aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2023-05-28target/ppc: Use SMT4 small core chip type in POWER9/10 PVRsNicholas Piggin1-3/+3
QEMU's PVR value for POWER9 DD2.0 has chip type 1, which is the SMT4 "small core" type that OpenPOWER processors use. QEMU's PVR for all other POWER9/10 have chip type 0, which "enterprise" systems use. The difference does not really matter to QEMU (because it does not care about SMT mode in the target), but for consistency all PVRs should use the same chip type. We'll go with the SMT4 OpenPOWER type. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20230515160131.394562-1-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-28hw/ppc/prep: Fix wiring of PIC -> CPU interruptBernhard Beschow1-1/+3
Commit cef2e7148e32 ("hw/isa/i82378: Remove intermediate IRQ forwarder") passes s->cpu_intr to i8259_init() in i82378_realize() directly. However, s- >cpu_intr isn't initialized yet since that happens after the south bridge's pci_realize_and_unref() in board code. Fix this by initializing s->cpu_intr before realizing the south bridge. Fixes: cef2e7148e32 ("hw/isa/i82378: Remove intermediate IRQ forwarder") Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20230304114043.121024-4-shentey@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-28spapr: Add SPAPR_CAP_AIL_MODE_3 for AIL mode 3 support for H_SET_MODE hcallNicholas Piggin6-12/+73
The behaviour of the Address Translation Mode on Interrupt resource is not consistently supported by all CPU versions or all KVM versions: KVM HV does not support mode 2, and does not support mode 3 on POWER7 or early POWER9 processesors. KVM PR only supports mode 0. TCG supports all modes (0, 2, 3) on CPUs with support for the corresonding LPCR[AIL] mode. This leads to inconsistencies in guest behaviour and could cause problems migrating guests. This was not noticable for Linux guests for a long time because the kernel only uses modes 0 and 3, and it used to consider AIL-3 to be advisory in that it would always keep the AIL-0 vectors around, so it did not matter whether or not interrupts were delivered according to the AIL mode. Recent Linux guests depend on AIL mode 3 working as specified in order to support the SCV facility interrupt. If AIL-3 can not be provided, then H_SET_MODE must return an error to Linux so it can disable the SCV facility (failure to do so can lead to userspace being able to crash the guest kernel). Add the ail-mode-3 capability to specify that AIL-3 is supported. AIL-0 is implied as the baseline, and AIL-2 is no longer supported by spapr. AIL-2 is not known to be used by any software, but support in TCG could be restored with an ail-mode-2 capability quite easily if a regression is reported. Modify the H_SET_MODE Address Translation Mode on Interrupt resource handler to check capabilities and correctly return error if not supported. KVM has a cap to advertise support for AIL-3. Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20230515160216.394612-1-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-28ui: add helpers for virtio-multitouch eventsSergio Lopez2-0/+41
Add helpers for generating Multi-touch events from the UI backends that can be sent to the guest through a virtio-multitouch device. Signed-off-by: Sergio Lopez <slp@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230526112925.38794-6-slp@redhat.com>
2023-05-28virtio-input-pci: add virtio-multitouch-pciSergio Lopez1-4/+21
Add virtio-multitouch-pci, a Multitouch-capable input device, to the list of devices that can be provided by virtio-input-pci. Signed-off-by: Sergio Lopez <slp@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230526112925.38794-5-slp@redhat.com>
2023-05-28virtio-input: add a virtio-mulitouch deviceSergio Lopez2-7/+120
Add a virtio-multitouch device to the family of devices emulated by virtio-input implementing the Multi-touch protocol as descripted here: https://www.kernel.org/doc/html/latest/input/multi-touch-protocol.html?highlight=multi+touch This patch just add the device itself, without connecting it to any backends. The following patches will add a PCI-based multitouch device, some helpers in "ui" and will enable the GTK3 backend to transpose multi-touch events from the host to the guest. Signed-off-by: Sergio Lopez <slp@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230526112925.38794-4-slp@redhat.com>
