git.maquefel.me Git - qemu.git/log

rust: allow using build-root bindings.rs from cargo

Right now, using cargo with QEMU requires copying by hand the bindings.rs to the
source tree. Instead, we can use an include file to escape the cage of cargo's
mandated source directory structure.

By running cargo within meson's "devenv" and adding a MESON_BUILD_ROOT
environment variable, it is easy for build.rs to find the file. However, the
file must be symlinked into cargo's output directory for rust-analyzer to find
it.

Suggested-by: Junjie Mao <junjie.mao@hotmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

rust: apply --cfg MESON to all crates

We might have more uses for --cfg MESON, even though right now it's only
qemu-api that has generated files. Since we're going to add more flags
to the add_project_arguments calls for Rust, it makes sense to also add
--cfg MESON everywhere.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

ci: enable rust in the Debian and Ubuntu system build job

We have fixed all incompatibilities with older versions of rustc
and bindgen. Enable Rust on Debian to check that the minimum
supported version of Rust is indeed 1.63.0, and 0.60.x for bindgen.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Update version for v9.2.0 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Update version for v9.2.0-rc3 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'chr-pull-request' of https://gitlab.com/marcandre.lureau/qemu into staging

chardev patch queue

# -----BEGIN PGP SIGNATURE-----
#
# iQJQBAABCAA6FiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmdPCg4cHG1hcmNhbmRy
# ZS5sdXJlYXVAcmVkaGF0LmNvbQAKCRDa6OEJdZac5dmTD/4pNcJ7fJzzxtfBDBvy
# +NWlq7nFDOX471g1B+4V91dOT0TbQLRK0hTmPUGc7FF8sCCDgfZOyHN6GA7TdwXG
# 8+oHqFjxaZcrtrSN67wv8n5tyFNm/1hr1IgqhieKjeVt6eT8PJ8rgFESm4zvDOej
# i2jjhDNN2piu9Lr9smhX3I/kJX70cPXRRX2qBlLEPcMKW280RoTRSEIL1jFdilan
# QyPugQm9R0cSayNg27At2HakFZ5HKgu8EyAvvMFvv1gdoGVdq9D+Gk5xruvBnF/P
# 4g7EnCe/YKWfg887LSjIA2Qcp1xEpUPeumUbCm152ikZ7KnwE9Tn/hPt693GjvMn
# WhyOOuxZmvL4AtJbYheskH7N0b/NB2vUT4N4ONkMeubjzfDu8UHw/rL+WpjAZfXW
# YwzcpVHKXXKazTzzKRLUgsoqfllWLTAQDwU5s46UyVmaBBf5qUSbSnr4ZX2nP0X6
# dP1jM2KcDyaKKowmpYGyQzTVqPwTXfyEdmSNnjirbS2Qyh77snd7rqrxXPz2jKm9
# jfb0yN7BWSEuFguyXL0izeCQsBb/rsrZB/tOYWkUeOzAgpm4GlAQuJ+3uAssgmnu
# aq/bYxGEjC1a+fzg8KUj6S+X+Jfp6+4/Y60M4HAMtMGuy6X1UaCBtH+cntS3JjUj
# 7ZBpTXirstW7KxKZ2mJMa2lkHQ==
# =34fm
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 03 Dec 2024 13:39:26 GMT
# gpg:                using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg:                issuer "marcandre.lureau@redhat.com"
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full]
# gpg:                 aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full]
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276  F62D DAE8 E109 7596 9CE5

* tag 'chr-pull-request' of https://gitlab.com/marcandre.lureau/qemu:
  chardev: Remove __-prefixed names
  chardev: Fix record/replay error path NULL deref in device creation

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'hw-misc-20241203' of https://github.com/philmd/qemu into staging

