[Stable-9.0.3 24/69] hw/misc/bcm2835_property: Fix handling of FRAMEBUFFER_SET_PALETTE

2024-09-06 Thread Michael Tokarev
From: Peter Maydell The documentation of the "Set palette" mailbox property at https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface#set-palette says it has the form: Length: 24..1032 Value: u32: offset: first palette index to set (0-255) u32: length: nu

[Stable-9.0.3 17/69] hw/intc/loongson_ipi: Fix resource leak

2024-09-06 Thread Michael Tokarev
From: Philippe Mathieu-Daudé Once initialised, QOM objects can be realized and unrealized multiple times before being finalized. Resources allocated in REALIZE must be deallocated in an equivalent UNREALIZE handler. Free the CPU array in loongson_ipi_unrealize() instead of loongson_ipi_finalize(

[Stable-9.0.3 48/69] nbd/server: CVE-2024-7409: Drop non-negotiating clients

2024-09-06 Thread Michael Tokarev
From: Eric Blake A client that opens a socket but does not negotiate is merely hogging qemu's resources (an open fd and a small amount of memory); and a malicious client that can access the port where NBD is listening can attempt a denial of service attack by intentionally opening and abandoning

[Stable-9.0.3 42/69] vvfat: Fix usage of `info.file.offset`

2024-09-06 Thread Michael Tokarev
From: Amjad Alsharafi The field is marked as "the offset in the file (in clusters)", but it was being used like this `cluster_size*(nums)+mapping->info.file.offset`, which is incorrect. Signed-off-by: Amjad Alsharafi Reviewed-by: Kevin Wolf Message-ID: <72f19a7903886dda1aa78bcae0e17702ee93926

[Stable-9.0.3 38/69] target/i386: Fix VSIB decode

2024-09-06 Thread Michael Tokarev
From: Richard Henderson With normal SIB, index == 4 indicates no index. With VSIB, there is no exception for VR4/VR12. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2474 Signed-off-by: Richard Henderson Link: https://lore.kernel.org/r/20240805003130.1421051-3-richard.hender...@linaro

[Stable-9.0.3 44/69] vvfat: Fix reading files with non-continuous clusters

2024-09-06 Thread Michael Tokarev
From: Amjad Alsharafi When reading with `read_cluster` we get the `mapping` with `find_mapping_for_cluster` and then we call `open_file` for this mapping. The issue appear when its the same file, but a second cluster that is not immediately after it, imagine clusters `500 -> 503`, this will give

[Stable-9.0.3 56/69] target/arm: Update translation regime comment for new features

2024-09-06 Thread Michael Tokarev
From: Peter Maydell We have a long comment describing the Arm architectural translation regimes and how we map them to QEMU MMU indexes. This comment has got a bit out of date: * FEAT_SEL2 allows Secure EL2 and corresponding new regimes * FEAT_RME introduces Realm state and its translation re

[Stable-9.0.3 45/69] iotests: Add `vvfat` tests

2024-09-06 Thread Michael Tokarev
From: Amjad Alsharafi Added several tests to verify the implementation of the vvfat driver. We needed a way to interact with it, so created a basic `fat16.py` driver that handled writing correct sectors for us. Added `vvfat` to the non-generic formats, as its not a normal image format. Signed-

[Stable-9.0.3 31/69] hw/arm/mps2-tz.c: fix RX/TX interrupts order

2024-09-06 Thread Michael Tokarev
From: Marco Palumbi The order of the RX and TX interrupts are swapped. This commit fixes the order as per the following documents: * https://developer.arm.com/documentation/dai0505/latest/ * https://developer.arm.com/documentation/dai0521/latest/ * https://developer.arm.com/documentation/dai05

[Stable-9.0.3 47/69] nbd/server: CVE-2024-7409: Cap default max-connections to 100

2024-09-06 Thread Michael Tokarev
From: Eric Blake Allowing an unlimited number of clients to any web service is a recipe for a rudimentary denial of service attack: the client merely needs to open lots of sockets without closing them, until qemu no longer has any more fds available to allocate. For qemu-nbd, we default to allow

[Stable-9.0.3 26/69] target/arm: Fix UMOPA/UMOPS of 16-bit values

2024-09-06 Thread Michael Tokarev
From: Peter Maydell The UMOPA/UMOPS instructions are supposed to multiply unsigned 8 or 16 bit elements and accumulate the products into a 64-bit element. In the Arm ARM pseudocode, this is done with the usual infinite-precision signed arithmetic. However our implementation doesn't quite get it

[Stable-9.0.3 55/69] target/arm: Clear high SVE elements in handle_vec_simd_wshli

2024-09-06 Thread Michael Tokarev
From: Richard Henderson AdvSIMD instructions are supposed to zero bits beyond 128. Affects SSHLL, USHLL, SSHLL2, USHLL2. Cc: qemu-sta...@nongnu.org Signed-off-by: Richard Henderson Message-id: 20240717060903.205098-15-richard.hender...@linaro.org Reviewed-by: Peter Maydell Signed-off-by: Peter

[Stable-9.0.3 69/69] target/hppa: Fix PSW V-bit packaging in cpu_hppa_get for hppa64

2024-09-06 Thread Michael Tokarev
From: Helge Deller While adding hppa64 support, the psw_v variable got extended from 32 to 64 bits. So, when packaging the PSW-V bit from the psw_v variable for interrupt processing, check bit 31 instead the 63th (sign) bit. This fixes a hard to find Linux kernel boot issue where the loss of th

