Merge tag 'pull-target-arm-20240913' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
* s390: convert s390 virtio-ccw and CPU to three-phase reset
* reset: remove

Merge tag 'pull-target-arm-20240913' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
* s390: convert s390 virtio-ccw and CPU to three-phase reset
* reset: remove now-unused device_class_set_parent_reset()
* reset: introduce device_class_set_legacy_reset()
* reset: remove unneeded transitional machinery
* kvm: Use 'unsigned long' for request argument in functions wrapping ioctl()
* hvf: arm: Implement and use hvf_get_physical_address_range
so VMs can have larger-than-36-bit IPA spaces when the host
supports this
* target/arm/tcg: refine cache descriptions with a wrapper
* hw/net/can/xlnx-versal-canfd: fix various bugs
* MAINTAINERS: update versal, CAN maintainer entries
* hw/intc/arm_gic: fix spurious level triggered interrupts

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmbkVokZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3pR5D/0ZJzJi7C0HIa4KYuBkcpZQ
# M3iUa1uiZoCniXlWuKFt2rUBrmhbW30YHw5gQjnxoUO4VVqREkFi3e5nzUKRQmvP
# FRm8dnuC36qwQJFhm+rQqUb8/AyqrVFnIaHhn7dBKLwRFm9+kbZ0v9x1Eq1DZk3S
# mijBQRiOjrj+FRkmyNJLhylGpm+p9VRdnBjmUtN2Yw+2fPkHmUURRSUvhwCK4BB5
# AvKgMC0EIIsLJKLfrWzk/EsYC8ogrGitISzFt8iWLAqxuxtuhv1StstleD4mZMK8
# gH+ZH5tsls2IiTIKkHfcbUcA55efDrQHGDat7n1Q0EWqOjET0soES+GpS0Jj6IXK
# uOnsDZ7MLFU/SbpckicLQ/JwNi3HiIfQgBVB2aJZ+cg8CGqaQCI5ZvWs7XFpUgkb
# naA4IR5mdNgXJm7ttBKbWarPNcmdODqa/5YDjXdyHmMx3JD994k1y5LIi3o69TgI
# rgHzU8ChZqaBDEvNa5KGtadQPnaSBP15Yqbp5rn2knVRKjDdyCdB94aWO5tZkmaO
# ARFmNk6h5bhwXdXl2Hu67RS2Kd0/fHMFWsxyHAX4NYT+Vq+ZTjLdaPzwFdfA0yAz
# wXWn0EAeYQ5M2xOPfDM/JYSc1THSzhpwy/CBrRjrCRZMDE+bx9BRC7pUXwquE8xF
# CW1NUxkvZikQeiMzgEBbTA==
# =u6u8
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 13 Sep 2024 16:13:13 BST
# gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg: issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# gpg: aka "Peter Maydell <peter@archaic.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20240913' of https://git.linaro.org/people/pmaydell/qemu-arm: (27 commits)
hw/intc/arm_gic: fix spurious level triggered interrupts
MAINTAINERS: Add my-self as CAN maintainer
MAINTAINERS: Update Xilinx Versal OSPI maintainer's email address
MAINTAINERS: Remove Vikram Garhwal as maintainer
hw/net/can/xlnx-versal-canfd: Fix FIFO issues
hw/net/can/xlnx-versal-canfd: Simplify DLC conversions
hw/net/can/xlnx-versal-canfd: Fix byte ordering
hw/net/can/xlnx-versal-canfd: Handle flags correctly
hw/net/can/xlnx-versal-canfd: Translate CAN ID registers
hw/net/can/xlnx-versal-canfd: Fix CAN FD flag check
hw/net/can/xlnx-versal-canfd: Fix interrupt level
target/arm/tcg: refine cache descriptions with a wrapper
hvf: arm: Implement and use hvf_get_physical_address_range
hvf: Split up hv_vm_create logic per arch
hw/boards: Add hvf_get_physical_address_range to MachineClass
kvm: Use 'unsigned long' for request argument in functions wrapping ioctl()
hw/core/resettable: Remove transitional_function machinery
hw/core/qdev: Simplify legacy_reset handling
hw: Remove device_phases_reset()
hw: Rename DeviceClass::reset field to legacy_reset
...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw: Use device_class_set_legacy_reset() instead of opencoding

Use device_class_set_legacy_reset() instead of opencoding an
assignment to DeviceClass::reset. This change was produced
with:
spatch --

hw: Use device_class_set_legacy_reset() instead of opencoding

Use device_class_set_legacy_reset() instead of opencoding an
assignment to DeviceClass::reset. This change was produced
with:
spatch --macro-file scripts/cocci-macro-file.h \
--sp-file scripts/coccinelle/device-reset.cocci \
--keep-comments --smpl-spacing --in-place --dir hw

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240830145812.1967042-8-peter.maydell@linaro.org

show more ...