Misc fixes for QEMU v9.2.0

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmdO66kACgkQ4+MsLN6t
# wN4dGw//ZSVZO/cdOc1izC44mCPjnHkhSjX5i12E09QnDfNQ9cef2pG50lsndm3N
# xJwunST+Hqfoh07YT4zuGSO+60BiiPsPse+ytnuHK0E4wLbIfrWzPcf1CMRDk3wf
# O4IniCv8O7BRYccK1iPkFI8ZVqK84m3Bn1tQ51LOy09b6om7jIqNwlxWxGYqkWCR
# l+9RxW/IKWD3OrveBATEhD1lwoUBIYPPzdm6NayEdOJXGOgnvbNbtmuRCR8dCxCS
# RUH3GZu0vvRTpOYjFzeR9Xy+CE1vcOeKsZf35QwV4eX8+UKv30HgF6J8fInkS60m
# EqPA+AU7fi+DN3Ua1Jx38wXHPr8mPTQoVGV6q0UB8b3B22kPQn+Mu8jHLyMOp4rK
# 6JEX5cAOZuwBEk0I8VjwqeDGVYgFwnMHhVuss0N4kCvP0qQcC2JMGMW0Rk4Lxw16
# q0kwbQ0c56+qET57EOf9VW40Yb1q3Zu9t39XfNO/m3KGLkVSPfFZEu5voWD14mZW
# RutPlG/ww3n878Xz06YsqYF0ED/0SiW8U1tmEzg+X9vA/7Z7/0MH0rleNb36a0Fs
# 0aDq/mZBcnFLKy+9rlpy18OolY/N6LZnebCpdQe5wSRn/ioWDc4/GyIaLO9lSE5o
# TFHmGtIIQ2FoeRgtwCSfVNwaA6ILgPRsgXFDOqxCUplgKv6GX2Q=
# =GZ/H
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 03 Dec 2024 11:29:45 GMT
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'hw-misc-20241203' of https://github.com/philmd/qemu:
  system: Select HVF by default when no other accelerator is available
  tests/qtest: add test for querying balloon guest stats
  tests/qtest: drop 'fuzz-' prefix from virtio-balloon test
  hw/virtio: fix crash in processing balloon stats
  hw/display/vga: Do not reset 'big_endian_fb' in vga_common_reset()
  target/riscv: Avoid bad shift in riscv_cpu_do_interrupt()
  hw/core/machine: diagnose wrapping of maxmem
  MAINTAINERS: update email addr for Brian Cain
  meson: Add missing SDL dependency to system/main.c
  MAINTAINERS: add myself as the maintainer for LoongArch VirtMachine
  ui/cocoa: Temporarily ignore annoying deprecated declaration warnings
  hw/openrisc/openrisc_sim: keep serial@90000000 as default
  hw/openrisc: Fixed undercounting of TTCR in continuous mode

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'pull-or1k-20241203' of https://github.com/stffrdhrn/qemu into staging

OpenRISC updates for 9.2.0

This series has 2 fixes:
- Fix to keep serial@90000000 as default
- Fixed undercounting of TTCR in continuous mode

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE2cRzVK74bBA6Je/xw7McLV5mJ+QFAmdO56EACgkQw7McLV5m
# J+T8BRAAxZMH4ykdRJBmYiFVOsYKagcdT6GGBHL44FGeQSr1lNyoU0Rn5r6v5GHe
# Nwq7DTeZlKoVji5GXki53mGrwENXr00m+xfc9ACMoWr5IM6McQUPXlQAQ/50fIGs
# lzXMZH/4EdPIVkkpCi+y8FLYw02oQg61U9G0HW02lQJy4Y4mudtvQFGzJ7f3SIZ3
# EkKn5YLG0bqszq/amFNLQXlbnq3yI5zfcMHhHx0KuDsm2yNhrNA+AJP8tLI3JlxL
# +0YIA+fWuxQzz8Zu9+ckc8VAV83HIgQpXVzI6rQxdSwbmRgUu9ITO09ZmxaDHZF6
# sDI6K3VouyaHJVkvu4coDajpYTjHLE26c9LAlaVBpgdnmnYy4vlndEqbfaBqOouX
# n0N2wJ3IGouIw7AnB9dTaZhM/Uo09hZKDr6kCm3hLfPn2+vi3yxsbwVwLaOpH3G3
# kQ5ZFKjoA7XWOaXGOUMcmhByXkSxja+pSBppB58vJAFyVp73HYIpea3/q1Zd8S4S
# noJoqxDtD2zf26bDBIe83pUEnSnL8fAcsh3rlQP8HrWYhU7ZulVSE1ZvPkPgDpkY
# LVCPautTElsMp2Mg4a2oODGvSDN4/5h2dp6TaK4Qep92HHFOwPZQBQW607VwWR5N
# II8dB/l8PluKkgZ3ymhP1p9JAAZFe9a2cMmegRIiM74PkPty0kk=
# =guIi
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 03 Dec 2024 11:12:33 GMT
# gpg:                using RSA key D9C47354AEF86C103A25EFF1C3B31C2D5E6627E4
# gpg: Good signature from "Stafford Horne <shorne@gmail.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: D9C4 7354 AEF8 6C10 3A25  EFF1 C3B3 1C2D 5E66 27E4

