aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2025-03-20Merge tag 'pull-request-2025-03-19' of https://gitlab.com/thuth/qemu into ↵Stefan Hajnoczi1-1/+2
staging * Fix linking problem when CONFIG_VIRTIO_PCI is not set for s390x * Update functional tests parts of the documenation * Some minor fixes for functional tests # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmfawycRHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbU2vA//UV2RdKVIQDS7MbMYRjmUr0NK9/9dLmrn # /lZVWXCBDEB7seu/VOGZmr1H0zoQ8XYJTSbrmp2cW0NRPhCVeAz9Zpg7+jt3Qy6/ # ahbiNQyhYztMbSa4XOOUEoLZBsfZILjWgqBilrRn7ng6wJoNabEIs/KqMP3O9qsx # TYCCnu5JkMF85Bf0l3kUJlLX0b5+BnpUNDke1cipvTa7u/Coz0mDBBZZtgW1bBj8 # TETuMC1JtCg3aj1ey7k0pK4nCd740mr5w659C4LE8NCE0/juc3AtRM5RCqU9tAGh # tXpfrZziyvSrAhyWieRQlgzLvrt2gTF/5FrqhPUssts+vkH1EgB56FiPXdqMtLRo # zU+SVRuOMHQZn7E6L9KQ7Gz5w98PSVGYxUUpWIvOx/0d9wgoIfYPjgtJz5UV11mV # Nnt304UV4FKw94V8S8JYUClamP4SMTMLZNRIsd46Ef+DOL1CI+jcDZBntijwSgs1 # 5fs0IZyl6ZXtmUibVWJ+PqyYW6YiAfi/wY/mJlfnvKVZjoudbhNkNOtC9hi4YTQd # yJ7gVy9A4OeQqXgiQcymFvlseggds7uPQ9/szuGC1RwrW2NYH1YLisKpNzPtqq16 # TEOnsozlDa9OUDshKxrA5rwHiDcSuqJjkP26N91AmdEQDgoQcbIKWghriTxkOV9Q # d2aJt+3KF04= # =cNi4 # -----END PGP SIGNATURE----- # gpg: Signature made Wed 19 Mar 2025 09:14:15 EDT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2025-03-19' of https://gitlab.com/thuth/qemu: tests/functional/test_migration: Use "ncat" instead of "nc" in the exec test tests/functional/test_x86_64_kvm_xen: Remove avocado tags docs/devel/testing/functional: Add a section about logging docs/system/arm: Use "functional tests" instead of "integration tests" docs/system: Use the meson binary from the pyvenv tests/functional: remove all class level fields tests/functional/test_arm_orangepi: rename test class to 'OrangePiMachine' hw/virtio: Also include md stubs in case CONFIG_VIRTIO_PCI is not set Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-03-20qdev, rust/hpet: fix type of HPET "timers" propertyPaolo Bonzini1-0/+37
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-03-20ppc/pnv: Fix system symbols in HOMER structure definitionsNicholas Piggin1-105/+96
These definitions were taken from skiboot firmware. I naively thought it would be nicer to keep the code similar by using the preprocessor, but it was pointed out that system headers might still use those symbols and cause something unexpected. Also just nicer to keep the QEMU tree clean. Cc: "Philippe Mathieu-Daudé" <philmd@linaro.org> Cc: "Stefan Hajnoczi" <stefanha@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Fixes: 70bc5c2498f46 ("ppc/pnv: Make HOMER memory a RAM region") Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
2025-03-20ppc/pnv: Move the PNOR LPC address into struct PnvPnorNicholas Piggin3-3/+5
Rather than use the hardcoded define throughout the tree for the PNOR LPC address, keep it within the PnvPnor object. This should solve a dead code issue in the BMC HIOMAP checks where Coverity (correctly) reported that the sanity checks are dead code. We would like to keep the sanity checks without turning them into a compile time assert in case we would like to make them configurable in future. Fixes: 4c84a0a4a6e5 ("ppc/pnv: Add a PNOR address and size sanity checks") Resolves: Coverity CID 1593723 Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
2025-03-20ppc/spapr: Fix possible pa_features memory overflowNicholas Piggin1-0/+1
Coverity reports a possible memory overflow in spapr_dt_pa_features(). This should not be a true bug since DAWR1 cap is only be true for CPU_POWERPC_LOGICAL_3_10. Add an assertion to ensure any bug there is caught. Resolves: Coverity CID 1593722 Fixes: 5f361ea187ba ("ppc: spapr: Enable 2nd DAWR on Power10 pSeries machine") Reviewed-By: Shivaprasad G Bhat <sbhat@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
2025-03-20ppc/xive2: Fix logical / bitwise comparison typoNicholas Piggin1-1/+1
The comparison as written is always false (perhaps confusingly, because the functions/macros are not really booleans but return 0 or the tested bit value). Change to use logical-and. Resolves: Coverity CID 1593721 Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
2025-03-20pnv/xive: Fix possible undefined shift error in group size calculationNicholas Piggin2-8/+38
Coverity discovered a potential shift overflow in group size calculation in the case of a guest error. Add checks and logs to ensure a issues are caught. Make the group and crowd error checking code more similar to one another while here. Resolves: Coverity CID 1593724 Fixes: 9cb7f6ebed60 ("ppc/xive2: Support group-matching when looking for target") Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
2025-03-20ppc/xive: Fix typo in crowd block level calculationNicholas Piggin1-1/+1
I introduced this bug when "tidying" the original patch, not Frederic. Paper bag for me. Fixes: 9cb7f6ebed60 ("ppc/xive2: Support group-matching when looking for target") Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
2025-03-20rust: Kconfig: Factor out whether HPET is Rust or CPeter Maydell4-4/+10
