Update QEMU to v9.2.2 #110
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…taging Misc HW fixes # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmc7NwwACgkQ4+MsLN6t # wN7zBA//VTiAcjB1KYovOiHQWdhtyE7JU+ZOCzULK2aDoKCP9wZM5yZVQgKbDFX/ # +bI2yjzTfZAWknxnqdShQMxvJE3PkD25mm8D2bP22/U9agKSrX4ll9pGt1NMIHUR # Hy01gxoLYp0r/Vs0aDWVQGSU4v62hKjTNOFn30Gqg+Xu9W4glEPSwI5GicypxpWZ # nNAl88whHZ6qouadNCSt0JghwWplw6ZkV3LU4dAUhhhRh+vkPoA3NiCCr4cNqNjJ # yeGc6lLGf2M9GMpX3t2XEV6lXkBTdhUtdv0inZTzH8W2dYt/SL3n/nSKdddXU+fl # F5cfUV8vhFTxeGOTodbwjv3GHxk4BAjKXhoHCPikkCC+tdzgCoAn+ie9Q0iSp28A # kpXt099ByFpkCQ+4fu2+XjX6deC8mxKBKrqjNNEZDqhwuOuiG5Kw8lAzueQErmcZ # djPm6HqnMQFvs4kAp3VMWiqMgkpjJqwB7dfffJfLcXr3+2WF8Ts181/y9LqnkGqn # rlEjy57/dzbzTdt547j8GtKCbXmYOxUgd2a3k2sKCGBsCITtIpTjz2YsrafV84iD # gij8M1IHvt41TNhikvWNKGxJ/5ZY2cx5G/QRbRFVYdFAR14xM45Q/XYuziQgt4if # 6/g7WibP9d8Sqb5Mlj4HLqpPghY0AZ+aaIAHVCDCVYsLpbw7Ixk= # =zdCl # -----END PGP SIGNATURE----- # gpg: Signature made Mon 18 Nov 2024 12:46:04 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'hw-misc-20241118' of https://github.com/philmd/qemu: hw/watchdog/cmsdk_apb_watchdog: Fix broken link net: mark struct ip_header as QEMU_PACKED hw/net/virtio-net.c: Don't assume IP length field is aligned hw/audio/hda: fix memory leak on audio setup Revert "hw/audio/hda: fix memory leak on audio setup" hw/misc/mos6522: Fix bad class definition of the MOS6522 device hw/sd/sdhci: Fix coding style tests/qtest/migration: Fix indentations usb-hub: Fix handling port power control messages MAINTAINERS: Update my email address for COLO hw/display: check frame buffer can hold blob hw/display: factor out the scanout blob to fb conversion hw/i386/elfboot: allocate "header" in heap hw/misc/nrf51_rng: Don't use BIT_MASK() when we mean BIT() vl: fix qemu_validate_options() indention Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/i386: fix compilation without CONFIG_HYPERV * configure: improve check for execution in the source directory # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmc7NvAUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroMOSQf/QXfSlvWBpu2OR6EIBVEDWnCUWyK8 # /88A/sWHCcWiD666NX7pKU5c7zzzC5x5e/ajzYriF2rNcwYhjX/MmsaQstfoWULM # dxtLpvhWxNyfoEPIHYwAXB4/VPpm8LbIfby6kXdKZR3PQcA223qdx3ZmoTB1PI2a # yVMkfW/+QEss9ZBzu+kUHk7BYWJ/o6o7jv6HZVtfxFV7xg17sJX/QgOZi2xmAXBj # Z2w/97h1IWwzNpnOqc+vkDzWgqjHI+o9HWK2fQDKgpUE8vW8kJ5SgoQ/wd2BHBu7 # xGwVXw/Yoz4D/+yPZOewxhX7Ep1PBxtwCXpx4Gx7dc1Su1OBPnn5chND4w== # =bsiH # -----END PGP SIGNATURE----- # gpg: Signature made Mon 18 Nov 2024 12:45:36 GMT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: configure: Use -ef to compare paths target/i386: hyperv: add stub for hyperv_syndbg_query_options Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
While testing the use of qemu-nbd in a Pod of a Kubernetes cluster, I got LOTS of log messages of the forms: qemu-nbd: option negotiation failed: Failed to read flags: Unexpected end-of-file before all data were read qemu-nbd: option negotiation failed: Failed to read flags: Unable to read from socket: Connection reset by peer While it is nice to warn about clients that aren't following protocol (in case it helps diagnosing bugs in those clients), a mere port probe (where the client never write()s any bytes, and where we might even hit EPIPE in trying to send our greeting to the client) is NOT abnormal, but merely serves to pollute the log. And Kubernetes _really_ likes to do port probes to determine whether a given Pod is up and running. Easy ways to demonstrate the above port probes: $ qemu-nbd -r -f raw path/to/file & $ nc localhost 10809 </dev/null $ bash -c 'exec </dev/tcp/localhost/10809' $ kill $! Silence the noise by not capturing errors until after our first successful read() from a client. Signed-off-by: Eric Blake <eblake@redhat.com> Message-ID: <20241115195638.1132007-2-eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
GDB 15 does not like exit() anymore:
(gdb) python exit(0)
Python Exception <class 'SystemExit'>: 0
Error occurred in Python: 0
Use the GDB's own exit command, like it's already done in a couple
places, everywhere. This is the same fix as commit 93a3048
("tests: Gently exit from GDB when tests complete"), but applied to
more places.
