aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2024-01-26virtio-net: correctly copy vnet header when flushing TXJason Wang1-4/+9
When HASH_REPORT is negotiated, the guest_hdr_len might be larger than the size of the mergeable rx buffer header. Using virtio_net_hdr_mrg_rxbuf during the header swap might lead a stack overflow in this case. Fixing this by using virtio_net_hdr_v1_hash instead. Reported-by: Xiao Lei <leixiao.nop@zju.edu.cn> Cc: Yuri Benditovich <yuri.benditovich@daynix.com> Cc: qemu-stable@nongnu.org Cc: Mauro Matteo Cascella <mcascell@redhat.com> Fixes: CVE-2023-6693 Fixes: e22f0603fb2f ("virtio-net: reference implementation of hash report") Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit 2220e8189fb94068dbad333228659fbac819abb0) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-22s390x/pci: drive ISM reset from subsystem resetMatthew Rosato2-9/+25
ISM devices are sensitive to manipulation of the IOMMU, so the ISM device needs to be reset before the vfio-pci device is reset (triggering a full UNMAP). In order to ensure this occurs, trigger ISM device resets from subsystem_reset before triggering the PCI bus reset (which will also trigger vfio-pci reset). This only needs to be done for ISM devices which were enabled for use by the guest. Further, ensure that AIF is disabled as part of the reset event. Fixes: ef1535901a ("s390x: do a subsystem reset before the unprotect on reboot") Fixes: 03451953c7 ("s390x/pci: reset ISM passthrough devices on shutdown and system reset") Reported-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Message-ID: <20240118185151.265329-4-mjrosato@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> (cherry picked from commit 68c691ca99a2538d6a53a70ce8a9ce06ee307ff1) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-22s390x/pci: refresh fh before disabling aifMatthew Rosato1-0/+9
Typically we refresh the host fh during CLP enable, however it's possible that the device goes through multiple reset events before the guest performs another CLP enable. Let's handle this for now by refreshing the host handle from vfio before disabling aif. Fixes: 03451953c7 ("s390x/pci: reset ISM passthrough devices on shutdown and system reset") Reported-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Message-ID: <20240118185151.265329-3-mjrosato@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> (cherry picked from commit 30e35258e25c75c9d799c34fd89afcafffb37084) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-22s390x/pci: avoid double enable/disable of aifMatthew Rosato1-2/+23
Use a flag to keep track of whether AIF is currently enabled. This can be used to avoid enabling/disabling AIF multiple times as well as to determine whether or not it should be disabled during reset processing. Fixes: d0bc7091c2 ("s390x/pci: enable adapter event notification for interpreted devices") Reported-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Message-ID: <20240118185151.265329-2-mjrosato@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> (cherry picked from commit 07b2c8e034d80ff92e202405c494d2ff80fcf848) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-20hw/scsi/esp-pci: set DMA_STAT_BCMBLT when BLAST command issuedMark Cave-Ayland1-0/+1
Even though the BLAST command isn't fully implemented in QEMU, the DMA_STAT_BCMBLT bit should be set after the command has been issued to indicate that the command has completed. This fixes an issue with the DC390 DOS driver which issues the BLAST command as part of its normal error recovery routine at startup, and otherwise sits in a tight loop waiting for DMA_STAT_BCMBLT to be set before continuing. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Guenter Roeck <linux@roeck-us.net> Message-ID: <20240112131529.515642-5-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> (cherry picked from commit c2d7de557d19ec76eb83b87b6bf77c8114e2f183) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-20hw/scsi/esp-pci: synchronise setting of DMA_STAT_DONE with ESP completion ↵Mark Cave-Ayland1-15/+13
interrupt The setting of DMA_STAT_DONE at the end of a DMA transfer can be configured to generate an interrupt, however the Linux driver manually checks for DMA_STAT_DONE being set and if it is, considers that a DMA transfer has completed. If DMA_STAT_DONE is set but the ESP device isn't indicating an interrupt then the Linux driver considers this to be a spurious interrupt. However this can occur in QEMU as there is a delay between the end of DMA transfer where DMA_STAT_DONE is set, and the ESP device raising its completion interrupt. This appears to be an incorrect assumption in the Linux driver as the ESP and PCI DMA interrupt sources are separate (and may not be raised exactly together), however we can work around this by synchronising the setting of DMA_STAT_DONE at the end of a DMA transfer with the ESP completion interrupt. In conjunction with the previous commit Linux is now able to correctly boot from an am53c974 PCI SCSI device on the hppa C3700 machine without emitting "iget: checksum invalid" and "Spurious irq, sreg=10" errors. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Guenter Roeck <linux@roeck-us.net> Message-ID: <20240112131529.515642-4-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> (cherry picked from commit 1e8e6644e063b20ad391140fae13d00ad7750b33) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-20hw/scsi/esp-pci: generate PCI interrupt from separate ESP and PCI sourcesMark Cave-Ayland1-5/+27
