On Thu, Feb 15, 2024 at 4:29 PM Jonathan Cameron <
jonathan.came...@huawei.com> wrote:
> On Thu, 8 Feb 2024 14:50:59 +
> Jonathan Cameron wrote:
>
> > On Wed, 7 Feb 2024 17:34:15 +
> > Jonathan Cameron wrote:
> >
> > > On Fri, 2 Feb 2024 16:56:18 +
> > > Peter Maydell wrote:
> > >
Dear QEMU Community,
Two months have passed since my last submission of the patch aimed at
addressing an issue encountered with kernels prior to Linux kernel 5.3.
When using the latest version of QEMU with '-cpu host', if the host
supports the rdseed instruction but not rdseed exiting, it
On 17/02/2024 19.52, Isaac David Bermudez Lara wrote:
Hi, I am just starting out on QEMU development, and I would like to know
which tools to use. I would really appreciate it.
Hi Isaac,
please see https://wiki.qemu.org/Hosts/Linux for some hints on how to get
started.
Additionally, how
On 17/02/2024 11.02, Bibo Mao wrote:
The cdrom test skips to execute on LoongArch system with command
"make check", this patch enables cdrom test for LoongArch virt
machine platform.
With this patch, cdrom test passes to run on LoongArch virt
machine type.
Signed-off-by: Bibo Mao
---
Add
Roman Khapov writes:
> To be clear: you meant that the description of the event must be extended,
> similar to its description on the commit message? Or you don't see its proper
> usage at all?
The commit message doesn't really tell me either why and how anybody
would use @reason. Once we
The fastpath in cpu_physical_memory_sync_dirty_bitmap() to test large
aligned ranges forgot to bring the TCG TLB up to date after clearing
some of the dirty memory bitmap bits. This can result in stores though
the TCG TLB not setting the dirty memory bitmap and ultimately causes
memory corruption
On 2/14/24 15:10, Chinmay Rath wrote:
This patch moves the below instructions to decodetree specification:
{add, subf}[c,e,me,ze][o][.] : XO-form
addic[.], subfic : D-form
addex : Z23-form
This patch introduces
According to RISC-V Debug specification, there are several common
matching conditions before firing a trigger, including the enabled
privilege levels of the trigger.
This commit adds trigger_common_match() to prepare the common matching
conditions for the type 2/3/6 triggers. For now, we just
According to RISC-V Debug specification, the enabled privilege levels of
the trigger is common match conditions for all the types of the trigger.
This series modularize the code for checking the privilege levels of
type 2/3/6 triggers by implementing functions trigger_common_match()
and
We have implemented trigger_common_match(), which checks if the enabled
privilege levels of the trigger match CPU's current privilege level.
Remove the related code in riscv_cpu_debug_check_watchpoint() and invoke
trigger_common_match() to check the privilege levels of the type 2 and
type 6
We have implemented trigger_common_match(), which checks if the enabled
privilege levels of the trigger match CPU's current privilege level.
Remove the related code in riscv_cpu_debug_check_breakpoint() and invoke
trigger_common_match() to check the privilege levels of the type 2 and
type 6
We have implemented trigger_common_match(), which checks if the enabled
privilege levels of the trigger match CPU's current privilege level. We
can invoke trigger_common_match() to check the privilege levels of the
type 3 triggers.
Signed-off-by: Alvin Chang
---
target/riscv/debug.c | 2 +-
1
Hi Andrea:
On Tue, Feb 06, 2024 at 05:38:35AM -0800, Andrea Bolognani wrote:
On Tue, Feb 06, 2024 at 10:10:02AM +0800, Xianglai Li wrote:
The UEFI loading mode in loongarch is very different
from that in other architectures:loongarch's UEFI code
is in rom, while other architectures' UEFI code
Hi Andrea:
I'm very sorry for the late reply.
I just had the Spring Festival holiday,
so I replied the email as soon as I saw it.