2023-05-28ui: add the infrastructure to support MT eventsSergio Lopez5-9/+87
Add the required infrastructure to support generating multitouch events. Signed-off-by: Sergio Lopez <slp@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20230526112925.38794-3-slp@redhat.com>
2023-05-28virtio-input: generalize virtio_input_key_config()Sergio Lopez1-17/+21
As there are other bitmap-based config properties that need to be dealt in a similar fashion as VIRTIO_INPUT_CFG_EV_BITS, generalize the function to receive select and subsel as arguments, and rename it to virtio_input_extend_config() Signed-off-by: Sergio Lopez <slp@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230526112925.38794-2-slp@redhat.com>
2023-05-28ui/cursor: make width/height unsigned 16-bit integerMauro Matteo Cascella2-3/+4
Although not actually exploitable at the moment, a negative width/height could make datasize wrap around and potentially lead to buffer overflow. Since there is no reason a negative width/height is ever appropriate, modify QEMUCursor struct and cursor_alloc prototype to accept uint16_t. This protects us against accidentally introducing future bugs. Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reported-by: Jacek Halon <jacek.halon@gmail.com> Reported-by: Yair Mizrahi <yairh33@gmail.com> Reported-by: Elsayed El-Refa'ei <e.elrefaei99@gmail.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20230523163023.608121-1-mcascell@redhat.com>
2023-05-28ui/sdl2: disable SDL_HINT_GRAB_KEYBOARD on WindowsVolker Rümelin1-0/+3
Windows sends an extra left control key up/down input event for every right alt key up/down input event for keyboards with international layout. Since commit 830473455f ("ui/sdl2: fix handling of AltGr key on Windows") QEMU uses a Windows low level keyboard hook procedure to reliably filter out the special left control key and to grab the keyboard on Windows. The SDL2 version 2.0.16 introduced its own Windows low level keyboard hook procedure to grab the keyboard. Windows calls this callback before the QEMU keyboard hook procedure. This disables the special left control key filter when the keyboard is grabbed. To fix the problem, disable the SDL2 Windows low level keyboard hook procedure. Reported-by: Bernhard Beschow <shentey@gmail.com> Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Thomas Huth <thuth@redhat.com> Tested-by: Bernhard Beschow <shentey@gmail.com> Message-Id: <20230418062823.5683-1-vr_qemu@t-online.de>
2023-05-28ui/sdl2: Grab Alt+F4 also under WindowsBernhard Beschow1-0/+1
SDL doesn't grab Alt+F4 under Windows by default. Pressing Alt+F4 thus closes the VM immediately without confirmation, possibly leading to data loss. Fix this by always grabbing Alt+F4 on Windows hosts, too. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20230417192139.43263-3-shentey@gmail.com>
2023-05-28ui/sdl2: Grab Alt+Tab also in fullscreen modeBernhard Beschow1-0/+3
By default, SDL grabs Alt+Tab only in non-fullscreen mode. This causes Alt+Tab to switch tasks on the host rather than in the VM in fullscreen mode while it switches tasks in non-fullscreen mode in the VM. Fix this confusing behavior by grabbing Alt+Tab in fullscreen mode, always causing tasks to be switched in the VM. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20230417192139.43263-2-shentey@gmail.com>
2023-05-28ui/dbus: add a FIXME about texture/dmabuf scanout handlingMarc-André Lureau1-0/+5
Except SDL, display backends seem to fail at handing full scanout geometry correctly. It would need some test/reproducer to actually check it. In the meantime, fill some missing fields, and leave a FIXME. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230515132537.1026310-1-marcandre.lureau@redhat.com>
2023-05-28gtk: add gl-area support on win32Marc-André Lureau1-0/+6