[Stable-9.0.3 57/69] target/arm: Fix usage of MMU indexes when EL3 is AArch32

2024-09-06 Thread Michael Tokarev
From: Peter Maydell Our current usage of MMU indexes when EL3 is AArch32 is confused. Architecturally, when EL3 is AArch32, all Secure code runs under the Secure PL1&0 translation regime: * code at EL3, which might be Mon, or SVC, or any of the other privileged modes (PL1) * code at EL0 (Sec

[Stable-9.0.3 49/69] nbd/server: CVE-2024-7409: Close stray clients at server-stop

2024-09-06 Thread Michael Tokarev
From: Eric Blake A malicious client can attempt to connect to an NBD server, and then intentionally delay progress in the handshake, including if it does not know the TLS secrets. Although the previous two patches reduce this behavior by capping the default max-connections parameter and killing

[Stable-9.0.3 22/69] target/rx: Use target_ulong for address in LI

2024-09-06 Thread Michael Tokarev
From: Richard Henderson Using int32_t meant that the address was sign-extended to uint64_t when passing to translator_ld*, triggering an assert. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2453 Signed-off-by: Richard Henderson Tested-by: Thomas Huth (cherry picked from commit 83340

[Stable-9.0.3 21/69] hw/virtio: Fix the de-initialization of vhost-user devices

2024-09-06 Thread Michael Tokarev
From: Thomas Huth The unrealize functions of the various vhost-user devices are calling the corresponding vhost_*_set_status() functions with a status of 0 to shut down the device correctly. Now these vhost_*_set_status() functions all follow this scheme: bool should_start = virtio_device_s

[Stable-9.0.3 40/69] hw/sd/sdhci: Reset @data_count index on invalid ADMA transfers

2024-09-06 Thread Michael Tokarev
From: Philippe Mathieu-Daudé We neglected to clear the @data_count index on ADMA error, allowing to trigger assertion in sdhci_read_dataport() or sdhci_write_dataport(). Cc: qemu-sta...@nongnu.org Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller") Reported-by: Zheyu Ma Resolv

[Stable-9.0.3 68/69] hw/audio/virtio-snd: fix invalid param check

2024-09-06 Thread Michael Tokarev
From: Volker Rümelin Commit 9b6083465f ("virtio-snd: check for invalid param shift operands") tries to prevent invalid parameters specified by the guest. However, the code is not correct. Change the code so that the parameters format and rate, which are a bit numbers, are compared with the bit s

[Stable-9.0.3 43/69] vvfat: Fix wrong checks for cluster mappings invariant

2024-09-06 Thread Michael Tokarev
From: Amjad Alsharafi How this `abort` was intended to check for was: - if the `mapping->first_mapping_index` is not the same as `first_mapping_index`, which **should** happen only in one case, when we are handling the first mapping, in that case `mapping->first_mapping_index == -1`, in all

[Stable-9.0.3 66/69] linux-user: Handle short reads in mmap_h_gt_g

2024-09-06 Thread Michael Tokarev
From: Richard Henderson In particular, if an image has a large bss, we can hit EOF before reading all host_len bytes of the mapping. Create a helper, mmap_pread to handle the job for both the larger block in mmap_h_gt_g itself, as well as the smaller block in mmap_frag. Cc: qemu-sta...@nongnu.o

[Stable-9.0.3 14/69] target/i386: do not crash if microvm guest uses SGX CPUID leaves

2024-09-06 Thread Michael Tokarev
From: Paolo Bonzini sgx_epc_get_section assumes a PC platform is in use: bool sgx_epc_get_section(int section_nr, uint64_t *addr, uint64_t *size) { PCMachineState *pcms = PC_MACHINE(qdev_get_machine()); However, sgx_epc_get_section is called by CPUID regardless of whether SGX state has been

[Stable-9.0.3 41/69] vvfat: Fix bug in writing to middle of file

2024-09-06 Thread Michael Tokarev
From: Amjad Alsharafi Before this commit, the behavior when calling `commit_one_file` for example with `offset=0x2000` (second cluster), what will happen is that we won't fetch the next cluster from the fat, and instead use the first cluster for the read operation. This is due to off-by-one erro

[Stable-9.0.3 61/69] target/sparc: Restrict STQF to sparcv9

2024-09-06 Thread Michael Tokarev
From: Richard Henderson Prior to sparcv9, the same encoding was STDFQ. Cc: qemu-sta...@nongnu.org Fixes: 06c060d9e5b ("target/sparc: Move simple fp load/store to decodetree") Signed-off-by: Richard Henderson Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20240816072311.353234-2-richard.hende

[Stable-9.0.3 33/69] virtio-net: Ensure queue index fits with RSS

2024-09-06 Thread Michael Tokarev
From: Akihiko Odaki Ensure the queue index points to a valid queue when software RSS enabled. The new calculation matches with the behavior of Linux's TAP device with the RSS eBPF program. Fixes: 4474e37a5b3a ("virtio-net: implement RX RSS processing") Reported-by: Zhibin Hu Cc: qemu-sta...@non

[Stable-9.0.3 15/69] chardev/char-win-stdio.c: restore old console mode

2024-09-06 Thread Michael Tokarev
From: songziming If I use `-serial stdio` on Windows, after QEMU exits, the terminal could not handle arrow keys and tab any more. Because stdio backend on Windows sets console mode to virtual terminal input when starts, but does not restore the old mode when finalize. This small patch saves the