The am53c974/dc390 PCI interrupt has two separate sources: the first is from the internal ESP device, and the second is from the PCI DMA transfer logic. Update the ESP interrupt handler so that it sets DMA_STAT_SCSIINT rather than driving the PCI IRQ directly, and introduce a new esp_pci_update_irq() function to generate the correct PCI IRQ level. In particular this fixes spurious interrupts being generated by setting DMA_STAT_DONE at the end of a transfer if DMA_CMD_INTE_D isn't set in the DMA_CMD register. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Guenter Roeck <linux@roeck-us.net> Message-ID: <20240112131529.515642-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> (cherry picked from commit 6b41417d934b2640b7ccf893544d656eea92a2e7) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-20hw/scsi/esp-pci: use correct address register for PCI DMA transfersMark Cave-Ayland1-1/+1
The current code in esp_pci_dma_memory_rw() sets the DMA address to the value of the DMA_SPA (Starting Physical Address) register which is incorrect: this means that for each callback from the SCSI layer the DMA address is set back to the starting address. In the case where only a single SCSI callback occurs (currently for transfer lengths < 128kB) this works fine, however for larger transfers the DMA address wraps back to the initial starting address, corrupting the buffer holding the data transferred to the guest. Fix esp_pci_dma_memory_rw() to use the DMA_WAC (Working Address Counter) for the DMA address which is correctly incremented across multiple SCSI layer transfers. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Guenter Roeck <linux@roeck-us.net> Message-ID: <20240112131529.515642-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> (cherry picked from commit 84a6835e004c257037492167d4f266dbb54dc33e) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-20hw/pflash: implement update buffer for block writesGerd Hoffmann3-30/+89
Add an update buffer where all block updates are staged. Flush or discard updates properly, so we should never see half-completed block writes in pflash storage. Drop a bunch of FIXME comments ;) Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240108160900.104835-4-kraxel@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> (cherry picked from commit 284a7ee2e290e0c9b8cd3ea6164d92386933054f) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (Mjt: drop const in hw/block/pflash_cfi01.c for before v8.2.0-220-g7d5dc0a367 "hw/block: Constify VMState")
2024-01-20hw/pflash: use ldn_{be,le}_p and stn_{be,le}_pGerd Hoffmann1-55/+8
Use the helper functions we have to read/write multi-byte values in correct byte order. Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240108160900.104835-3-kraxel@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> (cherry picked from commit 5dd58358a57048e5ceabf5c91c0544f4f56afdcd) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-20hw/pflash: refactor pflash_data_write()Gerd Hoffmann1-14/+16
Move the offset calculation, do it once at the start of the function and let the 'p' variable point directly to the memory location which should be updated. This makes it simpler to update other buffers than pfl->storage in an upcoming patch. No functional change. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240108160900.104835-2-kraxel@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> (cherry picked from commit 3b14a555fdb627ac091559ef5931c887d06590d8) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-17hw/hppa: Move software power button address back into PDCHelge Deller1-4/+5
The various operating systems (e.g. Linux, NetBSD) have issues mapping the power button when it's stored in page zero. NetBSD even crashes, because it fails to map that page and then accesses unmapped memory. Since we now have a consistent memory mapping of PDC in 32-bit and 64-bit address space (the lower 32-bits of the address are in sync) the power button can be moved back to PDC space. This patch fixes the power button on Linux, NetBSD and HP-UX. Signed-off-by: Helge Deller <deller@gmx.de> Tested-by: Bruno Haible <bruno@clisp.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit ed35afcb331a972210816435d6b1b5de17fc7d4f) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-17hw/pci-host/astro: Add missing astro & elroy registers for NetBSDHelge Deller1-3/+23
NetBSD accesses some astro and elroy registers which aren't accessed by Linux yet. Add emulation for those registers to allow NetBSD to boot further. Please note that this patch is not sufficient to completely boot up NetBSD on the 64-bit C3700 machine yet. Signed-off-by: Helge Deller <deller@gmx.de> Tested-by: Bruno Haible <bruno@clisp.org> (cherry picked from commit 3b57c15f02050227c5c73ca97fa0dfc02f154fe9) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-17hw/hppa/machine: Disable default devices with --nodefaults optionHelge Deller1-4/+6