* tag 'pull-or1k-20241203' of https://github.com/stffrdhrn/qemu:
  hw/openrisc: Fixed undercounting of TTCR in continuous mode
  hw/openrisc/openrisc_sim: keep serial@90000000 as default

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

chardev: Remove __-prefixed names

Peter points out double underscore prefix names tend to be reserved
for the system. Clean these up.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20240828043337.14587-3-npiggin@gmail.com>

chardev: Fix record/replay error path NULL deref in device creation

qemu_chardev_set_replay() was being called in chardev creation to
set up replay parameters even if the chardev is NULL.

A segfault can be reproduced by specifying '-serial chardev:bad' with
an rr=record mode.

Fix this with a NULL pointer check.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Resolves: Coverity CID 1559470
Fixes: 4c193bb129dae ("chardev: set record/replay on the base device of a muxed device")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20240828043337.14587-2-npiggin@gmail.com>

system: Select HVF by default when no other accelerator is available

When testing with a HVF-only binary, we get:

   3/12 qemu:func-quick+func-aarch64 / func-aarch64-version                                      ERROR            0.29s   exit status 1
  stderr:
  Traceback (most recent call last):
    File "tests/functional/test_version.py", line 22, in test_qmp_human_info_version
      self.vm.launch()
    File "machine/machine.py", line 461, in launch
      raise VMLaunchFailure(
  qemu.machine.machine.VMLaunchFailure: ConnectError: Failed to establish session: EOFError
      Exit code: 1
      Command: build/qemu-system-aarch64 -display none -vga none -chardev socket,id=mon,fd=5 -mon chardev=mon,mode=control -machine none -nodefaults
      Output: qemu-system-aarch64: No accelerator selected and no default accelerator available

Fix by checking for HVF in configure_accelerators() and using
it by default when no other accelerator is available.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20241203094232.62232-1-philmd@linaro.org>

tests/qtest: add test for querying balloon guest stats

This test would have identified the crash caused by the addition of new
balloon stats fields.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20241129135507.699030-4-berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

tests/qtest: drop 'fuzz-' prefix from virtio-balloon test

This test file is expected to be extended for arbitrary virtio-balloon
related tests, not merely those discovered by fuzzing.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20241129135507.699030-3-berrange@redhat.com>
[PMD: Update MAINTAINERS]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Michael S. Tsirkin <mst@redhat.com>

hw/virtio: fix crash in processing balloon stats

balloon_stats_get_all will iterate over guest stats upto the max
VIRTIO_BALLOON_S_NR value, calling visit_type_uint64 to populate
the QObject dict. The dict keys are obtained from the static
array balloon_stat_names which is VIRTIO_BALLOON_S_NR in size.

Unfortunately the way that array is declared results in any
unassigned stats getting a NULL name, which will then cause
visit_type_uint64 to trigger an assert in qobject_output_add_obj.

The balloon_stat_names array was fortunately fully populated with
names until recently:

  commit 0d2eeef77a33315187df8519491a900bde4a3d83
  Author: Bibo Mao <maobibo@loongson.cn>
  Date:   Mon Oct 28 10:38:09 2024 +0800

    linux-headers: Update to Linux v6.12-rc5

pulled a change to include/standard-headers/linux/virtio_balloon.h
which increased VIRTIO_BALLOON_S_NR by 6, and failed to add the new
names to balloon_stat_names.

This commit fills in the missing names, and uses a static assert to
guarantee that any future changes to VIRTIO_BALLOON_S_NR will cause
a build failure until balloon_stat_names is updated.