Currently we require everywhere that wants to know if there is an HPET device to check for "CONFIG_HPET || CONFIG_X_HPET_RUST". Factor out whether the HPET device is Rust or C into a separate Kconfig stanza, so that CONFIG_HPET means "there is an HPET", and whether this has pulled in CONFIG_X_HPET_RUST or CONFIG_HPET_C is something the rest of QEMU can ignore. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Link: https://lore.kernel.org/r/20250319193110.1565578-3-peter.maydell@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-03-20rust: Kconfig: Factor out whether PL011 is Rust or CPeter Maydell3-21/+17
Currently every board that uses the PL011 duplicates the logic that selects the Rust implementation if Rust was enabled and the C implementation if it does not. Factor this out into a separate Kconfig stanza, so that boards can go back to simply doing "select PL011" and get whichever implementation is correct for the build. This fixes a compilation failure if CONFIG_VMAPPLE is enabled in a Rust build, because hw/vmapple/Kconfig didn't have the "pick the Rust PL011 if Rust is enabled" logic in it. Fixes: 59f4d65584bd33 ("hw/vmapple/vmapple: Add vmapple machine type") Reported-by: Tanish Desai <tanishdesai37@gmail.com> Analyzed-by: Tanish Desai <tanishdesai37@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/r/20250319193110.1565578-2-peter.maydell@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-03-20target/loongarch: Clean up virt_cpu_irq_init() error handlingBibo Mao1-3/+4
The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. virt_cpu_irq_init() is wrong that way: it passes &err to hotplug_handler_plug() twice. If both calls failed, this could trip error_setv()'s assertion. Moreover, if just one fails, the Error object leaks. Fortunately, these calls can't actually fail. Messed up in commit 50ebc3fc47f7 (hw/intc/loongarch_ipi: Notify ipi object when cpu is plugged) and commit 087a23a87c57 (hw/intc/loongarch_extioi: Use cpu plug notification). Clean this up by passing &error_abort instead. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Acked-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20250320032158.1762751-7-maobibo@loongson.cn> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2025-03-20hw/loongarch/virt: Eliminate error_propagate()Bibo Mao1-21/+11
When there is an error, it is put into a local variable and then propagated to somewhere else. Instead the error can be set right away, error propagation can be removed. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Message-ID: <20250320032158.1762751-5-maobibo@loongson.cn> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2025-03-20ppc/spapr: Fix RTAS stopped stateNicholas Piggin3-2/+15
This change takes the CPUPPCState 'quiesced' field added for powernv hardware CPU core controls (used to stop and start cores), and extends it to spapr to model the "RTAS stopped" state. This prevents the schedulers attempting to run stopped CPUs unexpectedly, which can cause hangs and possibly other unexpected behaviour. The detail of the problematic situation is this: A KVM spapr guest boots with all secondary CPUs defined to be in the "RTAS stopped" state. In this state, the CPU is only responsive to the start-cpu RTAS call. This behaviour is modeled in QEMU with the start_powered_off feature, which sets ->halted on secondary CPUs at boot. ->halted=true looks like an idle / sleep / power-save state which typically is responsive to asynchronous interrupts, but spapr clears wake-on-interrupt bits in the LPCR SPR. This more-or-less works. Commit e8291ec16da8 ("target/ppc: fix timebase register reset state") recently caused the decrementer to expire sooner at boot, causing a decrementer exception on secondary CPUs in RTAS stopped state. This was not a problem on TCG, but KVM limits how a guest can modify LPCR, in particular it prevents the clearing of wake-on-interrupt bits, and so in the course of CPU register synchronisation, the LPCR as set by spapr to model the RTAS stopped state is overwritten with KVM's LPCR value, and that then causes QEMU's interrupt code to notice the expired decrementer exception, turn that into an interrupt, and set CPU_INTERRUPT_HARD. That causes the CPU to be kicked, and the KVM vCPU thread to loop calling kvm_cpu_exec(). kvm_cpu_exec() calls kvm_arch_process_async_events(), which on ppc just returns ->halted. This is still true, so it returns immediately with EXCP_HLT, and the vCPU never goes to sleep because qemu_wait_io_event() sees CPU_INTERRUPT_HARD is set. All this while the vCPU holds the bql. This causes the boot CPU to eventually lock up when it needs the bql. So make 'quiesced' represent the "RTAS stopped" state, and have it explicitly not respond to exceptions (interrupt conditions) rather than rely on machine register state to model that state. This matches the powernv quiesced state very well because it essentially turns off the CPU core via a side-band control unit. There are still issues with QEMU and KVM idea of LPCR diverging and that is quite ugly and fragile that should be fixed. spapr should synchronize its LPCR properly with KVM, and not try to use values that KVM does not support. Reported-by: Misbah Anjum N <misanjum@linux.ibm.com> Tested-by: Misbah Anjum N <misanjum@linux.ibm.com> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
2025-03-19hw/xen: Downgrade a xen_bus_realize() non-error to warningMarkus Armbruster1-4/+3