On Tue, Feb 06, 2024 at 10:10:02AM +0800, Xianglai Li wrote:
The UEFI loading mode in loongarch is very different
from that in other architectures:loongarch's
Signed-off-by: Sergey Kambalin
---
hw/misc/bcm2838_thermal.c| 2 +-
hw/net/bcm2838_genet.c | 99
hw/net/meson.build | 2 +
hw/net/trace-events | 16 +
include/hw/arm/bcm2838_peripherals.h | 2 +
Signed-off-by: Sergey Kambalin
---
hw/misc/bcm2835_property.c | 21 +
include/hw/arm/raspberrypi-fw-defs.h | 11 +++
2 files changed, 32 insertions(+)
diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
index 5c48f8d743..bdd9a6bbce 100644
Signed-off-by: Sergey Kambalin
---
hw/net/bcm2838_genet.c | 89 ++
include/hw/net/bcm2838_genet.h | 89 ++
2 files changed, 178 insertions(+)
diff --git a/hw/net/bcm2838_genet.c b/hw/net/bcm2838_genet.c
index
Signed-off-by: Sergey Kambalin
---
hw/net/bcm2838_genet.c | 126 -
include/hw/net/bcm2838_genet.h | 3 +-
2 files changed, 126 insertions(+), 3 deletions(-)
diff --git a/hw/net/bcm2838_genet.c b/hw/net/bcm2838_genet.c
index 56ff6a6f39..1fae3ecbc2 100644
Signed-off-by: Sergey Kambalin
---
tests/qtest/bcm2838-mbox-property-test.c | 213 ++-
1 file changed, 212 insertions(+), 1 deletion(-)
diff --git a/tests/qtest/bcm2838-mbox-property-test.c
b/tests/qtest/bcm2838-mbox-property-test.c
index b251d3f552..c96a9ba3f3 100644
---
Signed-off-by: Sergey Kambalin
---
hw/arm/bcm2838_pcie.c | 82 +++
hw/arm/meson.build| 5 ++-
include/hw/arm/bcm2838_pcie.h | 53 ++
3 files changed, 139 insertions(+), 1 deletion(-)
create mode 100644
Signed-off-by: Sergey Kambalin
---
tests/qtest/bcm2838-mbox-property-test.c | 196 ++-
1 file changed, 195 insertions(+), 1 deletion(-)
diff --git a/tests/qtest/bcm2838-mbox-property-test.c
b/tests/qtest/bcm2838-mbox-property-test.c
index acb421915b..b251d3f552 100644
---
Signed-off-by: Sergey Kambalin
---
tests/avocado/boot_linux_console.py | 92 +
1 file changed, 92 insertions(+)
diff --git a/tests/avocado/boot_linux_console.py
b/tests/avocado/boot_linux_console.py
index 3f0180e1f8..40e4aa86e1 100644
---
Signed-off-by: Sergey Kambalin
---
hw/net/bcm2838_genet.c | 189 +++--
include/hw/net/bcm2838_genet.h | 2 +
2 files changed, 182 insertions(+), 9 deletions(-)
diff --git a/hw/net/bcm2838_genet.c b/hw/net/bcm2838_genet.c
index be899b68f8..56ff6a6f39 100644
Signed-off-by: Sergey Kambalin
---
tests/qtest/bcm2838-mailbox.c | 1 +
tests/qtest/bcm2838-mailbox.h | 88 +++
2 files changed, 89 insertions(+)
diff --git a/tests/qtest/bcm2838-mailbox.c b/tests/qtest/bcm2838-mailbox.c
index 0928a3dff8..1efd3c628a 100644
---
Signed-off-by: Sergey Kambalin
---
hw/arm/bcm2838_peripherals.c | 27 ++--
hw/arm/raspi4b.c | 1 -
hw/misc/bcm2838_thermal.c| 98
hw/misc/meson.build | 3 +-
include/hw/arm/bcm2838_peripherals.h | 2 +
Signed-off-by: Sergey Kambalin
---
tests/qtest/bcm2838-mailbox.h | 152 ++
1 file changed, 152 insertions(+)