Acked-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20241022113939.19989-1-iii@linux.ibm.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
As of Nov 2024 [1], we have a new topical mailing list for Rust related patches. Add a new MAINTAINERS entry to touch all files under rust/ subdirectory and additionally add it to previous rust related entries. [1] https://lore.kernel.org/qemu-devel/CAFEAcA-ZQuyGTtG-vhRTEwpz0L4cpimNxkKix45Yw6gVHXozRQ@mail.gmail.com Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Message-Id: <20241109-update-maintainers-file-rust-v1-1-f4daba6f782f@linaro.org> [AJB: tweak commit msg] Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
There are two identical sequences of a code doing the same thing that raise warnings with Coverity. Before fixing those issues lets factor out the common code into a helper function we can share. Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Tested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20241111230040.68470-2-alex.bennee@linaro.org>
Coverity reports (CID 1564769, 1564770) that we potentially overflow by doing some 32x32 multiplies for something that ends up in a 64 bit value. Fix this by first using stride for all lines and casting input to uint64_t to ensure a 64 bit multiply is used. Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Tested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20241111230040.68470-3-alex.bennee@linaro.org>
While adding the new flexible boot order feature on s390x recently, we missed to add the "loadparm" property to the scsi-hd and scsi-cd devices. This property is required on s390x to pass the information to the boot loader about which kernel should be started or whether the boot menu should be shown. But even more serious: The missing property is now causing trouble with the corresponding libvirt patches that assume that the "loadparm" property is either settable for all bootable devices (when the "boot order" feature is implemented in QEMU), or none (meaning the behaviour of older QEMUs that only allowed one "loadparm" at the machine level). To fix this broken situation, let's implement the "loadparm" property in for the SCSI devices, too. Message-ID: <20241115141202.1877294-1-thuth@redhat.com> Acked-by: Eric Farman <farman@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Clear information about cdrom type so that current IPL device isn't tainted by stale data from previous devices. Signed-off-by: Jared Rossi <jrossi@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20241108194136.2833932-1-jrossi@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Commit bb185de ("s390x: Add individual loadparm assignment to CCW device") allowed boot devices to be assigned a loadparm value independent of the machine value, however, when no boot devices are defined, the machine loadparm becomes ignored. Therefore, let's check the machine loadparm prior to probing the devices. Signed-off-by: Jared Rossi <jrossi@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20241114161952.3508554-1-jrossi@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
…attempt Now that we can boot from multiple boot devices, we have to make sure to reinitialize static variables like rx_last_idx to avoid that they contain garbage data during the second boot attempt (which can lead to crashes when the code tries to access the wrong ring data). Message-ID: <20241111131120.317796-1-thuth@redhat.com> Reviewed-by: Jared Rossi <jrossi@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Add the fixes from the previous three commits to the binary, too. Signed-off-by: Thomas Huth <thuth@redhat.com>
The current 30 minute timeout on the cross_accel_build_job template is a bit low: sometimes if the k8s runners are running slow the can hit it, for example this cross-arm64-xen-only job hit the 30 minute timeout while still not quite finished with the compile: https://gitlab.com/qemu-project/qemu/-/jobs/8401277985 This is partly a "runner performance can be unpredictable" issue: https://gitlab.com/qemu-project/qemu/-/jobs/8391726482 is the same job from just a day earlier and it finished in 16 minutes. But we already have build jobs that are higher timeouts than 30 minutes, so we have headroom to raise the timeout here to something we're less likely to hit on a slow runner. Bump the cross_accel_build_job timeout to 60 mins. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-ID: <20241118153226.1524542-1-peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
…into staging * Fixes & doc updates for the new "boot order" s390x bios feature * Provide a "loadparm" property for scsi-hd & scsi-cd devices on s390x (required for the "boot order" feature) * Fix the floating-point multiply-and-add NaN rules on s390x * Raise timeout on cross-accel build jobs to 60m # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmc7ercRHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbVjyg//ZuhSDCj+oBSU6vwM7Lwh3CS6GwZvGECU # h60V3tizKypiRNtTJRXHoWcx95brXmoZgI+QQhDEXe3fFLkOEKT6AIlDhrKZRUsd # rpLPr6O8TVKO+rSE7JVJAP3X1tpOOQDxnq83uWBv53b0S+Da0VwDRtI9gcugRMmh # d58P8Q1bV344fQdcrebejstpSUG7RxSA4Plj2uSQx4mSHT7cy/hN+vA34Ha7reE3 # tcN9yfQq3Rmfvt0MV5I9Umd6JXEoDlEAwjSNsWRsCzo69jBZwiMtXSH8LyLtwRTp # C919G/MIRuhvImF74dStLVCr82sNq54YR1NP6CGcmqPH76FOH8Mx3vmx9Cxj9ckA # 6NI6SvIg++bW2O1efG2apz8p5fjbDzYXSAbHnaWTcEu3gPgH4PQ5QXoyKaDymvWV # JIh5/gXEy+twEXgIBsdWQ44A9E06lL/tNfKnqGdXK4ZYF2JIrI+Lq7AKBee7tebP # +72I4PljHLSHQ3GxdkoOeJ8ahu70IBdSz2/VEIwOWK1wIf5C5WFNBerLJyDmkyx8 # xIvIm0vlRLwPcuOC711nlaMaKqTNT+8W4DIqIY6fHs2Jy0psMdgey1uHQxYEj9Kh # fg7CvalK8n3MkGAwTqAvRJIwMFe0a4Ss6c6CaemSaYa38ud/pCNnv+IT+Eqr+mjq # 6y5PZWNrZi0= # =UaDH # -----END PGP