xen_bus_realize() reports a failure to set up a watch as error, but it doesn't treat it as one: it simply continues. Report a warning instead. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20250314143500.2449658-3-armbru@redhat.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-03-19hw/xen: Fix xen_bus_realize() error handlingMarkus Armbruster1-0/+1
The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. xen_bus_realize() is wrong that way: it passes &local_err to xs_node_watch() in a loop. If this fails in more than one iteration, it can trip error_setv()'s assertion. Fix by clearing @local_err. Fixes: c4583c8c394e (xen-bus: reduce scope of backend watch) Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20250314143500.2449658-2-armbru@redhat.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2025-03-19hw/virtio: Also include md stubs in case CONFIG_VIRTIO_PCI is not setThomas Huth1-1/+2
For the s390x target, it's possible to build the QEMU binary without CONFIG_VIRTIO_PCI and only have the virtio-mem device via the ccw transport. In that case, QEMU currently fails to link correctly: /usr/bin/ld: libqemu-s390x-softmmu.a.p/hw_s390x_s390-virtio-ccw.c.o: in function `s390_machine_device_pre_plug': ../hw/s390x/s390-virtio-ccw.c:579:(.text+0x1e96): undefined reference to `virtio_md_pci_pre_plug' /usr/bin/ld: libqemu-s390x-softmmu.a.p/hw_s390x_s390-virtio-ccw.c.o: in function `s390_machine_device_plug': ../hw/s390x/s390-virtio-ccw.c:608:(.text+0x21a4): undefined reference to `virtio_md_pci_plug' /usr/bin/ld: libqemu-s390x-softmmu.a.p/hw_s390x_s390-virtio-ccw.c.o: in function `s390_machine_device_unplug_request': ../hw/s390x/s390-virtio-ccw.c:622:(.text+0x2334): undefined reference to `virtio_md_pci_unplug_request' /usr/bin/ld: libqemu-s390x-softmmu.a.p/hw_s390x_s390-virtio-ccw.c.o: in function `s390_machine_device_unplug': ../hw/s390x/s390-virtio-ccw.c:633:(.text+0x2436): undefined reference to `virtio_md_pci_unplug' clang: error: linker command failed with exit code 1 (use -v to see invocation) We also need to include the stubs when CONFIG_VIRTIO_PCI is missing. Fixes: aa910c20ec5 ("s390x: virtio-mem support") Message-ID: <20250313063522.1348288-1-thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-03-19hw/riscv/riscv-iommu: Fix process directory table walkJason Chien2-3/+7
The PPN field in a non-leaf PDT entry is positioned differently from that in a leaf PDT entry. The original implementation incorrectly used the leaf entry's PPN mask to extract the PPN from a non-leaf entry, leading to an erroneous page table walk. This commit introduces new macros to properly define the fields for non-leaf PDT entries and corrects the page table walk. Signed-off-by: Jason Chien <jason.chien@sifive.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-ID: <20250301173751.9446-1-jason.chien@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2025-03-17hw/misc: use extract64 instead of 1 << iTigran Sogomonian1-1/+1
1 << i is casted to uint64_t while bitwise and with val. So this value may become 0xffffffff80000000 but only 31th "start" bit is required. Use the bitfield extract() API instead. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Tigran Sogomonian <tsogomonian@astralinux.ru> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Link: https://lore.kernel.org/r/20241227104618.2526-1-tsogomonian@astralinux.ru Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-03-16Merge tag 'migration-20250314-pull-request' of ↵Stefan Hajnoczi3-4/+33
https://gitlab.com/farosas/qemu into staging Migration pull request Fixes for cpr-transfer (live update functionality). # -----BEGIN PGP SIGNATURE----- # # iQJEBAABCAAuFiEEqhtIsKIjJqWkw2TPx5jcdBvsMZ0FAmfUQEYQHGZhcm9zYXNA # c3VzZS5kZQAKCRDHmNx0G+wxne24D/9iwMQyOuD+F3MYvX9tSmqD7KAxTsUOT1yk # +jD6/b05FwuAqTQVFLOyIg3bowYuScdgDY6LOHf8T/+NtO9xe305RDE+q8ZXVA16 # ldOPHc1Fvm7c79ShohAJIebec7h6UaWQ390kpbAyIXFRW8gZjvYe64hDAsRQLNQy # ykkD+5G5dBWU4pOJh5w9Q+C3yIM3IMwyPcP3zJsmrDyAs20B/BrnC0kIaq90rAyS # qYWIk1ttPrOckeOLK4bPM/bGNvIJWxzdBLgFqhRfTotfdSCj0YCDNhqN5JHKjQvY # 6bPzqr1BVOql4TpuwykYpUFWONQLeFasTfJxckls8s0qifkUWYRpQXT7+gWYrdHt # 3NId+0XG1Vq8gAXbEoQXCozsq0LAW9REryTQBCTZIJ1n8hwWuXLLUB1k9e2f1mXq # SyKrko2CADvWAQKz1Nl7MQc73vuHI/rK8W+JHlhT1KHfMPeXM06K+bBU2w4kQLhn # t8wfv5l1z4nH4Jmn4f5kmhbAzEfSny1FQXxGWwfamgw85FCYdmsJ0JTX0nosLIYf # 5ntOeJp2KnILtbSyd3c44jE1u/eSlw5Yb05SWjiUwFpDKo/1LBi61deJtbxoG6rE # pJauuOEM/X9GpAU1drlT9G0scwLRKGZBJ1FbOU43bMUbEF2fQiPi4pGeW428Ol4y # ggk8QixbGg== # =w3AQ # -----END PGP SIGNATURE----- # gpg: Signature made Fri 14 Mar 2025 10:42:14 EDT # gpg: using RSA key AA1B48B0A22326A5A4C364CFC798DC741BEC319D # gpg: issuer "farosas@suse.de" # gpg: Good signature from "Fabiano Rosas <farosas@suse.de>" [unknown] # gpg: aka "Fabiano Almeida Rosas <fabiano.rosas@suse.com>" [unknown] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: AA1B 48B0 A223 26A5 A4C3 64CF C798 DC74 1BEC 319D * tag 'migration-20250314-pull-request' of https://gitlab.com/farosas/qemu: hw/qxl: fix cpr hw/loader: fix roms during cpr pflash: fix cpr migration: cpr_is_incoming Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-03-14Revert "hw/char/pl011: Warn when using disabled receiver"Paolo Bonzini1-9/+10