Merge tag 'pull-20231230' of https://gitlab.com/rth7680/qemu into staging

Mark VMStateField and VMStateDescription arrays const.

# -----BEGIN PGP SIGNATURE-----
#
# iQFRBAABCgA7FiEEekgeeIaLTbaoWgXA

Merge tag 'pull-20231230' of https://gitlab.com/rth7680/qemu into staging

Mark VMStateField and VMStateDescription arrays const.

# -----BEGIN PGP SIGNATURE-----
#
# iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmWPOFsdHHJpY2hhcmQu
# aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV8cCQgAnQjy3Ic1i225AElh
# 0Ph3Aiw6WT9pECLoKmyroxHbTGuaEJoIXeaOhMAnowCTBLoKRR3/Ooq0DGOW+l/Z
# f5PwWSkjkb+OcS+dj/kgQBu58/Gk5G8ogksqKQvci8k2okhjHmITSQDu0dtwzDZr
# jVGh3gmGoat73jQyD/nAwgWFawlLkklOMR/yvnFX7EJIBepRVbkMPayoKlB+6W07
# 1kqhSwoI0vQCjhJ3Q7Q0GC4rrHK3KUq7o/25yvICf4EgPKfsaym1wAjDhdKToixl
# 9T+ALZG8SiZZkBlb6l3QZ7pqtqavxYtPdZ2Gx/nMu0RRu4G33d5AVGHRrXj9qttW
# 5mL7ZQ==
# =uQ4C
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 29 Dec 2023 21:21:31 GMT
# gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg: issuer "richard.henderson@linaro.org"
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F

* tag 'pull-20231230' of https://gitlab.com/rth7680/qemu: (71 commits)
docs: Constify VMstate in examples
tests/unit/test-vmstate: Constify VMState
util/fifo8: Constify VMState
replay: Constify VMState
system: Constify VMState
migration: Constify VMState
cpu-target: Constify VMState
backends: Constify VMState
audio: Constify VMState
hw/misc/macio: Constify VMState
hw/watchdog: Constify VMState
hw/virtio: Constify VMState
hw/vfio: Constify VMState
hw/usb: Constify VMState
hw/tpm: Constify VMState
hw/timer: Constify VMState
hw/ssi: Constify VMState
hw/sparc: Constify VMState
hw/sensor: Constify VMState
hw/sd: Constify VMState
...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw/audio: Constify VMState

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20231221031652.119827-24-richard.henderson@linaro.org>

Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging

* add host ticks function for RISC-V
* target/i386: Export GDS_NO bit
* target/i386: add support for bit 56 of MSR_IA32_VMX_B

Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging

* add host ticks function for RISC-V
* target/i386: Export GDS_NO bit
* target/i386: add support for bit 56 of MSR_IA32_VMX_BASIC
* first part of audiodev cleanups

# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmUNtYUUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroN7Uwf9Fy4aE1PHzSNr2FqT4rUSYrT4N8cL
# QiPeB8JiJUnl73TcCkTwi7S/Az+37okv+Qsr7eh1wdarY8DOYir9dGJU3TGzICSw
# cgPImb99rhBc2kEmwciCWGlhXIMD8WNN64EanPPg5VeQYdzrorYwl7jCTMQMBR5H
# wtOq3f6FfYJonVwZ6YOmbioD2mFfoGBuiDcYmTTw440vrruKqHagbm5onD1SY9kR
# SM0/HXcYaKB6Ae9qNKhyR9h94KZzDUkCvcTLdFGtK90GBs4VxZVHQn6Dpkh5lPtT
# t0MbMv1mcO6ODzg9TxO3gUAgoklTy3gM2wISXo5C9NGuxmF2svwkuQl5pg==
# =CuIa
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 22 Sep 2023 11:40:53 EDT
# gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg: issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1
# Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83

* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
vl: recognize audiodev groups in configuration files
tests/qtest: Specify audiodev= and -audiodev
hw/display/xlnx_dp.c: Add audiodev property
hw/audio/lm4549: Add errp error reporting to init function
hw/audio: Simplify hda audio init
hw/input/tsc210x: Extract common init code into new function
qemu/timer: Add host ticks function for RISC-V
target/i386: Export GDS_NO bit to guests
target/i386: enumerate bit 56 of MSR_IA32_VMX_BASIC

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

show more ...

hw/audio: Simplify hda audio init

No return values are used anywhere, so switch the functions to be void
and add support for error reporting using errp for use in next patches.

