aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2024-01-20backends/cryptodev: Do not ignore throttle/backends ErrorsPhilippe Mathieu-Daudé1-0/+10
Both cryptodev_backend_set_throttle() and CryptoDevBackendClass::init() can set their Error** argument. Do not ignore them, return early on failure. Without that, running into another failure trips error_setv()'s assertion. Use the ERRP_GUARD() macro as suggested in commit ae7c80a7bd ("error: New macro ERRP_GUARD()"). Cc: qemu-stable@nongnu.org Fixes: e7a775fd9f ("cryptodev: Account statistics") Fixes: 2580b452ff ("cryptodev: support QoS") Reviewed-by: zhenwei pi <pizhenwei@bytedance.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20231120150418.93443-1-philmd@linaro.org> (cherry picked from commit 484aecf2d3a75251b63481be2a0c3aef635002af) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-20target/i386: pcrel: store low bits of physical address in data[0]Paolo Bonzini2-5/+16
For PC-relative translation blocks, env->eip changes during the execution of a translation block, Therefore, QEMU must be able to recover an instruction's PC just from the TranslationBlock struct and the instruction data with. Because a TB will not span two pages, QEMU stores all the low bits of EIP in the instruction data and replaces them in x86_restore_state_to_opc. Bits 12 and higher (which may vary between executions of a PCREL TB, since these only use the physical address in the hash key) are kept unmodified from env->eip. The assumption is that these bits of EIP, unlike bits 0-11, will not change as the translation block executes. Unfortunately, this is incorrect when the CS base is not aligned to a page. Then the linear address of the instructions (i.e. the one with the CS base addred) indeed will never span two pages, but bits 12+ of EIP can actually change. For example, if CS base is 0x80262200 and EIP = 0x6FF4, the first instruction in the translation block will be at linear address 0x802691F4. Even a very small TB will cross to EIP = 0x7xxx, while the linear addresses will remain comfortably within a single page. The fix is simply to use the low bits of the linear address for data[0], since those don't change. Then x86_restore_state_to_opc uses tb->cs_base to compute a temporary linear address (referring to some unknown instruction in the TB, but with the correct values of bits 12 and higher); the low bits are replaced with data[0], and EIP is obtained by subtracting again the CS base. Huge thanks to Mark Cave-Ayland for the image and initial debugging, and to Gitlab user @kjliew for help with bisecting another occurrence of (hopefully!) the same bug. It should be relatively easy to write a testcase that performs MMIO on an EIP with different bits 12+ than the first instruction of the translation block; any help is welcome. Fixes: e3a79e0e878 ("target/i386: Enable TARGET_TB_PCREL", 2022-10-11) Cc: qemu-stable@nongnu.org Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Cc: Richard Henderson <richard.henderson@linaro.org> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1759 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1964 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2012 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 729ba8e933f8af5800c3a92b37e630e9bdaa9f1e) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-20target/i386: fix incorrect EIP in PC-relative translation blocksguoguangyao1-2/+2
The PCREL patches introduced a bug when updating EIP in the !CF_PCREL case. Using s->pc in func gen_update_eip_next() solves the problem. Cc: qemu-stable@nongnu.org Fixes: b5e0d5d22fbf ("target/i386: Fix 32-bit wrapping of pc/eip computation") Signed-off-by: guoguangyao <guoguangyao18@mails.ucas.ac.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240115020804.30272-1-guoguangyao18@mails.ucas.ac.cn> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 2926eab8969908bc068629e973062a0fb6ff3759) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-20target/i386: Do not re-compute new pc with CF_PCRELRichard Henderson1-4/+2
With PCREL, we have a page-relative view of EIP, and an approximation of PC = EIP+CSBASE that is good enough to detect page crossings. If we try to recompute PC after masking EIP, we will mess up that approximation and write a corrupt value to EIP. We already handled masking properly for PCREL, so the fix in b5e0d5d2 was only needed for the !PCREL path. Cc: qemu-stable@nongnu.org Fixes: b5e0d5d22fbf ("target/i386: Fix 32-bit wrapping of pc/eip computation") Reported-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240101230617.129349-1-richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit a58506b748b8988a95f4fa1a2420ac5c17038b30) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-19load_elf: fix iterator's type for elf file processingAnastasia Belova1-1/+1