Recognize the qemu --nodefaults option, which will disable the following default devices on hppa: - lsi53c895a SCSI controller, - artist graphics card, - LASI 82596 NIC, - tulip PCI NIC, - second serial PCI card, - USB OHCI controller. Adding this option is very useful to allow manual testing and debugging of the other possible devices on the command line. Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit d8a3220005d74512677b181e3a32cd94b13ddf49) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-17hw/hppa/machine: Allow up to 3840 MB total memoryHelge Deller1-3/+6
The physical hardware allows DIMMs of 4 MB size and above, allowing up to 3840 MB of memory, but is restricted by setup code to 3 GB. Increase the limit to allow up to the maximum amount of memory. Btw. the memory area from 0xf000.0000 to 0xffff.ffff is reserved by the architecture for firmware and I/O memory and can not be used for standard memory. An upcoming 64-bit SeaBIOS-hppa firmware will allow more than 3.75GB on 64-bit HPPA64. In this case the ram_max for the pa20 case will change. Signed-off-by: Helge Deller <deller@gmx.de> Noticed-by: Nelson H. F. Beebe <beebe@math.utah.edu> Fixes: b7746b1194c8 ("hw/hppa/machine: Restrict the total memory size to 3GB") Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Bruno Haible <bruno@clisp.org> (cherry picked from commit 92039f61af89629f268e04255946c2a3fa0c453f) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-11hw/intc/arm_gicv3_cpuif: handle LPIs in in the list registersPeter Maydell1-4/+13
The hypervisor can deliver (virtual) LPIs to a guest by setting up a list register to have an intid which is an LPI. The GIC has to treat these a little differently to standard interrupt IDs, because LPIs have no Active state, and so the guest will only EOI them, it will not also deactivate them. So icv_eoir_write() must do two things: * if the LPI ID is not in any list register, we drop the priority but do not increment the EOI count * if the LPI ID is in a list register, we immediately deactivate it, regardless of the split-drop-and-deactivate control This can be seen in the VirtualWriteEOIR0() and VirtualWriteEOIR1() pseudocode in the GICv3 architecture specification. Without this fix, potentially a hypervisor guest might stall because LPIs get stuck in a bogus Active+Pending state. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Miguel Luis <miguel.luis@oracle.com> (cherry picked from commit 82a65e3188abebb509510b391726711606aca642) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08hw/vfio: fix iteration over global VFIODevice listVolker Rümelin1-4/+4
Commit 3d779abafe ("vfio/common: Introduce a global VFIODevice list") introduced a global VFIODevice list, but forgot to update the list element field name when iterating over the new list. Change the code to use the correct list element field. Fixes: 3d779abafe ("vfio/common: Introduce a global VFIODevice list") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2061 Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> (cherry picked from commit 9353b6da430f90e47f352dbf6dc31120c8914da6) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08vfio/container: Replace basename with g_path_get_basenameCédric Le Goater1-2/+3
g_path_get_basename() is a portable utility function that has the advantage of not modifing the string argument. It also fixes a compile breakage with the Musl C library reported in [1]. [1] https://lore.kernel.org/all/20231212010228.2701544-1-raj.khem@gmail.com/ Reported-by: Khem Raj <raj.khem@gmail.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Signed-off-by: Cédric Le Goater <clg@redhat.com> (cherry picked from commit 213ae3ffda463c0503e39e0cf827511b5298c314) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08edu: fix DMA range upper bound checkMax Erenberg1-1/+1
The edu_check_range function checks that start <= end1 < end2, where end1 is the upper bound (exclusive) of the guest-supplied DMA range and end2 is the upper bound (exclusive) of the device's allowed DMA range. When the guest tries to transfer exactly DMA_SIZE (4096) bytes, end1 will be equal to end2, so the check fails and QEMU aborts with this puzzling error message (newlines added for formatting): qemu: hardware error: EDU: DMA range 0x0000000000040000-0x0000000000040fff out of bounds (0x0000000000040000-0x0000000000040fff)! By checking end1 <= end2 instead, guests will be allowed to transfer exactly 4096 bytes. It is not necessary to explicitly check for start <= end1 because the previous two checks (within(addr, start, end2) and end1 > addr) imply start < end1. Fixes: b30934cb52a7 ("hw: misc, add educational driver", 2015-01-21) Signed-off-by: Max Erenberg <merenber@uwaterloo.ca> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 2c5107e1b455d4a157124f021826ead4e04b4aea) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-08hw/net: cadence_gem: Fix MDIO_OP_xxx valuesBin Meng1-2/+2