SIGNATURE----- # gpg: Signature made Mon 18 Nov 2024 17:34:47 GMT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2024-11-18' of https://gitlab.com/thuth/qemu: .gitlab-ci.d: Raise timeout on cross-accel build jobs to 60m pc-bios: Update the s390 bios images with the recent fixes pc-bios/s390-ccw: Re-initialize receive queue index before each boot attempt pc-bios/s390x: Initialize machine loadparm before probing IPL devices pc-bios/s390x: Initialize cdrom type to false for each IPL device hw: Add "loadparm" property to scsi disk devices for booting on s390x hw/s390x: Restrict "loadparm" property to devices that can be used for booting docs/system/bootindex: Make it clear that s390x can also boot from virtio-net docs/system/s390x/bootdevices: Update loadparm documentation tests/tcg/s390x: Add the floating-point multiply-and-add test target/s390x: Fix the floating-point multiply-and-add NaN rules hw/usb: Use __attribute__((packed)) vs __packed Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
… staging NBD patches for 2024-11-18 - Eric Blake: Silence qemu-nbd on harmless client port probes # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCAAdFiEEccLMIrHEYCkn0vOqp6FrSiUnQ2oFAmc7lg0ACgkQp6FrSiUn # Q2qamgf/QJXHzF5koncXvpOC58QXthe1EQlTNqTv9lSz7GNif7UXtkv9RBMMqNEP # 7MDY2L9LzlvMdTqXx6dndQot2YG+PSpqLFQxdjf7J3YUK5N6dQ/w4lCVI+tfVfYF # DcYva7TBTfSWMByVdqYhnXc1nAn6liJfaaONf80y3wHObUu8T7qkMY/cb5njpjmT # YPKyIJO7DX+ZNY5EZkFGntAxPge368nIrBsViYqst8kNWjtr8o2Rzc7fqa6sbBtw # 47tiBDP6usBJb2kapOrpmC5zqHlbb56AbrIsTJ4Ge/iUOKrODtmCC4d7WWGSM3DC # udaL74DOMgoMfVGjjaX9KW6Wv3/HFw== # =DnNy # -----END PGP SIGNATURE----- # gpg: Signature made Mon 18 Nov 2024 19:31:25 GMT # gpg: using RSA key 71C2CC22B1C4602927D2F3AAA7A16B4A2527436A # gpg: Good signature from "Eric Blake <eblake@redhat.com>" [full] # gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" [full] # gpg: aka "[jpeg image of size 6874]" [full] # Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A * tag 'pull-nbd-2024-11-18' of https://repo.or.cz/qemu/ericb: nbd-server: Silence server warnings on port probes Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
…d/qemu into staging Misc fixes for 9.2 - fix remaining gdbstub test cases to exit cleanly - update MAINTAINERS with qemu-rust mailing list details - re-factor virtio-gpu and fix coverity warnings # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEEZoWumedRZ7yvyN81+9DbCVqeKkQFAmc7aQwACgkQ+9DbCVqe # KkQufwf/XN5dcHxddhUHCLQUNA/5STiO5P10vHOGpknqwT/ZKADAbY8gQsoJovSp # qxczZPFpHlnGkf+AV3wrj2IcFUWlvlhgTw5njsMTOSSjK0jtI2MZrNn2v+6hmelg # y8ACB+LHkj34Ood9y5H6augCiKsMC7ad2mpXEMQgcZzpp4KlAutu8nbsYpYlAF40 # 1d2Wdtkrt++jPHQGgp0pPqAxq5WyvR3uSdidUFGfmpAqkCRs0ExosqEgj/ODzdHF # WrvLy9ISdCjZk+5XOxfadmz1vJ31QcZ6pcmkZRXJAJR4p7EST5BTfS10IBNIipgs # C25TuT+IH9+It0n/Sohf3NlxTnbTDw== # =TYAI # -----END PGP SIGNATURE----- # gpg: Signature made Mon 18 Nov 2024 16:19:24 GMT # gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44 # gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [full] # Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44 * tag 'pull-9.2-rc-updates-181124-1' of https://gitlab.com/stsquad/qemu: hw/display: check frame buffer can hold blob hw/display: factor out the scanout blob to fb conversion MAINTAINERS: CC rust/ patches to qemu-rust list tests/tcg: Stop using exit() in the gdbstub testcases Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
The product "icnto * s->tcntb" may overflow uint32_t. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Frolov <frolov@swemel.ru> Message-id: 20241106083801.219578-2-frolov@swemel.ru Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
of_dpa_cmd_add_acl_ip() is called from a single place, and despite the fact that it always returns ROCKER_OK, its return value is still checked by the caller. Change of_dpa_cmd_add_acl_ip() to return void and remove the superfluous check from of_dpa_cmd_add_acl(). Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2471 Signed-off-by: Rodrigo Dias Correa <r@drigo.nl> Reviewed-by: Ján Tomko <jtomko@redhat.com> Message-id: 20241114075051.404284-1-r@drigo.nl Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
The clang sanitizer complains about the code in the EOI handling of openpic_cpu_write_internal(): UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1 ./build/clang/qemu-system-ppc -M mac99,graphics=off -display none -kernel day15/invaders.elf ../../hw/intc/openpic.c:1034:16: runtime error: index -1 out of bounds for type 'IRQSource[264]' (aka 'struct IRQSource[264]') SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../hw/intc/openpic.c:1034:16 in This is because we do src = &opp->src[n_IRQ]; when n_IRQ may be -1. This is in practice harmless because if n_IRQ is -1 then we don't do anything with the src pointer, but it is undefined behaviour. (This has been present since this device was first added to QEMU.) Rearrange the code so we only do the array index when n_IRQ is not -1. Cc: qemu-stable@nongnu.org Fixes: e9df014 ("Implement embedded IRQ controller for PowerPC 6xx/740 & 75") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-id: 20241105180205.3074071-1-peter.maydell@linaro.org