j is used while loading an ELF file to byteswap segments' data. If data is larger than 2GB an overflow may happen. So j should be elf_word. This commit fixes a minor bug: it's unlikely anybody is trying to load ELF files with 2GB+ segments for wrong-endianness targets, but if they did, it wouldn't work correctly. Found by Linux Verification Center (linuxtesting.org) with SVACE. Cc: qemu-stable@nongnu.org Fixes: 7ef295ea5b ("loader: Add data swap option to load-elf") Signed-off-by: Anastasia Belova <abelova@astralinux.ru> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 410c2a4d75f52f6a2fe978eda5a9b6f854afe5ea) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-17target/hppa: Update SeaBIOS-hppa to version 15Helge Deller1-0/+0
SeaBIOS-hppa version 15: - Fix OpenBSD 7.4 boot (PDC_MEM_MAP call returned wrong values) SeaBIOS-hppa version 14 comes with those fixes: - Fix 32-bit HP-UX crash (fix in PDC_FIND_MODULE call) - Fix NetBSD boot (power button fix and add option to disable it) - Fix FPU detection on NetBSD - Add MEMORY_HPA module on B160L - Fix detection of mptsas and esp scsi controllers - Fix terminate DMA transfer in esp driver (Mark Cave-Ayland) - Allow booting from esp controller Signed-off-by: Helge Deller <deller@gmx.de> (cherry picked from commit 4bda8224fa89ab28958644c5f1a4117886fe8418) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-17target/hppa: Fix IOR and ISR on error in probeHelge Deller1-5/+1
Put correct values (depending on CPU arch) into IOR and ISR on fault. Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit 31efbe72c6cc54b9cbc2505d78870a8a87a8d392) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-17target/hppa: Fix IOR and ISR on unaligned access trapHelge Deller1-5/+1
Put correct values (depending on CPU arch) into IOR and ISR on fault. Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit 910ada0225d17530188aa45afcb9412c17267f46) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-17target/hppa: Export function hppa_set_ior_and_isr()Helge Deller2-11/+13
Move functionality to set IOR and ISR on fault into own function. This will be used by follow-up patches. Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit 3824e0d643f34ee09e0cc75190c0c4b60928b78c) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-17target/hppa: Avoid accessing %gr0 when raising exceptionHelge Deller1-1/+1
The value of unwind_breg may reference register %r0, but we need to avoid accessing gr0 directly and use the value 0 instead. At runtime I've seen unwind_breg being zero with the Linux kernel when rfi is used to jump to smp_callin(). Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Bruno Haible <bruno@clisp.org> (cherry picked from commit 5915b67013eb8c3a84e3ef05e6ba4eae55ccd173) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-17hw/hppa: Move software power button address back into PDCHelge Deller1-4/+5
The various operating systems (e.g. Linux, NetBSD) have issues mapping the power button when it's stored in page zero. NetBSD even crashes, because it fails to map that page and then accesses unmapped memory. Since we now have a consistent memory mapping of PDC in 32-bit and 64-bit address space (the lower 32-bits of the address are in sync) the power button can be moved back to PDC space. This patch fixes the power button on Linux, NetBSD and HP-UX. Signed-off-by: Helge Deller <deller@gmx.de> Tested-by: Bruno Haible <bruno@clisp.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit ed35afcb331a972210816435d6b1b5de17fc7d4f) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-17target/hppa: Fix PDC address translation on PA2.0 with PSW.W=0Helge Deller2-2/+8
Fix the address translation for PDC space on PA2.0 if PSW.W=0. Basically, for any address in the 32-bit PDC range from 0xf0000000 to 0xf1000000 keep the lower 32-bits and just set the upper 32-bits to 0xfffffff0. This mapping fixes the emulated power button in PDC space for 32- and 64-bit machines and is how the physical C3700 machine seems to map PDC. Figures H-10 and H-11 in the parisc2.0 spec [1] show that the 32-bit region will be mapped somewhere into a higher and bigger 64-bit PDC space. The start and end of this 64-bit space is defined by the physical address bits. But the figures don't specifiy where exactly the mapping will start inside that region. Tests on a real HP C3700 regarding the address of the power button indicate, that the lower 32-bits will stay the same though. [1] https://parisc.wiki.kernel.org/images-parisc/7/73/Parisc2.0.pdf Signed-off-by: Helge Deller <deller@gmx.de> Tested-by: Bruno Haible <bruno@clisp.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit 6ce18d530638f6e4eb87ef8737c634e34362ad2b) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-17hw/pci-host/astro: Add missing astro & elroy registers for NetBSDHelge Deller1-3/+23