Signed-off-by: Marti

hw/audio: Simplify hda audio init

No return values are used anywhere, so switch the functions to be void
and add support for error reporting using errp for use in next patches.

Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <cd1df4ad2a6fae969c4a02a77955c4a8c0d430b6.1650874791.git.mkletzan@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

Merge tag 'fixes-20221123-pull-request' of https://gitlab.com/kraxel/qemu into staging

ui+usb+audio: bugfixes for 7.2

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTg

Merge tag 'fixes-20221123-pull-request' of https://gitlab.com/kraxel/qemu into staging

ui+usb+audio: bugfixes for 7.2

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmN+MaYACgkQTLbY7tPo
# cTiJ7A//dN/US7zHSHcgAscyjSClZRU4gHyJcnN0BoNtrOXW9lIGEnMzQBfOn2nb
# 5vaL2u2+Ooz/92pEi6P2qKUxHo63P7RfXXEOhPdi+kENK3UYOzlyJmlUUUrXyu78
# W8BM/styxb1s84KmPauRFGmgCoXCZZ4IklZUaVLqLYwJUv6/BGlbxorEdeuCGev0
# LgeyZTWaWcI5jOdIaL+Hl9PKzQCyKigT3HWA8lPvs31+hvdK5RvL5mai6SD+4Mtj
# JaLGqZ3N7oSo7a/LT+f0jebwg/QUV9EGkJmnF6tlGg3IM34/Mqbl+BMJjGAh3xqx
# z3qks/z2baHtz59CHGVS8sxWPC+5Wh3hgkpzOJ83fCUqueS7cMXBF6fcf0y0MJqP
# ne6ePE/4ZWcHnoycpZqNRDqao+Lh62PSdteAjf2yq8ZLhhm9HgP4bl/4je8tbi/I
# Z6WrP4yv8l7ea5jZUbtURbe0pYKAmzMr2rwv34jJbXAn+BU5vV1/5j7jyz2UlETK
# G7fiLJEUutFhYaCWhgNCE8HTgYt9V0PEjGfIJXkKHRHLd/229VSjlvdQyP/vtSLt
# EzaP1JdtGZ++QEzMBY8lzrozNHaJglGBjonG9fUnJ4VSB4+J8b3KqBEXlmWL16Fx
# UvV8MtOuQ6Y377ErbQJYjui6BOArV6iI5NBlbvWuc+CgA09orYs=
# =m/Hx
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 23 Nov 2022 09:43:50 EST
# gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138

* tag 'fixes-20221123-pull-request' of https://gitlab.com/kraxel/qemu:
hw/audio/intel-hda: Drop unnecessary prototype
hw/audio/intel-hda: don't reset codecs twice
hw/usb/hcd-xhci: Reset the XHCIState with device_cold_reset()
ui/gtk: prevent ui lock up when dpy_gl_update called again before current draw event occurs
hw/usb/hcd-xhci.c: spelling: tranfer
gtk: disable GTK Clipboard with a new meson option
Revert "usbredir: avoid queuing hello packet on snapshot restore"

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

show more ...

hw/audio/intel-hda: Drop unnecessary prototype

The only use of intel_hda_reset() is after its definition, so we
don't need to separately declare its prototype at the top of the
file; drop the unnece

hw/audio/intel-hda: Drop unnecessary prototype

The only use of intel_hda_reset() is after its definition, so we
don't need to separately declare its prototype at the top of the
file; drop the unnecessary line.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20221014142632.2092404-3-peter.maydell@linaro.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

show more ...

hw/audio/intel-hda: don't reset codecs twice

Currently the intel-hda device has a reset method which manually
resets all the codecs by calling device_legacy_reset() on them. This
means they get res

hw/audio/intel-hda: don't reset codecs twice

Currently the intel-hda device has a reset method which manually
resets all the codecs by calling device_legacy_reset() on them. This
means they get reset twice, once because child devices on a qbus get
reset before the parent device's reset method is called, and then
again because we're manually resetting them.