On Windows, we don't use the low-level GBM/EGL helpers (no dmabuf etc), we can turn on GL area support for the rest of rendering. (fwiw, GDK backend may be either WGL or EGL) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: Bernhard Beschow <shentey@gmail.com> Message-Id: <20230515132527.1026064-1-marcandre.lureau@redhat.com>
2023-05-28virtio-gpu: add a FIXME for virtio_gpu_load()Marc-André Lureau1-0/+1
It looks like the virtio_gpu_load() does not compute and set the offset, the same way virtio_gpu_set_scanout() does. This probably results in incorrect display until the scanout/framebuffer is updated again, I guess we should fix it, although I haven't checked this yet. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230515132518.1025853-1-marcandre.lureau@redhat.com>
2023-05-28win32: wrap socket close() with an exception handlerMarc-André Lureau2-6/+21
Since commit abe34282 ("win32: avoid mixing SOCKET and file descriptor space"), we set HANDLE_FLAG_PROTECT_FROM_CLOSE on the socket FD, to prevent closing the HANDLE with CloseHandle. This raises an exception which under gdb is fatal, and qemu exits. Let's catch the expected error instead. Note: this appears to work, but the mingw64 macro is not well documented or tested, and it's not obvious how it is meant to be used. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230515132440.1025315-1-marcandre.lureau@redhat.com>
2023-05-28ui/dbus: fix compilation when GBM && !OPENGLMarc-André Lureau1-5/+5
commit 4814d3cbf ("ui/dbus: restrict opengl to gbm-enabled config") assumes that whenever GBM is available, OpenGL is. This is not always the case, let's further restrict opengl-related paths and fix some compilation issues. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230515132348.1024663-1-marcandre.lureau@redhat.com>
2023-05-28ui/sdl2: fix surface_gl_update_texture: Assertion 'gls' failedMarc-André Lureau1-0/+4
Before sdl2_gl_update() is called, sdl2_gl_switch() may decide to destroy the console window and its associated shaders. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1644 Fixes: c84ab0a500a8 ("ui/console: optionally update after gfx switch") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20230511074217.4171842-1-marcandre.lureau@redhat.com>
2023-05-28ui/gtk-egl: fix scaling for cursor position in scanout modeErico Nunes1-2/+2
vc->gfx.w and vc->gfx.h are not updated appropriately in this code path, which leads to a different scaling factor for rendering the cursor on some edge cases (e.g. the focus has left and re-entered the gtk window). This can be reproduced using vhost-user-gpu with the gtk ui on the x11 backend. Use the surface dimensions which are already updated accordingly. Signed-off-by: Erico Nunes <ernunes@redhat.com> Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230320160856.364319-2-ernunes@redhat.com>
2023-05-28ui/gtk: use widget size for cursor motion eventErico Nunes1-5/+3
The gd_motion_event size has some calculations for the cursor position, which also take into account things like different size of the framebuffer compared to the window size. The use of window size makes things more difficult though, as at least in the case of Wayland includes the size of ui elements like a menu bar at the top of the window. This leads to a wrong position calculation by a few pixels. Fix it by using the size of the widget, which already returns the size of the actual space to render the framebuffer. Signed-off-by: Erico Nunes <ernunes@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Acked-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20230320160856.364319-1-ernunes@redhat.com>
2023-05-28ui/gtk: fix passing y0_top parameter to scanoutErico Nunes2-2/+2
The dmabuf->y0_top flag is passed to .dpy_gl_scanout_dmabuf(), however in the gtk ui both implementations dropped it when doing the next scanout_texture call. Fixes flipped linux console using vhost-user-gpu with the gtk ui display. Signed-off-by: Erico Nunes <ernunes@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230220175605.43759-1-ernunes@redhat.com>
2023-05-27target/ppc: Alignment faults do not set DSISR in ISA v3.0 onwardNicholas Piggin1-7/+10