The guest does not control whether characters are sent on the UART. Sending them before the guest happens to boot will now result in a "guest error" log entry that is only because of timing, even if the guest _would_ later setup the receiver correctly. This reverts the bulk of commit abf2b6a028670bd2890bb3aee7e103fe53e4b0df, and instead adds a comment about why we don't check the enable bits. Cc: Philippe Mathieu-Daudé <philmd@linaro.org> Cc: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20250311153717.206129-1-pbonzini@redhat.com [PMM: expanded comment] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-03-14hw/qxl: fix cprSteve Sistare1-3/+24
During normal migration, new QEMU creates and initializes memory regions, then loads the preserved contents of the region from vmstate. During CPR, memory regions are preserved in place, then the realize method initializes the regions contents, losing the old contents. To fix, skip writes to the qxl memory regions during CPR load. Reported-by: andrey.drobyshev@virtuozzo.com Tested-by: andrey.drobyshev@virtuozzo.com Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Message-ID: <1741380954-341079-5-git-send-email-steven.sistare@oracle.com> Signed-off-by: Fabiano Rosas <farosas@suse.de>
2025-03-14hw/loader: fix roms during cprSteve Sistare1-1/+4
During normal migration, new QEMU creates and initializes memory regions, then loads the preserved contents of the region from vmstate. During CPR, memory regions are preserved in place, then the realize method initializes the regions contents, losing the old contents. To fix, skip the re-init during CPR. Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Message-ID: <1741380954-341079-4-git-send-email-steven.sistare@oracle.com> Signed-off-by: Fabiano Rosas <farosas@suse.de>
2025-03-14pflash: fix cprSteve Sistare1-0/+5
During normal migration, new QEMU creates and initializes memory regions, then loads the preserved contents of the region from vmstate. During CPR, memory regions are preserved in place, then the realize method initializes the regions contents, losing the old contents. To fix, skip the re-init during CPR. Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Message-ID: <1741380954-341079-3-git-send-email-steven.sistare@oracle.com> Signed-off-by: Fabiano Rosas <farosas@suse.de>
2025-03-14target/arm: Move arm_current_el() and arm_el_is_aa64() to internals.hPeter Maydell1-0/+1
The functions arm_current_el() and arm_el_is_aa64() are used only in target/arm and in hw/intc/arm_gicv3_cpuif.c. They're functions that query internal state of the CPU. Move them out of cpu.h and into internals.h. This means we need to include internals.h in arm_gicv3_cpuif.c, but this is justifiable because that file is implementing the GICv3 CPU interface, which really is part of the CPU proper; we just ended up implementing it in code in hw/intc/ for historical reasons. The motivation for this move is that we'd like to change arm_el_is_aa64() to add a condition that uses cpu_isar_feature(); but we don't want to include cpu-features.h in cpu.h. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2025-03-14Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into stagingStefan Hajnoczi9-418/+602
Block layer patches - virtio-scsi: add iothread-vq-mapping parameter - Improve writethrough performance - Fix missing zero init in bdrv_snapshot_goto() - Added scripts/qcow2-to-stdout.py - Code cleanup and iotests fixes # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmfTDysRHGt3b2xmQHJl # ZGhhdC5jb20ACgkQfwmycsiPL9Yz6A//asOl37zjbtf9pYjY/gliH859TQOppPGD # LB9IIr+nTDME0wfUkCOlag+CeEYZwkeo2PF+XeopsyzlJeBOk4tL7AkY57XYe3lZ # M5hlnNrn6l3gb6iioMg60pEKSMrpKprB16vT3nAtyN6aEXsm9TvtPkWPFTCFGVeK # W74VCr7wuXbfdEJcOGd8WhB9ZHIgwoWYnoL41tvCoefW2yNaMA6X0TLn98toXzOi # il50ZnnchTQngns5R+n+1R1Ma995t393D+CArQcYVRzxKGOs5p0y4otz4gCkMhdp # GVL09R7Ge4TteSJ2myxlN/EjYOxmdoMrVDajr4xPdHBw12MKzgk8i82h4/Es/Q5o # 3Npgx74+jDyqlICb/czTVM5KJINpyO80vO3N3WpYUOQGyTCcYgv7pIpy8pB2o6Te # RPlv0W9bHVSSgThFFLQ0Ud8WRGJe1K/ar8bdmiWN08Wez1avENWaYmsv5zGnFL24 # vD6cNXMR4mF7mzyeWda/5hGKv75djVgX+ZfzvWNT3qgizD56JBOA3RdCRwBZJOJb # TvJkfi5RGyaji9BfKVCYBL3/iDELJEVDW8jxvIIUrS0aPcTHpAQ5gTO7VAokreqZ # 5Smll11eeoEgPPvNLw8ikmOGTWOMkJGrmExP2K1ApANq3kSbBSU4jroEr0BG9PZT # 6Y0hUdtFSdU= # =w2Ri # -----END PGP SIGNATURE----- # gpg: Signature made Fri 14 Mar 2025 01:00:27 HKT # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * tag 'for-upstream' of https://repo.or.cz/qemu/kevin: (23 commits) scripts/qcow2-to-stdout.py: Add script to write qcow2 images to stdout virtio-scsi: only expose cmd vqs via iothread-vq-mapping virtio-scsi: handle ctrl virtqueue in main loop virtio-scsi: add iothread-vq-mapping parameter virtio: extract iothread-vq-mapping.h API virtio-blk: tidy up iothread_vq_mapping functions virtio-blk: extract cleanup_iothread_vq_mapping() function virtio-scsi: perform TMFs in appropriate AioContexts virtio-scsi: protect events_dropped field virtio-scsi: introduce event and ctrl virtqueue locks scsi: introduce requests_lock scsi: track per-SCSIRequest AioContext dma: use current AioContext for dma_blk_io() scsi-disk: drop unused SCSIDiskState->bh field iotests: Limit qsd-migrate to working formats aio-posix: Adjust polling time also for new handlers aio-posix: Separate AioPolledEvent per AioHandler aio-posix: Factor out adjust_polling_time() aio: Create AioPolledEvent block/io: Ignore FUA with cache.no-flush=on ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-03-13virtio-scsi: only expose cmd vqs via iothread-vq-mappingStefan Hajnoczi1-13/+20