Testing upstream U-Boot with 'sifive_u' machine we see: => dhcp ethernet@10090000: PHY present at 0 Could not get PHY for ethernet@10090000: addr 0 phy_connect failed This has been working till QEMU 8.1 but broken since QEMU 8.2. Fixes: 1b09eeb122aa ("hw/net/cadence_gem: use FIELD to describe PHYMNTNC register fields") Reported-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Bin Meng <bmeng@tinylab.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 0c7ffc977195c1f71c8132eb5616827e589d4a0f) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-05hw/net/can/sja1000: fix bug for single acceptance filter and standard framePavel Pisa1-1/+1
A CAN sja1000 standard frame filter mask has been computed and applied incorrectly for standard frames when single Acceptance Filter Mode (MOD_AFM = 1) has been selected. The problem has not been found by Linux kernel testing because it uses dual filter mode (MOD_AFM = 0) and leaves falters fully open. The problem has been noticed by Grant Ramsay when testing with Zephyr RTOS which uses single filter mode. Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Reported-by: Grant Ramsay <gramsay@enphaseenergy.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2028 Fixes: 733210e754 ("hw/net/can: SJA1000 chip register level emulation") Message-ID: <20240103231426.5685-1-pisa@fel.cvut.cz> (cherry picked from commit 25145a7d7735344a469551946fc2a7f19eb4aa3d) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-01-05target/i386: the sgx_epc_get_section stub is reachablePaolo Bonzini1-1/+1
The sgx_epc_get_section stub is reachable from cpu_x86_cpuid. It should not assert, instead it should just return true just like the "real" sgx_epc_get_section does when SGX is disabled. Reported-by: Vladimír Beneš <vbenes@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-ID: <20220201190941.106001-1-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 219615740425d9683588207b40a365e6741691a6) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-12-05hw/ufs: avoid generating the same ID string for different LU devicesAkinobu Mita1-0/+8
QEMU would not start when trying to create two UFS host controllers and a UFS logical unit for each with the following options: -device ufs,id=bus0 \ -device ufs-lu,drive=drive1,bus=bus0,lun=0 \ -device ufs,id=bus1 \ -device ufs-lu,drive=drive2,bus=bus1,lun=0 \ This is because the same ID string ("0:0:0/scsi-disk") is generated for both UFS logical units. To fix this issue, prepend the parent pci device's path to make the ID string unique. ("0000:00:03.0/0:0:0/scsi-disk" and "0000:00:04.0/0:0:0/scsi-disk") Resolves: #2018 Fixes: 096434fea13a ("hw/ufs: Modify lu.c to share codes with SCSI subsystem") Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Reviewed-by: Jeuk Kim <jeuk20.kim@samsung.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20231204150543.48252-1-akinobu.mita@gmail.com> Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
2023-12-04Merge tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu into ↵Stefan Hajnoczi1-0/+1
staging ui/audio fixes for 8.2 # -----BEGIN PGP SIGNATURE----- # # iQJQBAABCAA6FiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmVtiO0cHG1hcmNhbmRy # ZS5sdXJlYXVAcmVkaGF0LmNvbQAKCRDa6OEJdZac5UDeEACvbixo8MuxOpBf9DK2 # JTCQeHYeVW7QtwDh9xUUnbcM77+lWgkr9OeCJ7FKxF1J7UHkQ7jIzISs/P0zuCw0 # JRkoOcfOnxV/Pn8XAq79F6Yq55EUdCdvsj0XgsVx+K096VHvjlK3fzNwNebJrkos # NpwQnnqI37TYBUFSivjKkEkPf1Kp4R4abeNs3eEzsIMUzEmEZQwwi5zZAMxxZ41o # fyItvdaEEDJxzupS6e0x4O4B5KkTo9RFwsJgstOAbkCxuJk67grV9dm3S3wFiUR3 # iFR2P/EyzctT9QOkU7oEIi87CiociKaYWgw/tDU4lFjXwbkt0a59b783Rha1RlN8 # ICFQ3B0NX+CNlc5PPsF1yp3+DNJRKz8Rap4PmU5IIVXTlPHm+YrWRw6vklw5kq7y # nAvdcfIJ+UQGVCgqQiLkuZslz4ATFOypnUvSL+eds1jHMS6UQcGd3zD1QCEPhDSP # jhFirqDQYWU/18ZU3b6VuDe5Ko3erd4V7hDikeQnjLjYfBFX1/Mts+6GmaGdfbqk # JLOHYa7CUP7akTB7fQF1/4B6cSf3hOsXYlmDHQPZgi1OYEy/BdPuwM5pN4jAikwO # b2z6TrXS3hQK61bUtU+XnhOOW98+gfz77UwluXDl22KHGV+c/SadyMFJWm8VYX4k # DuNTQ78vApqCuAhjFcKSXPSt7A== # =fpz/ # -----END PGP SIGNATURE----- # gpg: Signature made Mon 04 Dec 2023 03:08:13 EST # gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5 # gpg: issuer "marcandre.lureau@redhat.com" # gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full] # gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full] # Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5 * tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu: hw/audio/virtio-sound: mark the device as unmigratable ui/vnc-clipboard: fix inflate_buffer ui/gtk-egl: move function calls back to regular code path Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-12-04Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Stefan Hajnoczi12-47/+101