[Stable-9.0.3 53/69] block/blkio: use FUA flag on write zeroes only if supported

2024-09-06 Thread Michael Tokarev
From: Stefano Garzarella libblkio supports BLKIO_REQ_FUA with write zeros requests only since version 1.4.0, so let's inform the block layer that the blkio driver supports it only in this case. Otherwise we can have runtime errors as reported in https://issues.redhat.com/browse/RHEL-32878 Fixes:

[Stable-9.0.3 59/69] target/hexagon: don't look for static glib

2024-09-06 Thread Michael Tokarev
From: Alyssa Ross When cross compiling QEMU configured with --static, I've been getting configure errors like the following: Build-time dependency glib-2.0 found: NO ../target/hexagon/meson.build:303:15: ERROR: Dependency lookup for glib-2.0 with method 'pkgconfig' failed: Could not ge

[Stable-9.0.3 67/69] Revert "replay: stop us hanging in rr_wait_io_event"

2024-09-06 Thread Michael Tokarev
From: Nicholas Piggin This reverts commit 1f881ea4a444ef36a8b6907b0b82be4b3af253a2. That commit causes reverse_debugging.py test failures, and does not seem to solve the root cause of the problem x86-64 still hangs in record/replay tests. The problem with short-cutting the iowait that was taken

[Stable-9.0.3 37/69] linux-user/elfload: Fix pr_pid values in core files

2024-09-06 Thread Michael Tokarev
From: Ilya Leoshkevich Analyzing qemu-produced core dumps of multi-threaded apps runs into: (gdb) info threads [...] 21 Thread 0x3ff83cc0740 (LWP 9295) warning: Couldn't find general-purpose registers in core file. in ?? () The reason is that all pr_pid values are the sa

[Stable-9.0.3 63/69] hw/nvme: fix leak of uninitialized memory in io_mgmt_recv

2024-09-06 Thread Michael Tokarev
From: Klaus Jensen Yutaro Shimizu from the Cyber Defense Institute discovered a bug in the NVMe emulation that leaks contents of an uninitialized heap buffer if subsystem and FDP emulation are enabled. Cc: qemu-sta...@nongnu.org Reported-by: Yutaro Shimizu Signed-off-by: Klaus Jensen (cherry p

[Stable-9.0.3 39/69] tcg/ppc: Sync tcg_out_test and constraints

2024-09-06 Thread Michael Tokarev
From: Richard Henderson Ensure the code structure is the same for matching constraints and emitting code, lest we allow constants that cannot be trivially tested. Cc: qemu-sta...@nongnu.org Fixes: ad788aebbab ("tcg/ppc: Support TCG_COND_TST{EQ,NE}") Resolves: https://gitlab.com/qemu-project/qemu

[Stable-9.0.3 60/69] linux-user: Preserve NULL hit in target_mmap subroutines

2024-09-06 Thread Michael Tokarev
From: Richard Henderson Do not pass guest_base to the host mmap instead of zero hint. Cc: qemu-sta...@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2353 Signed-off-by: Richard Henderson (cherry picked from commit 3aefee3ec01e607529a9918e2978f365c5c3b5e9) Signed-off-by: Mich

[Stable-9.0.3 54/69] target/i386: Do not apply REX to MMX operands

2024-09-06 Thread Michael Tokarev
From: Richard Henderson Cc: qemu-sta...@nongnu.org Fixes: b3e22b2318a ("target/i386: add core of new i386 decoder") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2495 Signed-off-by: Richard Henderson Link: https://lore.kernel.org/r/20240812025844.58956-2-richard.hender...@linaro.org S

[Stable-9.0.3 29/69] docs/sphinx/depfile.py: Handle env.doc2path() returning a Path not a str

2024-09-06 Thread Michael Tokarev
From: Peter Maydell In newer versions of Sphinx the env.doc2path() API is going to change to return a Path object rather than a str. This was originally visible in Sphinx 8.0.0rc1, but has been rolled back for the final 8.0.0 release. However it will probably emit a deprecation warning and is lik

[Stable-9.0.3 51/69] net: Fix '-net nic, model=' for non-help arguments

2024-09-06 Thread Michael Tokarev
From: David Woodhouse Oops, don't *delete* the model option when checking for 'help'. Fixes: 64f75f57f9d2 ("net: Reinstate '-net nic, model=help' output as documented in man page") Reported-by: Hans Signed-off-by: David Woodhouse Cc: qemu-sta...@nongnu.org Reviewed-by: Michael Tokarev Signed

[Stable-9.0.3 32/69] target/arm: Handle denormals correctly for FMOPA (widening)

2024-09-06 Thread Michael Tokarev
From: Peter Maydell The FMOPA (widening) SME instruction takes pairs of half-precision floating point values, widens them to single-precision, does a two-way dot product and accumulates the results into a single-precision destination. We don't quite correctly handle the FPCR bits FZ and FZ16 whi

[Stable-9.0.3 50/69] nbd/server: CVE-2024-7409: Avoid use-after-free when closing server

2024-09-06 Thread Michael Tokarev
From: Eric Blake Commit 3e7ef738 plugged the use-after-free of the global nbd_server object, but overlooked a use-after-free of nbd_server->listener. Although this race is harder to hit, notice that our shutdown path first drops the reference count of nbd_server->listener, then triggers actions t

[Stable-9.0.3 58/69] module: Prevent crash by resetting local_err in module_load_qom_all()

2024-09-06 Thread Michael Tokarev
From: Alexander Ivanov Set local_err to NULL after it has been freed in error_report_err(). This avoids triggering assert(*errp == NULL) failure in error_setv() when local_err is reused in the loop. Signed-off-by: Alexander Ivanov Reviewed-by: Claudio Fontana Reviewed-by: Denis V. Lunev Link:

[Stable-9.0.3 64/69] virtio-pci: Fix the use of an uninitialized irqfd

2024-09-06 Thread Michael Tokarev
From: Cindy Lu The crash was reported in MAC OS and NixOS, here is the link for this bug https://gitlab.com/qemu-project/qemu/-/issues/2334 https://gitlab.com/qemu-project/qemu/-/issues/2321 In this bug, they are using the virtio_input device. The guest notifier was not supported for this device

[Stable-9.0.3 46/69] nbd/server: Plumb in new args to nbd_client_add()

2024-09-06 Thread Michael Tokarev
From: Eric Blake Upcoming patches to fix a CVE need to track an opaque pointer passed in by the owner of a client object, as well as request for a time limit on how fast negotiation must complete. Prepare for that by changing the signature of nbd_client_new() and adding an accessor to get at the

[Stable-9.0.3 52/69] hw/core/ptimer: fix timer zero period condition for freq > 1GHz

2024-09-06 Thread Michael Tokarev
From: Jianzhou Yue The real period is zero when both period and period_frac are zero. Check the method ptimer_set_freq, if freq is larger than 1000 MHz, the period is zero, but the period_frac is not, in this case, the ptimer will work but the current code incorrectly recognizes that the ptimer i

[Stable-9.0.3 27/69] target/arm: Avoid shifts by -1 in tszimm_shr() and tszimm_shl()

2024-09-06 Thread Michael Tokarev
From: Peter Maydell The function tszimm_esz() returns a shift amount, or possibly -1 in certain cases that correspond to unallocated encodings in the instruction set. We catch these later in the trans_ functions (generally with an "a-esz < 0" check), but before we do the decodetree-generated cod

[Stable-9.0.3 62/69] crypto/tlscredspsk: Free username on finalize

2024-09-06 Thread Michael Tokarev
From: Peter Maydell When the creds->username property is set we allocate memory for it in qcrypto_tls_creds_psk_prop_set_username(), but we never free this when the QCryptoTLSCredsPSK is destroyed. Free the memory in finalize. This fixes a LeakSanitizer complaint in migration-test: $ (cd build/

[Stable-9.0.3 65/69] migration/multifd: Free MultiFDRecvParams::data

2024-09-06 Thread Michael Tokarev
From: Peter Maydell In multifd_recv_setup() we allocate (among other things) * a MultiFDRecvData struct to multifd_recv_state::data * a MultiFDRecvData struct to each multfd_recv_state->params[i].data (Then during execution we might swap these pointers around.) But in multifd_recv_cleanup() w

[Stable-9.0.3 36/69] migration/multifd: Fix multifd_send_setup cleanup when channel creation fails

2024-09-06 Thread Michael Tokarev
From: Fabiano Rosas When a channel fails to create, the code currently just returns. This is wrong for two reasons: 1) Channel n+1 will not get to initialize it's semaphores, leading to an assert when terminate_threads tries to post to it: qemu-system-x86_64: ../util/qemu-thread-posix.c:92:

[Stable-9.0.3 19/69] util/async.c: Forbid negative min/max in aio_context_set_thread_pool_params()

2024-09-06 Thread Michael Tokarev
From: Peter Maydell aio_context_set_thread_pool_params() takes two int64_t arguments to set the minimum and maximum number of threads in the pool. We do some bounds checking on these, but we don't catch the case where the inputs are negative. This means that later in the function when we assign

[Stable-9.0.3 18/69] target/loongarch: Fix helper_lddir() a CID INTEGER_OVERFLOW issue

2024-09-06 Thread Michael Tokarev
From: Song Gao When the lddir level is 4 and the base is a HugePage, we may try to put value 4 into a field in the TLBENTRY that is only 2 bits wide. Fixes: Coverity CID 1547717 Fixes: 9c70db9a43388 ("target/loongarch: Fix tlb huge page loading issue") Signed-off-by: Song Gao Reviewed-by: Richa

Re: [PULL 00/42] Introduce new functional test framework

2024-09-06 Thread Peter Maydell
On Wed, 4 Sept 2024 at 11:40, Thomas Huth wrote: > > Hi! > > The following changes since commit e638d685ec2a0700fb9529cbd1b2823ac4120c53: > > Open 9.2 development tree (2024-09-03 09:18:43 -0700) > > are available in the Git repository at: > > https://gitlab.com/thuth/qemu.git tags/pull-reque

Re: [PATCH 0/3] hw/sh4: Remove the deprecated SHIX machine

2024-09-06 Thread Philippe Mathieu-Daudé
On 3/9/24 17:39, Philippe Mathieu-Daudé wrote: Remove the deprecated SH4 SHIX machine, along with the TC58128 NAND EEPROM. Philippe Mathieu-Daudé (3): hw/sh4: Remove the deprecated SHIX machine hw/block: Remove TC58128 NAND EEPROM hw/sh4: Remove sh7750_register_io_device() helper Seri

Re: nested-smmuv3 topic, Sep 2024

2024-09-06 Thread Mostafa Saleh
Hi Nicolin, On Thu, Sep 05, 2024 at 01:26:20AM -0700, Nicolin Chen wrote: > Hi all, > > Hope I didn't miss anybody who is related to the topic. Please, > feel free to add! > > <--- Background ---> > As some of you know, there is an ongoing effort for nested-smmuv3 > support in QEMU on ARM, worki