This problem was detected by the Cockpit Project's automated
integration tests on QEMU 9.2.0-rc1.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2329448
Fixes: 0d2eeef77a3 ("linux-headers: Update to Linux v6.12-rc5")
Reported-by: Martin Pitt <mpitt@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20241129135507.699030-2-berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/display/vga: Do not reset 'big_endian_fb' in vga_common_reset()

The 'pci-vga' device allow setting a 'big-endian-framebuffer'
property since commit 3c2784fc864 ("vga: Expose framebuffer
byteorder as a QOM property"). Similarly, the 'virtio-vga'
device since commit 8be61ce2ce3 ("virtio-vga: implement
big-endian-framebuffer property").

Both call vga_common_reset() in their reset handler, respectively
pci_secondary_vga_reset() and virtio_vga_base_reset_hold(), which
reset 'big_endian_fb', overwritting the property. This is not
correct: the hardware is expected to keep its configured
endianness during resets.

Move 'big_endian_fb' assignment from vga_common_reset() to
vga_common_init() which is called once when the common VGA state
is initialized.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Message-Id: <20241129101721.17836-2-philmd@linaro.org>

target/riscv: Avoid bad shift in riscv_cpu_do_interrupt()

In riscv_cpu_do_interrupt() we use the 'cause' value we got out of
cs->exception as a shift value.  However this value can be larger
than 31, which means that "1 << cause" is undefined behaviour,
because we do the shift on an 'int' type.

This causes the undefined behaviour sanitizer to complain
on one of the check-tcg tests:

$ UBSAN_OPTIONS=print_stacktrace=1:abort_on_error=1:halt_on_error=1 ./build/clang/qemu-system-riscv64 -M virt -semihosting -display none -device loader,file=build/clang/tests/tcg/riscv64-softmmu/issue1060
../../target/riscv/cpu_helper.c:1805:38: runtime error: shift exponent 63 is too large for 32-bit type 'int'
    #0 0x55f2dc026703 in riscv_cpu_do_interrupt /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/clang/../../target/riscv/cpu_helper.c:1805:38
    #1 0x55f2dc3d170e in cpu_handle_exception /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/clang/../../accel/tcg/cpu-exec.c:752:9

In this case cause is RISCV_EXCP_SEMIHOST, which is 0x3f.

Use 1ULL instead to ensure that the shift is in range.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Fixes: 1697837ed9 ("target/riscv: Add M-mode virtual interrupt and IRQ filtering support.")
Fixes: 40336d5b1d ("target/riscv: Add HS-mode virtual interrupt and IRQ filtering support.")
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241128103831.3452572-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/core/machine: diagnose wrapping of maxmem

The 'maxmem' parameter parsed on the command line is held in uint64_t
and then assigned to the MachineState field that is 'ram_addr_t'. This
assignment will wrap on 32-bit hosts, silently changing the user's
config request if it were over-sized.

Improve the existing diagnositics for validating 'size', and add the
same diagnostics for 'maxmem'

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Tested-by: Ani Sinha <anisinha@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Message-ID: <20241127114057.255995-1-berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

MAINTAINERS: update email addr for Brian Cain

Also: add mapping for "quic_bcain@quicinc.com" which was ~briefly
used for some replies to mailing list traffic.

Signed-off-by: Brian Cain <bcain@quicinc.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20241123164641.364748-2-bcain@quicinc.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

meson: Add missing SDL dependency to system/main.c

When building QEMU configure with --disable-gtk --disable-cocoa
on macOS we get:

  User interface
    Cocoa support                   : NO
    SDL support                     : YES 2.30.5
    SDL image support               : NO
    GTK support                     : NO
    pixman                          : YES 0.42.2
    VTE support                     : NO
    PNG support                     : YES 1.6.43
    VNC support                     : YES
    VNC SASL support                : YES
    VNC JPEG support                : YES 3.0.3
    spice protocol support          : YES 0.14.4
      spice server support          : NO
    curses support                  : YES
    brlapi support                  : NO

  User defined options
    cocoa                           : disabled
    docs                            : disabled
    gtk                             : disabled

  ../system/main.c:30:10: fatal error: 'SDL.h' file not found
     30 | #include <SDL.h>
        |          ^~~~~~~
  1 error generated.