Peter Krempa and Kevin Wolf observed that iothread-vq-mapping is confusing to use because the control and event virtqueues have a fixed location before the command virtqueues but need to be treated differently. Only expose the command virtqueues via iothread-vq-mapping so that the command-line parameter is intuitive: it controls where SCSI requests are processed. The control virtqueue needs to be hardcoded to the main loop thread for technical reasons anyway. Kevin also pointed out that it's better to place the event virtqueue in the main loop thread since its no poll behavior would prevent polling if assigned to an IOThread. This change is its own commit to avoid squashing the previous commit. Suggested-by: Kevin Wolf <kwolf@redhat.com> Suggested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20250311132616.1049687-14-stefanha@redhat.com> Tested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2025-03-13virtio-scsi: handle ctrl virtqueue in main loopStefan Hajnoczi2-117/+33
Previously the ctrl virtqueue was handled in the AioContext where SCSI requests are processed. When IOThread Virtqueue Mapping was added things become more complicated because SCSI requests could run in other AioContexts. Simplify by handling the ctrl virtqueue in the main loop where reset operations can be performed. Note that BHs are still used canceling SCSI requests in their AioContexts but at least the mean loop activity doesn't need BHs anymore. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20250311132616.1049687-13-stefanha@redhat.com> Tested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2025-03-13virtio-scsi: add iothread-vq-mapping parameterStefan Hajnoczi2-50/+103
Allow virtio-scsi virtqueues to be assigned to different IOThreads. This makes it possible to take advantage of host multi-queue block layer scalability by assigning virtqueues that have affinity with vCPUs to different IOThreads that have affinity with host CPUs. The same feature was introduced for virtio-blk in the past: https://developers.redhat.com/articles/2024/09/05/scaling-virtio-blk-disk-io-iothread-virtqueue-mapping Here are fio randread 4k iodepth=64 results from a 4 vCPU guest with an Intel P4800X SSD: iothreads IOPS ------------------------------ 1 189576 2 312698 4 346744 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20250311132616.1049687-12-stefanha@redhat.com> Tested-by: Peter Krempa <pkrempa@redhat.com> [kwolf: Updated 051 output, virtio-scsi can now use any iothread] Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2025-03-13virtio: extract iothread-vq-mapping.h APIStefan Hajnoczi3-141/+133
The code that builds an array of AioContext pointers indexed by the virtqueue is not specific to virtio-blk. virtio-scsi will need to do the same thing, so extract the functions. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20250311132616.1049687-11-stefanha@redhat.com> Tested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2025-03-13virtio-blk: tidy up iothread_vq_mapping functionsStefan Hajnoczi1-17/+16
Use noun_verb() function naming instead of verb_noun() because the former is the most common naming style for APIs. The next commit will move these functions into a header file so that virtio-scsi can call them. Shorten iothread_vq_mapping_apply()'s iothread_vq_mapping_list argument to just "list" like in the other functions. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20250311132616.1049687-10-stefanha@redhat.com> Tested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2025-03-13virtio-blk: extract cleanup_iothread_vq_mapping() functionStefan Hajnoczi1-6/+21
This is the cleanup function that must be called after apply_iothread_vq_mapping() succeeds. virtio-scsi will need this function too, so extract it. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20250311132616.1049687-9-stefanha@redhat.com> Tested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2025-03-13virtio-scsi: perform TMFs in appropriate AioContextsStefan Hajnoczi1-64/+206
With IOThread Virtqueue Mapping there will be multiple AioContexts processing SCSI requests. scsi_req_cancel() and other SCSI request operations must be performed from the AioContext where the request is running. Introduce a virtio_scsi_defer_tmf_to_aio_context() function and the necessary VirtIOSCSIReq->remaining refcount infrastructure to move the TMF code into the AioContext where the request is running. For the time being there is still just one AioContext: the main loop or the IOThread. When the iothread-vq-mapping parameter is added in a later patch this will be changed to per-virtqueue AioContexts. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20250311132616.1049687-8-stefanha@redhat.com> Tested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2025-03-13virtio-scsi: protect events_dropped fieldStefan Hajnoczi1-9/+20
