Re: [PATCH v4 11/24] net: Use virtual time for net announce

On Tue Mar 12, 2024 at 9:12 PM AEST, Pavel Dovgalyuk wrote: > On 12.03.2024 14:05, Nicholas Piggin wrote: > > On Tue Mar 12, 2024 at 7:09 PM AEST, Pavel Dovgalyuk wrote: > >> This won't work, as needed. Announce timer can't be enabled, because > >> it is set in post_load function. Therefore

Re: [PATCH] target/ppc: Move floating-point arithmetic instructions to decodetree.

On Wed Mar 13, 2024 at 12:29 AM AEST, Peter Maydell wrote: > On Tue, 12 Mar 2024 at 14:25, Nicholas Piggin wrote: > > > > On Wed Mar 13, 2024 at 12:01 AM AEST, Richard Henderson wrote: > > > On 3/11/24 23:36, Nicholas Piggin wrote: > > > > [snip] > > > > > > > > > > #define FPU_HELPER(name, op,

Re: [PATCH v4 05/24] Revert "replay: stop us hanging in rr_wait_io_event"

On Wed Mar 13, 2024 at 7:03 AM AEST, Alex Bennée wrote: > "Nicholas Piggin" writes: > > > On Tue Mar 12, 2024 at 11:33 PM AEST, Alex Bennée wrote: > >> Nicholas Piggin writes: > >> > >> > This reverts commit 1f881ea4a444ef36a8b6907b0b82be4b3af253a2. > >> > > >> > That commit causes

Re: [PATCH-for-9.0 v2 0/3] system/physmem: Fix migration dirty bitmap coherency with TCG memory access

On Wed Mar 13, 2024 at 7:09 AM AEST, Peter Xu wrote: > On Tue, Mar 12, 2024 at 09:14:55PM +0100, Philippe Mathieu-Daudé wrote: > > Respin of Nicholas patch, without introducing > > tcg_cpu_physical_memory_dirty_bits_cleared(), > > and split in more digestible parts. > > > > Nicholas Piggin (2): >

Re: [PATCH-for-9.0 v2 1/3] physmem: Expose tlb_reset_dirty_range_all()

On Wed Mar 13, 2024 at 6:14 AM AEST, Philippe Mathieu-Daudé wrote: > In order to call tlb_reset_dirty_range_all() outside of > system/physmem.c, expose its prototype. > Acked-by: Nicholas Piggin > Signed-off-by: Philippe Mathieu-Daudé > --- > include/exec/exec-all.h | 1 + > system/physmem.c

Re: [PATCH v9 0/5] eBPF RSS through QMP support.

Hi Andrew: On Wed, Mar 13, 2024 at 7:11 AM Andrew Melnichenko wrote: > > Hi all, > Apparently, eBPF code from ebpf/* can't be a part of the 'common' > library - that breaks non-system/user build. I'll change it to be a > 'system' library. I've dropped some of the tracing as a workaround (due to

Re: [PATCH v9 4/5] qmp: Added new command to retrieve eBPF blob.

On Wed, Mar 13, 2024 at 7:13 AM Andrew Melnichenko wrote: > > Hi all, > I've checked - apparently, qapi/ebpf.json should be added to > MAINTAINERS - I'll fix it. I've fixed this by myself and the pull request has been merged. Thanks > > On Fri, Mar 8, 2024 at 10:14 AM Jason Wang wrote: > > >

[PATCH v4 05/23] qapi: create QAPISchemaDefinition

Include entities don't have names, but we generally expect "entities" to have names. Reclassify all entities with names as *definitions*, leaving the nameless include entities as QAPISchemaEntity instances. This is primarily to help simplify typing around expectations of what callers expect for

[PATCH v4 09/23] qapi/schema: adjust type narrowing for mypy's benefit

We already take care to perform some type narrowing for arg_type and ret_type, but not in a way where mypy can utilize the result once we add type hints, e.g.: qapi/schema.py:833: error: Incompatible types in assignment (expression has type "QAPISchemaType", variable has type

[PATCH v4 21/23] qapi/schema: add type hints

This patch only adds type hints, which aren't utilized at runtime and don't change the behavior of this module in any way. In a scant few locations, type hints are removed where no longer necessary due to inference power from typing all of the rest of creation; and any type hints that no longer

[PATCH v4 12/23] qapi: use schema.resolve_type instead of schema.lookup_type

the function lookup_type() is capable of returning None, but some callers aren't prepared for that and assume it will always succeed. For static type analysis purposes, this creates problems at those callsites. Modify resolve_type() - which already cannot ever return None - to allow 'info' and

[PATCH v4 15/23] qapi/schema: add _check_complete flag

Instead of using the None value for the members field, use a dedicated flag to detect recursive misconfigurations. This is intended to assist with subsequent patches that seek to remove the "None" value from the members field (which can never hold that value after the final call to check()) in

[PATCH v4 03/23] qapi: sort pylint suppressions

Suggested-by: Markus Armbruster Signed-off-by: John Snow --- scripts/qapi/pylintrc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/qapi/pylintrc b/scripts/qapi/pylintrc index 90546df5345..1342412c3cf 100644 --- a/scripts/qapi/pylintrc +++

[PATCH v4 07/23] qapi/schema: declare type for QAPISchemaArrayType.element_type

A QAPISchemaArrayType's element type gets resolved only during .check(). We have QAPISchemaArrayType.__init__() initialize self.element_type = None, and .check() assign the actual type. Using .element_type before .check() is wrong, and hopefully crashes due to the value being None. Works.