Fix by adding the SDL dependency to main.c it's CFLAGS contains
the SDL include directory.

Fixes: 64ed6f92ff ("meson: link emulators without Makefile.target")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20241120114943.85080-1-philmd@linaro.org>

MAINTAINERS: add myself as the maintainer for LoongArch VirtMachine

Song Gao is will be sick leave for a long time, I apply for maintainer
for LoongArch Virt Machine during this period, LoongArch TCG keeps unchanged
since I am not familiar with it. The maintainer duty will transfer to him
after he comes back to work.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Acked-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20241112073714.1953481-1-maobibo@loongson.cn>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

ui/cocoa: Temporarily ignore annoying deprecated declaration warnings

These warnings are breaking some build configurations since 2 months
now (https://gitlab.com/qemu-project/qemu/-/issues/2575):

  ui/cocoa.m:662:14: error: 'CVDisplayLinkCreateWithCGDisplay' is deprecated: first deprecated in macOS 15.0 - use NSView.displayLink(target:selector:), NSWindow.displayLink(target:selector:), or NSScreen.displayLink(target:selector:)  [-Werror,-Wdeprecated-declarations]
    662 |         if (!CVDisplayLinkCreateWithCGDisplay(display, &displayLink)) {
        |              ^
  /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/CoreVideo.framework/Headers/CVDisplayLink.h:89:20: note: 'CVDisplayLinkCreateWithCGDisplay' has been explicitly marked deprecated here
     89 | CV_EXPORT CVReturn CVDisplayLinkCreateWithCGDisplay(
        |                    ^
  ui/cocoa.m:663:29: error: 'CVDisplayLinkGetNominalOutputVideoRefreshPeriod' is deprecated: first deprecated in macOS 15.0 - use NSView.displayLink(target:selector:), NSWindow.displayLink(target:selector:), or NSScreen.displayLink(target:selector:)  [-Werror,-Wdeprecated-declarations]
    663 |             CVTime period = CVDisplayLinkGetNominalOutputVideoRefreshPeriod(displayLink);
        |                             ^
  /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/CoreVideo.framework/Headers/CVDisplayLink.h:182:18: note: 'CVDisplayLinkGetNominalOutputVideoRefreshPeriod' has been explicitly marked deprecated here
    182 | CV_EXPORT CVTime CVDisplayLinkGetNominalOutputVideoRefreshPeriod( CVDisplayLinkRef CV_NONNULL displayLink );
        |                  ^
  ui/cocoa.m:664:13: error: 'CVDisplayLinkRelease' is deprecated: first deprecated in macOS 15.0 - use NSView.displayLink(target:selector:), NSWindow.displayLink(target:selector:), or NSScreen.displayLink(target:selector:)  [-Werror,-Wdeprecated-declarations]
    664 |             CVDisplayLinkRelease(displayLink);
        |             ^
  /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/CoreVideo.framework/Headers/CVDisplayLink.h:249:16: note: 'CVDisplayLinkRelease' has been explicitly marked deprecated here
    249 | CV_EXPORT void CVDisplayLinkRelease( CV_RELEASES_ARGUMENT CVDisplayLinkRef CV_NULLABLE displayLink );
        |                ^
  3 errors generated.

For the next release, ignore the warnings using #pragma directives.
At least until we figure the correct new API usage.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Phil Dennis-Jordan <phil@philjordan.eu>
Tested-by: Phil Dennis-Jordan <phil@philjordan.eu>
Message-Id: <20241121131954.98949-1-philmd@linaro.org>

hw/openrisc/openrisc_sim: keep serial@90000000 as default

We used to only have a single UART on the platform and it was located at
address 0x90000000. When the number of UARTs was increased to 4, the
first UART remained at it's location, but instead of being the first one
to be registered, it became the last.

This caused QEMU to pick 0x90000300 as the default UART, which broke
software that hardcoded the address of 0x90000000 and expected it's
output to be visible when the user configured only a single console.

This caused regressions[1] in the barebox test suite when updating to a
newer QEMU. As there seems to be no good reason to register the UARTs in
inverse order, let's register them by ascending address, so existing
software can remain oblivious to the additional UART ports.

