qemu/hw, branch master

hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()

2024-08-23T09:10:28Z

fix vhost_user_gpu_chr_read() where `size` was incorrectly passed to `msg->flags`. Fixes: 267f664658 ("hw/display: add vhost-user-vga & gpu-pci") Signed-off-by: Haoran Zhang Reviewed-by: Marc-André Lureau Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Michael Tokarev Signed-off-by: Michael Tokarev

hw/x86: add a couple of comments explaining how the kernel image is parsed

2024-08-23T09:07:23Z

Cosmetic: add comments in x86_load_linux() pointing to the kernel documentation so that users can better understand the code. CC: qemu-trivial@nongnu.org Signed-off-by: Ani Sinha Reviewed-by: Zhao Liu Reviewed-by: Michael Tokarev Signed-off-by: Michael Tokarev

hw/loongarch: Fix length for lowram in ACPI SRAT

2024-08-21T03:01:09Z

The size of lowram should be "gap" instead of the whole node. This is failing kernel's sanity check: [ 0.000000] ACPI: SRAT: Node 0 PXM 0 [mem 0x00000000-0xffffffff] [ 0.000000] ACPI: SRAT: Node 0 PXM 0 [mem 0x80000000-0x16fffffff] [ 0.000000] ACPI: SRAT: Node 1 PXM 1 [mem 0x170000000-0x26fffffff] [ 0.000000] Warning: node 0 [mem 0x00000000-0xffffffff] overlaps with itself [mem 0x80000000-0x16fffffff] Fixes: fc100011f38d ("hw/loongarch: Refine acpi srat table for numa memory") Signed-off-by: Jiaxun Yang Reviewed-by: Bibo Mao Signed-off-by: Song Gao

Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu into staging

2024-08-20T11:29:52Z

virtio: regression fixes 3 small patches to make sure we don't ship regressions. Signed-off-by: Michael S. Tsirkin # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmbEdw8PHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRp0dsIAKTzhmBR3IviFQVo223RgcDfthxoKejTB5tv # EhGVUi4ddrViIIHsKFZ0pTHXnRcwHpPRokg6GrbqNhrAM6K7ptP8pkEK1DDkbGtq # HaeceK55nNZ/wM1O5xHpRLVc2WtxmBrliDTFHGB2HjURO/kpjoHqWbE6Sn4GILc1 # EYU2T3Wn1UFgj+H4L7yF4SzmQSmyzq+7Tml6Z2GzpsatdwCoFQz2nA28piCnRMCq # lusMo2YdE6js9JS/h+zMqgKValuCyuU7S7ZbSO2dvYQwt/hgk07BegBrdsAENNh6 # 0IWRHrojwAg+4U6ULzbrBG6/hW2A8Q5065D8Nf9Bjy4eAU7QSbU= # =K6xx # -----END PGP SIGNATURE----- # gpg: Signature made Tue 20 Aug 2024 08:59:27 PM AEST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin " [undefined] # gpg: aka "Michael S. Tsirkin " [undefined] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: virtio-pci: Fix the use of an uninitialized irqfd hw/audio/virtio-snd: fix invalid param check vhost: Add VIRTIO_NET_F_RSC_EXT to vhost feature bits Signed-off-by: Richard Henderson

