aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2025-08-28hw/intc/loongarch_pch_pic: Fix ubsan warning and endianness issueThomas Huth1-7/+8
When booting the Linux kernel from tests/functional/test_loongarch64_virt.py with a QEMU that has been compiled with --enable-ubsan, there is a warning like this: .../hw/intc/loongarch_pch_pic.c:171:46: runtime error: index 512 out of bounds for type 'uint8_t[64]' (aka 'unsigned char[64]') SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior .../hw/intc/loongarch_pch_pic.c:171:46 .../hw/intc/loongarch_pch_pic.c:175:45: runtime error: index 256 out of bounds for type 'uint8_t[64]' (aka 'unsigned char[64]') SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior .../hw/intc/loongarch_pch_pic.c:175:45 It happens because "addr" is added first before substracting the base (PCH_PIC_HTMSI_VEC or PCH_PIC_ROUTE_ENTRY). Additionally, this code looks like it is not endianness safe, since it uses a 64-bit pointer to write values into an array of 8-bit values. Thus rework the code to use the stq_le_p / ldq_le_p helpers here and make sure that we do not create pointers with undefined behavior by accident. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Song Gao <gaosong@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2025-08-28Merge tag 'pull-lu-20250828' of https://gitlab.com/rth7680/qemu into stagingRichard Henderson1-4/+0
linux-user: do not print IP socket options by default linux-user: Add strace for rseq linux-user: Move get_elf_cpu_model to target/elfload.c linux-user: Move get_elf_hwcap to target/elfload.c linux-user: Move get_elf_hwcap2 to target/elfload.c linux-user: Move get_elf_platform to target/elfload.c linux-user: Move get_elf_base_platform to target/elfload.c linux-user: Create init_main_thread in target/cpu_loop.c semihosting: Retrieve stack top from image_info semihosting: Initialize heap once per process # -----BEGIN PGP SIGNATURE----- # # iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmive68dHHJpY2hhcmQu # aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV+LwwgAsjSjc5Bjal0mc+UI # Qmb7qbNM7YDhJ4o9eJoT7AfEo3AlR8vhA01/ayfBEKMxYStl4tkZU1jthb7LLTyS # TfPBsZEBF/ZuTYLV56dfQ/6AJZ2g5OhqJbeVeD8Ef93JK60qgBerCK/D5SfphSfh # TQtOG0LU2BXzGt8K3WghFxsFQeYcTrNeT5JdtIXYrmGQmDnPh3dOnQrFcO1leFLa # khUfj7l7bE1Rgqo5h5pveaee4AD3VndYe10zvSVKHKjBL4Zd3hxf3MypNRpDFC0v # ua9xt4qXtWgEYSkKPj/mipcd9fsb+RKs6kPA3oojwb8DCkFAZ0UogIwmd9/7lz8u # FMp+iQ== # =Nu63 # -----END PGP SIGNATURE----- # gpg: Signature made Thu 28 Aug 2025 07:42:07 AM AEST # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [ultimate] * tag 'pull-lu-20250828' of https://gitlab.com/rth7680/qemu: (46 commits) linux-user: do not print IP socket options by default linux-user: Add strace for rseq linux-user: Remove do_init_main_thread linux-user/hexagon: Create init_main_thread linux-user/xtensa: Create init_main_thread linux-user/hppa: Create init_main_thread linux-user/riscv: Create init_main_thread linux-user/s390x: Create init_main_thread linux-user/alpha: Create init_main_thread linux-user/m68k: Create init_main_thread linux-user/sh4: Create init_main_thread linux-user/openrisc: Create init_main_thread linux-user/microblaze: Create init_main_thread linux-user/mips: Create init_main_thread linux-user/loongarch64: Create init_main_thread linux-user/ppc: Create init_main_thread linux-user/sparc: Create init_main_thread linux-user/aarch64: Create init_main_thread linux-user/arm: Remove a.out startup remenents linux-user/arm: Create init_main_thread ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2025-08-28linux-user: Move ppc uabi/asm/elf.h workaround to osdep.hRichard Henderson1-4/+0
Move the workaround out of linux-user/elfload.c, so that we don't have to replicate it in many places. Place it immediately after the include of <signal.h>, which draws in the relevant symbols. Note that ARCH_DLINFO is not defined by the kernel header, and so there's no need to undef it either. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2025-08-28Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson1-1/+1
* rust: declare self as qemu_api for proc-macros * rust/qemu-api-macros: make derive(Object) friendly when missing parent * x86/loader: Don't update kernel header for CoCo VMs * target/i386: Add support for save/load of exception error code * i386/tcg/svm: fix incorrect canonicalization * scripts/minikconf.py: small fixes # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmivPVYUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroNi/wf/VvAfmXDNgiffoXl91cF8kx2zSs8L # D+pd/ufVEkFYsU1EnHUsGJKK0XrjHp/beCGkWZr9nTP448n1t5MiTYgI9z5Lkult # hwBQMZsxbOLw4BItbh9obWC5HrfHqgpy88hsfy+RfiSU31ae4drzottDm3/VbaFY # 2d0x9ai8lvaTk+GqBV8EeeCT210tS/Cb/8HC22o+vC2O2/cztnuCj6wtD43ocDEk # lhT00edP8jUX4EoPAx18Qkv/zzPL/p9jWVAFCcE/IZ/e4LSrgA61aUyoP9vvrjWh # U+f8C4MV2o8oZ1lM9FC5hJ0LdQbeq1kxqqukQIKYlRiFXjD3LZ+3wJueHQ== # =XEsN # -----END PGP SIGNATURE----- # gpg: Signature made Thu 28 Aug 2025 03:16:06 AM AEST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [unknown] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [unknown] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: rust: move dependencies to rust/Cargo.toml rust: declare self as qemu_api for proc-macros rust/qemu-api-macros: make derive(Object) friendly when missing parent subprojects: update proc-macro2 and syn rust: qemu-api-macros: support matching more than one error rust: disable borrow_as_ptr warning kvm/kvm-all: make kvm_park/unpark_vcpu local to kvm-all.c i386/tcg/svm: fix incorrect canonicalization x86/loader: Don't update kernel header for CoCo VMs MAINTAINERS: add a few more files to "Top Level Makefile and configure" python: mkvenv: fix messages printed by mkvenv scripts/minikconf.py: s/Error/KconfigParserError scripts/minikconf.py: fix invalid attribute access target/i386: Add support for save/load of exception error code Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2025-08-27x86/loader: Don't update kernel header for CoCo VMsXiaoyao Li1-1/+1
