802.20765-2-liuyang22@iscas.ac.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: rvv-1.0: Simplify vfwredsum codeYang Liu1-46/+10
Remove duplicate code by wrapping vfwredsum_vs's OP function. Signed-off-by: Yang Liu <liuyang22@iscas.ac.cn> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-Id: <20220817074802.20765-1-liuyang22@iscas.ac.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: debug: Add initial support of type 6 triggerFrank Chang2-4/+188
Type 6 trigger is similar to a type 2 trigger, but provides additional functionality and should be used instead of type 2 in newer implementations. Signed-off-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20220909134215.1843865-9-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: debug: Check VU/VS modes for type 2 triggerFrank Chang1-0/+10
Type 2 trigger cannot be fired in VU/VS modes. Signed-off-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20220909134215.1843865-8-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: debug: Create common trigger actions functionFrank Chang2-2/+70
Trigger actions are shared among all triggers. Extract to a common function. Signed-off-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> [bmeng: handle the DBG_ACTION_NONE case] Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20220909134215.1843865-7-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: debug: Introduce tinfo CSRFrank Chang4-3/+18
tinfo.info: One bit for each possible type enumerated in tdata1. If the bit is set, then that type is supported by the currently selected trigger. Signed-off-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Message-Id: <20220909134215.1843865-6-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: debug: Restrict the range of tselect value can be writtenFrank Chang1-6/+3
The value of tselect CSR can be written should be limited within the range of supported triggers number. Signed-off-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Message-Id: <20220909134215.1843865-5-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: debug: Introduce tdata1, tdata2, and tdata3 CSRsFrank Chang4-88/+48
Replace type2_trigger_t with the real tdata1, tdata2, and tdata3 CSRs, which allows us to support more types of triggers in the future. Signed-off-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Message-Id: <20220909134215.1843865-4-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: debug: Introduce build_tdata1() to build tdata1 register contentFrank Chang2-5/+12
Introduce build_tdata1() to build tdata1 register content, which can be shared among all types of triggers. Signed-off-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> [bmeng: moved RV{32,64}_DATA_MASK definition to this patch] Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20220909134215.1843865-3-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: debug: Determine the trigger type from tdata1.typeFrank Chang5-67/+140
Current RISC-V debug assumes that only type 2 trigger is supported. To allow more types of triggers to be supported in the future (e.g. type 6 trigger, which is similar to type 2 trigger with additional functionality), we should determine the trigger type from tdata1.type. RV_MAX_TRIGGERS is also introduced in replacement of TRIGGER_TYPE2_NUM. Signed-off-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> [bmeng: fixed MXL_RV128 case, and moved macros to the following patch] Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20220909134215.1843865-2-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-26m68k: align bootinfo strings and data to 4 bytesJason A. Donenfeld1-4/+6
Various tools, such as kexec-tools and m68k-bootinfo, expect each bootinfo entry to be aligned to 4 bytes, not 2 bytes. So adjust the padding to fill this out as such. Also, break apart the padding additions from the other field length additions, so that it's more clear why these magic numbers are being added, and comment them too. Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20220926113900.1256630-2-Jason@zx2c4.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-09-26target/m68k: use M68K_FEATURE_MOVEFROMSR_PRIV feature for move_from_sr ↵Mark Cave-Ayland3-1/+8
privilege check Now that M68K_FEATURE_M68000 has been renamed to M68K_FEATURE_M68K it is easier to see that the privilege exception check is wrong: it is currently only generated for ColdFire CPUs when in fact it should also be generated for Motorola CPUs from the 68010 onwards. Introduce a new M68K_FEATURE_MOVEFROMSR_PRIV feature which is set for all non- Motorola CPUs, and for all Motorola CPUs from the 68010 onwards and use it to determine whether a privilege exception should be generated for the MOVE-from-SR instruction. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220925134804.139706-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-09-26target/m68k: increase size of m68k CPU features from uint32_t to uint64_tMark Cave-Ayland2-5/+5
There are already 32 feature bits in use, so change the size of the m68k CPU features to uint64_t (along with the associated m68k_feature() functions) to allow up to 64 feature bits to be used. At the same time make use of the BIT_ULL() macro when reading/writing the CPU feature bits to improve readability, and also update m68k_feature() to return a bool rather than an int. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220925134804.139706-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-09-27hw/riscv/sifive_e: Fix inheritance of SiFiveEStateBernhard Beschow1-1/+2
SiFiveEState inherits from SysBusDevice while it's TypeInfo claims it to inherit from TYPE_MACHINE. This is an inconsistency which can cause undefined behavior such as memory corruption. Change SiFiveEState to inherit from MachineState since it is registered as a machine. Fixes: 0869490b1c ("riscv: sifive_e: Manually define the machine") Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220922075232.33653-1-shentey@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: Check the correct exception cause in vector GDB stubFrank Chang1-2/+2
After RISCVException enum is introduced, riscv_csrrw_debug() returns RISCV_EXCP_NONE to indicate there's no error. RISC-V vector GDB stub should check the result against RISCV_EXCP_NONE instead of value 0. Otherwise, 'E14' packet would be incorrectly reported for vector CSRs when using "info reg vector" GDB command. Signed-off-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Jim Shu <jim.shu@sifive.com> Reviewed-by: Tommy Wu <tommy.wu@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Message-Id: <20220918083245.13028-1-frank.chang@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27hw/riscv: opentitan: Expose the resetvec as a SoC propertyAlistair Francis2-1/+9