NetBSD accesses some astro and elroy registers which aren't accessed by Linux yet. Add emulation for those registers to allow NetBSD to boot further. Please note that this patch is not sufficient to completely boot up NetBSD on the 64-bit C3700 machine yet. Signed-off-by: Helge Deller <deller@gmx.de> Tested-by: Bruno Haible <bruno@clisp.org> (cherry picked from commit 3b57c15f02050227c5c73ca97fa0dfc02f154fe9) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-17hw/hppa/machine: Disable default devices with --nodefaults optionHelge Deller1-4/+6
Recognize the qemu --nodefaults option, which will disable the following default devices on hppa: - lsi53c895a SCSI controller, - artist graphics card, - LASI 82596 NIC, - tulip PCI NIC, - second serial PCI card, - USB OHCI controller. Adding this option is very useful to allow manual testing and debugging of the other possible devices on the command line. Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit d8a3220005d74512677b181e3a32cd94b13ddf49) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-17hw/hppa/machine: Allow up to 3840 MB total memoryHelge Deller1-3/+6
The physical hardware allows DIMMs of 4 MB size and above, allowing up to 3840 MB of memory, but is restricted by setup code to 3 GB. Increase the limit to allow up to the maximum amount of memory. Btw. the memory area from 0xf000.0000 to 0xffff.ffff is reserved by the architecture for firmware and I/O memory and can not be used for standard memory. An upcoming 64-bit SeaBIOS-hppa firmware will allow more than 3.75GB on 64-bit HPPA64. In this case the ram_max for the pa20 case will change. Signed-off-by: Helge Deller <deller@gmx.de> Noticed-by: Nelson H. F. Beebe <beebe@math.utah.edu> Fixes: b7746b1194c8 ("hw/hppa/machine: Restrict the total memory size to 3GB") Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Bruno Haible <bruno@clisp.org> (cherry picked from commit 92039f61af89629f268e04255946c2a3fa0c453f) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-13readthodocs: fully specify a build environmentAlex Bennée2-7/+14
This is now expected by rtd so I've expanded using their example as 22.04 is one of our supported platforms. I tried to work out if there was an easy way to re-generate a requirements.txt from our pythondeps.toml but in the end went for the easier solution. Cc: <qemu-stable@nongnu.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20231221174200.2693694-1-alex.bennee@linaro.org> (cherry picked from commit b16a45bc5e0e329a16af8a2e020a6e7044f9afa2) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-13.gitlab-ci.d/buildtest.yml: Work around htags bug when environment is largePeter Maydell1-1/+4
Sometimes the CI "pages" job fails with a message like this from htags: $ htags -anT --tree-view=filetree -m qemu_init -t "Welcome to the QEMU sourcecode" htags: Negative exec line limit = -371 This is due to a bug in hflags where if the environment is too large it falls over: https://lists.gnu.org/archive/html/bug-global/2024-01/msg00000.html This happens to us because GitLab CI puts the commit message of the commit under test into the CI_COMMIT_MESSAGE and/or CI_COMMIT_TAG_MESSAGE environment variables, so the job will fail if the commit happens to have a verbose commit message. Work around the htags bug by unsetting these variables while running htags. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2080 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240111125543.1573473-1-peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com> (cherry picked from commit 52a21689cd829c1cc931b59b5ee5bdb10dd578c1) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-13target/s390x: Fix LAE setting a wrong access registerIlya Leoshkevich1-1/+2
LAE should set the access register corresponding to the first operand, instead, it always modifies access register 1. Co-developed-by: Ido Plat <Ido.Plat@ibm.com> Cc: qemu-stable@nongnu.org Fixes: a1c7610a6879 ("target-s390x: implement LAY and LAEY instructions") Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-ID: <20240111092328.929421-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com> (cherry picked from commit e358a25a97c71c39e3513d9b869cdb82052e50b8) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-13tests/qtest/virtio-ccw: Fix device presence checkingSamuel Tardieu1-1/+1