Update the header makes it different from the original kernel that user provides via "-kernel", which leads to a different hash and breaks the attestation, e.g., for TDX. We already skip it for SEV VMs. Instead of adding another check of is_tdx_vm() to cover the TDX case, check machine->cgs to cover all the confidential computing case for x86. Reported-by: Vikrant Garg <vikrant1garg@gmail.com> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://lore.kernel.org/r/20250814092111.2353598-1-xiaoyao.li@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-08-27hw: add compat machines for 10.2Cornelia Huck8-9/+70
Add 10.2 machine types for arm/i440fx/m68k/q35/s390x/spapr. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20250805095616.1168905-1-cohuck@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-08-13Merge tag 'uefi-20250812-pull-request' of https://gitlab.com/kraxel/qemu ↵Stefan Hajnoczi3-3/+8
into staging hw/uefi: last-minute bug fixes for the uefi variable store [for 10.1] # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmibENYACgkQTLbY7tPo # cTi2vQ/9FlAPZTZ/z/D5dfDHLhB06esVe6qd7LuI7rV3/6bUB+g+LYwoJI40SVMq # Q5YDsQGX0muhzsE343XYMXIcz8yxUEvALpvFVW6e5pg92Q2g1aeHeJaxsaiPdbo2 # gG9WU3paCOQzRK488fUe8ed6Gkqmu6SLDwuAtQ5D9UXZ7qCSfy2Rr8/Li9Qs5JCJ # StLccRvK6G72S+ESYDo/O1Q1P0CdpgJXuOV+75NdYZn4e7G0GUXN52l1U3fH0JZZ # sSqoo4TgMjrchEhE4YrXNm/UFrhLpn+uv1Xhyv6UuLpLLWlSU/5EeARS7mGjMGbp # z3Np11LrqtbB9fxxrxf75OLzya2aKBVUlmuh/HCP1wLNx7kxYpT4yyjsywXkksQ3 # TV2dMknDHm0JRf/i2DJuS6bDZlbehfu+1KkR25+0h/QSd2tK9Ct/ZxO59QcR02Kt # ecvSzRfFG8+jTVorwVguftDyRe4b/qpFn4X7KujlkKvLiOA4lZ8NZsIFi0x2FGeA # efdLRVEaDRJBmblcykPR+NYAyxcwGdHYerOsbf/vnRlCAsNQw1oofqTSU6qxnjnH # hDF+fGBVQ2drjTfb5aFdLpQ4Fq9yD+x9fdpshT8IzqIdsJDKrlPYZK4ueSBF4A3V # 32N2ZumxH17bvE44WkclJ0aog25M2+dgs5OJvqjcYY5VllEMTis= # =Ntwr # -----END PGP SIGNATURE----- # gpg: Signature made Tue 12 Aug 2025 06:00:54 EDT # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * tag 'uefi-20250812-pull-request' of https://gitlab.com/kraxel/qemu: hw/uefi: open json file in binary mode hw/uefi: check access for first variable hw/uefi: return success for notifications hw/uefi: clear uefi-vars buffer in uefi_vars_write callback Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-12hw/sd/ssi-sd: Return noise (dummy byte) when no card connectedPhilippe Mathieu-Daudé1-0/+4
Commit 1585ab9f1ba ("hw/sd/sdcard: Fill SPI response bits in card code") exposed a bug in the SPI adapter: if no SD card is plugged, we are returning "there is a card with an error". This is wrong, we shouldn't return any particular packet response, but the noise shifted on the MISO line. Return the dummy byte, otherwise we get: qemu-system-riscv64: ../hw/sd/ssi-sd.c:160: ssi_sd_transfer: Assertion `s->arglen > 0' failed. Reported-by: Guenter Roeck <linux@roeck-us.net> Fixes: 775616c3ae8 ("Partial SD card SPI mode support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250812140415.70153-2-philmd@linaro.org>
2025-08-12hw/uefi: open json file in binary modeGerd Hoffmann1-1/+1
Fixes file length discrepancies due to line ending conversions on windows hosts. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3058 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20250811130110.820958-4-kraxel@redhat.com>
2025-08-12hw/uefi: check access for first variableGerd Hoffmann1-0/+3
When listing variables (via get-next-variable-name) only the names of variables which can be accessed will be returned. That check was missing for the first variable though. Add it. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20250811130110.820958-3-kraxel@redhat.com>
2025-08-12hw/uefi: return success for notificationsGerd Hoffmann1-0/+2
Set status to SUCCESS for ready-to-boot and exit-boot-services notification calls. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20250811130110.820958-2-kraxel@redhat.com>
2025-08-12hw/uefi: clear uefi-vars buffer in uefi_vars_write callbackMauro Matteo Cascella1-2/+2
When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is invoked. The function allocates a heap buffer without zeroing the memory, leaving the buffer filled with residual data from prior allocations. When the guest later reads from register UEFI_VARS_REG_PIO_BUFFER_TRANSFER, the .read callback `uefi_vars_read` returns leftover metadata or other sensitive process memory from the previously allocated buffer, leading to an information disclosure vulnerability. Fixes: CVE-2025-8860 Fixes: 90ca4e03c27d ("hw/uefi: add var-service-core.c") Reported-by: ZDI <zdi-disclosures@trendmicro.com> Suggested-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Message-ID: <20250811101128.17661-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2025-08-11Merge tag 'pull-nvme-20250811' of https://gitlab.com/birkelund/qemu into stagingStefan Hajnoczi1-15/+28