Re: [RFC PATCH v3 01/24] fifo32: add peek function

2024-09-06 Thread Philippe Mathieu-Daudé
Hi Octavian, On 27/8/24 08:45, Octavian Purdila wrote: Add fifo32_peek() that returns the first element from the queue without popping it. Signed-off-by: Octavian Purdila --- include/qemu/fifo32.h | 28 1 file changed, 28 insertions(+) diff --git a/include/qemu

[RFC PATCH 1/8] usb/uhci: checkpatch cleanup

2024-09-06 Thread Guenter Roeck
Fix reported checkpatch issues to prepare for next patches in the series. No functional change. Signed-off-by: Guenter Roeck --- hw/usb/hcd-uhci.c | 90 +-- 1 file changed, 56 insertions(+), 34 deletions(-) diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd

[RFC PATCH 5/8] usb/uhci: Add support for usb-uhci-sysbus

2024-09-06 Thread Guenter Roeck
Signed-off-by: Guenter Roeck --- hw/arm/Kconfig | 1 + hw/usb/Kconfig | 4 ++ hw/usb/hcd-uhci-sysbus.c | 100 +++ hw/usb/hcd-uhci-sysbus.h | 23 + hw/usb/meson.build | 1 + 5 files changed, 129 insertions(+) create mode

[RFC PATCH 2/8] usb/uhci: Introduce and use register defines

2024-09-06 Thread Guenter Roeck
Introduce defines for UHCI registers to simplify adding register access in subsequent patches of the series. No functional change. Signed-off-by: Guenter Roeck --- hw/usb/hcd-uhci.c | 32 include/hw/usb/uhci-regs.h | 11 +++ 2 files changed, 27

[RFC PATCH 4/8] usb/uhci: enlarge uhci memory space

2024-09-06 Thread Guenter Roeck
hcd-uhci-sysbus will require more memory than hcd-uhci-pci since registers for some hardware (specifically Aspeed) don't map 1:1. Signed-off-by: Guenter Roeck --- hw/usb/hcd-uhci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c index 68b

[RFC PATCH 0/8] usb/uhci: Add UHCI sysbus support, and enable for AST machines

2024-09-06 Thread Guenter Roeck
Some machines (like Aspeed ARM) only support a sysbus UHCI controller. The current UHCI implementation in qemu only supports PCI based UHCI controllers. This patch series separates basic and PCI functionality from the hcd-uhci implementation and then adds uhci-sysbus support. This is then used to

[RFC PATCH 6/8] usb/uhci: Add aspeed specific read and write functions

2024-09-06 Thread Guenter Roeck
Aspeed uses non-standard UHCI register addresses. On top of that, registers are 32 bit wide instead of 16 bit. Map Aspeed UHCI addresses to standard UHCI addresses and where needed combine/split 32 bit accesses to solve the problem. Signed-off-by: Guenter Roeck --- hw/usb/hcd-uhci-sysbus.c | 10

[RFC PATCH 3/8] usb/uhci: Move PCI-related code into a separate file

2024-09-06 Thread Guenter Roeck
Some machines (like Aspeed ARM) only have a sysbus UHCI controller. The current UHCI implementation only supports PCI based UHCI controllers. Move the UHCI-PCI device code into a separate file so that it is possible to create a sysbus UHCI device without PCI dependency. Signed-off-by: Guenter Roec

[RFC PATCH 7/8] aspeed: Add uhci support for ast2600

2024-09-06 Thread Guenter Roeck
Enable UHCO support for the ast2600 SoC. With this patch, the UHCI port is successfully instantiated on the rainier-bmc and ast2600-evb machines. Signed-off-by: Guenter Roeck --- hw/arm/aspeed_ast2600.c | 13 + include/hw/arm/aspeed_soc.h | 3 +++ 2 files changed, 16 insertions(

[RFC PATCH 8/8] aspeed: Add uhci support for ast2400 and ast2500

2024-09-06 Thread Guenter Roeck
Enable UHCI support for ast2400 and ast2500 SoCs. With this patch, the UHCI port is successfully instantiated on the ast2500-evb machine. Signed-off-by: Guenter Roeck --- hw/arm/aspeed_ast2400.c | 14 ++ 1 file changed, 14 insertions(+) diff --git a/hw/arm/aspeed_ast2400.c b/hw/arm/

Re: [PATCH v2 1/4] KVM: Dynamic sized kvm memslots array

2024-09-06 Thread Peter Xu
On Fri, Sep 06, 2024 at 12:54:37PM +0200, Juraj Marcin wrote: > Hi Peter, > > On Thu, Sep 5, 2024 at 6:00 PM Peter Xu wrote: > > > > On Thu, Sep 05, 2024 at 05:32:46PM +0200, Juraj Marcin wrote: > > > Hi Peter, > > > > Hi, Juraj, > > > > [...] > > > > > > unsigned int kvm_get_max_memslots(void)

[PATCH] aspeed: Add support for IBM Bonnell

2024-09-06 Thread Guenter Roeck
Introduce support for the IBM Bonnell BMC. Use Rainier machine information for HW strapping and other machine details since the actual hardware configuration is unknown. I2C device instantiation is based on the devicetree file in the upstream Linux kernel. Major difference to Rainier is that the

Re: [PATCH] target/hexagon: relicense GPL files to BSD-3

2024-09-06 Thread Brian Cain
On 9/4/2024 7:45 AM, Matheus Tavares Bernardino wrote: Our internal contribution guidelines for QEMU were to use the BSD 3 clause license but we used GPLv2+ in error. So relicense the GPLv2+ Hexagon files to the compatible BSD 3-Clause, also updating the verbose license boilerplate with the cle