Drop the manual reset call, and ensure that codecs are still reset
when the guest does a reset via ICH6_GCTL_RESET by using
device_cold_reset() (which resets all the devices on the qbus as well
as the device itself) instead of a direct call to the reset function.

This is a slight ordering change because the (only) codec reset now
happens before the controller registers etc are reset, rather than
once before and then once after, but the codec reset function
hda_audio_reset() doesn't care.

This lets us drop a use of device_legacy_reset(), which is
deprecated.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20221014142632.2092404-2-peter.maydell@linaro.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

show more ...

Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging

* fix WHPX debugging
* misc qga-vss fixes
* remove the deprecated CPU model 'Icelake-Client'
* support for x86 architectural

Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging

* fix WHPX debugging
* misc qga-vss fixes
* remove the deprecated CPU model 'Icelake-Client'
* support for x86 architectural LBR
* remove deprecated properties
* replace deprecated -soundhw with -audio

# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmJ/hZ4UHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroN2Igf/bFs+yluOikt0eFNmXYnshrGBWPXr
# oam0iumPox34vTzZnjpSjF6tJGxHWOgi+wbgIvbwOYHA/ONxx8akW580j+1VhEWa
# X29VyUzjZBffgFtmlF4fM74/ELYm7s4c1a1/D9TpVP6Dr0fSWbMujbx4dfeVstvf
# sONN+A8sVxaNdV9QKPE6BvqfMlPLoCiigrOetf6iY1KuUtkQDF8xDB0MdzdutqAQ
# szAtQ0rrzjxDx9EuGN1SECFM1/riDUbtOOoA9g2C7gGKrx3/iUc6pzrkIcAfWLFK
# xXbH7+6Wynia0cbUxnrvRdY4daMIxm4N3wUvN7szXgF9kxYxeQcsdgGsNA==
# =n4lu
# -----END PGP SIGNATURE-----
# gpg: Signature made Sat 14 May 2022 03:34:06 AM PDT
# gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg: issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [undefined]
# gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1
# Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83

* tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (23 commits)
configure: remove duplicate help messages
configure: remove another dead variable
build: remove useless dependency
introduce -audio as a replacement for -soundhw
soundhw: move help handling to vl.c
soundhw: unify initialization for ISA and PCI soundhw
soundhw: extract soundhw help to a separate function
soundhw: remove ability to create multiple soundcards
rng: make opened property read-only
crypto: make loaded property read-only
target/i386: Support Arch LBR in CPUID enumeration
target/i386: introduce helper to access supported CPUID
target/i386: Enable Arch LBR migration states in vmstate
target/i386: Add MSR access interface for Arch LBR
target/i386: Add XSAVES support for Arch LBR
target/i386: Enable support for XSAVES based features
target/i386: Add kvm_get_one_msr helper
target/i386: Add lbr-fmt vPMU option to support guest LBR
qdev-properties: Add a new macro with bitmask check for uint64_t property
i386/cpu: Remove the deprecated cpu model 'Icelake-Client'
...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

show more ...

introduce -audio as a replacement for -soundhw

-audio is used like "-audio pa,model=sb16". It is almost as simple as
-soundhw, but it reuses the -audiodev parsing machinery and attaches an
audiodev

introduce -audio as a replacement for -soundhw

-audio is used like "-audio pa,model=sb16". It is almost as simple as
-soundhw, but it reuses the -audiodev parsing machinery and attaches an
audiodev to the newly-created device. The main 'feature' is that
it knows about adding the codec device for model=intel-hda, and adding
the audiodev to the codec device.

In the future, it could be extended to support default models or
builtin devices, just like -nic, or even a default backend. For now,
keep it simple.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

Merge tag 'pull-request-2022-03-21' of https://gitlab.com/thuth/qemu into staging

* Fix stack-overflow due to recursive DMA in intel-hda (CVE-2021-3611)
* Fix heap overflow due to recursive DMA in s

Merge tag 'pull-request-2022-03-21' of https://gitlab.com/thuth/qemu into staging

* Fix stack-overflow due to recursive DMA in intel-hda (CVE-2021-3611)
* Fix heap overflow due to recursive DMA in sdhci code