Current watchdog is free running out of reset, this combined with the fact that current implementation also ensures the counter is running when programing WDOGLOAD creates issues when the firmware defer the programing of WDOGCONTROL.INTEN much later after WDOGLOAD. Arm Programmer's Model documentation states that INTEN is also the counter enable: > INTEN > > Enable the interrupt event, WDOGINT. Set HIGH to enable the counter > and the interrupt, or LOW to disable the counter and interrupt. > Reloads the counter from the value in WDOGLOAD when the interrupt > is enabled, after previously being disabled. Source of the time of writing: https://developer.arm.com/documentation/ddi0479/d/apb-components/apb-watchdog/programmers-model Signed-off-by: Roque Arcudia Hernandez <roqueh@google.com> Reviewed-by: Stephen Longfield <slongfield@google.com> Reviewed-by: Joe Komlodi <komlodi@google.com> Message-id: 20241115160328.1650269-3-roqueh@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Currently the CMSDK APB watchdog tests target an specialized version of the device (luminaris using the lm3s811evb machine) that prevents the development of tests for the more generic device documented in: https://developer.arm.com/documentation/ddi0479/d/apb-components/apb-watchdog/programmers-model This patch allows the execution of the watchdog tests in an MPS2 machine (when applicable) which uses the generic version of the CMSDK APB watchdog. Finally the rules for compiling the test have to change because it is possible not to have CONFIG_STELLARIS (required for the lm3s811evb machine) while still having CONFIG_CMSDK_APB_WATCHDOG and the test will fail. Due to the addition of the MPS2 machine CONFIG_MPS2 becomes also a dependency for the test compilation. Signed-off-by: Roque Arcudia Hernandez <roqueh@google.com> Reviewed-by: Stephen Longfield <slongfield@google.com> Message-id: 20241115160328.1650269-4-roqueh@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Currently the watchdog test has a behavior in which the first test assertion that fails will make the test abort making it impossible to see the result of other tests: # ERROR:../tests/qtest/cmsdk-apb-watchdog-test.c:87:test_watchdog: assertion failed ... Bail out! Aborted Changing the behavior in order to let the test finish other tests and report the ones that pass and fail: # ERROR:../tests/qtest/cmsdk-apb-watchdog-test.c:101:test_watchdog: assertion failed ... not ok 1 /arm/cmsdk-apb-watchdog/watchdog Signed-off-by: Roque Arcudia Hernandez <roqueh@google.com> Message-id: 20241115160328.1650269-5-roqueh@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
The following tests focus on making sure the counter is not running out of reset and the proper use of INTEN as the counter enable. As described in: https://developer.arm.com/documentation/ddi0479/d/apb-components/apb-watchdog/programmers-model The new tests have to target an MPS2 machine because the original machine used by the test (stellaris) has a variation of the cmsdk_apb_watchdog that locks INTEN when it is programmed to 1. The stellaris machine also does not reproduce the problem of the counter running out of cold reset due to the way the clocks are initialized. Signed-off-by: Roque Arcudia Hernandez <roqueh@google.com> Reviewed-by: Stephen Longfield <slongfield@google.com> Message-id: 20241115160328.1650269-6-roqueh@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
AP in armv7 short descriptor mode has 3 bits and also domain, which makes it incompatible with other arm schemas. To make it possible to share get_S1prot between armv8, armv7 long format, armv7 short format and armv6 it's easier to make caller decode AP. Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Message-id: 20241118152526.45185-1-paskripkin@gmail.com [PMM: fixed checkpatch nit] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Currently the handling of page protection in the short-format
descriptor is open-coded. This means that we forgot to update
it to handle some newer architectural features, including:
* handling of SCTLR.{UWXN,WXN}
* handling of SCR.SIF
Make the short-format descriptor code call the same get_S1prot()
that we already use for the LPAE descriptor format. This makes
the code simpler and means it now correctly honours the WXN/UWXN
and SIF bits.
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Message-id: 20241118152537.45277-1-paskripkin@gmail.com
[PMM: fixed a couple of checkpatch nits, tweaked commit message]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Currently bitops.h defines a set of operations that work on arbitrary-length bit arrays. However (largely because they originally came from the Linux kernel) the bit array storage is an array of 'unsigned long'. This is OK for the kernel and even for parts of QEMU where we don't really care about the underlying storage format, but it is not good for devices, where we often want to expose the storage to the guest and so need a type that is not variably-sized between host OSes. We already have a workaround for this in the GICv3 model: arm_gicv3_common.h defines equivalents of the bit operations that work on uint32_t. It turns out that we should also be using something similar in hw/intc/loongarch_extioi.c, which currently casts a pointer to a uint32_t array to 'unsigned long *' in extio_setirq(), which is both undefined behaviour and not correct on a big-endian host. Define equivalents of the set_bit() function family which work with a uint32_t array. (Cc stable because we're about to provide a bugfix to loongarch_extioi which will depend on this commit.) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20241108135514.4006953-2-peter.maydell@linaro.org
Now we have official uint32_t bit array functions in bitops.h, use them instead of the hand-rolled local versions. We retain gic_bmp_replace_bit() because bitops doesn't provide that specific functionality. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20241108135514.4006953-3-peter.maydell@linaro.org
In extioi_setirq() we try to operate on a bit array stored as an
array of uint32_t using the set_bit() and clear_bit() functions
by casting the pointer to 'unsigned long *'.