Re: [PATCH] hw/intc/arm_gic: fix spurious level triggered interrupts

2024-09-06 Thread Peter Maydell
On Mon, 2 Sept 2024 at 13:32, Jan Klötzke wrote: > > Level triggered interrupts are pending when either the interrupt line > is asserted or the interrupt was made pending by a GICD_ISPENDRn write. > Making a level triggered interrupt pending by software persists until > either the interrupt is ack

Re: [PULL 00/34] Migration patches for 2024-09-04

2024-09-06 Thread Peter Maydell
On Wed, 4 Sept 2024 at 13:49, Fabiano Rosas wrote: > > The following changes since commit e638d685ec2a0700fb9529cbd1b2823ac4120c53: > > Open 9.2 development tree (2024-09-03 09:18:43 -0700) > > are available in the Git repository at: > > https://gitlab.com/farosas/qemu.git tags/migration-20240

Re: [RFC PATCH v2 0/5] vhost-user: Add SHMEM_MAP/UNMAP requests

2024-09-06 Thread Stefan Hajnoczi
On Fri, 6 Sept 2024 at 00:19, David Stevens wrote: > > On Fri, Sep 6, 2024 at 12:56 AM Stefan Hajnoczi wrote: > > > > On Tue, Jul 16, 2024 at 10:21:35AM +0900, David Stevens wrote: > > > On Fri, Jul 12, 2024 at 2:47 PM Michael S. Tsirkin > > > wrote: > > > > > > > > On Fri, Jul 12, 2024 at 11:0

[PATCH 0/3] tests/unit: Slightly expand FIFO8 tests

2024-09-06 Thread Philippe Mathieu-Daudé
Mostly add documentation while reviewing them. Based-on: <20240828122258.928947-1-mark.cave-ayl...@ilande.co.uk> Philippe Mathieu-Daudé (3): tests/unit: Strengthen FIFO8 tests tests/unit: Expand test_fifo8_peek_buf_wrap() coverage tests/unit: Comment FIFO8 tests tests/unit/test-fifo.c | 2

[PATCH 3/3] tests/unit: Comment FIFO8 tests

2024-09-06 Thread Philippe Mathieu-Daudé
Add comments describing how the FIFO evolves during each test. Signed-off-by: Philippe Mathieu-Daudé --- tests/unit/test-fifo.c | 190 - 1 file changed, 188 insertions(+), 2 deletions(-) diff --git a/tests/unit/test-fifo.c b/tests/unit/test-fifo.c index 4

[PATCH 2/3] tests/unit: Expand test_fifo8_peek_buf_wrap() coverage

2024-09-06 Thread Philippe Mathieu-Daudé
Test fifo8_peek_buf() can fill a buffer with wrapped data. Signed-off-by: Philippe Mathieu-Daudé --- tests/unit/test-fifo.c | 7 +++ 1 file changed, 7 insertions(+) diff --git a/tests/unit/test-fifo.c b/tests/unit/test-fifo.c index 60436a7600..4706bf8708 100644 --- a/tests/unit/test-fifo.c

[PATCH 1/3] tests/unit: Strengthen FIFO8 tests

2024-09-06 Thread Philippe Mathieu-Daudé
Replace reused bytes { 0x1, 0x2, 0x3, 0x4 } by { 0x9, 0xa, 0xb, 0xc } to be sure a different value is overwritten. Signed-off-by: Philippe Mathieu-Daudé --- tests/unit/test-fifo.c | 12 ++-- 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/tests/unit/test-fifo.c b/tests/unit

Re: [PATCH 0/9] fifo8: add fifo8_peek(), fifo8_peek_buf() and tests

2024-09-06 Thread Philippe Mathieu-Daudé
Hi Mark, On 28/8/24 14:22, Mark Cave-Ayland wrote: Mark Cave-Ayland (9): fifo8: rename fifo8_peekpop_buf() to fifo8_peekpop_bufptr() fifo8: introduce head variable for fifo8_peekpop_bufptr() fifo8: add skip parameter to fifo8_peekpop_bufptr() fifo8: replace fifo8_pop_bufptr() with f

Re: [RFC PATCH v2 0/5] vhost-user: Add SHMEM_MAP/UNMAP requests

2024-09-06 Thread Stefan Hajnoczi
On Fri, 6 Sept 2024 at 03:06, Albert Esteve wrote: > On Thu, Sep 5, 2024 at 6:39 PM Stefan Hajnoczi wrote: >> >> On Tue, Sep 03, 2024 at 10:42:34AM +0200, Albert Esteve wrote: >> > Hello all, >> > >> > Sorry, I have been a bit disconnected from this thread as I was on >> > vacations and then had

Re: [PATCH 3/3] tests/unit: Comment FIFO8 tests

2024-09-06 Thread Philippe Mathieu-Daudé
On 6/9/24 15:12, Philippe Mathieu-Daudé wrote: Add comments describing how the FIFO evolves during each test. Signed-off-by: Philippe Mathieu-Daudé --- tests/unit/test-fifo.c | 190 - 1 file changed, 188 insertions(+), 2 deletions(-) @@ -65,23 +100

[PATCH 0/3] tmp105: Improvements and fixes

2024-09-06 Thread Guenter Roeck
Fix coding style issues as well as a couple of implementation bugs. Guenter Roeck (3): tmp105: Coding style fixes tmp105: OS (one-shot) bit in configuration register always returns 0 tmp105: Lower 4 bit of limit reg