The block layer can invoke the resize callback from any AioContext that is processing requests. The virtqueue is already protected but the events_dropped field also needs to be protected against races. Cover it using the event virtqueue lock because it is closely associated with accesses to the virtqueue. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20250311132616.1049687-7-stefanha@redhat.com> Tested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2025-03-13virtio-scsi: introduce event and ctrl virtqueue locksStefan Hajnoczi1-38/+46
Virtqueues are not thread-safe. Until now this was not a major issue since all virtqueue processing happened in the same thread. The ctrl queue's Task Management Function (TMF) requests sometimes need the main loop, so a BH was used to schedule the virtqueue completion back in the thread that has virtqueue access. When IOThread Virtqueue Mapping is introduced in later commits, event and ctrl virtqueue accesses from other threads will become necessary. Introduce an optional per-virtqueue lock so the event and ctrl virtqueues can be protected in the commits that follow. The addition of the ctrl virtqueue lock makes virtio_scsi_complete_req_from_main_loop() and its BH unnecessary. Instead, take the ctrl virtqueue lock from the main loop thread. The cmd virtqueue does not have a lock because the entirety of SCSI command processing happens in one thread. Only one thread accesses the cmd virtqueue and a lock is unnecessary. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20250311132616.1049687-6-stefanha@redhat.com> Tested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2025-03-13scsi: introduce requests_lockStefan Hajnoczi1-35/+85
SCSIDevice keeps track of in-flight requests for device reset and Task Management Functions (TMFs). The request list requires protection so that multi-threaded SCSI emulation can be implemented in commits that follow. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20250311132616.1049687-5-stefanha@redhat.com> Tested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2025-03-13scsi: track per-SCSIRequest AioContextStefan Hajnoczi2-11/+7
Until now, a SCSIDevice's I/O requests have run in a single AioContext. In order to support multiple IOThreads it will be necessary to move to the concept of a per-SCSIRequest AioContext. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20250311132616.1049687-4-stefanha@redhat.com> Tested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2025-03-13dma: use current AioContext for dma_blk_io()Stefan Hajnoczi3-8/+4
In the past a single AioContext was used for block I/O and it was fetched using blk_get_aio_context(). Nowadays the block layer supports running I/O from any AioContext and multiple AioContexts at the same time. Remove the dma_blk_io() AioContext argument and use the current AioContext instead. This makes calling the function easier and enables multiple IOThreads to use dma_blk_io() concurrently for the same block device. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20250311132616.1049687-3-stefanha@redhat.com> Tested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2025-03-13scsi-disk: drop unused SCSIDiskState->bh fieldStefan Hajnoczi1-1/+0
Commit 71544d30a6f8 ("scsi: push request restart to SCSIDevice") removed the only user of SCSIDiskState->bh. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20250311132616.1049687-2-stefanha@redhat.com> Tested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2025-03-13Merge tag 'hw-misc-20250312' of https://github.com/philmd/qemu into stagingStefan Hajnoczi17-47/+405
Misc HW patches - Set correct values for MPC8569E's eSDHC (Zoltan) - Emulate Ricoh RS5C372 RTC device (Bernhard) - Array overflow fixes in SMSC91C111 netdev (Peter) - Fix typo in Xen HVM (Philippe) - Move graphic height/width/depth globals to their own file (Philippe) - Introduce qemu_arch_available() helper (Philippe) - Check fw_cfg's ACPI availability at runtime (Philippe) - Remove virtio-mem dependency on CONFIG_DEVICES (Philippe) - Sort HyperV SYNDBG API definitions (Pierrick) - Remove need for SDHCI_VENDOR_FSL definition (Philippe) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmfRXiMACgkQ4+MsLN6t # wN5zFhAAzSW/hZneD8hycKtr9nBlvZSD72cEt+b656OCbTyyucUi1sG4rMPMvHeW # h6HP6xt2SfQxXbec6Y0pWxWUkBOQzk72s0zpttOED3oEspkrId2D+VSsSH1E+QLh # WoG7/hVgz0bDHexWYIDdGufO4no/icwewAKmC5Kp2HbaNxIIHyWlK1+RO69/lCLN # s3qkNesMsQyEWN28ogEMRqyCIG3oJVP76U4TVcdxIiE51WI8sP8/7V2um0AXN68m # IV3INrfVJjGDp501elrUbD3qsYopRdxoMAvwiVojrLXin6xtS+SQjEe/hcNxzM70 # 0IQPp9WWwLjNkeFlAJF4wpwGJttFNHj+5gtH7/YRrP75jt9kAxPXkFw/OFfpVd30 # NYbeFlWDhRL1QPBs+WPBZTrfD7fRmpfMJRLF3/w61+WvnVrshlyDaoCWbR+L329F # uOQFsBdAD7m/lkZ0mHtskS2vkZx7Itn1av4gql7T7/6cE1R7ItKy1HY9UUCtY6Gp # 7V6XrsAE3khg2HY8IcJ73+sPLQn/GxqZFE7PqmAhgcl6RZEFQv8PNrEgFxCEYyuK # KJjx0hRMLoigp0CEclLfOqz2d3knsI8SJbgD4iTYQc02E69lx8a4XS4N8JXoLEdh # 3i/ndwKEFmzwNuqbU0nYsSJDiAO9ejra8O2BXZS/a4pkxC2jtdw= # =VVr6 # -----END PGP SIGNATURE----- # gpg: Signature made Wed 12 Mar 2025 18:12:51 HKT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'hw-misc-20250312' of https://github.com/philmd/qemu: hw/sd/sdhci: Remove need for SDHCI_VENDOR_IMX definition hw/hyperv/hyperv-proto: Move SYNDBG definitions from target/i386 hw/virtio/virtio-mem: Remove CONFIG_DEVICES include hw/i386/fw_cfg: Check ACPI availability with acpi_builtin() hw/acpi: Introduce acpi_builtin() helper system: Replace arch_type global by qemu_arch_available() helper system: Extract target-specific globals to their own compilation unit hw/xen/hvm: Fix Aarch64 typo hw/net/smc91c111: Don't allow data register access to overrun buffer hw/net/smc91c111: Use MAX_PACKET_SIZE instead of magic numbers hw/net/smc91c111: Sanitize packet length on tx hw/net/smc91c111: Sanitize packet numbers hw/rtc: Add Ricoh RS5C372 RTC emulation hw/sd/sdhci: Set reset value of interrupt registers Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-03-13Merge tag 'pull-vfio-20250311' of https://github.com/legoater/qemu into stagingStefan Hajnoczi12-402/+285