On the OpenTitan hardware the resetvec is fixed at the start of ROM. In QEMU we don't run the ROM code and instead just jump to the next stage. This means we need to be a little more flexible about what the resetvec is. This patch allows us to set the resetvec from the command line with something like this: -global driver=riscv.lowrisc.ibex.soc,property=resetvec,value=0x20000400 This way as the next stage changes we can update the resetvec. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220914101108.82571-4-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27hw/riscv: opentitan: Fixup resetvecAlistair Francis1-1/+1
The resetvec for the OpenTitan machine ended up being set to an out of date value, so let's fix that and bump it to the correct start address (after the boot ROM) Fixes: bf8803c64d75 "hw/riscv: opentitan: bump opentitan version" Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20220914101108.82571-3-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: Set the CPU resetvec directlyAlistair Francis3-15/+7
Instead of using our properties to set a config value which then might be used to set the resetvec (depending on your timing), let's instead just set the resetvec directly in the env struct. This allows us to set the reset vec from the command line with: -global driver=riscv.hart_array,property=resetvec,value=0x20000400 Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220914101108.82571-2-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: remove fixed numbering from GDB xml feature filesAndrew Burgess4-20/+4
The fixed register numbering in the various GDB feature files for RISC-V only exists because these files were originally copied from the GDB source tree. However, the fixed numbering only exists in the GDB source tree so that GDB, when it connects to a target that doesn't provide a target description, will use a specific numbering scheme. That numbering scheme is designed to be compatible with the first versions of QEMU (for RISC-V), that didn't send a target description, and relied on a fixed numbering scheme. Because of the way that QEMU manages its target descriptions, recording the number of registers in each feature, and just relying on GDB's numbering starting from 0, then I propose that we remove all the fixed numbering from the RISC-V feature xml files, and just rely on the standard numbering scheme. Plenty of other targets manage their xml files this way, e.g. ARM, AArch64, Loongarch, m68k, rx, and s390. Signed-off-by: Andrew Burgess <aburgess@redhat.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmer@rivosinc.com> Message-Id: <6069395f90e6fc24dac92197be815fedf42f5974.1661934573.git.aburgess@redhat.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: remove fflags, frm, and fcsr from riscv-*-fpu.xmlAndrew Burgess3-38/+2
While testing some changes to GDB's handling for the RISC-V registers fcsr, fflags, and frm, I spotted that QEMU includes these registers twice in the target description it sends to GDB, once in the fpu feature, and once in the csr feature. Right now things basically work OK, QEMU maps these registers onto two different register numbers, e.g. fcsr maps to both 68 and 73, and GDB can use either of these to access the register. However, GDB's target descriptions don't really work this way, each register should appear just once in a target description, mapping the register name onto the number GDB should use when accessing the register on the target. Duplicate register names actually result in duplicate registers on the GDB side, however, as the registers have the same name, the user can only access one of these registers. Currently GDB has a hack in place, specifically for RISC-V, to spot the duplicate copies of these three registers, and hide them from the user, ensuring the user only ever sees a single copy of each. In this commit I propose fixing this issue on the QEMU side, and in the process, simplify the fpu register handling a little. I think we should, remove fflags, frm, and fcsr from the two (32-bit and 64-bit) fpu feature xml files. These files will only contain the 32 core floating point register f0 to f31. The fflags, frm, and fcsr registers will continue to be advertised in the csr feature as they currently are. With that change made, I will simplify riscv_gdb_get_fpu and riscv_gdb_set_fpu, removing the extra handling for the 3 status registers. Signed-off-by: Andrew Burgess <aburgess@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <0fbf2a5b12e3210ff3867d5cf7022b3f3462c9c8.1661934573.git.aburgess@redhat.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: fix csr check for cycle{h}, instret{h}, time{h}, hpmcounter3-31{h}Weiwei Li1-4/+9
- modify check for mcounteren to work in all less-privilege mode - modify check for scounteren to work only when S mode is enabled - distinguish the exception type raised by check for scounteren between U and VU mode Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn> Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20220817083756.12471-1-liweiwei@iscas.ac.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27target/riscv: Remove sideleg and sedelegRahul Pathak2-4/+0
sideleg and sedeleg csrs are not part of riscv isa spec anymore, these csrs were part of N extension which is removed from the riscv isa specification. These commits removed all traces of these csrs from riscv spec (https://github.com/riscv/riscv-isa-manual) - commit f8d27f805b65 ("Remove or downgrade more references to N extension (#674)") commit b6cade07034d ("Remove N extension chapter for now") Signed-off-by: Rahul Pathak <rpathak@ventanamicro.com> Reviewed-by: Andrew Jones <ajones@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20220824145255.400040-1-rpathak@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-27docs/system: clean up code escape for riscv virt platformAlex Bennée1-4/+9
The example code is rendered slightly mangled due to missing code block. Properly escape the code block and add shell prompt and qemu to fit in with the other examples on the page. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20220905163939.1599368-1-alex.bennee@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
generated by cgit v1.1 at 2025-01-15 15:21:46 +0000