[PATCH v4 22/23] qapi/schema: turn on mypy strictness

This patch can be rolled in with the previous one once the series is ready for merge, but for work-in-progress' sake, it's separate here. Signed-off-by: John Snow --- scripts/qapi/mypy.ini | 5 - 1 file changed, 5 deletions(-) diff --git a/scripts/qapi/mypy.ini b/scripts/qapi/mypy.ini

[PATCH v4 14/23] qapi/schema: assert info is present when necessary

QAPISchemaInfo arguments can often be None because built-in definitions don't have such information. The type hint can only be Optional[QAPISchemaInfo] then. But, mypy gets upset about all the places where we exploit that it can't actually be None there. Add assertions that will help mypy over

[PATCH v4 13/23] qapi/schema: fix QAPISchemaArrayType.check's call to resolve_type

Adjust the expression at the callsite to work around mypy's weak type introspection that believes this expression can resolve to QAPISourceInfo; it cannot. (Fundamentally: self.info only resolves to false in a boolean expression when it is None; therefore this expression may only ever produce

[PATCH v4 18/23] qapi/schema: assert inner type of QAPISchemaVariants in check_clash()

QAPISchemaVariant's "variants" field is typed as List[QAPISchemaVariant], where the typing for QAPISchemaVariant allows its type field to be any QAPISchemaType. However, QAPISchemaVariant expects that all of its variants contain the narrower QAPISchemaObjectType. This relationship is enforced at

[PATCH v4 02/23] qapi/parser: shush up pylint

Shhh! Signed-off-by: John Snow --- scripts/qapi/parser.py | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/qapi/parser.py b/scripts/qapi/parser.py index fed88e9074d..ec4ebef4e33 100644 --- a/scripts/qapi/parser.py +++ b/scripts/qapi/parser.py @@ -607,6 +607,7 @@ class QAPIDoc:

[PATCH v4 23/23] qapi/schema: remove unnecessary asserts

With strict typing enabled, these runtime statements aren't necessary anymore; we can prove them statically. Signed-off-by: John Snow --- scripts/qapi/schema.py | 25 - 1 file changed, 25 deletions(-) diff --git a/scripts/qapi/schema.py b/scripts/qapi/schema.py index

[PATCH v4 10/23] qapi/schema: add type narrowing to lookup_type()

This function is a bit hard to type as-is; mypy needs some assertions to assist with the type narrowing. Signed-off-by: John Snow --- scripts/qapi/schema.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/qapi/schema.py b/scripts/qapi/schema.py index

[PATCH v4 08/23] qapi/schema: make c_type() and json_type() abstract methods

These methods should always return a str, it's only the default abstract implementation that doesn't. They can be marked "abstract", which requires subclasses to override the method with the proper return type. Signed-off-by: John Snow --- scripts/qapi/schema.py | 5 - 1 file changed, 4

[PATCH v4 19/23] qapi/parser: demote QAPIExpression to Dict[str, Any]

Dict[str, object] is a stricter type, but with the way that code is currently arranged, it is infeasible to enforce this strictness. In particular, although expr.py's entire raison d'être is normalization and type-checking of QAPI Expressions, that type information is not "remembered" in any

[PATCH v4 16/23] qapi/schema: Don't initialize "members" with `None`

Declare, but don't initialize the "members" field with type List[QAPISchemaObjectTypeMember]. This simplifies the typing from what would otherwise be Optional[List[T]] to merely List[T]. This removes the need to add assertions to several callsites that this value is not None - which it never will

[PATCH v4 17/23] qapi/schema: fix typing for QAPISchemaVariants.tag_member

There are two related changes here: (1) We need to perform type narrowing for resolving the type of tag_member during check(), and (2) tag_member is a delayed initialization field, but we can hide it behind a property that raises an Exception if it's called too early. This simplifies

[PATCH v4 00/23] qapi: statically type schema.py

This is *v4*, for some definitions of "version" and "four". v4: - Rebased on top of latest QAPIDoc patches. - A couple of hotfixes on top of the QAPIDoc patches. - Adjusted commit message phrasing - Changed the "split checked into checked and checking" patch and follow-up. v3: - 01: fixed