An apparent copy-paste error tests for the presence of the virtio-rng-ccw device in order to perform tests on the virtio-scsi-ccw device. Signed-off-by: Samuel Tardieu <sam@rfc1149.net> Message-ID: <20240106130121.1244993-1-sam@rfc1149.net> Fixes: 65331bf5d1 ("tests/qtest: Check for virtio-ccw devices before using them") Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com> (cherry picked from commit c98873ee4a0c2694aac976ab9affcf55da8b7e61) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-12tests/acpi: disallow tests/data/acpi/virt/SSDT.memhp changesGerd Hoffmann1-1/+0
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 704f7cad5105246822686f65765ab92045f71a3b) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-12tests/acpi: update expected data filesGerd Hoffmann1-0/+0
edk2 firmware update caused a address layout change. DefinitionBlock ("", "SSDT", 1, "BOCHS ", "NVDIMM", 0x00000001) { [ ... ] - Name (MEMA, 0x43C90000) + Name (MEMA, 0x43C80000) } Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 55abfc1ffbe54c00529668903fd99b4bb57a6338) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-12edk2: update binaries to git snapshotGerd Hoffmann8-0/+0
Resolves: #1990 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 5058720151961d79ef3abdacea94327f2c63951a) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-12edk2: update build config, set PcdUninstallMemAttrProtocol = TRUE.Gerd Hoffmann1-3/+9
Needed to workaround buggy EFI_MEMORY_ATTRIBUTE_PROTOCOL usage in shim.efi. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 6f79fa5f097aa41fc96a14dfccdb0ea8d9facd6c) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-12edk2: update to git snapshotGerd Hoffmann1-0/+0
Want pick up edk2 commit cee7ba349c0c ("ArmVirtQemu: Allow EFI memory attributes protocol to be disabled"). Needed to fix issue #1990. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit c3667412582cdda42b36418bed135db96005bb85) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-12tests/acpi: allow tests/data/acpi/virt/SSDT.memhp changesGerd Hoffmann1-0/+1
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit ca8b0cc8e9176419960b844abb522a2298a794d6) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-11util: fix build with musl libc on ppc64leNatanael Copa1-3/+3
Use PPC_FEATURE2_ISEL and PPC_FEATURE2_VEC_CRYPTO from linux headers instead of the GNU specific PPC_FEATURE2_HAS_ISEL and PPC_FEATURE2_HAS_VEC_CRYPTO. This fixes build with musl libc. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1861 Signed-off-by: Natanael Copa <ncopa@alpinelinux.org> Fixes: 63922f467a ("tcg/ppc: Replace HAVE_ISEL macro with a variable") Fixes: 68f340d4cd ("tcg/ppc: Enable Altivec detection") Message-Id: <20231219105236.7059-1-ncopa@alpinelinux.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit 1d513e06d96697f44de4a1b85c6ff627c443e306) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-11tcg/ppc: Use new registers for LQ destinationRichard Henderson3-7/+19
LQ has a constraint that RTp != RA, else SIGILL. Therefore, force the destination of INDEX_op_qemu_*_ld128 to be a new register pair, so that it cannot overlap the input address. This requires new support in process_op_defs and tcg_reg_alloc_op. Cc: qemu-stable@nongnu.org Fixes: 526cd4ec01f ("tcg/ppc: Support 128-bit load/store") Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240102013456.131846-1-richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit ca5bed07d0e7e0530c2cafbc134c4f74e582ac50) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-11hw/intc/arm_gicv3_cpuif: handle LPIs in in the list registersPeter Maydell1-4/+13
The hypervisor can deliver (virtual) LPIs to a guest by setting up a list register to have an intid which is an LPI. The GIC has to treat these a little differently to standard interrupt IDs, because LPIs have no Active state, and so the guest will only EOI them, it will not also deactivate them. So icv_eoir_write() must do two things: * if the LPI ID is not in any list register, we drop the priority but do not increment the EOI count * if the LPI ID is in a list register, we immediately deactivate it, regardless of the split-drop-and-deactivate control This can be seen in the VirtualWriteEOIR0() and VirtualWriteEOIR1() pseudocode in the GICv3 architecture specification. Without this fix, potentially a hypervisor guest might stall because LPIs get stuck in a bogus Active+Pending state. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Miguel Luis <miguel.luis@oracle.com> (cherry picked from commit 82a65e3188abebb509510b391726711606aca642) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08hw/vfio: fix iteration over global VFIODevice listVolker Rümelin1-4/+4