This has two problems:
* the alignment of 'uint32_t' is less than that of 'unsigned long'
so we pass an insufficiently aligned pointer, which is
undefined behaviour
* on big-endian hosts the 64-bit 'unsigned long' will have
its two halves the wrong way around, and we will produce
incorrect results
The undefined behaviour is shown by the clang undefined-behaviour
sanitizer when running the loongarch64-virt functional test:
/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/include/qemu/bitops.h:41:5: runtime error: store to misaligned address 0x555559745d9c for type 'unsigned long', which requires 8 byte alignment
0x555559745d9c: note: pointer points here
ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
#0 0x555556fb81c4 in set_bit /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/include/qemu/bitops.h:41:9
#1 0x555556fb81c4 in extioi_setirq /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/clang/../../hw/intc/loongarch_extioi.c:65:9
#2 0x555556fb6e90 in pch_pic_irq_handler /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/clang/../../hw/intc/loongarch_pch_pic.c:75:5
#3 0x555556710265 in serial_ioport_write /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/clang/../../hw/char/serial.c
Fix these problems by using set_bit32() and clear_bit32(),
which work with bit arrays stored as an array of uint32_t.
Cc: qemu-stable@nongnu.org
Fixes: cbff2db ("hw/intc: Add LoongArch extioi interrupt controller(EIOINTC)")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-id: 20241108135514.4006953-4-peter.maydell@linaro.org
The dma-helpers.c file is in the system/ subdirectory, but it defines its trace events in the root trace-events file. Move them to the system/trace-events file where they more naturally belong. Fixes: 800d4de ("softmmu: move more files to softmmu/") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20241108162909.4080314-2-peter.maydell@linaro.org
The documentation for trace events says that every subdirectory which has trace events should have a trace.h header, whose only content is an include of the trace/trace-<subdir>.h file. When we added the trace events in target/arm/hvf/ we forgot to create this file and instead hvf.c directly includes trace/trace-target_arm_hvf.h. Create the standard trace.h file to bring this into line with the convention. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20241108162909.4080314-3-peter.maydell@linaro.org
The QEMU source archive is including the sources downloaded from crates.io
in both tarball form (in subprojects/packagecache) and expanded/patched
form (in the subprojects directory). The former is the more authoritative
form, as it has a hash that can be verified in the wrap file and checked
against the download URL, so keep that one only. This works also with
--disable-download; when building QEMU for the first time from the
tarball, Meson will print something like
Using proc-macro2-1-rs source from cache.
for each subproject, and then go on to extract the tarball and apply the
overlay or the patches in subprojects/packagefiles.
Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2719
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit be27b51)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
In x86_cpu_filter_features(), if host doesn't support AVX10, the configured avx10_version should be marked as filtered regardless of whether prefix is NULL or not. Check prefix before warn_report() instead of checking for have_filtered_features. Cc: qemu-stable@nongnu.org Fixes: commit bccfb84 ("target/i386: add AVX10 feature and AVX10 version property") Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Tao Su <tao1.su@linux.intel.com> Link: https://lore.kernel.org/r/20241106030728.553238-2-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit cf4c263) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
We're seeing periodic reports of errors like:
$ qemu-img create -f luks --object secret,data=123456,id=sec0 \
-o key-secret=sec0 luks-info.img 1M
Formatting 'luks-info.img', fmt=luks size=1048576 key-secret=sec0
qemu-img: luks-info.img: Unable to get accurate CPU usage
This error message comes from a recent attempt to workaround a
kernel bug with measuring rusage in long running processes:
commit c72cab5
Author: Tiago Pasqualini <tiago.pasqualini@canonical.com>
Date: Wed Sep 4 20:52:30 2024 -0300
crypto: run qcrypto_pbkdf2_count_iters in a new thread
Unfortunately this has a subtle bug on machines which are very fast.
On the first time around the loop, the 'iterations' value is quite
small (1 << 15), and so will run quite fast. Testing has shown that
some machines can complete this benchmarking task in as little as
7 milliseconds.
Unfortunately the 'getrusage' data is not updated at the time of
the 'getrusage' call, it is done asynchronously by the scheduler.
The 7 millisecond completion time for the benchmark is short
enough that 'getrusage' sometimes reports 0 accumulated execution
time.
As a result the 'delay_ms == 0' sanity check in the above commit
is triggering non-deterministically on such machines.
The benchmarking loop intended to run multiple times, increasing
the 'iterations' value until the benchmark ran for > 500 ms, but
the sanity check doesn't allow this to happen.
To fix it, we keep a loop counter and only run the sanity check
after we've been around the loop more than 5 times. At that point
the 'iterations' value is high enough that even with infrequent
updates of 'getrusage' accounting data on fast machines, we should
see a non-zero value.
Fixes: https://lore.kernel.org/qemu-devel/ffe542bb-310c-4616-b0ca-13182f849fd1@redhat.com/
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2336437
Reported-by: Thomas Huth <thuth@redhat.com>
Reported-by: Richard W.M. Jones <rjones@redhat.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250109093746.1216300-1-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 145f12e)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
…tools Configuring "--enable-user --disable-system --enable-tools" causes the build failure with the following information: /usr/bin/ld: libhwcore.a.p/hw_core_qdev.c.o: in function `device_finalize': /qemu/build/../hw/core/qdev.c:688: undefined reference to `qapi_event_send_device_deleted' collect2: error: ld returned 1 exit status To fix the above issue, add qdev.c stub when build with `have_tools`. With this fix, QEMU could be successfully built in the following cases: --enable-user --disable-system --enable-tools --enable-user --disable-system --disable-tools --enable-user --disable-system Cc: qemu-stable@nongnu.org Fixes: 388b849 ("stubs: avoid duplicate symbols in libqemuutil.a") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2766 Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20250121154318.214680-1-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 8113dbb) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
The pseudocode ResetSVEState() does:
FPSR = ZeroExtend(0x0800009f<31:0>, 64);
but QEMU's arm_reset_sve_state() called vfp_set_fpcr() by accident.