[PATCH v4 20/23] qapi/parser.py: assert member.info is present in connect_member

Signed-off-by: John Snow --- scripts/qapi/parser.py | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/qapi/parser.py b/scripts/qapi/parser.py index 2f3c704fa24..7b13a583ac1 100644 --- a/scripts/qapi/parser.py +++ b/scripts/qapi/parser.py @@ -707,6 +707,7 @@ def append_line(self, line:

[PATCH v4 11/23] qapi/schema: assert resolve_type has 'info' and 'what' args on error

resolve_type() is generally used to resolve configuration-provided type names into type objects, and generally requires valid 'info' and 'what' parameters. In some cases, such as with QAPISchemaArrayType.check(), resolve_type may be used to resolve built-in types and as such will not have an

[PATCH v4 01/23] qapi/parser: fix typo - self.returns.info => self.errors.info

Small copy-pasto. The correct info field to use in this conditional block is self.errors.info. Fixes: 3a025d3d1ffa Signed-off-by: John Snow --- scripts/qapi/parser.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/qapi/parser.py b/scripts/qapi/parser.py index

[PATCH v4 06/23] qapi/schema: declare type for QAPISchemaObjectTypeMember.type

A QAPISchemaObjectTypeMember's type gets resolved only during .check(). We have QAPISchemaObjectTypeMember.__init__() initialize self.type = None, and .check() assign the actual type. Using .type before .check() is wrong, and hopefully crashes due to the value being None. Works. However, it

[PATCH v4 04/23] qapi/schema: add pylint suppressions

With this patch, pylint is happy with the file, so enable it in the configuration. Signed-off-by: John Snow Reviewed-by: Markus Armbruster --- scripts/qapi/pylintrc | 5 - scripts/qapi/schema.py | 5 + 2 files changed, 5 insertions(+), 5 deletions(-) diff --git

RE: [PATCH v1 3/6] intel_iommu: Add a framework to check and sync host IOMMU cap/ecap

Hi Michael, >-Original Message- >From: Michael S. Tsirkin >Subject: Re: [PATCH v1 3/6] intel_iommu: Add a framework to check and >sync host IOMMU cap/ecap > >On Wed, Feb 28, 2024 at 05:44:29PM +0800, Zhenzhong Duan wrote: >> From: Yi Liu >> >> Add a framework to check and synchronize

Re: [PULL 38/68] hw/vfio/iommufd: Fix missing ERRP_GUARD() in iommufd_cdev_getfd()

This one is needed that it doesn't merge. Thanks! On Tue, Mar 12, 2024 at 06:27:29PM -0400, Michael S. Tsirkin wrote: > Date: Tue, 12 Mar 2024 18:27:29 -0400 > From: "Michael S. Tsirkin" > Subject: [PULL 38/68] hw/vfio/iommufd: Fix missing ERRP_GUARD() in > iommufd_cdev_getfd() > X-Mailer:

Re: [PULL 39/68] hw/intc: Check @errp to handle the error of IOAPICCommonClass.realize()

Hi Michael, Thanks a lot and also this one, I forgot to update the status :/, this patch has been merged (commit 4a9fafb478b5, "hw/intc: Check @errp to handle the error of IOAPICCommonClass.realize()"). Sorry to make you repeat the merge. Best Regards, Zhao On Tue, Mar 12, 2024 at 06:27:32PM

Re: [PULL 37/68] hw/pci-bridge/cxl_upstream: Fix missing ERRP_GUARD() in cxl_usp_realize()

Hi Michael, Thanks a lot and also this one, I forgot to update the status :/, this patch has been merged (commit 8cb84d7d6bd1f, "hw/pci-bridge/ cxl_upstream: Fix missing ERRP_GUARD() in cxl_usp_realize()"). Sorry to make you repeat the merge. Best Regards, Zhao On Tue, Mar 12, 2024 at

Re: [PULL 36/68] hw/misc/xlnx-versal-trng: Check returned bool in trng_prop_fault_event_set()

Hi Michael, Thanks a lot and aslo this one, I forgot to update the status :/, this patch has been merged (commit 1e0efa9735635, "hw/misc/xlnx-versal-trng: Check returned bool in trng_prop_fault_event_set()"). Sorry to make you repeat the merge. Best Regards, Zhao On Tue, Mar 12, 2024 at

Re: [PULL 35/68] hw/mem/cxl_type3: Fix missing ERRP_GUARD() in ct3_realize()

Hi Michael, Thanks a lot and aslo this one, I forgot to update the status :/, this patch has been merged (commit 294cbbf1753e, "hw/mem/cxl_type3: Fix missing ERRP_GUARD() in ct3_realize()"). Sorry to make you repeat the merge. Best Regards, Zhao On Tue, Mar 12, 2024 at 06:27:19PM -0400, Michael