virtio-pci: Fix the use of an uninitialized irqfd

2024-08-20T10:57:47Z

The crash was reported in MAC OS and NixOS, here is the link for this bug https://gitlab.com/qemu-project/qemu/-/issues/2334 https://gitlab.com/qemu-project/qemu/-/issues/2321 In this bug, they are using the virtio_input device. The guest notifier was not supported for this device, The function virtio_pci_set_guest_notifiers() was not called, and the vector_irqfd was not initialized. So the fix is adding the check for vector_irqfd in virtio_pci_get_notifier() The function virtio_pci_get_notifier() can be used in various devices. It could also be called when VIRTIO_CONFIG_S_DRIVER_OK is not set. In this situation, the vector_irqfd being NULL is acceptable. We can allow the device continue to boot If the vector_irqfd still hasn't been initialized after VIRTIO_CONFIG_S_DRIVER_OK is set, it means that the function set_guest_notifiers was not called before the driver started. This indicates that the device is not using the notifier. At this point, we will let the check fail. This fix is verified in vyatta,MacOS,NixOS,fedora system. The bt tree for this bug is: Thread 6 "CPU 0/KVM" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7c817be006c0 (LWP 1269146)] kvm_virtio_pci_vq_vector_use () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:817 817 if (irqfd->users == 0) { (gdb) thread apply all bt ... Thread 6 (Thread 0x7c817be006c0 (LWP 1269146) "CPU 0/KVM"): 0 kvm_virtio_pci_vq_vector_use () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:817 1 kvm_virtio_pci_vector_use_one () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:893 2 0x00005983657045e2 in memory_region_write_accessor () at ../qemu-9.0.0/system/memory.c:497 3 0x0000598365704ba6 in access_with_adjusted_size () at ../qemu-9.0.0/system/memory.c:573 4 0x0000598365705059 in memory_region_dispatch_write () at ../qemu-9.0.0/system/memory.c:1528 5 0x00005983659b8e1f in flatview_write_continue_step.isra.0 () at ../qemu-9.0.0/system/physmem.c:2713 6 0x000059836570ba7d in flatview_write_continue () at ../qemu-9.0.0/system/physmem.c:2743 7 flatview_write () at ../qemu-9.0.0/system/physmem.c:2774 8 0x000059836570bb76 in address_space_write () at ../qemu-9.0.0/system/physmem.c:2894 9 0x0000598365763afe in address_space_rw () at ../qemu-9.0.0/system/physmem.c:2904 10 kvm_cpu_exec () at ../qemu-9.0.0/accel/kvm/kvm-all.c:2917 11 0x000059836576656e in kvm_vcpu_thread_fn () at ../qemu-9.0.0/accel/kvm/kvm-accel-ops.c:50 12 0x0000598365926ca8 in qemu_thread_start () at ../qemu-9.0.0/util/qemu-thread-posix.c:541 13 0x00007c8185bcd1cf in ??? () at /usr/lib/libc.so.6 14 0x00007c8185c4e504 in clone () at /usr/lib/libc.so.6 Fixes: 2ce6cff94d ("virtio-pci: fix use of a released vector") Cc: qemu-stable@nongnu.org Signed-off-by: Cindy Lu Message-Id: <20240806093715.65105-1-lulu@redhat.com> Acked-by: Jason Wang Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin

hw/audio/virtio-snd: fix invalid param check

2024-08-20T10:57:47Z

Commit 9b6083465f ("virtio-snd: check for invalid param shift operands") tries to prevent invalid parameters specified by the guest. However, the code is not correct. Change the code so that the parameters format and rate, which are a bit numbers, are compared with the bit size of the data type. Fixes: 9b6083465f ("virtio-snd: check for invalid param shift operands") Signed-off-by: Volker Rümelin Message-Id: <20240802071805.7123-1-vr_qemu@t-online.de> Reviewed-by: Manos Pitsidianakis Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin

vhost: Add VIRTIO_NET_F_RSC_EXT to vhost feature bits

2024-08-20T10:57:47Z

VIRTIO_NET_F_RSC_EXT is implemented in the rx data path, which vhost implements, so vhost needs to support the feature if it is ever to be enabled with vhost. The feature must be disabled otherwise. Fixes: 2974e916df87 ("virtio-net: support RSC v4/v6 tcp traffic for Windows HCK") Reported-by: Jason Wang Signed-off-by: Akihiko Odaki Message-Id: <20240802-rsc-v1-1-2b607bd2f555@daynix.com> Acked-by: Jason Wang Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin

Merge tag 'nvme-next-pull-request' of https://gitlab.com/birkelund/qemu into staging

2024-08-20T06:51:15Z

hw/nvme late fix # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmbEHsUACgkQTeGvMW1P # DenlQgf/dzz4B5pzdD0HsjNVNulxygAJEnYitiF/50LRj564hQDoisNYPvHeKMA7 # wfk8jSSimTM6YkETksiR2DvnXlZ3wXn/HAhqE15GSW8vtRK2/RO9vNn51gyoFvl3 # z/Wm8ahoFaNpygQQkQMIJ9QHVD3GheZH4OxMhqI1523+s7dGcUNetoZiyoBAdJ6m # 7KOa/zUTPBmvpKMOEa25Ss+nZIPp9eFuCwQxhToV0gEuJFHolRZYv7GA4UjnodvJ # HrBrbsB8W4vh65FmC7WLAG9XFvNMgC0h8qtzWyKhNcxf478E7FckLvnAzSZExitj # fJzrSJV0bJHlQEM2q0yHYpL0urh5XA== # =ZeRF # -----END PGP SIGNATURE----- # gpg: Signature made Tue 20 Aug 2024 02:42:45 PM AEST # gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9 # gpg: Good signature from "Klaus Jensen " [unknown] # gpg: aka "Klaus Jensen " [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838 # Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9 * tag 'nvme-next-pull-request' of https://gitlab.com/birkelund/qemu: hw/nvme: fix leak of uninitialized memory in io_mgmt_recv Signed-off-by: Richard Henderson

hw/nvme: fix leak of uninitialized memory in io_mgmt_recv

2024-08-20T04:16:48Z

Yutaro Shimizu from the Cyber Defense Institute discovered a bug in the NVMe emulation that leaks contents of an uninitialized heap buffer if subsystem and FDP emulation are enabled. Cc: qemu-stable@nongnu.org Reported-by: Yutaro Shimizu Signed-off-by: Klaus Jensen