vfio queue: * Fixed endianness of VFIO device state packets * Improved IGD passthrough support with legacy mode * Improved build * Added support for old AMD GPUs (x550) * Updated property documentation # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmfQfQcACgkQUaNDx8/7 # 7KEUNw/+PjFpHrz5muQ8itkbyd36eJJdcxCl+9IPIWfnUfB582epkLcgvWyswGUo # krFTregoRG0PKtgZDtv95owGtVJOgK6XYFadGHiYkvvsb41twOYsP7/SuI+KMiEv # IDFLMvCTyorSIIoEF8i2EexfGPRV1VoWwvBoHgRRmYlzwzXnufjABpoZ0a25DTye # DQ4yhSfqoIh1gOcdL9tPictnZg9OxKr2ePXNdrtymtEIhg3ZobD3Jd8J4WCcsfKT # fxxBO5NsGgA8oM7i02fYN9kgMwqTnVhSAu1wq9PXsbrnNXam+trywAWSO6CjL+rV # ++STWNSrRoHzuotRBr7BzrTpTFyQyfwBWqUT5L4NlhgXB3Xybk+M6Zj08Yva8pjE # w78JQKvKp54gU34AWBW0/J6+u3v+iE8l1Eywx6xueF9Q+YSUDeW9B1LDdjFJryhF # d8j3J+vuglbdsp05D+tVErf5cqFvFDfrjTkXkZNtmx7wky45XS9ZvNazYW1KI3f9 # bg8Wjb7ZujuvxpSjycPRZzdKa8kqSgSZg7fg91Wimiy1Iqe3SZVVWNchLYiPp8Dm # nXMfOEpVHQZ1vzeo7dVWyxu9Y1ujgvUQy8kMa9q2W2S7HQ5Sna79n7eMVJxqZQ4G # m0ETFToOcPPOnZBWgqNOSUlSQncFuIVgNTDvycQ9dMhGorYcBDI= # =Vh0m # -----END PGP SIGNATURE----- # gpg: Signature made Wed 12 Mar 2025 02:12:23 HKT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [full] # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-vfio-20250311' of https://github.com/legoater/qemu: (21 commits) vfio/pci: Drop debug commentary from x-device-dirty-page-tracking vfio/pci-quirks: Exclude non-ioport BAR from ATI quirk hw/vfio: Compile display.c once hw/vfio: Compile iommufd.c once hw/vfio: Compile more objects once hw/vfio: Compile some common objects once hw/vfio/common: Get target page size using runtime helpers hw/vfio/common: Include missing 'system/tcg.h' header hw/vfio/spapr: Do not include <linux/kvm.h> system: Declare qemu_[min/max]rampagesize() in 'system/hostmem.h' vfio/migration: Use BE byte order for device state wire packets vfio/igd: Fix broken KVMGT OpRegion support vfio/igd: Introduce x-igd-lpc option for LPC bridge ID quirk vfio/igd: Handle x-igd-opregion option in config quirk vfio/igd: Decouple common quirks from legacy mode vfio/igd: Refactor vfio_probe_igd_bar4_quirk into pci config quirk vfio/pci: Add placeholder for device-specific config space quirks vfio/igd: Move LPC bridge initialization to a separate function vfio/igd: Consolidate OpRegion initialization into a single function vfio/igd: Do not include GTT stolen size in etc/igd-bdsm-size ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-03-13Merge tag 'pull-ppc-for-10.0-1-20250311' of https://gitlab.com/npiggin/qemu ↵Stefan Hajnoczi27-2708/+2473
into staging * Next round of XIVE patches... * tag 'pull-ppc-for-10.0-1-20250311' of https://gitlab.com/npiggin/qemu: (72 commits) docs/system/ppc/amigang.rst: Update for NVRAM emulation ppc/amigaone: Add #defines for memory map constants ppc/amigaone: Add kernel and initrd support ppc/amigaone: Add default environment ppc/amigaone: Implement NVRAM emulation ppc/amigaone: Simplify replacement dummy_fw spapr: Generate random HASHPKEYR for spapr machines target/ppc: Avoid warning message for zero process table entries target/ppc: Wire up BookE ATB registers for e500 family target/ppc: fix timebase register reset state spapr: nested: Add support for reporting Hostwide state counter ppc: spapr: Enable 2nd DAWR on Power10 pSeries machine ppc: Enable 2nd DAWR support on Power10 PowerNV machine hw/ppc/epapr: Do not swap ePAPR magic value hw/ppc/spapr: Convert DIRTY_HPTE() macro as hpte_set_dirty() method hw/ppc/spapr: Convert CLEAN_HPTE() macro as hpte_set_clean() method hw/ppc/spapr: Convert HPTE_DIRTY() macro as hpte_is_dirty() method hw/ppc/spapr: Convert HPTE_VALID() macro as hpte_is_valid() method hw/ppc/spapr: Convert HPTE() macro as hpte_get_ptr() method target/ppc: Restrict ATTN / SCV / PMINSN helpers to TCG ... [Fix __packed macro redefinition on FreeBSD 14 hosts: ../hw/ppc/pnv_occ.c:397:9: error: '__packed' macro redefined [-Werror,-Wmacro-redefined] 397 | #define __packed QEMU_PACKED | ^ /usr/include/sys/cdefs.h:217:9: note: previous definition is here 217 | #define __packed __attribute__((__packed__)) | ^ --Stefan] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-03-12hw/sd/sdhci: Remove need for SDHCI_VENDOR_IMX definitionPhilippe Mathieu-Daudé6-20/+4
All instances of TYPE_IMX_USDHC set vendor=SDHCI_VENDOR_IMX. No need to special-case it. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Message-Id: <20250308213640.13138-3-philmd@linaro.org>
2025-03-11hw/virtio/virtio-mem: Remove CONFIG_DEVICES includePhilippe Mathieu-Daudé1-4/+2