Re: [PULL 34/68] hw/display/macfb: Fix missing ERRP_GUARD() in macfb_nubus_realize()

Hi Michael, Thanks a lot and aslo this one, I forgot to update the status :/, this patch has been merged (commit d470fd6acd60, "hw/display/macfb: Fix missing ERRP_GUARD() in macfb_nubus_realize()"). Best Regards, Zhao On Tue, Mar 12, 2024 at 06:27:16PM -0400, Michael S. Tsirkin wrote: > Date:

Re: [PULL 33/68] hw/cxl/cxl-host: Fix missing ERRP_GUARD() in cxl_fixed_memory_window_config()

Hi Michael, Thanks a lot and I forgot to update the status :/, this patch has been merged by Thomas (commit 5c7eedf53d44, "hw/cxl/cxl-host: Fix missing ERRP_GUARD() in cxl_fixed_memory_window_config()"). Best Regards, Zhao On Tue, Mar 12, 2024 at 06:27:12PM -0400, Michael S. Tsirkin wrote: >

[PATCH v3] target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR

Both CSRRS and CSRRC always read the addressed CSR and cause any read side effects regardless of rs1 and rd fields. Note that if rs1 specifies a register holding a zero value other than x0, the instruction will still attempt to write the unmodified value back to the CSR and will cause any

Re: [PATCH 01/15] tcg/optimize: Fold andc with immediate to and

On 3/12/24 04:38, Richard Henderson wrote: +/* Fold andc r,x,i to and r,x,~i. */ +op->opc = (ctx->type == TCG_TYPE_I32 + ? INDEX_op_and_i32 : INDEX_op_and_i64); This and the next two patches also need to handle vector types. r~

Re: [PATCH v5 15/65] i386/tdx: Get tdx_capabilities via KVM_TDX_CAPABILITIES

On Thu, Feb 29, 2024 at 01:36:36AM -0500, Xiaoyao Li wrote: > KVM provides TDX capabilities via sub command KVM_TDX_CAPABILITIES of > IOCTL(KVM_MEMORY_ENCRYPT_OP). Get the capabilities when initializing > TDX context. It will be used to validate user's setting later. > > Since there is no

Re: [PATCH v3] docs/system/ppc: Document running Linux on AmigaNG machines

Am 12. März 2024 14:34:47 UTC schrieb Nicholas Piggin : >On Tue Mar 12, 2024 at 8:36 PM AEST, Nicholas Piggin wrote: >> On Tue Mar 12, 2024 at 7:28 PM AEST, Bernhard Beschow wrote: >> > >> > >> > Am 9. März 2024 11:34:56 UTC schrieb BALATON Zoltan : >> > >On Thu, 29 Feb 2024, BALATON Zoltan

Re: [PATCH v9 4/5] qmp: Added new command to retrieve eBPF blob.

Hi all, I've checked - apparently, qapi/ebpf.json should be added to MAINTAINERS - I'll fix it. On Fri, Mar 8, 2024 at 10:14 AM Jason Wang wrote: > > On Tue, Feb 6, 2024 at 12:55 AM Andrew Melnychenko wrote: > > > > Now, the binary objects may be retrieved by id. > > It would require for future

Re: [PATCH v9 0/5] eBPF RSS through QMP support.

Hi all, Apparently, eBPF code from ebpf/* can't be a part of the 'common' library - that breaks non-system/user build. I'll change it to be a 'system' library. On Fri, Mar 8, 2024 at 10:06 AM Jason Wang wrote: > > On Fri, Mar 8, 2024 at 2:30 PM Jason Wang wrote: > > > > On Mon, Feb 26, 2024 at

[PULL 44/68] pcie_sriov: Reset SR-IOV extended capability

From: Akihiko Odaki pcie_sriov_pf_disable_vfs() is called when resetting the PF, but it only disables VFs and does not reset SR-IOV extended capability, leaking the state and making the VF Enable register inconsistent with the actual state. Replace pcie_sriov_pf_disable_vfs() with

[PULL 46/68] hw/pci: Always call pcie_sriov_pf_reset()

From: Akihiko Odaki Call pcie_sriov_pf_reset() from pci_do_device_reset() just as we do for msi_reset() and msix_reset() to prevent duplicating code for each SR-IOV PF. Signed-off-by: Akihiko Odaki Message-Id: <20240228-reuse-v8-5-282660281...@daynix.com> Reviewed-by: Michael S. Tsirkin

[PULL 56/68] hw/i386/acpi-build: Add support for SRAT Generic Initiator structures

From: Ankit Agrawal The acpi-generic-initiator object is added to allow a host device to be linked with a NUMA node. Qemu use it to build the SRAT Generic Initiator Affinity structure [1]. Add support for i386. [1] ACPI Spec 6.3, Section 5.2.16.6 Suggested-by: Jonathan Cameron Signed-off-by:

[PULL 26/68] pcie: Support PCIe Gen5/Gen6 link speeds

From: Lukas Stockner This patch extends the PCIe link speed option so that slots can be configured as supporting 32GT/s (Gen5) or 64GT/s (Gen5) speeds. This is as simple as setting the appropriate bit in LnkCap2 and the appropriate value in LnkCap and LnkCtl2. Signed-off-by: Lukas Stockner

[PULL 66/68] hmat acpi: Fix out of bounds access due to missing use of indirection

From: Jonathan Cameron With a numa set up such as -numa nodeid=0,cpus=0 \ -numa nodeid=1,memdev=mem \ -numa nodeid=2,cpus=1 and appropriate hmat_lb entries the initiator list is correctly computed and writen to HMAT as 0,2 but then the LB data is accessed using the node id (here 2), landing

[PULL 50/68] hw/i386/pc: Remove "rtc_state" link again

From: Bernhard Beschow Commit 99e1c1137b6f "hw/i386/pc: Populate RTC attribute directly" made linking the "rtc_state" property unnecessary and removed it. Commit 84e945aad2d0 "vl, pc: turn -no-fd-bootchk into a machine property" accidently reintroduced the link. Remove it again since it is not

[PULL 61/68] virtio-iommu: Add an option to define the input range width

From: Eric Auger aw-bits is a new option that allows to set the bit width of the input address range. This value will be used as a default for the device config input_range.end. By default it is set to 64 bits which is the current value. Signed-off-by: Eric Auger Reviewed-by: Zhenzhong Duan

[PULL 65/68] hmat acpi: Do not add Memory Proximity Domain Attributes Structure targetting non existent memory.

From: Jonathan Cameron If qemu is started with a proximity node containing CPUs alone, it will provide one of these structures to say memory in this node is directly connected to itself. This description is arguably pointless even if there is memory in the node. If there is no memory present,

[PULL 06/68] vdpa: add vhost_vdpa_set_dev_vring_base trace for svq mode

From: Si-Wei Liu For better debuggability and observability. Message-Id: <1707910082-10243-8-git-send-email-si-wei@oracle.com> Reviewed-by: Eugenio Pérez Acked-by: Jason Wang Signed-off-by: Si-Wei Liu Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin ---

[PULL 47/68] pc: q35: Bump max_cpus to 4096 vcpus

From: Ani Sinha Since commit f10a570b093e6 ("KVM: x86: Add CONFIG_KVM_MAX_NR_VCPUS to allow up to 4096 vCPUs") Linux kernel can support upto a maximum number of 4096 vcpus when MAXSMP is enabled in the kernel. At present, QEMU has been tested to correctly boot a linux guest with 4096 vcpus

[PULL 49/68] Revert "hw/i386/pc: Confine system flash handling to pc_sysfw"

From: Bernhard Beschow Specifying the property `-M pflash0` results in a regression: qemu-system-x86_64: Property 'pc-q35-9.0-machine.pflash0' not found Revert the change for now until a solution is found. This reverts commit 6f6ad2b24582593d8feb00434ce2396840666227. Reported-by: Volker

[PULL 10/68] vdpa: indicate transitional state for SVQ switching

From: Si-Wei Liu svq_switching indicates the transitional state whether or not SVQ mode switching is in progress, and towards which direction. Add the neccessary state around where the switching would take place. Message-Id: <1707910082-10243-12-git-send-email-si-wei@oracle.com>

[PULL 20/68] libvhost-user: Factor out search for memory region by GPA and simplify

From: David Hildenbrand Memory regions cannot overlap, and if we ever hit that case something would be really flawed. For example, when vhost code in QEMU decides to increase the size of memory regions to cover full huge pages, it makes sure to never create overlaps, and if there would be

[PULL 29/68] hw/pci-bridge/pxb-cxl: Drop RAS capability from host bridge.

From: Jonathan Cameron This CXL component isn't allowed to have a RAS capability. Whilst this should be harmless as software is not expected to look here, good to clean it up. Signed-off-by: Jonathan Cameron Message-Id: <20240215155206.2736-1-jonathan.came...@huawei.com> Reviewed-by: Michael

[PULL 23/68] libvhost-user: Factor out vq usability check

From: David Hildenbrand Let's factor it out to prepare for further changes. Reviewed-by: Raphael Norwitz Acked-by: Stefano Garzarella Signed-off-by: David Hildenbrand Message-Id: <20240214151701.29906-13-da...@redhat.com> Tested-by: Mario Casquero Reviewed-by: Michael S. Tsirkin

[PULL 27/68] vdpa: stash memory region properties in vars

From: Eugenio Pérez Next changes uses this variables, so avoid call repeatedly to memory region functions. No functional change intended. Signed-off-by: Eugenio Pérez Message-Id: <20240215103616.330518-2-epere...@redhat.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin

[PULL 53/68] hw/i386/pc: Inline pc_cmos_init() into pc_cmos_init_late() and remove it

From: Bernhard Beschow Now that pc_cmos_init() doesn't populate the X86MachineState::rtc attribute any longer, its duties can be merged into pc_cmos_init_late() which is called within machine_done notifier. This frees pc_piix and pc_q35 from explicit CMOS initialization. Signed-off-by: Bernhard

[PULL 09/68] vdpa: define SVQ transitioning state for mode switching

From: Si-Wei Liu Will be used in following patches. DISABLING(-1) means SVQ is being switched off to passthrough mode. ENABLING(1) means passthrough VQs are being switched to SVQ. DONE(0) means SVQ switching is completed. Message-Id: <1707910082-10243-11-git-send-email-si-wei@oracle.com>

[PULL 43/68] pcie_sriov: Validate NumVFs

From: Akihiko Odaki The guest may write NumVFs greater than TotalVFs and that can lead to buffer overflow in VF implementations. Cc: qemu-sta...@nongnu.org Fixes: CVE-2024-26327 Fixes: 7c0fa8dff811 ("pcie: Add support for Single Root I/O Virtualization (SR/IOV)") Signed-off-by: Akihiko Odaki

[PULL 60/68] virtio-iommu: Trace domain range limits as unsigned int

From: Eric Auger Use %u format to trace domain_range limits. Signed-off-by: Eric Auger Reviewed-by: Zhenzhong Duan Reviewed-by: Cédric Le Goater Message-Id: <20240307134445.92296-6-eric.au...@redhat.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin ---

[PULL 36/68] hw/misc/xlnx-versal-trng: Check returned bool in trng_prop_fault_event_set()

From: Zhao Liu As the comment in qapi/error, dereferencing @errp requires ERRP_GUARD(): * = Why, when and how to use ERRP_GUARD() = * * Without ERRP_GUARD(), use of the @errp parameter is restricted: * - It must not be dereferenced, because it may be null. ... * ERRP_GUARD() lifts these

[PULL 41/68] Implement SMBIOS type 9 v2.6

From: Felix Wu Signed-off-by: Felix Wu Signed-off-by: Nabih Estefan Message-Id: <20240221170027.1027325-3-nabiheste...@google.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- include/hw/firmware/smbios.h | 4 +++ hw/smbios/smbios.c | 49

[PULL 68/68] docs/specs/pvpanic: document shutdown event

From: Thomas Weißschuh Shutdown requests are normally hardware dependent. By extending pvpanic to also handle shutdown requests, guests can submit such requests with an easily implementable and cross-platform mechanism. Signed-off-by: Thomas Weißschuh Message-Id:

[PULL 34/68] hw/display/macfb: Fix missing ERRP_GUARD() in macfb_nubus_realize()

From: Zhao Liu As the comment in qapi/error, dereferencing @errp requires ERRP_GUARD(): * = Why, when and how to use ERRP_GUARD() = * * Without ERRP_GUARD(), use of the @errp parameter is restricted: * - It must not be dereferenced, because it may be null. ... * ERRP_GUARD() lifts these

[PULL 67/68] hw/cxl: Fix missing reserved data in CXL Device DVSEC

From: Jonathan Cameron The r3.1 specification introduced a new 2 byte field, but to maintain DWORD alignment, a additional 2 reserved bytes were added. Forgot those in updating the structure definition but did include them in the size define leading to a buffer overrun. Also use the define so

[PULL 37/68] hw/pci-bridge/cxl_upstream: Fix missing ERRP_GUARD() in cxl_usp_realize()

From: Zhao Liu As the comment in qapi/error, dereferencing @errp requires ERRP_GUARD(): * = Why, when and how to use ERRP_GUARD() = * * Without ERRP_GUARD(), use of the @errp parameter is restricted: * - It must not be dereferenced, because it may be null. ... * ERRP_GUARD() lifts these

[PULL 63/68] hw/arm/virt: Set virtio-iommu aw-bits default value to 48

From: Eric Auger On ARM we set 48b as a default (matching SMMUv3 SMMU_IDR5.VAX == 0). hw_compat_8_2 is used to handle the compatibility for machine types before 9.0 (default was 64 bits). Signed-off-by: Eric Auger Reviewed-by: Zhenzhong Duan Message-Id:

[PULL 22/68] libvhost-user: Use most of mmap_offset as fd_offset

From: David Hildenbrand In the past, QEMU would create memory regions that could partially cover hugetlb pages, making mmap() fail if we would use the mmap_offset as an fd_offset. For that reason, we never used the mmap_offset as an offset into the fd and instead always mapped the fd from the

[PULL 55/68] hw/acpi: Implement the SRAT GI affinity structure

From: Ankit Agrawal ACPI spec provides a scheme to associate "Generic Initiators" [1] (e.g. heterogeneous processors and accelerators, GPUs, and I/O devices with integrated compute or DMA engines GPUs) with Proximity Domains. This is achieved using Generic Initiator Affinity Structure in SRAT.