Commit 3d779abafe ("vfio/common: Introduce a global VFIODevice list") introduced a global VFIODevice list, but forgot to update the list element field name when iterating over the new list. Change the code to use the correct list element field. Fixes: 3d779abafe ("vfio/common: Introduce a global VFIODevice list") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2061 Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> (cherry picked from commit 9353b6da430f90e47f352dbf6dc31120c8914da6) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08vfio/container: Replace basename with g_path_get_basenameCédric Le Goater1-2/+3
g_path_get_basename() is a portable utility function that has the advantage of not modifing the string argument. It also fixes a compile breakage with the Musl C library reported in [1]. [1] https://lore.kernel.org/all/20231212010228.2701544-1-raj.khem@gmail.com/ Reported-by: Khem Raj <raj.khem@gmail.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Signed-off-by: Cédric Le Goater <clg@redhat.com> (cherry picked from commit 213ae3ffda463c0503e39e0cf827511b5298c314) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08edu: fix DMA range upper bound checkMax Erenberg1-1/+1
The edu_check_range function checks that start <= end1 < end2, where end1 is the upper bound (exclusive) of the guest-supplied DMA range and end2 is the upper bound (exclusive) of the device's allowed DMA range. When the guest tries to transfer exactly DMA_SIZE (4096) bytes, end1 will be equal to end2, so the check fails and QEMU aborts with this puzzling error message (newlines added for formatting): qemu: hardware error: EDU: DMA range 0x0000000000040000-0x0000000000040fff out of bounds (0x0000000000040000-0x0000000000040fff)! By checking end1 <= end2 instead, guests will be allowed to transfer exactly 4096 bytes. It is not necessary to explicitly check for start <= end1 because the previous two checks (within(addr, start, end2) and end1 > addr) imply start < end1. Fixes: b30934cb52a7 ("hw: misc, add educational driver", 2015-01-21) Signed-off-by: Max Erenberg <merenber@uwaterloo.ca> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 2c5107e1b455d4a157124f021826ead4e04b4aea) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08hw/net: cadence_gem: Fix MDIO_OP_xxx valuesBin Meng1-2/+2
Testing upstream U-Boot with 'sifive_u' machine we see: => dhcp ethernet@10090000: PHY present at 0 Could not get PHY for ethernet@10090000: addr 0 phy_connect failed This has been working till QEMU 8.1 but broken since QEMU 8.2. Fixes: 1b09eeb122aa ("hw/net/cadence_gem: use FIELD to describe PHYMNTNC register fields") Reported-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Bin Meng <bmeng@tinylab.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 0c7ffc977195c1f71c8132eb5616827e589d4a0f) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08audio/audio.c: remove trailing newline in error_setgMichael Tokarev1-1/+1
error_setg() appends newline to the formatted message. Fixes: cb94ff5f80c5 ("audio: propagate Error * out of audio_init") Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> (cherry picked from commit 09a36158c283f7448d1b00fdbb6634f05d27f922) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08chardev/char.c: fix "abstract device type" error messageMichael Tokarev1-1/+1
Current error message: qemu-system-x86_64: -chardev spice,id=foo: Parameter 'driver' expects an abstract device type while in fact the meaning is in reverse, -chardev expects a non-abstract device type. Fixes: 777357d758d9 ("chardev: qom-ify" 2016-12-07) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> (cherry picked from commit 4ad87cd4b2254197b7ac12e3da824854e6a90f8f) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08target/riscv: Fix mcycle/minstret increment behaviorXu Lu1-7/+7
The mcycle/minstret counter's stop flag is mistakenly updated on a copy on stack. Thus the counter increments even when the CY/IR bit in the mcountinhibit register is set. This commit corrects its behavior. Fixes: 3780e33732f88 (target/riscv: Support mcycle/minstret write operation) Signed-off-by: Xu Lu <luxu.kernel@bytedance.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 5cb0e7abe1635cb82e0033260dac2b910d142f8c) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-05hw/net/can/sja1000: fix bug for single acceptance filter and standard framePavel Pisa1-1/+1