Changing the order of uart registration alone breaks Linux which
was choosing the UART at 0x90000300 as the default for ttyS0.  To fix
Linux we fix three things in the device tree:

1. Define stdout-path only one time for the first registered UART
    instead of incorrectly defining for each UART.
2. Change the UART alias name from 'uart0' to 'serial0' as almost all
    Linux tty drivers look for an alias starting with "serial".
3. Add the UART nodes so they appear in the final DTB in the
    order starting with the lowest address and working upwards.

In summary these changes mean that the QEMU default UART (serial_hd(0))
is now setup where:

* serial_hd(0) is the lowest-address UART
* serial_hd(0) is listed first in the DTB
* serial_hd(0) is the /chosen/stdout-path one
* the /aliases/serial0 alias points at serial_hd(0)

[1]: https://lore.barebox.org/barebox/707e7c50-aad1-4459-8796-0cc54bab32e2@pengutronix.de/T/#m5da26e8a799033301489a938b5d5667b81cef6ad

[stafford: Change to serial0 alias and update change message, reverse
uart registration order]

Fixes: 777784bda468 ("hw/openrisc: support 4 serial ports in or1ksim")
Cc: qemu-stable@nongnu.org
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Stafford Horne <shorne@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20241203110536.402131-2-shorne@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/openrisc: Fixed undercounting of TTCR in continuous mode

In the existing design, TTCR is prone to undercounting when running in
continuous mode. This manifests as a timer interrupt appearing to
trigger a few cycles prior to the deadline set in SPR_TTMR_TP.

When the timer triggers, the virtual time delta in nanoseconds between
the time when the timer was set, and when it triggers is calculated.
This nanoseconds value is then divided by TIMER_PERIOD (50) to compute
an increment of cycles to apply to TTCR.

However, this calculation rounds down the number of cycles causing the
undercounting.

A simplistic solution would be to instead round up the number of cycles,
however this will result in the accumulation of timing error over time.

This patch corrects the issue by calculating the time delta in
nanoseconds between when the timer was last reset and the timer event.
This approach allows the TTCR value to be rounded up, but without
accumulating error over time.

Signed-off-by: Joel Holdsworth <jholdsworth@nvidia.com>
[stafford: Incremented version in vmstate_or1k_timer, checkpatch fixes]
Signed-off-by: Stafford Horne <shorne@gmail.com>
Message-ID: <20241203110536.402131-3-shorne@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/openrisc: Fixed undercounting of TTCR in continuous mode

In the existing design, TTCR is prone to undercounting when running in
continuous mode. This manifests as a timer interrupt appearing to
trigger a few cycles prior to the deadline set in SPR_TTMR_TP.

When the timer triggers, the virtual time delta in nanoseconds between
the time when the timer was set, and when it triggers is calculated.
This nanoseconds value is then divided by TIMER_PERIOD (50) to compute
an increment of cycles to apply to TTCR.

However, this calculation rounds down the number of cycles causing the
undercounting.

A simplistic solution would be to instead round up the number of cycles,
however this will result in the accumulation of timing error over time.

This patch corrects the issue by calculating the time delta in
nanoseconds between when the timer was last reset and the timer event.
This approach allows the TTCR value to be rounded up, but without
accumulating error over time.

Signed-off-by: Joel Holdsworth <jholdsworth@nvidia.com>
[stafford: Incremented version in vmstate_or1k_timer, checkpatch fixes]
Signed-off-by: Stafford Horne <shorne@gmail.com>

hw/openrisc/openrisc_sim: keep serial@90000000 as default

We used to only have a single UART on the platform and it was located at
address 0x90000000. When the number of UARTs was increased to 4, the
first UART remained at it's location, but instead of being the first one
to be registered, it became the last.

This caused QEMU to pick 0x90000300 as the default UART, which broke
software that hardcoded the address of 0x90000000 and expected it's
output to be visible when the user configured only a single console.

This caused regressions[1] in the barebox test suite when updating to a
newer QEMU. As there seems to be no good reason to register the UARTs in
inverse order, let's register them by ascending address, so existing
software can remain oblivious to the additional UART ports.