into staging virtio,pc,pci: features, cleanups, fixes misc fixes, cleanups Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmVrmhwPHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRp/XsH/05hHtQqO+EnKSAW5SEwZnlLfzDcajVVPIkT # h6Yf6ahHNf4hG1qqa2CICqJtDAOQYamO128QjZdQxsnYejwBmZ/oG//neWh6qLPV # Hp4AaKV2MjKRQZPNblnrGUirxkSWSTqIONXp4FsVVpKOKW9IX5f9tH6nyFAqXWX7 # KzNY/3KD1CVSwAV1+hY2c6OzWVdTSJykPRocfB0jTYY1RygI0t57Hiq7v8AliGAx # 7ktSJFD9MBr+4Un7CQZWp24eyrL77j8U+YQRlPVYupkmQyuXHPdBr4RruHcGupIy # GeIvbkX1mTCEfOd/HFQ1X41hpf8AEyZjjq2SOEBncIRWY6EhSio= # =opjy # -----END PGP SIGNATURE----- # gpg: Signature made Sat 02 Dec 2023 15:57:00 EST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: vhost-user-scsi: free the inflight area when reset vhost-user: fix the reconnect error msix: unset PCIDevice::msix_vector_poll_notifier in rollback virtio-iommu: Remove useless !sdev check in virtio_iommu_probe() hw/i386: fix short-circuit logic with non-optimizing builds hw/acpi/erst: Do not ignore Error* in realize handler pcie_sriov: Remove g_new assertion virtio-sound: add realize() error cleanup path virtio-snd: check AUD_register_card return value hw/audio/hda-codec: reenable the audio mixer hw/audio/hda-codec: fix multiplication overflow hw/audio/virtio-snd-pci: fix the PCI class code tests/acpi/bios-tables-test: do not write new blobs unless there are changes netdev: set timeout depending on loadavg osdep: add getloadavg Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-12-04hw/audio/virtio-sound: mark the device as unmigratableVolker Rümelin1-0/+1
The virtio-sound device is currently not migratable. QEMU crashes on the source machine at some point during the migration with a segmentation fault. Even with this bug fixed, the virtio-sound device doesn't migrate the state of the audio streams. For example, running streams leave the device on the destination machine in a broken condition. Mark the device as unmigratable until these issues have been fixed. Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20231204072837.6058-1-vr_qemu@t-online.de>
2023-12-02vhost-user-scsi: free the inflight area when resetLi Feng2-1/+17
Keep it the same to vhost-user-blk. At the same time, fix the vhost_reset_device. Signed-off-by: Li Feng <fengli@smartx.com> Message-Id: <20231123055431.217792-3-fengli@smartx.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02vhost-user: fix the reconnect errorLi Feng3-7/+7
If the error occurs in vhost_dev_init, the value of s->connected is set to true in advance, and there is no chance to enter this function execution again in the future. Signed-off-by: Li Feng <fengli@smartx.com> Message-Id: <20231123055431.217792-2-fengli@smartx.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02msix: unset PCIDevice::msix_vector_poll_notifier in rollbackRobert Hoo1-0/+1
In the rollback in msix_set_vector_notifiers(), original patch forgot to undo msix_vector_poll_notifier pointer. Fixes: bbef882cc193 ("msi: add API to get notified about pending bit poll") Signed-off-by: Robert Hoo <robert.hoo.linux@gmail.com> Message-Id: <20231113081349.1307-1-robert.hoo.linux@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02virtio-iommu: Remove useless !sdev check in virtio_iommu_probe()Eric Auger1-3/+0
The code already checks iommu_mr is not NULL so there is no need to check container_of() is not NULL. Remove the check. Fixes: CID 1523901 Fixes: 09b4c3d6a2 ("virtio-iommu: Record whether a probe request has been issued") Signed-off-by: Eric Auger <eric.auger@redhat.com> Reported-by: Coverity (CID 1523901) Message-Id: <20231109170715.259520-1-eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02hw/i386: fix short-circuit logic with non-optimizing buildsDaniel Hoffman1-3/+12
`kvm_enabled()` is compiled down to `0` and short-circuit logic is used to remove references to undefined symbols at the compile stage. Some build configurations with some compilers don't attempt to simplify this logic down in some cases (the pattern appears to be that the literal false must be the first term) and this was causing some builds to emit references to undefined symbols. An example of such a configuration is clang 16.0.6 with the following configure: ./configure --enable-debug --without-default-features --target-list=x86_64-softmmu --enable-tcg-interpreter Signed-off-by: Daniel Hoffman <dhoff749@gmail.com> Message-Id: <20231119203116.3027230-1-dhoff749@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02hw/acpi/erst: Do not ignore Error* in realize handlerPhilippe Mathieu-Daudé1-0/+10
erst_realizefn() passes @errp to functions without checking for failure. If it runs into another failure, it trips error_setv()'s assertion. Use the ERRP_GUARD() macro and check *errp, as suggested in commit ae7c80a7bd ("error: New macro ERRP_GUARD()"). Cc: qemu-stable@nongnu.org Fixes: f7e26ffa59 ("ACPI ERST: support for ACPI ERST feature") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20231120130017.81286-1-philmd@linaro.org> Reviewed-by: Ani Sinha <anisinha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02pcie_sriov: Remove g_new assertionAkihiko Odaki1-1/+0
g_new() aborts if the allocation fails so it returns NULL only if the requested allocation size is zero. register_vfs() makes such an allocation if NumVFs is zero so it should not assert that g_new() returns a non-NULL value. Fixes: 7c0fa8dff8 ("pcie: Add support for Single Root I/O Virtualization (SR/IOV)") Buglink: https://issues.redhat.com/browse/RHEL-17209 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20231123075630.12057-1-akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Yanghang Liu<yanghliu@redhat.com> Reviewed-by: Cédric Le Goater &lt;<a href="mailto:clg@redhat.com" target="_blank">clg@redhat.com</a>&gt;<br> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02virtio-sound: add realize() error cleanup pathManos Pitsidianakis1-17/+22