[PULL 30/68] hw/audio/virtio-sound: return correct command response size

From: Volker Rümelin The payload size returned by command VIRTIO_SND_R_PCM_INFO is wrong. The code in process_cmd() assumes that all commands return only a virtio_snd_hdr payload, but some commands like VIRTIO_SND_R_PCM_INFO may return an additional payload. Add a zero initialized payload_size

[PULL 16/68] libvhost-user: Factor out adding a memory region

From: David Hildenbrand Let's factor it out, reducing quite some code duplication and perparing for further changes. If we fail to mmap a region and panic, we now simply don't add that (broken) region. Note that we now increment dev->nregions as we are successfully adding memory regions, and

[PULL 13/68] libvhost-user: Bump up VHOST_USER_MAX_RAM_SLOTS to 509

From: David Hildenbrand Let's support up to 509 mem slots, just like vhost in the kernel usually does and the rust vhost-user implementation recently [1] started doing. This is required to properly support memory hotplug, either using multiple DIMMs (ACPI supports up to 256) or using virtio-mem.

[PULL 19/68] libvhost-user: Don't search for duplicates when removing memory regions

From: David Hildenbrand We cannot have duplicate memory regions, something would be deeply flawed elsewhere. Let's just stop the search once we found an entry. We'll add more sanity checks when adding memory regions later. Reviewed-by: Raphael Norwitz Acked-by: Stefano Garzarella

[PULL 48/68] Revert "hw/i386/pc_sysfw: Inline pc_system_flash_create() and remove it"

From: Bernhard Beschow Commit 6f6ad2b24582 "hw/i386/pc: Confine system flash handling to pc_sysfw" causes a regression when specifying the property `-M pflash0` in the PCI PC machines: qemu-system-x86_64: Property 'pc-q35-9.0-machine.pflash0' not found In order to revert the commit, the commit

[PULL 40/68] Implement base of SMBIOS type 9 descriptor.

From: Felix Wu Version 2.1+. Signed-off-by: Felix Wu Signed-off-by: Nabih Estefan Message-Id: <20240221170027.1027325-2-nabiheste...@google.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- include/hw/firmware/smbios.h | 13 + hw/smbios/smbios.c | 99

[PULL 64/68] qemu-options.hx: Document the virtio-iommu-pci aw-bits option

From: Eric Auger Document the new aw-bits option. Signed-off-by: Eric Auger Message-Id: <20240307134445.92296-10-eric.au...@redhat.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Reviewed-by: Philippe Mathieu-Daudé --- qemu-options.hx | 3 +++ 1 file changed, 3

[PULL 21/68] libvhost-user: Speedup gpa_to_mem_region() and vu_gpa_to_va()

From: David Hildenbrand Let's speed up GPA to memory region / virtual address lookup. Store the memory regions ordered by guest physical addresses, and use binary search for address translation, as well as when adding/removing memory regions. Most importantly, this will speed up GPA->VA address

[PULL 62/68] hw/i386/q35: Set virtio-iommu aw-bits default value to 39

From: Eric Auger Currently the default input range can extend to 64 bits. On x86, when the virtio-iommu protects vfio devices, the physical iommu may support only 39 bits. Let's set the default to 39, as done for the intel-iommu. We use hw_compat_8_2 to handle the compatibility for machines

[PULL 45/68] pcie_sriov: Do not reset NumVFs after disabling VFs

From: Akihiko Odaki The spec does not NumVFs is reset after disabling VFs except when resetting the PF. Clearing it is guest visible and out of spec, even though Linux doesn't rely on this value being preserved, so we never noticed. Fixes: 7c0fa8dff811 ("pcie: Add support for Single Root I/O

[PULL 28/68] vdpa: trace skipped memory sections

From: Eugenio Pérez Sometimes, certain parts are not being skipped in vhost_vdpa_listener_region_del, but they are skipped in vhost_vdpa_listener_region_add, or vice versa. The vhost-vdpa code expects all parts to maintain their properties, so we're adding a trace to help with debugging when

[PULL 24/68] libvhost-user: Dynamically remap rings after (temporarily?) removing memory regions

From: David Hildenbrand Currently, we try to remap all rings whenever we add a single new memory region. That doesn't quite make sense, because we already map rings when setting the ring address, and panic if that goes wrong. Likely, that handling was simply copied from set_mem_table code, where

[PULL 54/68] qom: new object to associate device to NUMA node

From: Ankit Agrawal NVIDIA GPU's support MIG (Mult-Instance GPUs) feature [1], which allows partitioning of the GPU device resources (including device memory) into several (upto 8) isolated instances. Each of the partitioned memory needs a dedicated NUMA node to operate. The partitions are not