nvme queue # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmiZmYQACgkQTeGvMW1P # DenI0wf9GPov0a82A2F23UTU+R8NC/NASBovEfPRTz7/J9fGL844ID3G6uT4emFP # wAilGmMbNuPHKAtII4holCximP/7yosVZJIIdjLsRBBP9AZqpMHkr27VBny9rklZ # X7TW6zI8INIjdqvRlIBevH5t5By/qLiaDc6GzRWJ3PoeXE6SKACDi0lNBsn75xah # IbcHi72c96CwYJCEtOHXBs+zECo1yGDhK0OPvs/s7OykuRcOumF21IzuY958bVs/ # 7dJZkTL+oarZHIvKiUrErKK3gWfSrLeaWrR6sW1QNuOhzEeNHk47w86p+CEQ7CrU # w0ioEaZ9awXk7wnZeY//CpUKFbsmwQ== # =Qfvu # -----END PGP SIGNATURE----- # gpg: Signature made Mon 11 Aug 2025 03:19:32 EDT # gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9 # gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown] # gpg: aka "Klaus Jensen <k.jensen@samsung.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838 # Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9 * tag 'pull-nvme-20250811' of https://gitlab.com/birkelund/qemu: hw/nvme: cap MDTS value for internal limitation hw/nvme: revert CMIC behavior hw/nvme: fix namespace attachment Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-11hw/nvme: cap MDTS value for internal limitationKeith Busch1-0/+5
The emulated device had let the user set whatever max transfers size they wanted, including no limit. However the device does have an internal limit of 1024 segments. NVMe doesn't report max segments, though. This is implicitly inferred based on the MDTS and MPSMIN values. IOV_MAX is currently 1024 which 4k PRPs can exceed with 2MB transfers. Don't allow MDTS values that can exceed this, otherwise users risk seeing "internal error" status to their otherwise protocol compliant commands. Signed-off-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2025-08-11hw/nvme: revert CMIC behaviorKlaus Jensen1-13/+17
Commit cd59f50ab017 ("hw/nvme: always initialize a subsystem") causes the controller to always set the CMIC.MCTRS ("Multiple Controllers") bit. While spec-compliant, this is a deviation from the previous behavior where this was only set if an nvme-subsys device was explicitly created (to configure a subsystem with multiple controllers/namespaces). Revert the behavior to only set CMIC.MCTRS if an nvme-subsys device is created explicitly. Reported-by: Alan Adamson <alan.adamson@oracle.com> Fixes: cd59f50ab017 ("hw/nvme: always initialize a subsystem") Reviewed-by: Alan Adamson <alan.adamson@oracle.com> Tested-by: Alan Adamson <alan.adamson@oracle.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2025-08-11hw/nvme: fix namespace attachmentKlaus Jensen1-2/+6
Commit 6ccca4b6bb9f ("hw/nvme: rework csi handling") introduced a bug in Namespace Attachment, causing it to a) not allow a controller to attach namespaces to other controllers b) assert if a valid non-attached namespace is detached This fixes both issues. Fixes: 6ccca4b6bb9f ("hw/nvme: rework csi handling") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2976 Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2025-08-09vfio: Document 'use-legacy-x86-rom' propertyCédric Le Goater1-0/+3
Commit 350785d41d8b ("ramfb: Add property to control if load the romfile") introduced the `use-legacy-x86-rom` property for the `vfio-pci-nohotplug` device. Add documentation for the property. Fixes: d5fcf0d960d8 ("hw/i386: Add the ramfb romfile compatibility") Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/qemu-devel/20250805065543.120091-1-clg@redhat.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-08-09vfio/pci: preserve pending interruptsSteve Sistare3-0/+94
cpr-transfer may lose a VFIO interrupt because the KVM instance is destroyed and recreated. If an interrupt arrives in the middle, it is dropped. To fix, stop pending new interrupts during cpr save, and pick up the pieces. In more detail: Stop the VCPUs. Call kvm_irqchip_remove_irqfd_notifier_gsi --> KVM_IRQFD to deassign the irqfd gsi that routes interrupts directly to the VCPU and KVM. After this call, interrupts fall back to the kernel vfio_msihandler, which writes to QEMU's kvm_interrupt eventfd. CPR already preserves that eventfd. When the route is re-established in new QEMU, the kernel tests the eventfd and injects an interrupt to KVM if necessary. Deassign INTx in a similar manner. For both MSI and INTx, remove the eventfd handler so old QEMU does not consume an event. If an interrupt was already pended to KVM prior to the completion of kvm_irqchip_remove_irqfd_notifier_gsi, it will be recovered by the subsequent call to cpu_synchronize_all_states, which pulls KVM interrupt state to userland prior to saving it in vmstate. Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Link: https://lore.kernel.org/qemu-devel/1752689169-233452-3-git-send-email-steven.sistare@oracle.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-08-09vfio/pci: augment set_handlerSteve Sistare3-4/+14
Extend vfio_pci_msi_set_handler() so it can set or clear the handler. Add a similar accessor for INTx. No functional change. Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/1752689169-233452-2-git-send-email-steven.sistare@oracle.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-08-05hw/i386/microvm: Explicitly select ACPI_PCIEric Auger1-0/+1