# gpg: Signature made Mon 21 Mar 2022 16:14:36 GMT
# gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg: issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg: aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2022-03-21' of https://gitlab.com/thuth/qemu:
tests/qtest/fuzz-sdcard-test: Add reproducer for OSS-Fuzz (Issue 29225)
hw/sd/sdhci: Prohibit DMA accesses to devices
hw/sd/sdhci: Honor failed DMA transactions
tests/qtest/intel-hda-test: Add reproducer for issue #542
hw/audio/intel-hda: Restrict DMA engine to memories (not MMIO devices)
hw/audio/intel-hda: Do not ignore DMA overrun errors
softmmu/physmem: Introduce MemTxAttrs::memory field and MEMTX_ACCESS_ERROR
softmmu/physmem: Simplify flatview_write and address_space_access_valid

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

Merge tag 'pull-misc-2022-03-21' of git://repo.or.cz/qemu/armbru into staging

Miscellaneous patches patches for 2022-03-21

# gpg: Signature made Mon 21 Mar 2022 14:48:16 GMT
# gpg: u

Merge tag 'pull-misc-2022-03-21' of git://repo.or.cz/qemu/armbru into staging

Miscellaneous patches patches for 2022-03-21

# gpg: Signature made Mon 21 Mar 2022 14:48:16 GMT
# gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg: issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full]
# gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full]
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653

* tag 'pull-misc-2022-03-21' of git://repo.or.cz/qemu/armbru:
Use g_new() & friends where that makes obvious sense
9pfs: Use g_new() & friends where that makes obvious sense
scripts/coccinelle: New use-g_new-etc.cocci
block-qdict: Fix -Werror=maybe-uninitialized build failure

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

Use g_new() & friends where that makes obvious sense

g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer,
for two reasons. One, it catches multiplication overflowing size_t.
Two, i

Use g_new() & friends where that makes obvious sense

g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer,
for two reasons. One, it catches multiplication overflowing size_t.
Two, it returns T * rather than void *, which lets the compiler catch
more type errors.

This commit only touches allocations with size arguments of the form
sizeof(T).

Patch created mechanically with:

$ spatch --in-place --sp-file scripts/coccinelle/use-g_new-etc.cocci \
--macro-file scripts/cocci-macro-file.h FILES...

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20220315144156.1595462-4-armbru@redhat.com>
Reviewed-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru>

show more ...

hw/audio/intel-hda: Restrict DMA engine to memories (not MMIO devices)

Issue #542 reports a reentrancy problem when the DMA engine accesses
the HDA controller I/O registers. Fix by restricting the D

hw/audio/intel-hda: Restrict DMA engine to memories (not MMIO devices)

Issue #542 reports a reentrancy problem when the DMA engine accesses
the HDA controller I/O registers. Fix by restricting the DMA engine
to memories regions (forbidding MMIO devices such the HDA controller).

Reported-by: OSS-Fuzz (Issue 28435)
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/542
CVE: CVE-2021-3611
Message-Id: <20211218160912.1591633-3-philmd@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

show more ...

hw/audio/intel-hda: Do not ignore DMA overrun errors

Per the "High Definition Audio Specification" manual (rev. 1.0a),
section "3.3.30 Offset 5Dh: RIRBSTS - RIRB Status":

Response Overrun Interru

hw/audio/intel-hda: Do not ignore DMA overrun errors

Per the "High Definition Audio Specification" manual (rev. 1.0a),
section "3.3.30 Offset 5Dh: RIRBSTS - RIRB Status":

Response Overrun Interrupt Status (RIRBOIS):

Hardware sets this bit to a 1 when an overrun occurs in the RIRB.
An interrupt may be generated if the Response Overrun Interrupt
Control bit is set.

This bit will be set if the RIRB DMA engine is not able to write
the incoming responses to memory before additional incoming
responses overrun the internal FIFO.

When hardware detects an overrun, it will drop the responses which
overrun the buffer and set the RIRBOIS status bit to indicate the
error condition. Optionally, if the RIRBOIC is set, the hardware
will also generate an error to alert software to the problem.

QEMU emulates the DMA engine with the stl_le_pci_dma() calls. This
function returns a MemTxResult indicating whether the DMA access
was successful.
Handle any MemTxResult error as "DMA engine is not able to write the
incoming responses to memory" and raise the Overrun Interrupt flag
when this case occurs.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20211218160912.1591633-2-philmd@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

show more ...