A CAN sja1000 standard frame filter mask has been computed and applied incorrectly for standard frames when single Acceptance Filter Mode (MOD_AFM = 1) has been selected. The problem has not been found by Linux kernel testing because it uses dual filter mode (MOD_AFM = 0) and leaves falters fully open. The problem has been noticed by Grant Ramsay when testing with Zephyr RTOS which uses single filter mode. Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Reported-by: Grant Ramsay <gramsay@enphaseenergy.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2028 Fixes: 733210e754 ("hw/net/can: SJA1000 chip register level emulation") Message-ID: <20240103231426.5685-1-pisa@fel.cvut.cz> (cherry picked from commit 25145a7d7735344a469551946fc2a7f19eb4aa3d) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-05target/i386: the sgx_epc_get_section stub is reachablePaolo Bonzini1-1/+1
The sgx_epc_get_section stub is reachable from cpu_x86_cpuid. It should not assert, instead it should just return true just like the "real" sgx_epc_get_section does when SGX is disabled. Reported-by: Vladimír Beneš <vbenes@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-ID: <20220201190941.106001-1-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 219615740425d9683588207b40a365e6741691a6) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-05configure: use a native non-cross compiler for linux-userPaolo Bonzini1-2/+2
Commit c2118e9e1ab ("configure: don't try a "native" cross for linux-user", 2023-11-23) sought to avoid issues with using the native compiler with a cross-endian or cross-bitness setup. However, in doing so it ended up requiring a cross compiler setup (and most likely a slow compiler setup) even when building TCG tests that are native to the host architecture. Always allow the host compiler in that case. Cc: qemu-stable@nongnu.org Fixes: c2118e9e1ab ("configure: don't try a "native" cross for linux-user", 2023-11-23) Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 007531586aa8ef6dccdadd927b89a50af62288d1) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-12-26include/ui/rect.h: fix qemu_rect_init() mis-assignmentElen Avan1-1/+1
Signed-off-by: Elen Avan <elen.avan@bk.ru> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2051 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2050 Fixes: a200d53b1fde "virtio-gpu: replace PIXMAN for region/rect test" Cc: qemu-stable@nongnu.org Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 9d5b42beb6978dc6219d5dc029c9d453c6b8d503)
2023-12-26target/riscv/kvm: do not use non-portable strerrorname_np()Natanael Copa1-10/+8
strerrorname_np is non-portable and breaks building with musl libc. Use strerror(errno) instead, like we do other places. Cc: qemu-stable@nongnu.org Fixes: commit 082e9e4a58ba (target/riscv/kvm: improve 'init_multiext_cfg' error msg) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2041 Buglink: https://gitlab.alpinelinux.org/alpine/aports/-/issues/15541 Signed-off-by: Natanael Copa <ncopa@alpinelinux.org> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit d424db235434b8356c6b2d9420b846c7ddcc83ea)
2023-12-22iotests: Basic tests for internal snapshotsKevin Wolf2-0/+277
We have a few test cases that include tests for corner case aspects of internal snapshots, but nothing that tests that they actually function as snapshots or that involves deleting a snapshot. Add a test for this kind of basic internal snapshot functionality. The error cases include a regression test for the crash we just fixed with snapshot operations on inactive images. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20231201142520.32255-4-kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit bb6e2511eb48539b7dcbcb5f47772e156b9c45d1) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-12-22vl: Improve error message for conflicting -incoming and -loadvmKevin Wolf1-0/+4
Currently, the conflict between -incoming and -loadvm is only detected when loading the snapshot fails because the image is still inactive for the incoming migration. This results in a suboptimal error message: $ ./qemu-system-x86_64 -hda /tmp/test.qcow2 -loadvm foo -incoming defer qemu-system-x86_64: Device 'ide0-hd0' is writable but does not support snapshots Catch the situation already in qemu_validate_options() to improve the message: $ ./qemu-system-x86_64 -hda /tmp/test.qcow2 -loadvm foo -incoming defer qemu-system-x86_64: 'incoming' and 'loadvm' options are mutually exclusive Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20231201142520.32255-3-kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 5a7f21efaf99c60614fe1967be1c0f9aa46c526e) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-12-22block: Fix crash when loading snapshot on inactive nodeKevin Wolf1-1/+3