QEMU crashes on exit when a virtio-sound device has failed to realise. Its vmstate field was not cleaned up properly with qemu_del_vm_change_state_handler(). This patch changes the realize() order as 1. Validate the given configuration values (no resources allocated by us either on success or failure) 2. Try AUD_register_card() and return on failure (no resources allocated by us on failure) 3. Initialize vmstate, virtio device, heap allocations and stream parameters at once. If error occurs, goto error_cleanup label which calls virtio_snd_unrealize(). This cleans up all resources made in steps 1-3. Reported-by: Volker Rümelin <vr_qemu@t-online.de> Fixes: 2880e676c000 ("Add virtio-sound device stub") Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Message-Id: <20231116072046.4002957-1-manos.pitsidianakis@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-12-02virtio-snd: check AUD_register_card return valueManos Pitsidianakis1-1/+3
AUD_register_card might fail. Even though errp was passed as an argument, the call's return value was not checked for failure. Fixes: Coverity CID 1523899 Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Message-Id: <20231109162034.2108018-1-manos.pitsidianakis@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02hw/audio/hda-codec: reenable the audio mixerVolker Rümelin1-6/+6
Commit b7639b7dd0 ("hw/audio: Simplify hda audio init") inverted the sense of hda codec property mixer during initialization. Change the code so that mixer=on enables the hda mixer emulation and mixer=off disables the hda mixer emulation. With this change audio playback and recording streams don't start muted by default. Fixes: b7639b7dd0 ("hw/audio: Simplify hda audio init") Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20231105172552.8405-2-vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02hw/audio/hda-codec: fix multiplication overflowVolker Rümelin1-8/+21
After a relatively short time, there is an multiplication overflow when multiplying (now - buft_start) with hda_bytes_per_second(). While the uptime now - buft_start only overflows after 2**63 ns = 292.27 years, this happens hda_bytes_per_second() times faster with the multiplication. At 44100 samples/s * 2 channels * 2 bytes/channel = 176400 bytes/s that is 14.52 hours. After the multiplication overflow the affected audio stream stalls. Replace the multiplication and following division with muldiv64() to prevent a multiplication overflow. Fixes: 280c1e1cdb ("audio/hda: create millisecond timers that handle IO") Reported-by: M_O_Bz <m_o_bz@163.com> Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20231105172552.8405-1-vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-12-02hw/audio/virtio-snd-pci: fix the PCI class codeVolker Rümelin1-0/+2
The virtio sound device is currently an unclassified PCI device. ~> sudo lspci -s '00:02.0' -v -nn | head -n 2 00:02.0 Unclassified device [00ff]: Red Hat, Inc. Device [1af4:1059] (rev 01) Subsystem: Red Hat, Inc. Device [1af4:1100] Set the correct PCI class code to change the device to a multimedia audio controller. ~> sudo lspci -s '00:02.0' -v -nn | head -n 2 00:02.0 Multimedia audio controller [0401]: Red Hat, Inc. Device [1af4:1059] (rev 01) Subsystem: Red Hat, Inc. Device [1af4:1100] Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20231107185034.6434-1-vr_qemu@t-online.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-11-30ppc/amigaone: Allow running AmigaOS without firmware imageBALATON Zoltan1-12/+23
The machine uses a modified U-Boot under GPL license but the sources of it are lost with only a binary available so it cannot be included in QEMU. Allow running without the firmware image which can be used when calling a boot loader directly and thus simplifying booting guests. We need a small routine that AmigaOS calls from ROM which is added in this case to allow booting AmigaOS without external firmware image. Fixes: d9656f860a38 ("hw/ppc: Add emulation of AmigaOne XE board") Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
2023-11-28Merge tag 'misc-next-20231128' of https://github.com/philmd/qemu into stagingStefan Hajnoczi4-31/+69
Misc fixes for 8.2 * buildsys: Invoke bash via 'env' (Samuel) * doc: Fix example in s390-cpu-topology.rst (Zhao) * HW: Fix AVR ATMega reset stack (Gihun) and VT82C686 IRQ routing (Zoltan) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmVl7MUACgkQ4+MsLN6t # wN4nsQ//U7/GGrMaNJF369pC0UfC0dfD39RoD9jmmrWUQB17baMvXo+BMBcELX0Q # BtgRjIYwnywnVZlB11JL5Ql9ykSRqd7VeqnZfH//GqQO+ySF7jl6ekNT6YNjUbWu # iF9bU3o0/LAVl/3pe9LQ4q/yOjzERA5o4JKYviHZYcWE811/5lBNgER4iPyCz6a8 # aGI3S5PGmq6a9x5266jkY2WWldDy7D1ujkuvxxc4tgnmbBjL21soJ/oRLOBjGTNl # hCRfDTEiFZm7OxjV7oB03Nr3EGGStGdy0aPhhtFwzZxQ9yV7d2DLsbYGgwzZYkKQ # 9v4DtGqYyvDA7LBmfxOrnzL0WXgN4xO3qekLqHDtChDzFFEYwtHvH0duPUiQv1Yu # qHyOsfB58rKzWHeo0ACEjMWGdD1opCXCeoJlEf/saiQ5EgyBwph/z2mWYN4yak5H # Zu3xF15BcnyavC6sVeuE+rT574dhCzOtH8Vf3WVwqfL5D5cyCjHlmPSAXXMqBkmh # BMOD8O210n6IdzuuOQ038t3yGvIc0YysOmQgfLjRYlZa884q3wExgrufH+NYbGMj # bFthPjLKgHm+q4k2mH65G98xwXQFT6rdHanw2iEJcPJbhhk9SNWYgaQ0r0Oi2Pfd # zCQ22F1j9UqGcqKh+8tzAfjayRyQUJtgizPXEWanADkpIDYxrRk= # =323/ # -----END PGP SIGNATURE----- # gpg: Signature made Tue 28 Nov 2023 08:36:05 EST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'misc-next-20231128' of https://github.com/philmd/qemu: docs/s390: Fix wrong command example in s390-cpu-topology.rst hw/avr/atmega: Fix wrong initial value of stack pointer hw/audio/via-ac97: Route interrupts using via_isa_set_irq() hw/isa/vt82c686: Route PIRQ inputs using via_isa_set_irq() hw/usb/vt82c686-uhci-pci: Use ISA instead of PCI interrupts hw/isa/vt82c686: Bring back via_isa_set_irq() target/hexagon/idef-parser/prepare: use env to invoke bash Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-11-28Merge tag 'pull-target-arm-20231127' of ↵Stefan Hajnoczi9-17/+112
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * Set IL bit for pauth, SVE access, BTI trap syndromes * Handle overflow in calculation of next timer tick * hw/net/can/xlnx-zynqmp: Avoid underflow when popping FIFOs * Various devices: Free array property memory on device finalize * hw/ssi/xilinx_spips: fix an out of bound access * hw/misc, hw/ssi: Fix some URLs for AMD / Xilinx models * hw/dma/xlnx_csu_dma: don't throw guest errors when stopping the SRC DMA # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmVkzLAZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3o79D/0Yh7Q7N4+fc4xdBK5hb1GN # 31rBWZ3z0XzBzXrN80g6ig5i+CvTq7+120yx4Kl5bdyAMGdXpryTeNSoa4ewmNtC # +c6pqV8IUIHA3axepuHtwjs4wRzWoFz13gy+X/1spfhcrtFpWyRt0f3cc1fElhzX # 2K/4H9TD2d5yZBvaKLoJ6GzdK2wtWfucvWQDOUigRF7rvSST3awZ6gkumm+/6EM5 # vbIVOqi+0JcnWKJj0i4S1vRUPg0+CuaZN8glXcGkq2BaMfOohpjFGTMY0KsAK1Cv # Ow1guxxy2mcLixQ8pX7ii5WHVDCuPqTVcwHUQJqN5Ln6CFEre38jM1ZwgHpWhb8G # CoVOu2B96QwPoICD7QomaKCJYHkAczC4KETsTz/Mc+zcU6+cQiv0swc2sDhwBlmT # weHQAmZg5dPRl3DQ/8F3llhdYyvOGnUpaaBauJiuH2I5n/qhqbvcgu9G7pGwd2gm # lk8LuzjbVEtBu2jFlPCMpvuSuJJciR/3/QdHMGlN6L0ooY6dFL9puW51wFKSh+Kx # JqetuUJXVWLTiL9ekLnNPQkuQQwP3WQsIvQO8tjEiuojw1utk/50JPmXg/xHEahx # rN8aiLstR4olh1i+CrIee3QR6IwhqZmvEVHROIw0ExJ1L04FCCtPlvJ/G2gD1ta2 # oLvqWLlc752+nND72lIJZg== # =X700 # -----END PGP SIGNATURE----- # gpg: Signature made Mon 27 Nov 2023 12:06:56 EST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20231127' of https://git.linaro.org/people/pmaydell/qemu-arm: hw/dma/xlnx_csu_dma: don't throw guest errors when stopping the SRC DMA hw/misc, hw/ssi: Fix some URLs for AMD / Xilinx models hw/ssi/xilinx_spips: fix an out of bound access hw/input/stellaris_gamepad: Free StellarisGamepad::keycodes[] array hw/nvram/xlnx-efuse-ctrl: Free XlnxVersalEFuseCtrl[] "pg0-lock" array hw/nvram/xlnx-efuse: Free XlnxEFuse::ro_bits[] array on finalize() hw/misc/mps2-scc: Free MPS2SCC::oscclk[] array on finalize() hw/virtio: Free VirtIOIOMMUPCI::vdev.reserved_regions[] on finalize() hw/virtio: Add VirtioPCIDeviceTypeInfo::instance_finalize field hw/net/can/xlnx-zynqmp: Avoid underflow while popping RX FIFO hw/net/can/xlnx-zynqmp: Avoid underflow while popping TX FIFOs target/arm: Handle overflow in calculation of next timer tick target/arm: Set IL bit for pauth, SVE access, BTI trap syndromes Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-11-28Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into stagingStefan Hajnoczi1-6/+11
Block layer patches - ide/via: Fix BAR4 value in legacy mode - export/vhost-user-blk: Fix consecutive drains - vmdk: Don't corrupt desc file in vmdk_write_cid - iotests: fix default machine type detection # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmVl9GARHGt3b2xmQHJl # ZGhhdC5jb20ACgkQfwmycsiPL9Y9KRAAx3ryUIdaVZX5RZbVC4ZmkgGIpSv+8dS+ # e98H+accyyVTVXlMNYWy0s7tP6sxhhlmGqfGLx/hDynvjJRxyS8VSOXXNIqYcHqN # wGXcgLEgb+qxu7+Y8g3UhMeSmDyRhanOE/MxhMqGOKd/5nxfY1XdD7nkRwCsPAAi # Tud/Jd7t0CSV0wUDfvMtBsQZCBSQyoSu3S3TjZ8I2CPjBaoYojj3XM+LKrlJu+B5 # zwgB5IURac1dOfsjYsX0M0zXxr6pTVNtkdNNwFoiNP+omoRjCXV3W9iTtyU+/zc3 # cnVzQQRE6XufQ/Q7IWHNE3/U5LvM3m+sjB+YryrMTRVItjpGUCgYGsrgodjZp7aj # 4hmwxyZ8PN3+o96d5RWqhRXnY9fy5hzJZOhUMQV6lV/Z14wt8YYsJoqgi4wryoYf # 7VdyZP2Szt2Sgl4+n0uSfPBoR+qMEwni1AxO8iK9OZbpewv7aBO3In4tOAvP/eB8 # VAoCZOfrILSXaR5aorlAPr6IOXanPvgOotmzNs0NaaqYnpfYr6KAH9FjyAm3DZqp # b+/Ep+hrekq9XqnZGMblQsjlTFAc9mRWtqsHUrftl9FhRvSah4R+TyKov8lD23VZ # bvw1etcc0p55Ws4RkUkGn8G5kRyhec3nkHdr4MODCR0s0uo0cBaITnoV0Ra9p7of # K78WSodwZKQ= # =ktlF # -----END PGP SIGNATURE----- # gpg: Signature made Tue 28 Nov 2023 09:08:32 EST # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * tag 'for-upstream' of https://repo.or.cz/qemu/kevin: ide/via: Fix BAR4 value in legacy mode export/vhost-user-blk: Fix consecutive drains vmdk: Don't corrupt desc file in vmdk_write_cid iotests: fix default machine type detection Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-11-28ide/via: Fix BAR4 value in legacy modeBALATON Zoltan1-6/+11