Merge remote-tracking branch 'remotes/kraxel/tags/kraxel-20220114-pull-request' into staging

- bugfixes for ui, usb, audio, display
- change default display resolution
- add horizontal scrolling sup

Merge remote-tracking branch 'remotes/kraxel/tags/kraxel-20220114-pull-request' into staging

- bugfixes for ui, usb, audio, display
- change default display resolution
- add horizontal scrolling support

# gpg: Signature made Fri 14 Jan 2022 06:52:53 GMT
# gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/kraxel-20220114-pull-request:
ui/input-legacy: pass horizontal scroll information
ui/sdl2: pass horizontal scroll information to the device code
ui/gtk: pass horizontal scroll information to the device code
ui/cocoa: pass horizontal scroll information to the device code
ps2: Initial horizontal scroll support
edid: Added support for 4k@60 Hz monitor
edid: set default resolution to 1280x800 (WXGA)
hw/mips/jazz: Inline vga_mmio_init() and remove it
hw/display/vga-mmio: QOM'ify vga_mmio_init() as TYPE_VGA_MMIO
hw/display/vga-mmio: Inline vga_mm_init()
hw/display: Rename VGA_ISA_MM -> VGA_MMIO
uas: add missing return
ui: fix gtk clipboard clear assertion
ui/dbus: fix buffer-overflow detected by ASAN
hw/audio/intel-hda: fix stream reset
dsoundaudio: fix crackling audio recordings
jackaudio: use ifdefs to hide unavailable functions
ui/vnc.c: Fixed a deadlock bug.
usb: allow max 8192 bytes for desc
hw/usb/dev-wacom: add missing HID descriptor

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw/audio/intel-hda: fix stream reset

Quote from:
High Definition Audio Specification 1.0a, section 3.3.35

Offset 80: {IOB}SDnCTL Stream Reset (SRST): Writing a 1 causes
the corresponding stream to

hw/audio/intel-hda: fix stream reset

Quote from:
High Definition Audio Specification 1.0a, section 3.3.35

Offset 80: {IOB}SDnCTL Stream Reset (SRST): Writing a 1 causes
the corresponding stream to be reset. The Stream Descriptor
registers (except the SRST bit itself) ... are reset.

Change the code to reset the Stream Descriptor Control and Status
registers except the SRST bit.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/757
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20211226154017.6067-3-vr_qemu@t-online.de>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

show more ...

Merge tag 'memory-api-20211231' of https://github.com/philmd/qemu into staging

Memory API patches

Have various functions from the Memory API:
- take a MemTxAttrs argument,
- propagate a MemTxResult

Merge tag 'memory-api-20211231' of https://github.com/philmd/qemu into staging

Memory API patches

Have various functions from the Memory API:
- take a MemTxAttrs argument,
- propagate a MemTxResult.

# gpg: Signature made Thu 30 Dec 2021 04:52:20 PM PST
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE

* tag 'memory-api-20211231' of https://github.com/philmd/qemu: (22 commits)
pci: Let ld*_pci_dma() propagate MemTxResult
pci: Let st*_pci_dma() propagate MemTxResult
pci: Let ld*_pci_dma() take MemTxAttrs argument
pci: Let st*_pci_dma() take MemTxAttrs argument
dma: Let ld*_dma() propagate MemTxResult
dma: Let st*_dma() propagate MemTxResult
dma: Let ld*_dma() take MemTxAttrs argument
dma: Let st*_dma() take MemTxAttrs argument
dma: Let dma_buf_rw() propagate MemTxResult
dma: Let dma_buf_read() take MemTxAttrs argument
dma: Let dma_buf_write() take MemTxAttrs argument
dma: Let dma_buf_rw() take MemTxAttrs argument
pci: Let pci_dma_rw() take MemTxAttrs argument
dma: Have dma_buf_read() / dma_buf_write() take a void pointer
dma: Have dma_buf_rw() take a void pointer
dma: Let dma_memory_map() take MemTxAttrs argument
dma: Let dma_memory_read/write() take MemTxAttrs argument
dma: Let dma_memory_rw() take MemTxAttrs argument
dma: Let dma_memory_rw_relaxed() take MemTxAttrs argument
dma: Let dma_memory_set() take MemTxAttrs argument
...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

show more ...

pci: Let ld*_pci_dma() propagate MemTxResult

ld*_dma() returns a MemTxResult type. Do not discard
it, return it to the caller.

Update the few callers.

Reviewed-by: Richard Henderson <richard.hende

pci: Let ld*_pci_dma() propagate MemTxResult

ld*_dma() returns a MemTxResult type. Do not discard
it, return it to the caller.