Rather than checking ACPI availability at compile time by checking the CONFIG_ACPI definition from CONFIG_DEVICES, check at runtime via acpi_builtin(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20250307223949.54040-5-philmd@linaro.org>
2025-03-11hw/i386/fw_cfg: Check ACPI availability with acpi_builtin()Philippe Mathieu-Daudé2-4/+7
Define acpi_tables / acpi_tables_len stubs, then replace the compile-time CONFIG_ACPI check in fw_cfg.c by a runtime one. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Ani Sinha <anisinha@redhat.com> Message-Id: <20250307223949.54040-4-philmd@linaro.org>
2025-03-11hw/acpi: Introduce acpi_builtin() helperPhilippe Mathieu-Daudé2-0/+10
acpi_builtin() can be used to check at runtime whether the ACPI subsystem is built in a qemu-system binary. Reviewed-by: Ani Sinha <anisinha@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20250307223949.54040-3-philmd@linaro.org>
2025-03-11system: Replace arch_type global by qemu_arch_available() helperPhilippe Mathieu-Daudé1-1/+1
qemu_arch_available() is a bit simpler to understand while reviewing than the undocumented arch_type variable. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20250305005225.95051-5-philmd@linaro.org>
2025-03-11hw/net/smc91c111: Don't allow data register access to overrun bufferPeter Maydell1-12/+53
For accesses to the 91c111 data register, the address within the packet's data frame is determined by a combination of the pointer register and the offset used to access the data register, so that you can access data at effectively wider than byte width. The pointer register's pointer field is 11 bits wide, which is exactly the size to index a 2048-byte data frame. We weren't quite getting the logic right for ensuring that we end up with a pointer value to use in the s->data[][] array that isn't out of bounds: * we correctly mask when getting the initial pointer value * for the "autoincrement the pointer register" case, we correctly mask after adding 1 so that the pointer register wraps back around at the 2048 byte mark * but for the non-autoincrement case where we have to add the low 2 bits of the data register offset, we don't account for the possibility that the pointer register is 0x7ff and the addition should wrap Fix this bug by factoring out the "get the p value to use as an array index" into a function, making it use FIELD macro names rather than hard-coded constants, and having a utility function that does "add a value and wrap it" that we can use both for the "autoincrement" and "add the offset bits" codepaths. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2758 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250228191652.1957208-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-03-11hw/net/smc91c111: Use MAX_PACKET_SIZE instead of magic numbersPeter Maydell1-3/+5
Now we have a constant for the maximum packet size, we can use it to replace various hardcoded 2048 values. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250228174802.1945417-4-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-03-11hw/net/smc91c111: Sanitize packet length on txPeter Maydell1-5/+29
When the smc91c111 transmits a packet, it must read a control byte which is at the end of the data area and CRC. However, we don't sanitize the length field in the packet buffer, so if the guest sets the length field to something large we will try to read past the end of the packet data buffer when we access the control byte. As usual, the datasheet says nothing about the behaviour of the hardware if the guest misprograms it in this way. It says only that the maximum valid length is 2048 bytes. We choose to log the guest error and silently drop the packet. This requires us to factor out the "mark the tx packet as complete" logic, so we can call it for this "drop packet" case as well as at the end of the loop when we send a valid packet. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2742 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250228174802.1945417-3-peter.maydell@linaro.org> [PMD: Update smc91c111_do_tx() as len > MAX_PACKET_SIZE] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-03-11hw/net/smc91c111: Sanitize packet numbersPeter Maydell1-0/+45
The smc91c111 uses packet numbers as an index into its internal s->data[][] array. Valid packet numbers are between 0 and 3, but the code does not generally check this, and there are various places where the guest can hand us an arbitrary packet number and cause an out-of-bounds access to the data array. Add validation of packet numbers. The datasheet is not very helpful about how guest errors like this should be handled: it says nothing on the subject, and none of the documented error conditions are relevant. We choose to log the situation with LOG_GUEST_ERROR and silently ignore the attempted operation. In the places where we are about to access the data[][] array using a packet number and we know the number is valid because we got it from somewhere that has already validated, we add an assert() to document that belief. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250228174802.1945417-2-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
generated by cgit v1.1 at 2025-09-23 03:56:28 +0000