diff --git a/tests/qtest/bcm2838-mailbox.h b/tests/qtest/bcm2838-mailbox.h
index 1360fbb8cf..b4f7b7b314 100644
--- a/tests/qtest/bcm2838-mailbox.h
+++
Signed-off-by: Sergey Kambalin
---
hw/gpio/bcm2838_gpio.c | 193 -
1 file changed, 190 insertions(+), 3 deletions(-)
diff --git a/hw/gpio/bcm2838_gpio.c b/hw/gpio/bcm2838_gpio.c
index a312490bbd..69d15dbb49 100644
--- a/hw/gpio/bcm2838_gpio.c
+++
Signed-off-by: Sergey Kambalin
---
hw/arm/bcm2838_peripherals.c | 6 ++
include/hw/arm/bcm2838_peripherals.h | 1 +
2 files changed, 7 insertions(+)
diff --git a/hw/arm/bcm2838_peripherals.c b/hw/arm/bcm2838_peripherals.c
index 48c5fd5978..35366386ca 100644
---
Signed-off-by: Sergey Kambalin
---
tests/qtest/bcm2838-mailbox.h | 177 ++
1 file changed, 177 insertions(+)
diff --git a/tests/qtest/bcm2838-mailbox.h b/tests/qtest/bcm2838-mailbox.h
index 9222b38bad..1360fbb8cf 100644
--- a/tests/qtest/bcm2838-mailbox.h
+++
Signed-off-by: Sergey Kambalin
---
hw/gpio/bcm2838_gpio.c | 52 +-
include/hw/gpio/bcm2838_gpio.h | 5
2 files changed, 56 insertions(+), 1 deletion(-)
diff --git a/hw/gpio/bcm2838_gpio.c b/hw/gpio/bcm2838_gpio.c
index 69d15dbb49..2ddf62f695 100644
Signed-off-by: Sergey Kambalin
---
tests/qtest/bcm2838-mailbox.c | 60 +++
tests/qtest/bcm2838-mailbox.h | 37 +
tests/qtest/meson.build | 1 +
3 files changed, 98 insertions(+)
create mode 100644 tests/qtest/bcm2838-mailbox.c
create
Signed-off-by: Sergey Kambalin
---
hw/arm/bcm2838.c | 9 +
hw/arm/bcm2838_peripherals.c | 23 +++
hw/arm/meson.build | 7 ---
hw/arm/raspi4b.c | 1 -
include/hw/arm/bcm2838_peripherals.h | 2 ++
Signed-off-by: Sergey Kambalin
---
include/hw/net/bcm2838_genet.h | 76 ++
1 file changed, 76 insertions(+)
diff --git a/include/hw/net/bcm2838_genet.h b/include/hw/net/bcm2838_genet.h
index 94c2f3ebca..e7a76cda81 100644
--- a/include/hw/net/bcm2838_genet.h
+++
Signed-off-by: Sergey Kambalin
---
hw/net/bcm2838_genet.c | 88 ++
include/hw/net/bcm2838_genet.h | 88 ++
2 files changed, 176 insertions(+)
diff --git a/hw/net/bcm2838_genet.c b/hw/net/bcm2838_genet.c
index
Signed-off-by: Sergey Kambalin
---
include/hw/net/bcm2838_genet.h | 37 ++
1 file changed, 37 insertions(+)
diff --git a/include/hw/net/bcm2838_genet.h b/include/hw/net/bcm2838_genet.h
index 1bd004785a..94c2f3ebca 100644
--- a/include/hw/net/bcm2838_genet.h
+++
Signed-off-by: Sergey Kambalin
---
hw/net/bcm2838_genet.c | 221 -
include/hw/net/bcm2838_genet.h | 17 +++
2 files changed, 237 insertions(+), 1 deletion(-)
diff --git a/hw/net/bcm2838_genet.c b/hw/net/bcm2838_genet.c
index 1fae3ecbc2..4c9b39a3ca 100644
Signed-off-by: Sergey Kambalin
---
hw/arm/bcm2838_pcie.c | 217 +-
hw/arm/trace-events | 4 +
include/hw/arm/bcm2838_pcie.h | 22
3 files changed, 241 insertions(+), 2 deletions(-)
diff --git a/hw/arm/bcm2838_pcie.c
Pre setup for BCM2838 introduction
Signed-off-by: Sergey Kambalin
---