Changing the order of uart registration alone breaks Linux which
was choosing the UART at 0x90000300 as the default for ttyS0.  To fix
Linux we fix three things in the device tree:

1. Define stdout-path only one time for the first registered UART
    instead of incorrectly defining for each UART.
2. Change the UART alias name from 'uart0' to 'serial0' as almost all
    Linux tty drivers look for an alias starting with "serial".
3. Add the UART nodes so they appear in the final DTB in the
    order starting with the lowest address and working upwards.

In summary these changes mean that the QEMU default UART (serial_hd(0))
is now setup where:

* serial_hd(0) is the lowest-address UART
* serial_hd(0) is listed first in the DTB
* serial_hd(0) is the /chosen/stdout-path one
* the /aliases/serial0 alias points at serial_hd(0)

[1]: https://lore.barebox.org/barebox/707e7c50-aad1-4459-8796-0cc54bab32e2@pengutronix.de/T/#m5da26e8a799033301489a938b5d5667b81cef6ad

Fixes: 777784bda468 ("hw/openrisc: support 4 serial ports in or1ksim")
Cc: qemu-stable@nongnu.org
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
[stafford: Change to serial0 alias and update change message, reverse
uart registration order]
Signed-off-by: Stafford Horne <shorne@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'pull-nvme-20241203' of https://gitlab.com/birkelund/qemu into staging

nvme queue

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmdOpR0ACgkQTeGvMW1P
# DenTOgf/S4+yjo1pkOIyWoDEQZ434eOwXeUqcM8taGwwRB/IyulFBbGexkY8Feu3
# iCYA78FTtGcTCIKWc0ze5TsA2abbrX1mB1IxR3keeYPdQyZPacfxXG5qjjeygU0N
# 2Ws6UZBFZDNBkLxasT6yHBl9oHriz91IjksA62FYr1pXGHfLbluWTyKYghPfoY4t
# ifc0tTSinhsFjKixRvuyUo7AWd+jm29QJbcfhckcPTVZ52VE5FUGg0bWvdLk/zWY
# K4qlPVa2MngV3fSY04Qt1lHuLUCegiHMCjyJHvN3S2nxhJLSWLyE/RU9zUJCXFsd
# HvJ7nKxq8GODjLNghsjOzdL1rxQPdA==
# =yOQB
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 03 Dec 2024 06:28:45 GMT
# gpg:                using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9
# gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [full]
# gpg:                 aka "Klaus Jensen <k.jensen@samsung.com>" [full]
# Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468  4272 63D5 6FC5 E55D A838
#      Subkey fingerprint: 5228 33AA 75E2 DCE6 A247  66C0 4DE1 AF31 6D4F 0DE9

* tag 'pull-nvme-20241203' of https://gitlab.com/birkelund/qemu:
  hw/nvme: take a reference on the subsystem on vf realization
  hw/nvme: SR-IOV VFs must hardwire pci interrupt pin register to zero
  hw/nvme: fix use/unuse of msix vectors
  hw/nvme: fix msix_uninit with exclusive bar

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'migration-20241202-pull-request' of https://gitlab.com/peterx/qemu into staging

Migration pull for 9.2-rc3

- Prasad's one fix on thread name typo

# -----BEGIN PGP SIGNATURE-----
#
# iIgEABYKADAWIQS5GE3CDMRX2s990ak7X8zN86vXBgUCZ04mxBIccGV0ZXJ4QHJl
# ZGhhdC5jb20ACgkQO1/MzfOr1wbyegEAxWBfoGpPoysYOe+ijwMZKgsXylWzHrfJ
# HGlVck7f1RQA/jAwS8aR3t6QZwhL42lXfAlGPX2ebz4IL+f52qs6/nQP
# =L+tL
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 02 Dec 2024 21:29:40 GMT
# gpg:                using EDDSA key B9184DC20CC457DACF7DD1A93B5FCCCDF3ABD706
# gpg:                issuer "peterx@redhat.com"
# gpg: Good signature from "Peter Xu <xzpeter@gmail.com>" [marginal]
# gpg:                 aka "Peter Xu <peterx@redhat.com>" [marginal]
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: B918 4DC2 0CC4 57DA CF7D  D1A9 3B5F CCCD F3AB D706

* tag 'migration-20241202-pull-request' of https://gitlab.com/peterx/qemu:
  migration: correct multifd receive thread name

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

hw/nvme: take a reference on the subsystem on vf realization

Make sure we grab a reference on the subsystem when a VF is realized.
Otherwise, the subsytem will be unrealized automatically when the VFs
are unregistered and unreffed.