Update the few callers.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20211223115554.3155328-24-philmd@redhat.com>

show more ...

pci: Let ld*_pci_dma() take MemTxAttrs argument

Let devices specify transaction attributes when calling ld*_pci_dma().

Keep the default MEMTXATTRS_UNSPECIFIED in the few callers.

Reviewed-by: Rich

pci: Let ld*_pci_dma() take MemTxAttrs argument

Let devices specify transaction attributes when calling ld*_pci_dma().

Keep the default MEMTXATTRS_UNSPECIFIED in the few callers.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20211223115554.3155328-22-philmd@redhat.com>

show more ...

pci: Let st*_pci_dma() take MemTxAttrs argument

Let devices specify transaction attributes when calling st*_pci_dma().

Keep the default MEMTXATTRS_UNSPECIFIED in the few callers.

Reviewed-by: Rich

pci: Let st*_pci_dma() take MemTxAttrs argument

Let devices specify transaction attributes when calling st*_pci_dma().

Keep the default MEMTXATTRS_UNSPECIFIED in the few callers.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20211223115554.3155328-21-philmd@redhat.com>

show more ...

pci: Let pci_dma_rw() take MemTxAttrs argument

Let devices specify transaction attributes when calling pci_dma_rw().

Keep the default MEMTXATTRS_UNSPECIFIED in the few callers.

Reviewed-by: Klaus

pci: Let pci_dma_rw() take MemTxAttrs argument

Let devices specify transaction attributes when calling pci_dma_rw().

Keep the default MEMTXATTRS_UNSPECIFIED in the few callers.

Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20211223115554.3155328-10-philmd@redhat.com>

show more ...

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210930' into staging

target-arm queue:
* allwinner-h3: Switch to SMC as PSCI conduit
* arm: tcg: Adhere to SMCCC 1.3 section 5

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210930' into staging

target-arm queue:
* allwinner-h3: Switch to SMC as PSCI conduit
* arm: tcg: Adhere to SMCCC 1.3 section 5.2
* xlnx-zcu102, xlnx-versal-virt: Support BBRAM and eFUSE devices
* gdbstub related code cleanups
* Don't put FPEXC and FPSID in org.gnu.gdb.arm.vfp XML
* Use _init vs _new convention in bus creation function names
* sabrelite: Connect SPI flash CS line to GPIO3_19

# gpg: Signature made Thu 30 Sep 2021 16:11:20 BST
# gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg: issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20210930: (22 commits)
hw/arm: sabrelite: Connect SPI flash CS line to GPIO3_19
ide: Rename ide_bus_new() to ide_bus_init()
qbus: Rename qbus_create() to qbus_new()
qbus: Rename qbus_create_inplace() to qbus_init()
pci: Rename pci_root_bus_new_inplace() to pci_root_bus_init()
ipack: Rename ipack_bus_new_inplace() to ipack_bus_init()
scsi: Replace scsi_bus_new() with scsi_bus_init(), scsi_bus_init_named()
target/arm: Don't put FPEXC and FPSID in org.gnu.gdb.arm.vfp XML
target/arm: Move gdbstub related code out of helper.c
target/arm: Fix coding style issues in gdbstub code in helper.c
configs: Don't include 32-bit-only GDB XML in aarch64 linux configs
docs/system/arm: xlnx-versal-virt: BBRAM and eFUSE Usage
hw/arm: xlnx-zcu102: Add Xilinx eFUSE device
hw/arm: xlnx-zcu102: Add Xilinx BBRAM device
hw/arm: xlnx-versal-virt: Add Xilinx eFUSE device
hw/arm: xlnx-versal-virt: Add Xilinx BBRAM device
hw/nvram: Introduce Xilinx battery-backed ram
hw/nvram: Introduce Xilinx ZynqMP eFuse device
hw/nvram: Introduce Xilinx Versal eFuse device
hw/nvram: Introduce Xilinx eFuse QOM
...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

qbus: Rename qbus_create_inplace() to qbus_init()

Rename qbus_create_inplace() to qbus_init(); this is more in line
with our usual naming convention for functions that in-place
initialize objects.

qbus: Rename qbus_create_inplace() to qbus_init()

Rename qbus_create_inplace() to qbus_init(); this is more in line
with our usual naming convention for functions that in-place
initialize objects.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 20210923121153.23754-5-peter.maydell@linaro.org

show more ...