This optional behavior was removed from the ISA in v3.0, see Summary of Changes preface: Data Storage Interrupt Status Register for Alignment Interrupt: Simplifies the Alignment interrupt by remov- ing the Data Storage Interrupt Status Register (DSISR) from the set of registers modified by the Alignment interrupt. Reviewed-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20230515092655.171206-5-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-27target/ppc: Fix width of some 32-bit SPRsNicholas Piggin6-27/+27
Some 32-bit SPRs are incorrectly implemented as 64-bits on 64-bit targets. This changes VRSAVE, DSISR, HDSISR, DAWRX0, PIDR, LPIDR, DEXCR, HDEXCR, CTRL, TSCR, MMCRH, and PMC[1-6] from to be 32-bit registers. This only goes by the 32/64 classification in the architecture, it does not try to implement finer details of SPR implementation (e.g., not all bits implemented as simple read/write storage). Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com> Message-Id: <20230515092655.171206-2-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-27target/ppc: Fix fallback to MFSS for MFFS* instructions on pre 3.0 ISAsRichard Purdie2-13/+29
The following commits changed the code such that the fallback to MFSS for MFFSCRN, MFFSCRNI, MFFSCE and MFFSL on pre 3.0 ISAs was removed and became an illegal instruction: bf8adfd88b547680aa857c46098f3a1e94373160 - target/ppc: Move mffscrn[i] to decodetree 394c2e2fda70da722f20fb60412d6c0ca4bfaa03 - target/ppc: Move mffsce to decodetree 3e5bce70efe6bd1f684efbb21fd2a316cbf0657e - target/ppc: Move mffsl to decodetree The hardware will handle them as a MFFS instruction as the code did previously. This means applications that were segfaulting under qemu when encountering these instructions which is used in glibc libm functions for example. The fallback for MFFSCDRN and MFFSCDRNI added in a later patch was also missing. This patch restores the fallback to MFSS for these instructions on pre 3.0s ISAs as the hardware decoder would, fixing the segfaulting libm code. It doesn't have the fallback for 3.0 onwards to match hardware behaviour. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Reviewed-by: Matheus Ferst <matheus.ferst@eldorado.org.br> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230510111913.1718734-1-richard.purdie@linuxfoundation.org> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-26Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson13-85/+50
* build system fixes and cleanups * use subproject() for the dtc and keycodemapdb submodules * fix virtio memory leak * update slirp.wrap to latest commit in the master branch # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmRwi6cUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroO3awf9GsLa0sip+lUsV2JgzZGm2mL7Fo9A # kBbuehaT+5gI2PGY6Sp1RVdDnf/JS4HkU11TBBVYFpJdDwqerCNcprgOO3Y5Mung # Ukg93FgdvORlbTyfnMXNUe8dDaoTe6kvN1kTm+zhzMCJDTSCgZRqWc4Fh5oNg+No # pupeR7hjW6nEKSnYVhjP7LjSOteJfR9aeKT/bxRaQpmlegeGVC6RZ1naZtRHY6le # Y8KeKoelgBkEGPk5MnmFhnrITwYrfV0g2uP4Jinr5GildC8E/ZSmxo5h1TUqkQFA # /MKuIt6cRBitCHyYQLiXY+MZc6AkS3tsAhCo41Nknb4nylKeWgPHBIAWxA== # =NRBc # -----END PGP SIGNATURE----- # gpg: Signature made Fri 26 May 2023 03:36:23 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [undefined] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: configure: ignore --make meson: use subproject for keycodemapdb meson: use subproject for internal libfdt meson: simplify logic for -Dfdt virtio: qmp: fix memory leak slirp: update wrap to latest master meson: Add static glib dependency for initrd-stress.img meson: Remove leftover comment configure: unset harmful environment variables Makefile: remove $(TESTS_PYTHON) tests/vm: fix and simplify HOST_ARCH definition tests/docker: simplify HOST_ARCH definition Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-26Merge tag 'pull-hex-20230526' of https://github.com/quic/qemu into stagingRichard Henderson32-1296/+1150