With a microvm-only build based on a custom device config, we get a link failure due to undefined reference to build_pci_host_bridge_osc_method() which is defined in hw/acpi/pci.c and whose compilation depends on CONFIG_ACPI_PCI. Although CONFIG_ACPI and CONFIG_PCI are set with such configuration, implied CONFIG_ACPI_PCI in config PCI_EXPRESS_GENERIC_BRIDGE is not selected as expected. It Looks like CONFIG_ACPI_PCI must be enforced and this patch selects CONFIG_ACPI_PCI in MICROVM config directly as done for PC config. Reproducer: ../configure \ --without-default-features \ --target-list=x86_64-softmmu \ --enable-kvm --disable-tcg \ --enable-pixman \ --enable-vnc \ --audio-drv-list="" \ --without-default-devices \ --with-devices-x86_64=microvm \ --enable-vhost-user with configs/devices/x86_64-softmmu/microvm.mak: CONFIG_PCI_DEVICES=n CONFIG_MICROVM=y CONFIG_VIRTIO_BLK=y CONFIG_VIRTIO_SERIAL=y CONFIG_VIRTIO_INPUT=y CONFIG_VIRTIO_INPUT_HOST=y CONFIG_VHOST_USER_INPUT=y CONFIG_VIRTIO_NET=y CONFIG_VIRTIO_SCSI=y CONFIG_VIRTIO_RNG=y CONFIG_VIRTIO_CRYPTO=y CONFIG_VIRTIO_BALLOON=y CONFIG_VIRTIO_GPU=y CONFIG_VHOST_USER_GPU=y FAILED: qemu-system-x86_64 cc -m64 @qemu-system-x86_64.rsp /usr/bin/ld: libsystem.a.p/hw_pci-host_gpex-acpi.c.o: in function `acpi_dsdt_add_host_bridge_methods': hw/pci-host/gpex-acpi.c:83:(.text+0x274): undefined reference to `build_pci_host_bridge_osc_method' collect2: error: ld returned 1 exit status Fixes: af151d50eac24 "hw/pci-host/gpex-acpi: Use build_pci_host_bridge_osc_method" Signed-off-by: Eric Auger <eric.auger@redhat.com> Reported-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20250804152008.247673-1-eric.auger@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-08-05hw/sd/sdcard: Remove SDState::mode fieldPhilippe Mathieu-Daudé2-20/+19
SD card mode is a superset of its state (SDState::state), no need to migrate it. Use sd_mode() to get the SDCardModes from the SDCardStates. Fixes: 50a5be6c3d5 ("hw/sd.c: add SD card save/load support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-11-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Disable checking STBY mode in SPI SEND_CSD/CIDPhilippe Mathieu-Daudé1-0/+11
The card should be in STANDBY mode to process SEND_CSD or SEND_CID, but is still in IDLE mode. Unfortunately I don't have enough time to keep debugging this issue, so disable the check for the time being and the next release, as it blocks Linux. I'll keep looking. Reported-by: Guenter Roeck <linux@roeck-us.net> Reported-by: Ben Dooks <ben.dooks@codethink.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-10-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Factor spi_cmd_SEND_CxD() outPhilippe Mathieu-Daudé1-9/+10
spi_cmd_SEND_CSD() and spi_cmd_SEND_CID() are very similar. Factor the common code as spi_cmd_SEND_CxD(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-9-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Allow using SWITCH_FUNCTION in more SPI statesPhilippe Mathieu-Daudé1-2/+8
In SPI mode, SWITCH_FUNCTION is valid in all mode (except the IDLE one). Fixes: 775616c3ae8 ("Partial SD card SPI mode support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-8-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Use complete SEND_OP_COND implementation in SPI modePhilippe Mathieu-Daudé1-10/+5
While spi_cmd_SEND_OP_COND() is incomplete, sd_cmd_SEND_OP_COND() is, except it doesn't return the correct value in SPI mode. Correct and use, removing the need for spi_cmd_SEND_OP_COND(). Fixes: 775616c3ae8 ("Partial SD card SPI mode support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-7-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Implement SPI R2 return valuePhilippe Mathieu-Daudé2-6/+35
In SPI mode, R2 is a 2-byte value. Implement in spi_response_r2_make() and return SPI R2 in the SEND_STATUS commands. Reported-by: Guenter Roeck <linux@roeck-us.net> Fixes: 775616c3ae8 ("Partial SD card SPI mode support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-6-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Fill SPI response bits in card codePhilippe Mathieu-Daudé2-84/+35
ssi-sd.c contains the SPI link layer adaptation, while sd.c contains all the SD card internal details. We already handle the response values in sd.c, but missed the SPI case. Complete them (fill R1, prepend R1 in R3/R7 and always return something in SPI mode). Remove all the duplication in ssi-sd.c. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-5-philmd@linaro.org>
2025-08-05hw/sd/sdbus: Provide buffer size to sdbus_do_command()Philippe Mathieu-Daudé8-28/+26
We provide to sdbus_do_command() a pointer to a buffer to be filled with a varying number of bytes. By not providing the buffer size, the callee can not check the buffer is big enough. Pass the buffer size as argument to follow good practices. sdbus_do_command() doesn't return any error, only the size filled in the buffer. Convert the returned type to unsigned and remove the few unreachable lines in callers. This allow to check for possible overflow in sd_do_command(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-4-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Factor sd_response_size() outPhilippe Mathieu-Daudé1-7/+29
Set @rsplen once before switching to fill the response buffer. This will allow to assert in a single place that the buffer is big enough to be filled with the response. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-3-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Do not ignore errors in sd_cmd_to_sendingdata()Philippe Mathieu-Daudé1-1/+1