[PATCH v2 0/3] tests/unit: Slightly expand FIFO8 tests

2024-09-06 Thread Philippe Mathieu-Daudé
Since v1: - Correctly place patch hunks in corresponding patch Mostly add documentation while reviewing them. Based-on: <20240828122258.928947-1-mark.cave-ayl...@ilande.co.uk> Philippe Mathieu-Daudé (3): tests/unit: Strengthen FIFO8 tests tests/unit: Expand test_fifo8_peek_buf_wrap() coverag

[PATCH 2/3] tmp105: OS (one-shot) bit in configuration register always returns 0

2024-09-06 Thread Guenter Roeck
Per datasheet, "ONE-SHOT (OS)", the OS bit always returns 0 when reading the configuration register. Signed-off-by: Guenter Roeck --- hw/sensor/tmp105.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/sensor/tmp105.c b/hw/sensor/tmp105.c index 77fbf2f8d3..22728798f7 100644

[PATCH v2 1/3] tests/unit: Strengthen FIFO8 tests

2024-09-06 Thread Philippe Mathieu-Daudé
Replace reused bytes { 0x1, 0x2, 0x3, 0x4 } by { 0x9, 0xa, 0xb, 0xc } to be sure a different value is overwritten. Signed-off-by: Philippe Mathieu-Daudé --- tests/unit/test-fifo.c | 12 ++-- 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/tests/unit/test-fifo.c b/tests/unit

[PATCH v2 3/3] tests/unit: Comment FIFO8 tests

2024-09-06 Thread Philippe Mathieu-Daudé
Add comments describing how the FIFO evolves during each test. Signed-off-by: Philippe Mathieu-Daudé --- tests/unit/test-fifo.c | 188 - 1 file changed, 187 insertions(+), 1 deletion(-) diff --git a/tests/unit/test-fifo.c b/tests/unit/test-fifo.c index fa

[PATCH 1/3] tmp105: Coding style fixes

2024-09-06 Thread Guenter Roeck
Coding style asks for no space between variable and "++". The next patch in this series will change one of those assignments. Instead of changing just one with that patch, change all of them for consistency. While at it, also fix other coding style problems reported by checkpatch. Signed-off-by:

[PATCH 3/3] tmp105: Lower 4 bit of limit registers are always 0

2024-09-06 Thread Guenter Roeck
Per datasheet, "HIGH AND LOW LIMIT REGISTERS", the lower 4 bit of the limit registers are unused and always report 0. The lower 4 bit should not be used for temperature comparisons, so mask the unused bits before storing the limits. Signed-off-by: Guenter Roeck --- hw/sensor/tmp105.c | 2 +- 1 f

[PATCH v2 2/3] tests/unit: Expand test_fifo8_peek_buf_wrap() coverage

2024-09-06 Thread Philippe Mathieu-Daudé
Test fifo8_peek_buf() can fill a buffer with wrapped data. Signed-off-by: Philippe Mathieu-Daudé --- tests/unit/test-fifo.c | 9 - 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/tests/unit/test-fifo.c b/tests/unit/test-fifo.c index 9b3a4940d0..fada526b6c 100644 --- a/tests/

Re: [PATCH 1/3] tests/unit: Strengthen FIFO8 tests

2024-09-06 Thread Philippe Mathieu-Daudé
On 6/9/24 15:12, Philippe Mathieu-Daudé wrote: Replace reused bytes { 0x1, 0x2, 0x3, 0x4 } by { 0x9, 0xa, 0xb, 0xc } to be sure a different value is overwritten. Signed-off-by: Philippe Mathieu-Daudé --- tests/unit/test-fifo.c | 12 ++-- 1 file changed, 6 insertions(+), 6 deletions(-

Re: [PATCH v3 3/4] tests/guest-debug: Support passing arguments to the GDB test script

2024-09-06 Thread Alex Bennée
Gustavo Romero writes: > This commit adds support for passing arguments to the GDB test scripts > so it's possible to parse the args in an "argparse way" in the test > scripts launched by the runner. The arguments should be preceded by -- > when passed to the runner. For example, passing "--help"

Re: [PATCH v6 3/8] crypto: Introduce x509 utils

2024-09-06 Thread Daniel P . Berrangé
On Fri, Sep 06, 2024 at 01:57:30AM +0600, Dorjoy Chowdhury wrote: > An utility function for getting fingerprint from X.509 certificate > has been introduced. Implementation only provided using gnutls. > > Signed-off-by: Dorjoy Chowdhury > --- > crypto/meson.build | 4 ++ > crypto/x509-

Re: [PATCH v6 0/8] AWS Nitro Enclave emulation support

2024-09-06 Thread Daniel P . Berrangé
On Fri, Sep 06, 2024 at 01:57:27AM +0600, Dorjoy Chowdhury wrote: > This is v6 submission for AWS Nitro Enclave emulation in QEMU. From the QEMU > side > the implementation for nitro enclaves is complete. v5 is at: > https://lists.gnu.org/archive/html/qemu-devel/2024-08/msg03251.html snip. Since

Re: [PATCH v6 3/8] crypto: Introduce x509 utils

2024-09-06 Thread Dorjoy Chowdhury
On Fri, Sep 6, 2024 at 7:50 PM Daniel P. Berrangé wrote: > > On Fri, Sep 06, 2024 at 01:57:30AM +0600, Dorjoy Chowdhury wrote: > > An utility function for getting fingerprint from X.509 certificate > > has been introduced. Implementation only provided using gnutls. > > > > Signed-off-by: Dorjoy Ch