Hexagon update # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEENjXHiM5iuR/UxZq0ewJE+xLeRCIFAmRwv6QACgkQewJE+xLe # RCLRvQf/e0utA8/KAYwmay4dYiiVlrtJ4UVpwogQ8JC7je5H2+Gv633P4BF8uGAF # HmhdUk031jvG/BvKGH+493ESKgtIX3caLxJInPtYu3elqKxZhqKpke2VPF3srrwI # Mli8IqdwE2scSilG591xTjhU8vBGSm+hiQptSg9OaSotVcH8Qc/32+vudnr2JZtK # ko3MqISMW/KvfD+x47UcX4IX4bmQfDyysQITQs9lfwYgzv/4drl6/7CUFQZ3b8Go # Rz4ClbYhKT8YybJjX+yaKuTaHSrL9r0+90ORzYisEYcPiOOChmy9vv4HbZ1zTCbY # MVJM69IPdZDi1quE00jULYEEPrHRoA== # =vczK # -----END PGP SIGNATURE----- # gpg: Signature made Fri 26 May 2023 07:18:12 AM PDT # gpg: using RSA key 3635C788CE62B91FD4C59AB47B0244FB12DE4422 # gpg: Good signature from "Taylor Simpson (Rock on) <tsimpson@quicinc.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 3635 C788 CE62 B91F D4C5 9AB4 7B02 44FB 12DE 4422 * tag 'pull-hex-20230526' of https://github.com/quic/qemu: Hexagon (target/hexagon) Change Hexagon maintainer Hexagon: fix outdated `hex_new_*` comments target/hexagon/*.py: clean up used 'toss' and 'numregs' vars Hexagon (target/hexagon) Fix assignment to tmp registers Hexagon (tests/tcg/hexagon) Clean up Hexagon check-tcg tests Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-26Merge tag 'pull-loongarch-20230526' of https://gitlab.com/gaosong/qemu into ↵Richard Henderson3-16/+31
staging pull-loongarch-20230526 # -----BEGIN PGP SIGNATURE----- # # iLMEAAEIAB0WIQS4/x2g0v3LLaCcbCxAov/yOSY+3wUCZHB6VwAKCRBAov/yOSY+ # 390YA/98bGE+W8NGBoKI4sxke6LE6jbF1vYiOz4DiqvbGFcyL+sYKnlN92mpfNaP # K8BlgD3kvL7wV/DtCGTq4c0aAtUmSZNCC1w7PSlOkFxkJ+QONQGMGZKmI75BRYdY # Q/JQxUG02Hm4K/ghJDMGAm3+m+VaZaqxYNCv/6gLhmTERB5l5A== # =yu/e # -----END PGP SIGNATURE----- # gpg: Signature made Fri 26 May 2023 02:22:31 AM PDT # gpg: using RSA key B8FF1DA0D2FDCB2DA09C6C2C40A2FFF239263EDF # gpg: Good signature from "Song Gao <m17746591750@163.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: B8FF 1DA0 D2FD CB2D A09C 6C2C 40A2 FFF2 3926 3EDF * tag 'pull-loongarch-20230526' of https://gitlab.com/gaosong/qemu: target/loongarch: Fix the vinsgr2vr/vpickve2gr instructions cause system coredump target/loongarch: Fix LD/ST{LE/GT} instructions get wrong CSR_ERA and CSR_BADV Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-26Merge tag 'pull-request-2023-05-26' of https://gitlab.com/thuth/qemu into ↵Richard Henderson16-19/+140
staging * Use MachineClass->default_nic in more machines to allow running them without "--nodefaults" in builds that used "--without-default-devices" * Improve qtests for such builds * Add up-/downsampling qtest * Avoid crash if default RAM backend name has been stolen * Fix reentrant DMA problem in the lsi53c895a device (CVE-2023-0330) # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmRwdqsRHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbXk6g//eQzVGv1Ep4ZusQXPDpFJLgBNq7JMOF6a # bWa6fTluzCn2ivnbgPEf0lV1TsCrUuQwqWlEozylltE6l4zbmIWBMO8F/6Wy0JZH # DuBrO9fio+nKhcEqeFLE+wTWUCiBqM66n8LL+rznO3RjXv2QU8zhk9owmsEKZUV0 # vXrMO5XdUO/dTrxyBdVjbok9L1UpkF+Sp9LEHNxIJZnAqhVmx13jnKq6WTrDR/fX # ZwGbwWxsnTZl5PuPsHePdTWhXigzZJYcI5TSfcdTVHbzIxVKzFIvTX7stKxySL3b # 3rXqmkmdozi28UPq7kXvLRoN8VscORgC3J+0izVxd1P0q+sh6p+hF/8T1r0UCqWa # cgPoqGP5fcqfQiQxdaPbm3Ar9qscZPqzpZWxzjFQsptxf69RIEg+8XZq/EP+6g+c # GxCh1cqugLdWvZPpBjoGIDlftxJZ99rMKnOZJEudaAIDzRWbNBuqzVo5osj8n5ht # m68Nanlil451+ySuTS7iiWyyKXF6hIfe5I6A72QdxMPeHsavcCk5D5AN76dFSTmN # XWWqlk9CNYbvaYSIqyxJpANiwA5Y0j7r6GVXdWFZ9YRt//+z2rMwOrZIqYyvoscE # 5p+ul/qgUq10XkNwI9t1pd9DX8g+5yuIY0chfC9G1B0AuiPHzvmszORBYY+8+7GT # 2Rwq/HqraC4= # =eab7 # -----END PGP SIGNATURE----- # gpg: Signature made Fri 26 May 2023 02:06:51 AM PDT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [undefined] # gpg: aka "Thomas Huth <thuth@redhat.com>" [undefined] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2023-05-26' of https://gitlab.com/thuth/qemu: hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) lsi53c895a: disable reentrancy detection for MMIO region, too machine: do not crash if default RAM backend name has been stolen tests/qtest/ac97-test: add up-/downsampling tests tests/qtest/usb-hcd-ehci-test: Check for EHCI and UHCI HCDs before using them tests/qtest/rtl8139-test: Check whether the rtl8139 device is available tests/qtest: Check for virtio-blk before using -cdrom with the arm virt machine tests/qtest/usb-hcd-uhci-test: Check whether "usb-storage" is available hw/mips: Use MachineClass->default_nic in the virt machine hw/arm: Use MachineClass->default_nic in the sbsa-ref machine hw/xtensa: Use MachineClass->default_nic in the virt machine hw/loongarch64: Use MachineClass->default_nic in the virt machine hw/arm: Use MachineClass->default_nic in the virt machine hw/alpha: Use MachineClass->default_nic in the alpha machine hw/hppa: Use MachineClass->default_nic in the hppa machine Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-26Hexagon (target/hexagon) Change Hexagon maintainerTaylor Simpson2-1/+2