Unfortunately when adding sd_cmd_to_sendingdata() in commit f486bf7d109 we neglected to return any possible error. Fix. Fixes: f486bf7d109 ("hw/sd/sdcard: Introduce sd_cmd_to_sendingdata and sd_generic_read_byte") Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20250804133406.17456-2-philmd@linaro.org>
2025-08-04Merge tag 'pull-aspeed-20250804' of https://github.com/legoater/qemu into ↵Stefan Hajnoczi1-1/+2
staging aspeed queue: * Fixed vbootrom build under roms/ * Updated vbootrom image to 183c9ff805 * Fixed SMC model of AST1030 SoC # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmiQkpMACgkQUaNDx8/7 # 7KFVFw//X8mpLW97oCdh2ZuelkwQh+udAn34/f8cZWu97g9/Dmi6oDNb/GmPy5t2 # lFNg4hCSBh3JcRbHSMLVieE3lZLi5XuRb/g64TSH0gzgfhFKaPsqxzaD51R5cxVF # JG9JSsGKJdbp1inWZvr1uEZsioAOdUPP4qeD+WLoTHKrhSPCrUHsjslVmReBKu/O # sbgTGHkI8RJA6knz+j5JzXgy5y7XGsfbkl3pWlI8Ni9l6VDVrgfCcSgGtjQdzF4Q # J/QtpYYjo6crJ4wbvAPhKP3RZNNl0m60oxn0BSLFzrM3fZ95VP4pGVOrkCKtZLgG # Q0KvHcDKvm3BsgLPaUeyMjYHKbku2f/U3acsY4VqfLbvLNarmsG8OtFPiEs1tKnu # Dkqb1Ac85O/8dKohyIFhxEy1nEY4iW4495iDD2CklD2lY1Ck+bFkwC2jBNfpgaO6 # xzfLPpiyyU+GbnXbV5HASHland+5AyIjxEKfYpIcARIsfuDOR0qYPl/wmPkV8utO # /X0cKHZxSZ0x3E7xiOwTo6ZIgKdYbNEljTRT0AYxChB/ZRIEByQvYnwAXaL9IqLc # qSc2GRXTy+G8WNy4z1kn2B0Sp9rENvB5uzoRGZ1PtwBySclzUHICQ653a7HKEYeH # imXU9dGNhkQ+RMdA9+bZ3B3H8ykJDtX27woK6yerlbk3CUT9ZIs= # =oAuL # -----END PGP SIGNATURE----- # gpg: Signature made Mon 04 Aug 2025 06:59:31 EDT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [full] # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-aspeed-20250804' of https://github.com/legoater/qemu: hw/ssi/aspeed_smc: Fix incorrect FMC_WDT2 register read on AST1030 pc-bios: Update vbootrom image to commit 183c9ff8056b roms/Makefile: build ast27x0_bootrom roms/vbootrom: update to 7b1eb5f7fe6a Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-04Merge tag 'pull-target-arm-20250801' of https://gitlab.com/pm215/qemu into ↵Stefan Hajnoczi2-7/+5
staging target-arm queue: * Add missing 64-bit PMCCNTR in AArch32 mode * Reinstate bogus AArch32 DBGDTRTX register for migration compat * fix big-endian handling of AArch64 FPU registers in gdbstub * fix handling of setting SVE registers from gdbstub * hw/intc/arm_gicv3_kvm: fix writing of enable/active/pending state to KVM * hw/display/framebuffer: Add cast to force 64x64 multiply * tests/tcg: Fix run for tests with specific plugin # -----BEGIN PGP SIGNATURE----- # # iQJMBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmiM4mgZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3lH/D/iniJpHRVDVAvHcYe7vSgLl # HHfdEro/lOJJbaktQwOwkSuyl5HFy3YoIg3/5K2kX40DRkeA/M1HWkaWpwpCUReV # 6XS8fCDmxw5M0oncJsTD1cYxCAAHm/CSt2uvdwgHo6nU+vnEa85ml3Q57phLEkvl # 2R6xjXDD2FY3Xi6l2Jvqhnx/y60D5YnZVo/G9jcwRI2kIvpwTxukge5rGRTeagzL # fKwsgr8jThvWyzTJtd88n36uD8xiH8/IfHh+e0kGYfzPRjEGfN3rKh4OlyfRyv7D # AVI8qgVz0ex7DEjJTCS2nNYmNhO8hTE+cybcsH6AU2e3V7/vqg3Lh0/1cWlmvGnR # 8L0/RBy0exPI1kRABfjXPV4VtNSuByxp+F+s4LvUrxgnnbv29ldOnQNHn3BZJtZn # OuuixZNa3/tJFa+2U20fPW+q2H9uhPhvLn5fhtCx1ucYONLMrWl3Z8Q3/qwbW+5e # FR459UaVHUvqKDGL6cjnaQ3VclrsXngCbeBmLm7fDfniRf/4uIc3q6RzdwY3waj3 # t7D/+GmLwZzajEaCU1NcI+Uz+yO/wJhEXUtWAzm6xeowYfOEeZc1pRgGWSqy4qvi # L9vKmZtRW5LvwLwpMLdcoB3BOIszSDy7AylX4onSWl3Vp3GYiOhYqv9OKlQoUGtu # xjFCVDCB/0FPl9b+xoYK # =lN06 # -----END PGP SIGNATURE----- # gpg: Signature made Fri 01 Aug 2025 11:51:04 EDT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20250801' of https://gitlab.com/pm215/qemu: tests/tcg: Fix run for tests with specific plugin target/arm: Fix handling of setting SVE registers from gdb target/arm: Fix big-endian handling of NEON gdb remote debugging target/arm: Reinstate bogus AArch32 DBGDTRTX register for migration compat hw/display/framebuffer: Add cast to force 64x64 multiply hw/intc/arm_gicv3_kvm: Write all 1's to clear enable/active hw/intc/arm_gicv3_kvm: Remove writes to ICPENDR registers target/arm: add support for 64-bit PMCCNTR in AArch32 mode Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-04hw/ssi/aspeed_smc: Fix incorrect FMC_WDT2 register read on AST1030Jamin Lin1-1/+2
On AST1030, reading the FMC_WDT2 register always returns 0xFFFFFFFF. This issue is due to the aspeed_smc_read function, which checks for the ASPEED_SMC_FEATURE_WDT_CONTROL feature. Since AST1030 was missing this feature flag, the read operation fails and returns -1. To resolve this, add the WDT_CONTROL feature to AST1030's feature set so that FMC_WDT2 can be correctly accessed by firmware. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Fixes: 2850df6a81bcdc2e063dfdd56751ee2d11c58030 ("aspeed/smc: Add AST1030 support ") Link: https://lore.kernel.org/qemu-devel/20250804014633.512737-1-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-08-01hw/display/framebuffer: Add cast to force 64x64 multiplyPeter Maydell1-3/+3
In framebuffer_update_display(), Coverity complains because we multiply two values of type 'int' (which will be done as a 32x32 multiply and so in theory might overflow) and then add the result to a ram_addr_t, which can be 64 bits. 4GB framebuffers are not plausible anyway, but keep Coverity happy by adding casts which force these multiplies to be done as 64x64. Coverity: CID 1487248 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Message-id: 20250710174312.1313177-1-peter.maydell@linaro.org