hw/arm/bcm2836.c | 103 ++-
hw/arm/raspi.c | 2 +-
include/hw/arm/bcm2836.h | 26 +-
3 files changed, 84 insertions(+), 47 deletions(-)
diff --git
Signed-off-by: Sergey Kambalin
---
hw/arm/bcm2838.c | 6 ++
hw/arm/bcm2838_peripherals.c | 11 +++
hw/arm/raspi4b.c | 20 +---
include/hw/arm/bcm2838_peripherals.h | 2 ++
4 files changed, 20 insertions(+), 19
Signed-off-by: Sergey Kambalin
---
hw/net/bcm2838_genet.c | 265 -
include/hw/net/bcm2838_genet.h | 1 +
2 files changed, 265 insertions(+), 1 deletion(-)
diff --git a/hw/net/bcm2838_genet.c b/hw/net/bcm2838_genet.c
index 4c9b39a3ca..61c1981e10 100644
Signed-off-by: Sergey Kambalin
---
hw/arm/bcm2838.c | 167 ++-
hw/arm/trace-events | 3 +
include/hw/arm/bcm2838.h | 2 +
include/hw/arm/bcm2838_peripherals.h | 37 ++
4 files changed, 207 insertions(+), 2
Signed-off-by: Sergey Kambalin
---
docs/system/arm/raspi.rst | 11 +++
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/docs/system/arm/raspi.rst b/docs/system/arm/raspi.rst
index d0a6f08b2b..c21b27744e 100644
--- a/docs/system/arm/raspi.rst
+++ b/docs/system/arm/raspi.rst
Signed-off-by: Sergey Kambalin
---
hw/net/bcm2838_genet.c | 37
include/hw/net/bcm2838_genet.h | 77 +-
2 files changed, 113 insertions(+), 1 deletion(-)
diff --git a/hw/net/bcm2838_genet.c b/hw/net/bcm2838_genet.c
index
Signed-off-by: Sergey Kambalin
---
hw/arm/bcm2835_peripherals.c| 17 ++--
hw/arm/bcm2836.c| 2 +
hw/arm/bcm2838.c| 2 +
hw/arm/meson.build | 2 +-
hw/arm/raspi.c | 27 -
hw/arm/raspi4b.c| 70
Signed-off-by: Sergey Kambalin
---
hw/arm/bcm2838.c | 4 +
hw/arm/bcm2838_peripherals.c | 14 +
hw/arm/raspi4b.c | 1 -
hw/misc/bcm2838_rng200.c | 405 +++
hw/misc/meson.build | 1 +
Signed-off-by: Sergey Kambalin
---
tests/qtest/bcm2838-mailbox.h | 78 +++
1 file changed, 78 insertions(+)
diff --git a/tests/qtest/bcm2838-mailbox.h b/tests/qtest/bcm2838-mailbox.h
index b4f7b7b314..d753f17fb2 100644
--- a/tests/qtest/bcm2838-mailbox.h
+++
Signed-off-by: Sergey Kambalin
---
hw/arm/bcm2838_peripherals.c | 143 +++
include/hw/arm/bcm2838_peripherals.h | 8 ++
2 files changed, 151 insertions(+)
diff --git a/hw/arm/bcm2838_peripherals.c b/hw/arm/bcm2838_peripherals.c
index 06110c724f..55ae56733f
Signed-off-by: Sergey Kambalin
---
tests/qtest/bcm2838-mailbox.c| 1 -
tests/qtest/bcm2838-mbox-property-test.c | 207 +++
tests/qtest/meson.build | 2 +-
3 files changed, 208 insertions(+), 2 deletions(-)
create mode 100644
Signed-off-by: Sergey Kambalin
---
tests/qtest/bcm2838-mbox-property-test.c | 19 +++
1 file changed, 19 insertions(+)
diff --git a/tests/qtest/bcm2838-mbox-property-test.c
b/tests/qtest/bcm2838-mbox-property-test.c
index c96a9ba3f3..ff7c347e7c 100644
---
Signed-off-by: Sergey Kambalin
---
hw/arm/bcm2838.c | 98
hw/arm/bcm2838_peripherals.c | 72
hw/arm/meson.build | 2 +
include/hw/arm/bcm2838.h | 29
Pre-setup for raspberry pi 4 introduction