Before the advent of FEAT_AFP, this was only setting a collection of
RES0 bits, which vfp_set_fpsr() would then ignore, so the only effect
was that we didn't actually set the FPSR the way we are supposed to
do. Once FEAT_AFP is implemented, setting the bottom bits of FPSR
will change the floating point behaviour.
Call vfp_set_fpsr(), as we ought to.
(Note for stable backports: commit 7f2a01e moved this function
from sme_helper.c to helper.c, but it had the same bug before the
move too.)
Cc: qemu-stable@nongnu.org
Fixes: f84734b ("target/arm: Implement SMSTART, SMSTOP")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-4-peter.maydell@linaro.org
(cherry picked from commit 1edc3d4)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
When USBPacket in OUT direction has larger payload than the ep_out_buffer (of size 512), a buffer overflow would occur. It could be fixed by limiting the size of usb_packet_copy to be at most buffer size. Further optimization gets rid of the ep_out_buffer and directly uses ep_out as the target buffer. This is reported by a security researcher who artificially constructed an OUT packet of size 2047. The report has gone through the QEMU security process, and as this device is for testing purpose and no deployment of it in virtualization environment is observed, it is triaged not to be a security bug. Cc: qemu-stable@nongnu.org Fixes: d7d3491 ("hw/usb: Add CanoKey Implementation") Reported-by: Juan Jose Lopez Jaimez <thatjiaozi@gmail.com> Signed-off-by: Hongren Zheng <i@zenithal.me> Message-id: Z4TfMOrZz6IQYl_h@Sun Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 664280a) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
qemu_ram_alloc_from_fd allocates space if file_size == 0. If non-zero, it uses the existing space and verifies it is large enough, but the verification was broken when the offset parameter was introduced. As a result, a file smaller than offset passes the verification and causes errors later. Fix that, and update the error message to include offset. Peter provides this concise reproducer: $ touch ramfile $ truncate -s 64M ramfile $ ./qemu-system-x86_64 -object memory-backend-file,mem-path=./ramfile,offset=128M,size=128M,id=mem1,prealloc=on qemu-system-x86_64: qemu_prealloc_mem: preallocating memory failed: Bad address With the fix, the error message is: qemu-system-x86_64: mem1 backing store size 0x4000000 is too small for 'size' option 0x8000000 plus 'offset' option 0x8000000 Cc: qemu-stable@nongnu.org Fixes: 4b870dc ("hostmem-file: add offset option") Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Reviewed-by: Peter Xu <peterx@redhat.com> Acked-by: David Hildenbrand <david@redhat.com> Link: https://lore.kernel.org/r/1736967650-129648-3-git-send-email-steven.sistare@oracle.com Signed-off-by: Fabiano Rosas <farosas@suse.de> (cherry picked from commit 719168f) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Node.js crashes in qemu-system-s390x with random SIGSEGVs / SIGILLs. The v8 JIT used by Node.js can garbage collect and overwrite unused code. Overwriting is performed by WritableJitAllocation::CopyCode(), which ultimately calls memcpy(). For certain sizes, memcpy() uses the MVC instruction. QEMU implements MVC and other similar instructions using helpers. While TCG store ops invalidate affected translation blocks automatically, helpers must do this manually by calling probe_access_flags(). The MVC helper does this using the access_prepare() -> access_prepare_nf() -> s390_probe_access() -> probe_access_flags() call chain. At the last step of this chain, the store size is replaced with 0. This causes the probe_access_flags() -> notdirty_write() -> tb_invalidate_phys_range_fast() chain to miss some translation blocks. When this happens, QEMU executes a mix of old and new code. This quickly leads to either a SIGSEGV or a SIGILL in case the old code ends in the middle of a new instruction. Fix by passing the true size. Reported-by: Berthold Gunreben <azouhr@opensuse.org> Cc: Sarah Kriesch <ada.lovelace@gmx.de> Cc: qemu-stable@nongnu.org Closes: https://bugzilla.opensuse.org/show_bug.cgi?id=1235709 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Fixes: e2faabe ("accel/tcg: Forward probe size on to notdirty_write") Message-ID: <20250128001338.11474-1-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com> (cherry picked from commit e43ced8) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
b9ad513 ("net: Remove receive_raw()") adds an iovec entry in qemu_deliver_packet_iov() to add the virtio-net header in the data when QEMU_NET_PACKET_FLAG_RAW is set but forgets to increase the number of iovec entries in the array, so receive_iov() will only send the first entry (the virtio-net entry, full of 0) and no data. The packet will be discarded. The only user of QEMU_NET_PACKET_FLAG_RAW is announce_self. We can see the problem with tcpdump: - QEMU parameters: .. -monitor stdio \ -netdev bridge,id=netdev0,br=virbr0 \ -device virtio-net,mac=9a:2b:2c:2d:2e:2f,netdev=netdev0 \ - HMP command: (qemu) announce_self - TCP dump: $ sudo tcpdump -nxi virbr0 without the fix: <nothing> with the fix: ARP, Reverse Request who-is 9a:2b:2c:2d:2e:2f tell 9a:2b:2c:2d:2e:2f, length 46 0x0000: 0001 0800 0604 0003 9a2b 2c2d 2e2f 0000 0x0010: 0000 9a2b 2c2d 2e2f 0000 0000 0000 0000 0x0020: 0000 0000 0000 0000 0000 0000 0000 Reported-by: Xiaohui Li <xiaohli@redhat.com> Bug: https://issues.redhat.com/browse/RHEL-73891 Fixes: b9ad513 ("net: Remove receive_raw()") Cc: akihiko.odaki@daynix.com Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 84dfdcb) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
When a packet is sent with QEMU_NET_PACKET_FLAG_RAW by QEMU it
never includes virtio-net header even if qemu_get_vnet_hdr_len()
is not 0, and filter-dump is not managing this case.