bdrv_is_read_only() only checks if the node is configured to be read-only eventually, but even if it returns false, writing to the node may not be permitted at the moment (because it's inactive). bdrv_is_writable() checks that the node can be written to right now, and this is what the snapshot operations really need. Change bdrv_can_snapshot() to use bdrv_is_writable() to fix crashes like the following: $ ./qemu-system-x86_64 -hda /tmp/test.qcow2 -loadvm foo -incoming defer qemu-system-x86_64: ../block/io.c:1990: int bdrv_co_write_req_prepare(BdrvChild *, int64_t, int64_t, BdrvTrackedRequest *, int): Assertion `!(bs->open_flags & BDRV_O_INACTIVE)' failed. The resulting error message after this patch isn't perfect yet, but at least it doesn't crash any more: $ ./qemu-system-x86_64 -hda /tmp/test.qcow2 -loadvm foo -incoming defer qemu-system-x86_64: Device 'ide0-hd0' is writable but does not support snapshots Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20231201142520.32255-2-kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit d3007d348adaaf04ee8b099a475282034a662414) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-12-19Update version for v8.2.0 releasev8.2.0Stefan Hajnoczi1-1/+1
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-12-12Update version for v8.2.0-rc4 releasev8.2.0-rc4Stefan Hajnoczi1-1/+1
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-12-12Merge tag 'pull-tcg-20231212' of https://gitlab.com/rth7680/qemu into stagingStefan Hajnoczi5-22/+58
target/i386: Fix 32-bit wrapping of pc/eip computation (#2022) tcg: Reduce serial context atomicity earlier (#2034) # -----BEGIN PGP SIGNATURE----- # # iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmV41IEdHHJpY2hhcmQu # aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV+0DwgApqX4Ntaz1/eIbEmr # sWTGlG7sQX28JrYm+Bd4MgtlE2+i06Vs3q1ZHThuZs9S6tQf8bcm1q1m0qZ486jk # hgQqSMPAOJv1U+QhTRy1kW3l8UmZkw9YddfV5FjBHeuRWglVeSxDtqkc4fUffthb # 82KvYIqo836HsYOOWtJqSuWVi60+q1RqYg+WZuygUmprf8Y+72Zu7ojjrizHoUNQ # wTjGR8Jsf22ZrFi+B0MXL78oumMLTnjxCv1426+P+0zVclJAJZxS/7K+VhD4cG1q # FG2zAphly+vuB248XSyzYxM8vgCVNAkLoUb2AAw1pdQpUzNaAEoTcAXIR7PJDord # wZnmvw== # =Fsyn # -----END PGP SIGNATURE----- # gpg: Signature made Tue 12 Dec 2023 16:45:37 EST # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * tag 'pull-tcg-20231212' of https://gitlab.com/rth7680/qemu: tcg: Reduce serial context atomicity earlier target/i386: Fix 32-bit wrapping of pc/eip computation Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-12-12tcg: Reduce serial context atomicity earlierRichard Henderson2-12/+25
Reduce atomicity while emitting opcodes, instead of later during code generation. This ensures that any helper called also sees the reduced atomicity requirement. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2034 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20231212193542.149117-1-richard.henderson@linaro.org>
2023-12-12target/i386: Fix 32-bit wrapping of pc/eip computationRichard Henderson3-10/+33
In 32-bit mode, pc = eip + cs_base is also 32-bit, and must wrap. Failure to do so results in incorrect memory exceptions to the guest. Before 732d548732ed, this was implicitly done via truncation to target_ulong but only in qemu-system-i386, not qemu-system-x86_64. To fix this, we must add conditional zero-extensions. Since we have to test for 32 vs 64-bit anyway, note that cs_base is always zero in 64-bit mode. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2022 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20231212172510.103305-1-richard.henderson@linaro.org>
2023-12-12docs: clean-up the xenpvh documentationAlex Bennée2-17/+24
I noticed the code blocks where not rendering properly so thought I'd better fix things up. So: - Use better title for the machine type - Explain why Xen is a little different - Add a proper anchor to the tpm-device link - add newline so code block properly renders - add some indentation to make continuation clearer Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20231207130623.360473-1-alex.bennee@linaro.org>
2023-12-12block: Fix AioContext locking in qmp_block_resize()Kevin Wolf1-1/+2
The AioContext must be unlocked before calling blk_co_unref(), because it takes the AioContext lock internally in blk_unref_bh(), which is scheduled in the main thread. If we don't unlock, the AioContext is locked twice and nested event loops such as in bdrv_graph_wrlock() will deadlock. Cc: <qemu-stable@nongnu.org> Fixes: https://issues.redhat.com/browse/RHEL-15965 Fixes: 0c7d204f50c382c6baac8c94bd57af4a022b3888 Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20231208124352.30295-1-kwolf@redhat.com>
generated by cgit v1.1 at 2025-01-12 18:04:44 +0000