Signed-off-by: Sergey Kambalin
---
hw/arm/raspi.c | 112 ++--
include/hw/arm/raspi_platform.h | 21 ++
2 files changed, 85 insertions(+), 48 deletions(-)
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
Pre-setup for BCM2838 introduction
Signed-off-by: Sergey Kambalin
---
hw/arm/bcm2835_peripherals.c | 198 +++
hw/arm/bcm2836.c | 24 ++--
include/hw/arm/bcm2835_peripherals.h | 29 +++-
include/hw/arm/bcm2836.h | 3 +-
4 files
This commit adds RPi4B device tree modifications:
- disable pcie, rng200, thermal sensor and genet devices
(they're going to be re-enabled in the following commits)
- create additional memory region in device tree
if RAM amount exceeds VC base address.
Signed-off-by: Sergey Kambalin
---
Introducing Raspberry Pi 4B model.
It contains new BCM2838 SoC, PCIE subsystem,
RNG200, Thermal sensor and Genet network controller.
It can work with recent linux kernels 6.x.x.
Two avocado tests was added to check that.
Unit tests has been made as read/write operations
via mailbox properties.
Signed-off-by: Sergey Kambalin
---
hw/arm/bcm2838_peripherals.c | 3 +++
include/hw/arm/bcm2838_peripherals.h | 2 ++
include/hw/arm/raspi_platform.h | 2 +-
3 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/hw/arm/bcm2838_peripherals.c b/hw/arm/bcm2838_peripherals.c
Signed-off-by: Sergey Kambalin
---
hw/gpio/bcm2838_gpio.c | 153 +
hw/gpio/meson.build| 5 +-
include/hw/gpio/bcm2838_gpio.h | 40 +
3 files changed, 197 insertions(+), 1 deletion(-)
create mode 100644 hw/gpio/bcm2838_gpio.c
create
On Sun, Feb 18, 2024 at 01:56:07PM +0900, Akihiko Odaki wrote:
> The guest may write NumVFs greater than TotalVFs and that can lead
> to buffer overflow in VF implementations.
>
> Cc: qemu-sta...@nongnu.org
> Fixes: 7c0fa8dff811 ("pcie: Add support for Single Root I/O Virtualization
> (SR/IOV)")
On Sun, Feb 18, 2024 at 01:56:10PM +0900, Akihiko Odaki wrote:
> Use pci_rom_bar_explicitly_enabled() to determine if rombar is explicitly
> enabled.
>
> Signed-off-by: Akihiko Odaki
I see little point in all this reworks: QDict lookups are
robust. But if Alex wants this change, I won't oppose
On Sun, 18 Feb 2024, Bernhard Beschow wrote:
This series attempts to make QEMU's south bridge families PIIX, ICH9, and VIA
82xx more self-contained by integrating IO port 92 like the originals do.
In QEMU, the IO port is currently instantiated as a dedicated device in common
PC code. While this
On Sun, 18 Feb 2024 12:30:01 +0300
Michael Tokarev wrote:
> I don't maintain this code, so my email is just a random comment.
Thanks for your comment anyway!
> But I did have an issue with smbd not working right due to one
> missing/wrong parameter or another, more than once. Also, samba
> is
To be clear: you meant that the description of the event must be
extended, similar to its description on the commit message? Or you don't
see its proper usage at all?