Change Hexagon maintainer from Taylor Simpson to Brian Cain Put Taylor's gmail address in .mailmap Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org Message-Id: <20230524165355.3157700-2-tsimpson@quicinc.com>
2023-05-26Hexagon: fix outdated `hex_new_*` commentsMatheus Tavares Bernardino2-15/+13
Some code comments refer to hex_new_value and hex_new_pred_value, which have been transferred to DisasContext and, in the case of hex_new_value, should now be accessed through get_result_gpr(). In order to fix this outdated comments and also avoid having to tweak them whenever we make a variable name change in the future, let's replace them with pseudocode. Suggested-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Message-Id: <8e1689e28dd7b1318369b55127cf47b82ab75921.1684939078.git.quic_mathbern@quicinc.com>
2023-05-26target/hexagon/*.py: clean up used 'toss' and 'numregs' varsMatheus Tavares Bernardino7-70/+70
Many Hexagon python scripts call hex_common.get_tagregs(), but only one call site use the full reg structure given by this function. To make the code cleaner, let's make get_tagregs() filter out the unused fields (i.e. 'toss' and 'numregs'), properly removed the unused variables at the call sites. The hex_common.bad_register() function is also adjusted to work exclusively with 'regtype' and 'regid' args. For the single call site that does use toss/numregs, we provide an optional parameter to get_tagregs() which will restore the old full behavior. Suggested-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Tested-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Message-Id: <3ffd4ccb972879f57f499705c624e8eaba7f8b52.1684939078.git.quic_mathbern@quicinc.com>
2023-05-26Hexagon (target/hexagon) Fix assignment to tmp registersMarco Liebel2-4/+35
The order in which instructions are generated by gen_insn() influences assignment to tmp registers. During generation, tmp instructions (e.g. generate_V6_vassign_tmp) use vreg_src_off() to determine what kind of register to use as source. If some instruction (e.g. generate_V6_vmpyowh_64_acc) uses a tmp register but is generated prior to the corresponding tmp instruction, the vregs_updated_tmp bit map isn't updated in time. Exmple: { v14.tmp = v16; v25 = v14 } This works properly because generate_V6_vassign_tmp is generated before generate_V6_vassign and the bit map is updated. { v15:14.tmp = vcombine(v21, v16); v25:24 += vmpyo(v18.w,v14.h) } This does not work properly because vmpyo is generated before vcombine and therefore the bit map does not yet know that there's a tmp register. The parentheses in the decoding function were in the wrong place. Moving them to the correct location makes shuffling of .tmp vector registers work as expected. Signed-off-by: Marco Liebel <quic_mliebel@quicinc.com> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Tested-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20230522174708.464197-1-quic_mliebel@quicinc.com>
2023-05-26Hexagon (tests/tcg/hexagon) Clean up Hexagon check-tcg testsTaylor Simpson19-1206/+1030
Move test infra to header file check functions (always print line number on error) USR manipulation Useful floating point values Use stdint.h types Use stdbool.h bool where appropriate Use trip counts local to for loop Suggested-by: Anton Johansson <anjo@rev.ng> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Anton Johansson <anjo@rev.ng> Tested-by: Anton Johansson <anjo@rev.ng> Message-Id: <20230522174341.1805460-1-tsimpson@quicinc.com>
2023-05-26configure: ignore --makePaolo Bonzini2-18/+1