2025-08-01hw/intc/arm_gicv3_kvm: Write all 1's to clear enable/activeZenghui Yu1-1/+1
KVM's userspace access interface to the GICD enable and active bits is via set/clear register pairs which implement the hardware's "write 1s to the clear register to clear the 0 bits, and write 1s to the set register to set the 1 bits" semantics. We didn't get this right, because we were writing 0 to the clear register. Writing 0 to GICD_IC{ENABLE,ACTIVE}R architecturally has no effect on interrupt status (all writes are simply ignored by KVM) and doesn't comply with the intention of "first write to the clear-reg to clear all bits". Write all 1's to actually clear the enable/active status. This didn't have any adverse effects on migration because there we start with a clean VM state; it would be guest-visible when doing a system reset, but since Linux always cleans up the register state of the GIC during bootup before it enables it most users won't have run into a problem here. Cc: qemu-stable@nongnu.org Fixes: 367b9f527bec ("hw/intc/arm_gicv3_kvm: Implement get/put functions") Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev> Message-id: 20250729161650.43758-3-zenghui.yu@linux.dev Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-01hw/intc/arm_gicv3_kvm: Remove writes to ICPENDR registersZenghui Yu1-3/+1
As per the arm-vgic-v3 kernel doc [1]: Accesses to GICD_ICPENDR register region and GICR_ICPENDR0 registers have RAZ/WI semantics, meaning that reads always return 0 and writes are always ignored. The state behind these registers (both 0 and 1 bits) is written by writing to the GICD_ISPENDR and GICR_ISPENDR0 registers, unlike some of the other set/clear register pairs. Remove the useless writes to ICPENDR registers in kvm_arm_gicv3_put(). [1] https://docs.kernel.org/virt/kvm/devices/arm-vgic-v3.html Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev> Message-id: 20250729161650.43758-2-zenghui.yu@linux.dev Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-01Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Stefan Hajnoczi7-60/+136
into staging virtio,pci,pc: bugfixes small fixes all over the place. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmiMzgoPHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRpAO4H+gKeZbkJFFPHBduwn/LyTTkBpEghy14wEp7G # 6y3knCkWXOVOnFJ/Lw1p6ZLtB6o547Ktin49msY+SKF2X33N1b6I0DmLxixnLVqP # fHMUF+/QssH7QdIMuZNTxr/nwdDzGnj6Rv4xVyrwdZlf+nQPE8GuXWPmAmyGwcXM # 1sEPTjZq30y2eRiQkKsgS7g+COqfPy+O3VeiyQWR1Q/Cb85alegGwUPBy289u3V+ # uHaBC6d73NWxRCHJM4J8CnWpY5LA+y/YgfJXys1NH8pzRLbTpiYt7gfUbfdHbIvF # IpjZraVh+ApbwXhQLmDmsHtGsyIE1zFlcZTq9pR6WUgYGUDQMpY= # =cJxn # -----END PGP SIGNATURE----- # gpg: Signature made Fri 01 Aug 2025 10:24:10 EDT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: net/vdpa: fix potential fd leak in net_init_vhost_vdpa() MAINTAINERS: add net/vhost* files under `vhost` intel_iommu: Allow both Status Write and Interrupt Flag in QI wait tests/acpi: virt: update HEST file with its current data tests/qtest/bios-tables-test: extend to also check HEST table tests/acpi: virt: add an empty HEST file hw/i386/amd_iommu: Fix event log generation hw/i386/amd_iommu: Support MMIO writes to the status register hw/i386/amd_iommu: Fix amdvi_write*() hw/i386/amd_iommu: Move IOAPIC memory region initialization to the end hw/i386/amd_iommu: Remove unused and wrongly set ats_enabled field hw/i386/amd_iommu: Fix MMIO register write tracing pcie_sriov: Fix configuration and state synchronization virtio-net: Fix VLAN filter table reset timing vhost: Do not abort on log-stop error vhost: Do not abort on log-start error virtio: fix off-by-one and invalid access in virtqueue_ordered_fill Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-01intel_iommu: Allow both Status Write and Interrupt Flag in QI waitDavid Woodhouse1-6/+9
FreeBSD does both, and this appears to be perfectly valid. The VT-d spec even talks about the ordering (the status write should be done first, unsurprisingly). We certainly shouldn't assert() and abort QEMU if the guest asks for both. Fixes: ed7b8fbcfb88 ("intel-iommu: add supports for queued invalidation interface") Closes: https://gitlab.com/qemu-project/qemu/-/issues/3028 Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Message-Id: <0122cbabc0adcc3cf878f5fd7834d8f258c7a2f2.camel@infradead.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-08-01hw/i386/amd_iommu: Fix event log generationSairaj Kodilkar2-9/+36
Current event logging code is broken, because of following issues 1. The code uses '|' instead of '&' to test the bit field, which causes vIOMMU to generate overflow interrupt for every log entry. 2. Code does not update the eventlog tail MMIO register after adding an entry to the buffer, because of which guest cannot process new entries (as head == tail means buffer is empty). 3. Compares eventlog tail (which is byte offset in the buffer) to eventlog length (which is number of maximum entries in the buffer). This causes vIOMMU to generate only fix number of event logs, after which it keeps on generating overflow interrupts, without actually resetting the log buffer. 4. Updates ComWaitInt instead of EventLogInt bitfield in Status register. Guest checks this field to see if there are new event log entries in the buffer. 5. Does not reset event log head and tail pointers when guest writes to eventlog base register. Fix above issues, so that guest can process event log entries. Fixes: d29a09ca68428 ("hw/i386: Introduce AMD IOMMU") Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Message-Id: <20250801060507.3382-7-sarunkod@amd.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-08-01hw/i386/amd_iommu: Support MMIO writes to the status registerSairaj Kodilkar1-0/+3