The only user of QEMU_NET_PACKET_FLAG_RAW is announce_self,
we can show the problem using it and tcpddump:
- QEMU parameters:
.. -monitor stdio \
-netdev bridge,id=netdev0,br=virbr0 \
-device virtio-net,mac=9a:2b:2c:2d:2e:2f,netdev=netdev0 \
-object filter-dump,netdev=netdev0,file=log.pcap,id=pcap0
- HMP command:
(qemu) announce_self
- TCP dump:
$ tcpdump -nxr log.pcap
without the fix:
08:00:06:04:00:03 > 2e:2f:80:35:00:01, ethertype Unknown (0x9a2b), length 50:
0x0000: 2c2d 2e2f 0000 0000 9a2b 2c2d 2e2f 0000
0x0010: 0000 0000 0000 0000 0000 0000 0000 0000
0x0020: 0000 0000
with the fix:
ARP, Reverse Request who-is 9a:2b:2c:2d:2e:2f tell 9a:2b:2c:2d:2e:2f, length 46
0x0000: 0001 0800 0604 0003 9a2b 2c2d 2e2f 0000
0x0010: 0000 9a2b 2c2d 2e2f 0000 0000 0000 0000
0x0020: 0000 0000 0000 0000 0000 0000 0000
Fixes: 481c523 ("net: Strip virtio-net header when dumping")
Cc: akihiko.odaki@daynix.com
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit c6a1b59)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit fixes an incorrect format string for formatting integers provided to GDB when debugging a target run in QEMU user mode. The correct format is hexadecimal for both success and errno values, some of which can be seen here [0]. [0] https://github.com/bminor/binutils-gdb/blob/e65a355022d0dc6b5707310876a72b5693ec0aa5/gdbserver/hostio.cc#L196-L213 Signed-off-by: Dominik 'Disconnect3d' Czarnota <dominik.b.czarnota@gmail.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Fixes: e282010 ("gdbstub: Add support for info proc mappings") Cc: qemu-stable@nongnu.org Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 8b647bd) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Without it, recent bindgen will give an error error: extern block cannot be declared unsafe if rustc is not new enough to support the "unsafe extern" construct. Cc: qemu-rust@nongnu.org Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-ID: <20250206111514.2134895-1-pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 131c584) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
ASAN detected a leak when running the ahci-test
/ahci/io/dma/lba28/retry:
Direct leak of 35 byte(s) in 1 object(s) allocated from:
#0 in malloc
#1 in __vasprintf_internal
#2 in vasprintf
#3 in g_vasprintf
#4 in g_strdup_vprintf
#5 in g_strdup_printf
#6 in object_get_canonical_path ../qom/object.c:2096:19
#7 in blk_get_attached_dev_id_or_path ../block/block-backend.c:1033:12
#8 in blk_get_attached_dev_path ../block/block-backend.c:1047:12
#9 in send_qmp_error_event ../block/block-backend.c:2140:36
#10 in blk_error_action ../block/block-backend.c:2172:9
#11 in ide_handle_rw_error ../hw/ide/core.c:875:5
#12 in ide_dma_cb ../hw/ide/core.c:894:13
#13 in dma_complete ../system/dma-helpers.c:107:9
#14 in dma_blk_cb ../system/dma-helpers.c:129:9
#15 in blk_aio_complete ../block/block-backend.c:1552:9
#16 in blk_aio_write_entry ../block/block-backend.c:1619:5
#17 in coroutine_trampoline ../util/coroutine-ucontext.c:175:9
Plug the leak by freeing the device path string.
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20241111145214.8261-1-farosas@suse.de>
[PMD: Use g_autofree]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20241111170333.43833-3-philmd@linaro.org>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 23ea425)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
…_io_error()' Commit 7452162 introduced 'qom-path' argument to BLOCK_IO_ERROR event but when the event is instantiated in 'send_qmp_error_event()' the arguments for 'device' and 'qom_path' in qapi_event_send_block_io_error() were reversed : Generated code for sending event: void qapi_event_send_block_io_error(const char *qom_path, const char *device, const char *node_name, IoOperationType operation, [...] Call inside send_qmp_error_event(): qapi_event_send_block_io_error(blk_name(blk), blk_get_attached_dev_path(blk), bs ? bdrv_get_node_name(bs) : NULL, optype, [...] This results into reporting the QOM path as the device alias and vice versa which in turn breaks libvirt, which expects the device alias being either a valid alias or empty (which would make libvirt do the lookup by node-name instead). Cc: qemu-stable@nongnu.org Fixes: 7452162 ("qapi: add qom-path to BLOCK_IO_ERROR event") Signed-off-by: Peter Krempa <pkrempa@redhat.com> Message-ID: <09728d784888b38d7a8f09ee5e9e9c542c875e1e.1737973614.git.pkrempa@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 107c551) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
glibc 2.41+ has added [1] definitions for sched_setattr and sched_getattr functions and struct sched_attr. Therefore, it needs to be checked for here as well before defining sched_attr, to avoid a compilation failure. Define sched_attr conditionally only when SCHED_ATTR_SIZE_VER0 is not defined. [1] https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=21571ca0d70302909cf72707b2a7736cf12190a0;hp=298bc488fdc047da37482f4003023cb9adef78f8 Signed-off-by: Khem Raj <raj.khem@gmail.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2799 Cc: qemu-stable@nongnu.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 27a8d89) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Add VHOST_USER_PROTOCOL_F_SHARED_OBJECT and VHOST_USER_PROTOCOL_F_DEVICE_STATE protocol feature maps to the virtio introspection. Cc: jonah.palmer@oracle.com Fixes: 1609476 ("vhost-user: add shared_object msg") Cc: aesteve@redhat.com Fixes: cda83ad ("vhost-user: Interface for migration state transfer") Cc: hreitz@redhat.com Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 1e3d4d9) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
The FreeBSD job started to fail since the 14-1 image disappeared from the cloud. Update the job to v14.2 to fix it. Message-ID: <20250211120817.35050-1-thuth@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> (cherry picked from commit 66a1b49) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