[PATCH] SMBIOS: fix long lines

Break up long lines to fit under 80/90 char limit. Signed-off-by: Michael S. Tsirkin --- hw/smbios/smbios.c | 9 ++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c index e3d5d8f2e2..949c2d74a1 100644 --- a/hw/smbios/smbios.c +++

[PULL 12/68] libvhost-user: Dynamically allocate memory for memory slots

From: David Hildenbrand Let's prepare for increasing VHOST_USER_MAX_RAM_SLOTS by dynamically allocating dev->regions. We don't have any ABI guarantees (not dynamically linked), so we can simply change the layout of VuDev. Let's zero out the memory, just as we used to do. Reviewed-by: Raphael

[PULL 57/68] virtio-iommu: Add a granule property

From: Eric Auger This allows to choose which granule will be used by default by the virtio-iommu. Current page size mask default is qemu_target_page_mask so this translates into a 4k granule on ARM and x86_64 where virtio-iommu is supported. Signed-off-by: Eric Auger Reviewed-by: Philippe

[PULL 35/68] hw/mem/cxl_type3: Fix missing ERRP_GUARD() in ct3_realize()

From: Zhao Liu As the comment in qapi/error, dereferencing @errp requires ERRP_GUARD(): * = Why, when and how to use ERRP_GUARD() = * * Without ERRP_GUARD(), use of the @errp parameter is restricted: * - It must not be dereferenced, because it may be null. ... * ERRP_GUARD() lifts these

[PULL 58/68] virtio-iommu: Change the default granule to the host page size

From: Eric Auger We used to set the default granule to 4KB but with VFIO assignment it makes more sense to use the actual host page size. Indeed when hotplugging a VFIO device protected by a virtio-iommu on a 64kB/64kB host/guest config, we current get a qemu crash: "vfio: DMA mapping failed,

[PULL 38/68] hw/vfio/iommufd: Fix missing ERRP_GUARD() in iommufd_cdev_getfd()

From: Zhao Liu As the comment in qapi/error, dereferencing @errp requires ERRP_GUARD(): * = Why, when and how to use ERRP_GUARD() = * * Without ERRP_GUARD(), use of the @errp parameter is restricted: * - It must not be dereferenced, because it may be null. ... * ERRP_GUARD() lifts these

[PULL 59/68] qemu-options.hx: Document the virtio-iommu-pci granule option

From: Eric Auger We are missing an entry for the virtio-iommu-pci device. Add the information on which machine it is currently supported and document the new granule option. Signed-off-by: Eric Auger Message-Id: <20240307134445.92296-5-eric.au...@redhat.com> Reviewed-by: Michael S. Tsirkin

[PULL 33/68] hw/cxl/cxl-host: Fix missing ERRP_GUARD() in cxl_fixed_memory_window_config()

From: Zhao Liu As the comment in qapi/error, dereferencing @errp requires ERRP_GUARD(): * = Why, when and how to use ERRP_GUARD() = * * Without ERRP_GUARD(), use of the @errp parameter is restricted: * - It must not be dereferenced, because it may be null. ... * ERRP_GUARD() lifts these

[PULL 04/68] vdpa: add vhost_vdpa_set_address_space_id trace

From: Si-Wei Liu For better debuggability and observability. Message-Id: <1707910082-10243-6-git-send-email-si-wei@oracle.com> Reviewed-by: Eugenio Pérez Signed-off-by: Si-Wei Liu Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- net/vhost-vdpa.c | 3 +++

[PULL 51/68] hw/i386/pc: Avoid one use of the current_machine global

From: Bernhard Beschow The RTC can be accessed through the X86 machine instance, so rather than passing the RTC it's possible to pass the machine state instead. This avoids pc_boot_set() from having to access the current_machine global. Signed-off-by: Bernhard Beschow Message-Id:

[PULL 08/68] vdpa: add trace event for vhost_vdpa_net_load_mq

From: Si-Wei Liu For better debuggability and observability. Message-Id: <1707910082-10243-10-git-send-email-si-wei@oracle.com> Reviewed-by: Eugenio Pérez Signed-off-by: Si-Wei Liu Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- net/vhost-vdpa.c | 2 ++

[PULL 52/68] hw/i386/pc: Set "normal" boot device order in pc_basic_device_init()

From: Bernhard Beschow The boot device order may change during the lifetime of a VM. Usually, the "normal" order is set once during machine init(). However, if a user specifies `-boot once=...`, the "normal" order is overwritten by the "once" order just before machine_done, and a reset handler

[PULL 31/68] hw/virtio: check owner for removing objects

From: Albert Esteve Shared objects lack spoofing protection. For VHOST_USER_BACKEND_SHARED_OBJECT_REMOVE messages received by the vhost-user interface, any backend was allowed to remove entries from the shared table just by knowing the UUID. Only the owner of the entry shall be allowed to

  1   2   3   4   5   6   7   >