Merge tag 'hw-misc-20240820' of https://github.com/philmd/qemu into staging

2024-08-19T23:17:41Z

Various fixes - Null pointer dereference in IPI IOCSR (Jiaxun) - Correct '-smbios type=4' in man page (Heinrich) - Use correct MMU index in MIPS get_pte (Phil) - Reset MPQEMU remote message using device_cold_reset (Peter) - Update linux-user MIPS CPU list (Phil) - Do not let exec_command read console if no pattern to wait for (Nick) - Remove shadowed declaration warning (Pierrick) - Restrict STQF opcode to SPARC V9 (Richard) - Add missing Kconfig dependency for POWERNV ISA serial port (Bernhard) - Do not allow vmport device without i8042 PS/2 controller (Kamil) - Fix QCryptoTLSCredsPSK leak (Peter) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmbDzAsACgkQ4+MsLN6t # wN7SvBAAwM0Frtg4ZKDZQu8XgMjLq1xVoSWjC3YJZKTpyGap5gO+7StvHg0sf9iB # YyGqocCO+qdj9a7pTSasfGDyufpwoIZkOqkwGUWKBos76cOcHWt4e/gkl9O65Lf1 # VVKX4/xdY+a5w2eVAAdWWrYdaPWkKLm0ZZXKoeSIvN4R9A41j7J4kANhE2SweczF # NnTt2gBnSlpRzghlVWPJKhnq+aYbvLeR7ApdNGUJDpSI1ZTh9gH1GtZFwBN7aeDo # PvDucoui0EmuyHTVdOYOH3zihTfzKlNZECcT3Y6/6i8y5p7jLHyINHHexsKw6T56 # i5RidJMPTfM0EO6LU1GvUN5FzZy24zXOf298Fe/GMYczQsOznQd4+aFHYPb3d4hZ # 8Vc1wB1s8XF5WGj+7bchBAUdynUnbwUqfMOb2pMXLIm21pSDnOTVgmYMnp1Kt4AA # 9WbHiS6tUJf/HjQsep8BBNGUiVSsUPDNNhL8QN43u2C0NgNRPgtRuIV+ytgVXS1G # 2t1QiRX0lX4ACHmw88agUCU3OhorumuDOpoitQK5jn2VutT7TqbGgibkQMFSgn9E # Xwrmtlf7nYU9MVgXYJjH2bBh7wbOmQCqbHniEj0targkxccAMJoswG4vtKsP9zkd # tBs6qMiZ8qSj5eoq8JBRF8bF4tONmboPZjRlboACJ0kTD5wCElA= # =lPMG # -----END PGP SIGNATURE----- # gpg: Signature made Tue 20 Aug 2024 08:49:47 AM AEST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) " [full] * tag 'hw-misc-20240820' of https://github.com/philmd/qemu: crypto/tlscredspsk: Free username on finalize hw/i386/pc: Ensure vmport prerequisites are fulfilled hw/i386/pc: Unify vmport=auto handling hw/ppc/Kconfig: Add missing SERIAL_ISA dependency to POWERNV machine target/sparc: Restrict STQF to sparcv9 contrib/plugins/execlog: Fix shadowed declaration warning tests/avocado: Mark ppc_hv_tests.py as non-flaky after fixed console interaction tests/avocado: exec_command should not consume console output linux-user/mips: Select Loongson CPU for Loongson binaries linux-user/mips: Select MIPS64R2-generic for Rel2 binaries linux-user/mips: Select Octeon68XX CPU for Octeon binaries linux-user/mips: Do not try to use removed R5900 CPU hw/remote/message.c: Don't directly invoke DeviceClass:reset hw/dma/xilinx_axidma: Use semicolon at end of statement, not comma target/mips: Load PTE as DATA target/mips: Use correct MMU index in get_pte() target/mips: Pass page table entry size as MemOp to get_pte() qemu-options.hx: correct formatting -smbios type=4 hw/mips/loongson3_virt: Fix condition of IPI IOCSR connection hw/mips/loongson3_virt: Store core_iocsr into LoongsonMachineState Signed-off-by: Richard Henderson