When iommufd_cdev_ram_block_discard_disable() fails for whatever reason, errp should be set or else SIGSEV is triggered in vfio_realize() when error_prepend() is called. By this chance, use the same error message for both legacy and iommufd backend. Fixes: 5ee3dc7 ("vfio/iommufd: Implement the iommufd backend") Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Link: https://lore.kernel.org/r/20250116102307.260849-1-zhenzhong.duan@intel.com Signed-off-by: Cédric Le Goater <clg@redhat.com> (cherry picked from commit 7b3d5b8) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Windows only: The libSDL2 Windows message loop needs the libSDL2 Windows low level keyboard hook procedure to grab the left and right Windows keys correctly. Reenable the SDL2 Windows keyboard hook procedure. Since SDL2 2.30.4 the SDL2 keyboard hook procedure also filters out the special left Control key event for every Alt Gr key event on keyboards with an international layout. This means the QEMU low level keyboard hook procedure is no longer needed. Remove the QEMU Windows keyboard hook procedure. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2139 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2323 Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Link: https://lore.kernel.org/r/20241231115950.6732-1-vr_qemu@t-online.de Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 4dafba7) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (Mjt: context fix in ui/sdl2.c (includes))
The current logic scans qemu.git/subprojects/ from *.wrap files to determine whether or not to include the associated directories in the release tarballs. However, the script assumes that it is being run from the top-level of the source directory, which may not always be the case. In particular, when generating releases via, e.g.: make qemu-9.2.1.tar.xz the $CWD will either be an arbitrary external build directory, or qemu.git/build, and the exclusions will not be processed as expected. Fix this by using the $src parameter passed to the script as the root directory for the various subproject/ paths referenced by this logic. Also, the error case at the beginning of the subproject_dir() will not result in the error message being printed, and will instead produce an error message about "error" not being a valid command. Fix this by using basic shell commands. Fixes: be27b51 ("make-release: only leave tarball of wrap-file subprojects") Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Michael Tokarev <mjt@tls.msk.ru> Cc: qemu-stable@nongnu.org Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit b79b05d) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
The SMC91C111 includes an MMU Command register which permits the guest to remove entries from the RX FIFO. The datasheet does not specify what happens if the guest tries to do this when the FIFO is already empty; there are no status registers containing error bits which might be applicable. Currently we don't guard at all against pop of an empty RX FIFO, with the result that we allow the guest to drive the rx_fifo_len index to negative values, which will cause smc91c111_receive() to write to the rx_fifo[] array out of bounds when we receive the next packet. Instead ignore attempts to pop an empty RX FIFO. Cc: qemu-stable@nongnu.org Fixes: 80337b6 ("NIC emulation for qemu arm-softmmu") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2780 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250207151157.3151776-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> (cherry picked from commit 937df81) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
When complying with the alignment requested in the ELF and unmapping the excess reservation, having align_end not aligned to the guest page causes the unmap to be rejected by the alignment check at target_munmap and later brk adjustments hit an EEXIST. Fix by aligning the start of region to be unmapped. Fixes: c81d1fa ("linux-user: Honor elf alignment when placing images") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1913 Signed-off-by: Fabiano Rosas <farosas@suse.de> [rth: Align load_end as well.] Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250213143558.10504-1-farosas@suse.de> (cherry picked from commit 4b7b20a) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
…ions A bug was introduced in commit 0bba757 which causes the fdtox and fqtox instructions to incorrectly select the destination registers. More information and a test program can be found in issue #2802. Cc: qemu-stable@nongnu.org Fixes: 0bba757 ("target/sparc: Perform DFPREG/QFPREG in decodetree") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2802 Signed-off-by: Mikael Szreder <git@miszr.win> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> [rth: Squash patches together, since the second fixes a typo in the first.] Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250205090333.19626-3-git@miszr.win> (cherry picked from commit 807c3eb) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
The gdbstub implementation for the Sparc architecture would incorrectly calculate the the floating point register offset. This resulted in, for example, registers f32 and f34 to point to the same value. The issue was caused by the confusion between even register numbers and even register indexes. For example, the register index of f32 is 64 and f34 is 65. Cc: qemu-stable@nongnu.org Fixes: 30038fd ("target-sparc: Change fpr representation to doubles.") Signed-off-by: Mikael Szreder <git@miszr.win> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250214070343.11501-1-git@miszr.win> (cherry picked from commit 7a74e46) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Update the code in net/slirp.c to be compatible with libslirp 4.9.0, which deprecated slirp_pollfds_fill() and started using slirp_os_socket type for sockets (which is a 64-bit integer on win64) for all callbacks starting with version 6 of the interface. Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Message-ID: <20250130123253.864681-1-mjt@tls.msk.ru> [thuth: Added some spaces to make checkpatch.pl happy] Signed-off-by: Thomas Huth <thuth@redhat.com> (cherry picked from commit f141caa) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
v9.2.2 release
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.