Support the writes to the status register so that guest can reset the EventOverflow, EventLogInt, ComWaitIntr, etc bits after servicing the respective interrupt. Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Message-Id: <20250801060507.3382-6-sarunkod@amd.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-08-01hw/i386/amd_iommu: Fix amdvi_write*()Sairaj Kodilkar1-3/+18
amdvi_write*() function do not preserve the older values of W1C bits in the MMIO register. This results in all W1C bits set to 0, when guest tries to reset a single bit by writing 1 to it. Fix this by preserving W1C bits in the old value of the MMIO register. Fixes: d29a09ca68428 ("hw/i386: Introduce AMD IOMMU") Suggested-by: Ethan MILON <ethan.milon@eviden.com> Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com> Message-Id: <20250801060507.3382-5-sarunkod@amd.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-08-01hw/i386/amd_iommu: Move IOAPIC memory region initialization to the endSairaj Kodilkar1-3/+3
Setting up IOAPIC memory region requires mr_sys and mr_ir. Currently these two memory regions are setup after the initializing the IOAPIC memory region, which cause `amdvi_host_dma_iommu()` to use unitialized mr_sys and mr_ir. Move the IOAPIC memory region initialization to the end in order to use the mr_sys and mr_ir regions after they are fully initialized. Fixes: 577c470f4326 ("x86_iommu/amd: Prepare for interrupt remap support") Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Message-Id: <20250801060507.3382-4-sarunkod@amd.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-08-01hw/i386/amd_iommu: Remove unused and wrongly set ats_enabled fieldSairaj Kodilkar2-4/+2
The ats_enabled field is set using HTTUNEN, which is wrong. Fix this by removing the field as it is never used. MST: includes a tweak suggested by Philippe Fixes: d29a09ca68428 ("hw/i386: Introduce AMD IOMMU") Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Message-Id: <20250801060507.3382-3-sarunkod@amd.com> Message-ID: <948a6ac3-ded9-475b-8c45-9d36220b442b@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-08-01hw/i386/amd_iommu: Fix MMIO register write tracingSairaj Kodilkar1-5/+18
Define separate functions to trace MMIO write accesses instead of using `trace_amdvi_mmio_read()` for both read and write. Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20250801060507.3382-2-sarunkod@amd.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-08-01pcie_sriov: Fix configuration and state synchronizationAkihiko Odaki1-19/+23
Fix issues in PCIe SR-IOV configuration register handling that caused inconsistent internal state due to improper write mask handling and incorrect migration behavior. Two main problems were identified: 1. VF Enable bit write mask handling: pcie_sriov_config_write() incorrectly assumed that its val parameter was already masked, causing it to ignore the actual write mask. This led to the VF Enable bit being processed even when masked, resulting in incorrect VF registration/unregistration. It is identified as CVE-2025-54567. 2. Migration state inconsistency: pcie_sriov_pf_post_load() unconditionally called register_vfs() regardless of the VF Enable bit state, creating inconsistent internal state when VFs should not be enabled. Additionally, it failed to properly update the NumVFs write mask based on the current configuration. It is identified as CVE-2025-54566. Root cause analysis revealed that both functions relied on incorrect special-case assumptions instead of properly reading and consuming the actual configuration values. This change introduces a unified consume_config() function that reads actual configuration values and synchronize the internal state without special-case assumptions. The solution only adds register read overhead in non-hot-path code while ensuring correct SR-IOV state management across configuration writes and migration scenarios. Fixes: 5e7dd17e4348 ("pcie_sriov: Remove num_vfs from PCIESriovPF") Fixes: f9efcd47110d ("pcie_sriov: Register VFs after migration") Fixes: CVE-2025-54566 Fixes: CVE-2025-54567 Cc: qemu-stable@nongnu.org Reported-by: Corentin BAYET <corentin.bayet@reversetactics.com> Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Message-Id: <20250727-wmask-v2-1-394910b1c0b6@rsg.ci.i.u-tokyo.ac.jp> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-08-01virtio-net: Fix VLAN filter table reset timingAkihiko Odaki1-3/+4