[PATCH] gitlab: fix logic for changing docker tag on stable branches

2024-09-06 Thread Daniel P . Berrangé
This fixes: commit e28112d00703abd136e2411d23931f4f891c9244 Author: Daniel P. Berrangé Date: Thu Jun 8 17:40:16 2023 +0100 gitlab: stable staging branches publish containers in a separate tag Due to a copy+paste mistake, that commit included "QEMU_JOB_SKIPPED" in the final rule that

Re: [PATCH v2 0/4] i386/cpu: Add support for perfmon-v2, RAS bits and EPYC-Turin CPU model

2024-09-06 Thread Moger, Babu
Working v3 to add few more bits. Will post it sometime next week. On 8/7/2024 5:15 PM, Babu Moger wrote: This series adds the support for following features in qemu. 1. RAS feature bits (SUCCOR, McaOverflowRecov) 2. perfmon-v2 3. Update EPYC-Genoa to support perfmon-v2 and RAS bits 4. Add suppo

Re: [PULL 00/25] target-arm queue

2024-09-06 Thread Peter Maydell
On Thu, 5 Sept 2024 at 14:01, Peter Maydell wrote: > > First target-arm queue for 9.2. I know I have more stuff in > my to-review queue after this... > > -- PMM > > The following changes since commit cab1afb393ea0943b3086188e91d71d594ede6bf: > > Merge tag 'hppa-v9.1-fixes-pull-request' of > htt

Re: [PATCH 0/2] tests/qtest: Fix problems running with make vm-build-openbsd

2024-09-06 Thread Peter Maydell
On Thu, 5 Sept 2024 at 17:55, Peter Maydell wrote: > > I noticed that 'make vm-build-openbsd' had bitrotted a bit: > * two tests for the stm32l4x5 forgot a qtest_quit(), which meant >they would pass all their subtests but then timeout because the >underlying QEMU process never exited > *

Re: [PATCH] hw/loongarch: virt: support up to 4 serial ports

2024-09-06 Thread Jason A. Donenfeld
On Fri, Sep 06, 2024 at 04:34:53PM +0800, maobibo wrote: > > +for (i = 0; i < VIRT_UART_COUNT; ++i) { > How about adding serial_hd(i) checking here, such as >for (i = 0; (i < VIRT_UART_COUNT) && serial_hd(i); ++i) { That doesn't seem to do anything, unfortunately. > > > +hwaddr b

[PATCH v2] hw/loongarch: virt: support up to 4 serial ports

2024-09-06 Thread Jason A. Donenfeld
In order to support additional channels of communication using `-serial`, add several serial ports, up to the standard 4 generally supported by the 8250 driver. Signed-off-by: Jason A. Donenfeld --- As I don't use ACPI, I haven't tested the ACPI part of this, which Maobibo wrote. hw/loongarch/a

[PATCH v4 0/5] gdbstub: Add support for MTE in system mode

2024-09-06 Thread Gustavo Romero
This patchset makes handle_q_memtag, handle_q_isaddresstagged, and handle_Q_memtag stubs build for system mode, allowing all GDB 'memory-tag' subcommands to work with QEMU gdbstub on aarch64 system mode, resolving: https://gitlab.com/qemu-project/qemu/-/issues/620 For running the tests, a GDB tha

[PATCH v4 3/5] tests/guest-debug: Support passing arguments to the GDB test script

2024-09-06 Thread Gustavo Romero
This commit adds support for passing arguments to the GDB test scripts so it's possible to parse the args in an "argparse way" in the test scripts launched by the runner. The arguments should be preceded by -- when passed to the runner. For example, passing "--help" arg to the GDB_TEST_SCRIPT: run

[PATCH v4 2/5] gdbstub: Add support for MTE in system mode

2024-09-06 Thread Gustavo Romero
This commit makes handle_q_memtag, handle_q_isaddresstagged, and handle_Q_memtag stubs build for system mode, allowing all GDB 'memory-tag' subcommands to work with QEMU gdbstub on aarch64 system mode. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/620 Signed-off-by: Gustavo Romero Revie

[PATCH v4 5/5] tests/tcg/aarch64: Extend MTE gdbstub tests to system mode

2024-09-06 Thread Gustavo Romero
Extend MTE gdbstub tests to also run in system mode (share tests between user mode and system mode). The tests will only run if a version of GDB that supports MTE on baremetal is available in the test environment and if available compiler supports the 'memtag' flag (-march=armv8.5-a+memtag). For t

[PATCH v4 1/5] gdbstub: Use specific MMU index when probing MTE addresses

2024-09-06 Thread Gustavo Romero
Use cpu_mmu_index() to determine the specific translation regime (MMU index) before probing addresses using allocation_tag_mem_probe(). Currently, the MMU index is hardcoded to 0 and only works for user mode. By obtaining the specific MMU index according to the translation regime, future use of th

[PATCH v4 4/5] tests/tcg/aarch64: Improve linker script organization

2024-09-06 Thread Gustavo Romero
Improve kernel.ld linker script organization by using MEMORY command. Signed-off-by: Richard Henderson Signed-off-by: Gustavo Romero --- tests/tcg/aarch64/system/kernel.ld | 24 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/tests/tcg/aarch64/system/ker

Re: [PATCH v2 0/7] hw/net/can/xlnx-versal-canfd: Miscellaneous fixes

2024-09-06 Thread Peter Maydell
On Tue, 27 Aug 2024 at 04:51, Doug Brown wrote: > > This series fixes several problems I ran into while trying to simulate > the AMD/Xilinx Versal CANFD controller in the xlnx-versal-virt machine > using Xilinx's v6.6_LTS_2024.1 kernel. With all of these patches > applied, everything works correct

<    1   2   3   4   >