Setting the MAKE variable to a GNU Make executable does not really have any effect: if a non-GNU Make is used, the QEMU Makefile will fail to parse. Just remove everything related to --make and $make as dead code. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-26meson: use subproject for keycodemapdbPaolo Bonzini5-9/+9
By using a subproject, our own meson.build can use variables from the subproject instead of hard-coded paths. This is also the first step towards managing downloads with .wrap files instead of submodule. Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-26meson: use subproject for internal libfdtPaolo Bonzini5-24/+8
Recent dtc/libfdt can use either Make or meson as the build system. By using a subproject, our own meson.build can remove the hard coded list of source files. This is also the first step towards managing downloads with .wrap files instead of submodule. Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-26meson: simplify logic for -DfdtPaolo Bonzini1-13/+16
fdt_opt == 'disabled' is going to give an error if libfdt is required by any target, so catch that immediately. For fdt_opt == 'enabled', instead, do not check immediately whether the internal libfdt is present. Instead do the check after ascertaining that libfdt is absent or too old. Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-26virtio: qmp: fix memory leakPaolo Bonzini1-6/+5
The VirtioInfoList is already allocated by QAPI_LIST_PREPEND and need not be allocated by the caller. Fixes Coverity CID 1508724. Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-26slirp: update wrap to latest masterPaolo Bonzini1-1/+1
It is recommended to use SSIZE_T for ssize_t on win32, but the commit that is being used for slirp.wrap uses int. Update to include the fix as well as the other bugfix commit "ip: Enforce strict aliasing". Reported-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-26meson: Add static glib dependency for initrd-stress.imgFabiano Rosas1-1/+3
We recently moved glib detection code to meson but this changes the linker command line from -lglib-2.0 to using a path to libglib-2.0.so. This does not work for static linking, which is used by stress.c: $ make V=1 tests/migration/initrd-stress.img cc -m64 -mcx16 -o tests/migration/stress ... -static -Wl,--start-group /usr/lib64/libglib-2.0.so -Wl,--end-group ... bin/ld: attempted static link of dynamic object `/usr/lib64/libglib-2.0.so' Add a specific dependency for stress.c, which is linked statically. The compiler command line is now: cc -m64 -mcx16 -o tests/migration/stress ... -static -pthread -Wl,--start-group -lm /usr/lib64/libpcre.a -lglib-2.0 -Wl,--end-group Fixes: fc9a809e0d ("build: move glib detection and workarounds to meson") Signed-off-by: Fabiano Rosas <farosas@suse.de> Message-Id: <20230525212044.30222-3-farosas@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-26meson: Remove leftover commentFabiano Rosas1-2/+0
Commit d2e6f9272d ("fuzz: remove fork-fuzzing scaffolding") removed the linker script and forgot to remove the comment. Signed-off-by: Fabiano Rosas <farosas@suse.de> Message-Id: <20230525212044.30222-2-farosas@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-26target/loongarch: Fix the vinsgr2vr/vpickve2gr instructions cause system ↵Song Gao1-13/+26
coredump The vinsgr2vr/vpickve2gr instructions need use get_src/get_dst to get gpr registers value, not cpu_gpr[]. The $zero register does not have cpu_gpr[0] allocated. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1662 Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230525120005.2223413-1-gaosong@loongson.cn>
2023-05-26target/loongarch: Fix LD/ST{LE/GT} instructions get wrong CSR_ERA and CSR_BADVSong Gao2-3/+5
1.helper_asrtle_d/helper_asrtgt_d need use GETPC() to get PC; 2 LD/ST{LE/GT} need set CSR_BADV = gpr[rj]; 3 ASRTLE.D/ASRTGT.D also write CSR_BADV, but this value is random and has no reference value. Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230515130042.2719712-1-gaosong@loongson.cn>
2023-05-26configure: unset harmful environment variablesPaolo Bonzini1-3/+2