Problem ------- The expected initial state of the table depends on feature negotiation: With VIRTIO_NET_F_CTRL_VLAN: The table must be empty in accordance with the specification. Without VIRTIO_NET_F_CTRL_VLAN: The table must be filled to permit all VLAN traffic. Prior to commit 06b636a1e2ad ("virtio-net: do not reset vlan filtering at set_features"), virtio_net_set_features() always reset the VLAN table. That commit changed the behavior to skip table reset when VIRTIO_NET_F_CTRL_VLAN was negotiated, assuming the table would be properly cleared during device reset and remain stable. However, this assumption breaks when a driver renegotiates features: 1. Initial negotiation without VIRTIO_NET_F_CTRL_VLAN (table filled) 2. Renegotiation with VIRTIO_NET_F_CTRL_VLAN (table will not be cleared) The problem was exacerbated by commit 0caed25cd171 ("virtio: Call set_features during reset"), which triggered virtio_net_set_features() during device reset, exposing the bug whenever VIRTIO_NET_F_CTRL_VLAN was negotiated after a device reset. Solution -------- Fix the issue by initializing the table when virtio_net_set_features() is called to change the VIRTIO_NET_F_CTRL_VLAN bit of vdev->guest_features. This approach ensures the correct table state regardless of feature negotiation sequence by performing initialization in virtio_net_set_features() as QEMU did prior to commit 06b636a1e2ad ("virtio-net: do not reset vlan filtering at set_features"). This change still preserves the goal of the commit, which was to avoid resetting the table during migration, by checking whether the VIRTIO_NET_F_CTRL_VLAN bit of vdev->guest_features is being changed; vdev->guest_features is set before virtio_net_set_features() gets called during migration. It also avoids resetting the table when the driver sets a feature bitmask with no change for the VIRTIO_NET_F_CTRL_VLAN bit, which makes the operation idempotent and its semantics cleaner. Additionally, this change ensures the table is initialized after feature negotiation and before the DRIVER_OK status bit being set for compatibility with the Linux driver before commit 50c0ada627f5 ("virtio-net: fix race between ndo_open() and virtio_device_ready()"), which did not ensure to set the DRIVER_OK status bit before modifying the table. Fixes: 06b636a1e2ad ("virtio-net: do not reset vlan filtering at set_features") Cc: qemu-stable@nongnu.org Reported-by: Konstantin Shkolnyy <kshk@linux.ibm.com> Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Tested-by: Konstantin Shkolnyy <kshk@linux.ibm.com> Tested-by: Lei Yang <leiyang@redhat.com> Message-Id: <20250727-vlan-v3-1-bbee738619b1@rsg.ci.i.u-tokyo.ac.jp> Tested-by: Konstantin Shkolnyy <kshk@linux.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-08-01vhost: Do not abort on log-stop errorHanna Czenczek1-1/+2
Failing to stop logging in a vhost device is not exactly fatal. We can log such an error, but there is no need to abort the whole qemu process because of it. Signed-off-by: Hanna Czenczek <hreitz@redhat.com> Message-Id: <20250724125928.61045-3-hreitz@redhat.com> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Tested-by: Lei Yang <leiyang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-08-01vhost: Do not abort on log-start errorHanna Czenczek1-1/+2
Commit 3688fec8923 ("memory: Add Error** argument to .log_global_start() handler") enabled vhost_log_global_start() to return a proper error, but did not change it to do so; instead, it still aborts the whole process on error. This crash can be reproduced by e.g. killing a virtiofsd daemon before initiating migration. In such a case, qemu should not crash, but just make the attempted migration fail. Buglink: https://issues.redhat.com/browse/RHEL-94534 Reported-by: Tingting Mao <timao@redhat.com> Signed-off-by: Hanna Czenczek <hreitz@redhat.com> Message-Id: <20250724125928.61045-2-hreitz@redhat.com> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Tested-by: Lei Yang <leiyang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-08-01virtio: fix off-by-one and invalid access in virtqueue_ordered_fillJonah Palmer1-6/+16
Commit b44135daa372 introduced virtqueue_ordered_fill for VIRTIO_F_IN_ORDER support but had a few issues: * Conditional while loop used 'steps <= max_steps' but should've been 'steps < max_steps' since reaching steps == max_steps would indicate that we didn't find an element, which is an error. Without this change, the code would attempt to read invalid data at an index outside of our search range. * Incremented 'steps' using the next chain's ndescs instead of the current one. This patch corrects the loop bounds and synchronizes 'steps' and index increments. We also add a defensive sanity check against malicious or invalid descriptor counts to avoid a potential infinite loop and DoS. Fixes: b44135daa372 ("virtio: virtqueue_ordered_fill - VIRTIO_F_IN_ORDER support") Reported-by: terrynini <terrynini38514@gmail.com> Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com> Message-Id: <20250721150208.2409779-1-jonah.palmer@oracle.com> Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com> Acked-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-31hw/intc/loongarch_ipi: Fix start fail with smp cpu < smp maxcpus on KVMSong Gao1-11/+16
QEMU start failed when smp cpu < smp maxcpus , because qemu send a NULL cpu to KVM, this patch adds a check for kvm_ipi_access_regs() to fix it. run with '-smp 1,maxcpus=4,sockets=4,cores=1,threads=1' we got: Unexpected error in kvm_device_access() at ../accel/kvm/kvm-all.c:3477: qemu-system-loongarch64: KVM_SET_DEVICE_ATTR failed: Group 1073741825 attr 0x0000000000010000: Invalid argument Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Bibo Mao <maobibo@loongson.cn> Message-ID: <20250725081213.3867592-1-gaosong@loongson.cn>
generated by cgit v1.1 at 2025-09-18 08:57:05 +0000