If the first is true, then I agree, the description can be improved, and
it will be useful, thanks! Will add it in the next
This function is used once in the pc machines. Remove it since it contains one
line only.
Signed-off-by: Bernhard Beschow
---
include/hw/input/i8042.h | 1 -
hw/i386/pc.c | 2 +-
hw/input/pckbd.c | 5 -
3 files changed, 1 insertion(+), 7 deletions(-)
diff --git
Port 92 is an integral part of the PIIX and ICH south bridges, so instantiate it
there. The isapc machine now needs to instantiate it explicitly, analoguous to
the RTC.
Note that due to migration compatibility, port92 is optional in the south
bridges. It is always instantiated the isapc machine
Port 92 is an integral part of south bridges. Allow for embedding it there.
South bridges aren't architecture-specific, so move port92.c to hw/isa which is
accessible to other architectures than x86.
Signed-off-by: Bernhard Beschow
---
include/hw/i386/pc.h | 5 -
Fixes: fbd758008f0f "hw/isa: extract FDC37M81X to a separate file"
Signed-off-by: Bernhard Beschow
---
hw/isa/meson.build | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/isa/meson.build b/hw/isa/meson.build
index f650b39507..3219282217 100644
--- a/hw/isa/meson.build
+++
This series attempts to make QEMU's south bridge families PIIX, ICH9, and VIA
82xx more self-contained by integrating IO port 92 like the originals do.
In QEMU, the IO port is currently instantiated as a dedicated device in common
PC code. While this works and even results in less code, it seems
Port 92 is an integral part of the south bridge, so instantiate it there.
Signed-off-by: Bernhard Beschow
---
hw/isa/vt82c686.c | 7 +++
hw/isa/Kconfig| 1 +
2 files changed, 8 insertions(+)
diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c
index aa91942745..c7b96b3133 100644
---
Am 18. Februar 2024 10:47:26 UTC schrieb "Philippe Mathieu-Daudé"
:
>On 17/2/24 11:46, Bernhard Beschow wrote:
>> The interrupt handlers need to be populated before the device is realized
>> since
>> internal devices such as the RTC are wired during realize(). If the interrupt
>> handlers
On 16/2/24 22:45, Richard Henderson wrote:
Please include your comment
https://gitlab.com/qemu-project/qemu/-/issues/2169#note_1777369822
---
Apple differs from the standard ABI in the alignment of __int128_t.
From Apple's documentation:
When passing an argument with 16-byte alignment in
On 16/2/24 16:04, Philippe Mathieu-Daudé wrote:
sysbus_add_io(...) is a simple wrapper to
memory_region_add_subregion(get_system_io(), ...).
It is used in 3 places; inline it directly.
Rationale here is we want to move to an explicit I/O bus,
rather that an implicit one. Besides in
On 17/2/24 11:46, Bernhard Beschow wrote:
The interrupt handlers need to be populated before the device is realized since
internal devices such as the RTC are wired during realize(). If the interrupt
handlers aren't populated, devices such as the RTC will be wired with a NULL
interrupt handler,
On 2024/02/18 19:11, BALATON Zoltan wrote:
On Sun, 18 Feb 2024, Akihiko Odaki wrote:
Hi Marc-André, Paolo,
This patch has Reviewed-by: and Tested-by: but not pulled yet. Can
either of you pull this?
I think we dropped this because it's not consistent with the other help
options such as
On Sun, 18 Feb 2024, Akihiko Odaki wrote:
Hi Marc-André, Paolo,
This patch has Reviewed-by: and Tested-by: but not pulled yet. Can either of
you pull this?
I think we dropped this because it's not consistent with the other help
options such as -cpu help -device help that print the available
09.09.2023 16:23, Michael Tokarev :
A friendly ping?
A friendly ping #2?
Thanks,
/mjt
21.07.2023 14:50, Michael Tokarev wrote:
Currently qemu-binfmt-conf.sh does a number of strange things.