Apart from CLICOLOR_FORCE and GREP_OPTIONS, there are other variables that are listed in the Autoconf manual. While Autoconf neutralizes them very early, and assumes it does not (yet) run in a shell that has "unset", QEMU assumes that the user invoked configure under a POSIX shell, and therefore can simply use "unset" to clear them. CDPATH is particularly nasty because it messes up "cd ... && pwd". Reported-by: Juan Quintela <quintela@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-26Makefile: remove $(TESTS_PYTHON)Paolo Bonzini2-6/+4
It is now the same as $(PYTHON), since the latter always points at pyvenv/bin/python3. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-26tests/vm: fix and simplify HOST_ARCH definitionPaolo Bonzini1-3/+2
ARCH is always empty, so just define HOST_ARCH as the result of uname. The incorrect definition was not being used because the "ifeq" statement is wrong; replace it with the same idiom based on $(realpath) that the main Makefile uses. With this change, vm-build-netbsd in a configured tree will not use the PYTHONPATH hack. Reported-by: John Snow <jsnow@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-26tests/docker: simplify HOST_ARCH definitionPaolo Bonzini1-1/+1
ARCH is always empty, so just define HOST_ARCH as the result of uname. Acked-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-26hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330)Thomas Huth2-6/+50
We cannot use the generic reentrancy guard in the LSI code, so we have to manually prevent endless reentrancy here. The problematic lsi_execute_script() function has already a way to detect whether too many instructions have been executed - we just have to slightly change the logic here that it also takes into account if the function has been called too often in a reentrant way. The code in fuzz-lsi53c895a-test.c has been taken from an earlier patch by Mauro Matteo Cascella. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1563 Message-Id: <20230522091011.1082574-1-thuth@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-26lsi53c895a: disable reentrancy detection for MMIO region, tooThomas Huth1-0/+1
While trying to use a SCSI disk on the LSI controller with an older version of Fedora (25), I'm getting: qemu: warning: Blocked re-entrant IO on MemoryRegion: lsi-mmio at addr: 0x34 and the SCSI controller is not usable. Seems like we have to disable the reentrancy checker for the MMIO region, too, to get this working again. The problem could be reproduced it like this: ./qemu-system-x86_64 -accel kvm -m 2G -machine q35 \ -device lsi53c810,id=lsi1 -device scsi-hd,drive=d0 \ -drive if=none,id=d0,file=.../somedisk.qcow2 \ -cdrom Fedora-Everything-netinst-i386-25-1.3.iso Where somedisk.qcow2 is an image that contains already some partitions and file systems. In the boot menu of Fedora, go to "Troubleshooting" -> "Rescue a Fedora system" -> "3) Skip to shell" Then check "dmesg | grep -i 53c" for failure messages, and try to mount a partition from somedisk.qcow2. Message-Id: <20230516090556.553813-1-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-26machine: do not crash if default RAM backend name has been stolenIgor Mammedov1-0/+8
QEMU aborts when default RAM backend should be used (i.e. no explicit '-machine memory-backend=' specified) but user has created an object which 'id' equals to default RAM backend name used by board. $QEMU -machine pc \ -object memory-backend-ram,id=pc.ram,size=4294967296 Actual results: QEMU 7.2.0 monitor - type 'help' for more information (qemu) Unexpected error in object_property_try_add() at ../qom/object.c:1239: qemu-kvm: attempt to add duplicate property 'pc.ram' to object (type 'container') Aborted (core dumped) Instead of abort, check for the conflicting 'id' and exit with an error, suggesting how to remedy the issue. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2207886 Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20230522131717.3780533-1-imammedo@redhat.com> Tested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Shaoqin Huang <shahuang@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
generated by cgit v1.1 at 2025-09-23 23:23:51 +0000