Return default value in legacy mode for BAR4 when unset. This can't be set in reset method because BARs are cleared on reset so we return it instead when BARs are read in legacy mode. This fixes UDMA on amigaone with AmigaOS. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-ID: <20231125140135.AF6A075A4C3@zero.eik.bme.hu> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2023-11-28hw/avr/atmega: Fix wrong initial value of stack pointerGihun Nam1-0/+4
The current implementation initializes the stack pointer of AVR devices to 0. Although older AVR devices used to be like that, newer ones set it to RAMEND. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1525 Signed-off-by: Gihun Nam <gihun.nam@outlook.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <PH0P222MB0010877445B594724D40C924DEBDA@PH0P222MB0010.NAMP222.PROD.OUTLOOK.COM> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-11-28hw/audio/via-ac97: Route interrupts using via_isa_set_irq()BALATON Zoltan2-4/+5
This device is a function of VIA south bridge and should allow setting interrupt routing within that chip. This is implemented in via_isa_set_irq(). Fixes: eb604411a78b82c468e2b8d81a9401eb8b9c7658 Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-ID: <5329840e4be6dd8ae143d07cbfe61d8d2d106654.1701035944.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-11-28hw/isa/vt82c686: Route PIRQ inputs using via_isa_set_irq()BALATON Zoltan1-41/+24
The chip has 4 pins (called PIRQA-D in VT82C686B and PINTA-D in VT8231) that are meant to be connected to PCI IRQ lines and allow routing PCI interrupts to the ISA PIC. Route these in via_isa_set_irq() to make it possible to share them with internal functions that can also be routed to the same ISA IRQs. Fixes: 2fdadd02e675caca4aba4ae26317701fe2c4c901 Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-ID: <8c4513d8b78fac40e6d4e65a0a4b3a7f2f278a4b.1701035944.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-11-28hw/usb/vt82c686-uhci-pci: Use ISA instead of PCI interruptsBALATON Zoltan1-0/+9
This device is part of a superio/ISA bridge chip and IRQs from it are routed to an ISA interrupt. Use via_isa_set_irq() function to implement this in a vt82c686-uhci-pci specific irq handler. This reverts commit 422a6e8075752bc5342afd3eace23a4990dd7d98. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-ID: <ed5cdeaba7cf01eebdaa35f84c63427f4d8876b1.1701035944.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-11-28hw/isa/vt82c686: Bring back via_isa_set_irq()BALATON Zoltan1-0/+41
The VIA integrated south bridge chips combine several functions and allow routing their interrupts to any of the ISA IRQs also allowing multiple sources to share the same ISA IRQ. E.g. pegasos2 firmware configures everything to use IRQ 9 but amigaone routes them to separate ISA IRQs so the current simplified routing does not work. Bring back via_isa_set_irq() and change it to take the component that wants to change an IRQ and keep track of interrupt status of each source separately and do the mapping to ISA IRQ within the ISA bridge. This may not handle cases when an ISA IRQ is controlled by devices directly, not going through via_isa_set_irq() such as serial, parallel or keyboard but these IRQs being conventionally fixed are not likely to be change by guests or share with other devices so this does not cause a problem in practice. This reverts commit 4e5a20b6da9b1f6d2e9621ed7eb8b239560104ae. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-ID: <1c3902d4166234bef0a476026441eaac3dd6cda5.1701035944.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-11-28qdev: Fix crash in array property getterKevin Wolf1-7/+26
Passing an uninitialised list to visit_start_list() happens to work for the QObject output visitor because it treats the pointer as an opaque value and never dereferences it, but the string output visitor expects a valid list to check if it has more than one element. The existing code crashes with the string output visitor if the uninitialised value is non-NULL. Passing an explicit NULL would fix the crash, but still result in wrong output. Rework get_prop_array() so that it conforms to the expectations that the string output visitor has. This includes building a real list first and using visit_next_list() to iterate it. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1993 Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Tested-by: Dan Hoffman <dhoff749@gmail.com> Tested-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20231121173416.346610-2-kwolf@redhat.com>
2023-11-27hw/dma/xlnx_csu_dma: don't throw guest errors when stopping the SRC DMAFrederic Konrad1-4/+8
UG1087 states for the source channel that: if SIZE is programmed to 0, and the DMA is started, the interrupts DONE and MEM_DONE will be asserted. This implies that it is allowed for the guest to stop the source DMA by writing a size of 0 to the SIZE register, so remove the LOG_GUEST_ERROR in that case. While at it remove the comment marking the SIZE register as write-only. See: https://docs.xilinx.com/r/en-US/ug1087-zynq-ultrascale-registers/CSUDMA_SRC_SIZE-CSUDMA-Register Signed-off-by: Frederic Konrad <fkonrad@amd.com> Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com> Message-id: 20231124143505.1493184-4-fkonrad@amd.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.1 at 2025-08-04 04:05:24 +0000