1. --systemd requires an argument - the CPU type to register,
while --debian (which is
18.02.2024 01:28, Henrik Carlqvist :
Still wondering if there are any plans to apply my patch or if you would like
to change anything in the patch?
Being able to set parameters in smb.conf would be really useful these days for
people running old versions of Windows like Windows XP in a qemu
Split out the function virtio_snd_pcm_set_active() from
virtio_snd_pcm_start_stop(). A later patch also needs this
new funcion. There is no functional change.
Reviewed-by: Marc-André Lureau
Signed-off-by: Volker Rümelin
---
hw/audio/virtio-snd.c | 21 -
1 file changed, 16
Split out the function virtio_snd_pcm_open() from
virtio_snd_pcm_prepare(). A later patch also needs
the new function. There is no functional change.
Reviewed-by: Marc-André Lureau
Signed-off-by: Volker Rümelin
---
hw/audio/virtio-snd.c | 57 +++
1 file
Split out virtio_snd_pcm_start_stop(). This is a preparation
for the next patch so that it doesn't become too big.
Reviewed-by: Marc-André Lureau
Signed-off-by: Volker Rümelin
---
hw/audio/trace-events | 3 ++-
hw/audio/virtio-snd.c | 57 ---
2 files
All remaining stream buffers in the stream queues must
be freed after a reset. This is the initial state of the
virtio-sound device.
Signed-off-by: Volker Rümelin
---
hw/audio/virtio-snd.c | 11 +++
1 file changed, 11 insertions(+)
diff --git a/hw/audio/virtio-snd.c
A malicious guest may trigger a segmentation fault in the tx/rx xfer
handlers. On handler entry the stream variable is initialized with
NULL. If the first element of the virtio queue has an invalid size
or an invalid stream id, the error handling code dereferences the
stream variable NULL pointer.
So far, only rudimentary checks have been made to ensure that
the guest only performs state transitions permitted in
virtio-v1.2-csd01 5.14.6.6.1 PCM Command Lifecycle. Add a state
variable per audio stream and check all state transitions.
Because only permitted state transitions are possible,
All code in virtio-snd.c runs with the BQL held. Remove the
command queue mutex and the stream queue mutexes. The qatomic
functions are also not needed.
Signed-off-by: Volker Rümelin
---
hw/audio/virtio-snd.c | 215 +++---
include/hw/audio/virtio-snd.h | 3
It is much easier to migrate an array of structs than individual
structs that are accessed via a pointer to a pointer to an array
of pointers to struct.
For this reason, allocate an array of streams in
virtio_snd_realize() and initialise all stream variables that
are constant at runtime
When a running audio stream is migrated, on average half of a
recording stream buffer is lost or half of a playback stream
buffer is played twice. Add a placeholder for the write position
of the current stream buffer to the migrated data. Additional
program code is required to resolve the above
The virtio-sound device is currently not migratable. Add the
missing VMSTATE fields, enable migration and reconnect the audio
streams after migration.
The queue_inuse[] array variables mimic the inuse variable in
struct VirtQueue which is private. They are needed to restart
the virtio queues
The payload size returned by command VIRTIO_SND_R_PCM_INFO is
wrong. The code in process_cmd() assumes that all commands
return only a virtio_snd_hdr payload, but some commands like
VIRTIO_SND_R_PCM_INFO may return an additional payload.
Add a zero initialized payload_size variable to struct
Here is the first part of my virtio-sound patches. Most of them are a
preparation to make migration work. Patch 10/11 enables migration.
The second part isn't finished yet and will have to do with virtio-sound
jack and channel maps configuration and migration.
Patch 01/11 "hw/audio/virtio-sound:
Am 05.01.24 um 12:36 schrieb Marc-André Lureau:
> Hi
>
> On Fri, Jan 5, 2024 at 12:34 AM Volker Rümelin wrote:
>> The payload size returned by command VIRTIO_SND_R_PCM_INFO is
>> wrong. The code in process_cmd() assumes that all commands
>> return only a virtio_snd_hdr payload, but some commands
88 matches
Mail list logo