This fixes a latent bug but was not exposed until commit 08f632848008
("pcie: Release references of virtual functions"). This was then fixed
(or rather, hidden) by commit c613ad25125b ("pcie_sriov: Do not manually
unrealize"), but that was then reverted (due to other issues) in commit
b0fdaee5d1ed, exposing the bug yet again.

Cc: qemu-stable@nongnu.org
Fixes: 08f632848008 ("pcie: Release references of virtual functions")
Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>

hw/nvme: SR-IOV VFs must hardwire pci interrupt pin register to zero

The PCI Interrupt Pin Register does not apply to VFs and MUST be
hardwired to zero.

Fixes: 44c2c09488db ("hw/nvme: Add support for SR-IOV")
Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>

hw/nvme: fix use/unuse of msix vectors

Only call msix_{un,}use_vector() when interrupts are actually enabled
for a completion queue.

Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>

hw/nvme: fix msix_uninit with exclusive bar

Commit fa905f65c554 introduced a machine compatibility parameter to
enable an exclusive bar for msix. It failed to account for this when
cleaning up. Make sure that if an exclusive bar is enabled, we use the
proper cleanup routine.

Cc: qemu-stable@nongnu.org
Fixes: fa905f65c554 ("hw/nvme: add machine compatibility parameter to enable msix exclusive bar")
Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>

migration: correct multifd receive thread name

Multifd receive threads run on the destination side.
Correct the thread name marco to indicate the same.

Fixes: e620b1e4770b ("migration: Put thread names together with macros")
Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20241127111528.167330-1-ppandit@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>

Merge tag 'pull-request-2024-12-02' of https://gitlab.com/thuth/qemu into staging

* Fix timeouts in arm-sx1 test
* Check for the "pc" machine in the virtio_version and acpi-bits tests

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmdNvDsRHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbXEDBAAkGHlPrQ9JVDjR+SHn4Bjl7DOQbKuLq1T
# MXPSOUvYtX7/F0WOMBXQOXj86iv3HphvlQD/kFYfdogC8trE1gLyk2vGQnwkr0FK
# cZRQZb9wdg8XYJEP++59WEQL8MIS+TcQkjqpUXbT5T3ZSmODc1FMEZinsvChM/C/
# XC6VcRAibpQ6k7189ORWZfmjlbnxbS95+NJ2FZ/c2oyFbA2fJneef5RWcp/0/1hx
# isjRDI9wTb+l12JcRn06Osh9KyjUbz3qaN7HIrsMoMHYtsYOCn4r/MKD56iGp2Aw
# G86nwGyNIZBcfadnL792gu6xda8A915aWIIn6WzRTnGvWKseoub2hHDYrADW0wvV
# 8lsMa2uHoLp1SLRDE4TYWgzsbgO2ueC73T/QPpmkaAdYaRaFpKl3+oT19UsbtqUg
# xzUpR1nM8sdOF9g5OF971z10LaVFRE710UWuiWVRlS3gSXMvQ93PR7rKhM6bM/yM
# x+fP9/X9wka8ZFXQ67XGqPxE4xrXN0JD4wCKH5KysIO9hJ+c2GkZitFV7VB9r365
# VdbWItw/lTznIuQ+54Zm6xB9kskwnp6XAPzSgQwJEwD8wTDRM7vo0G+CTHYtKJ68
# VZVgwkbSMoI0XDMsAoxS4V+wtuOj7UWTYLskHkV7Tqp87oq7cIgEJy3CnvIjWZ0d
# Uh+L0I4qz60=
# =oeWj
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 02 Dec 2024 13:55:07 GMT
# gpg:                using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg:                issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2024-12-02' of https://gitlab.com/thuth/qemu:
  tests/functional: increase timeouts for arm sx1 test
  tests/functional/test_virtio_version: Check for the availability of the machine
  tests/functional/test_acpi_bits: Turn the test into a QemuSystemTest

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

tests/functional: increase timeouts for arm sx1 test

When under high load the test VM does not complete running in the
default 30 second timeout. Double it to give more headroom.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20241129173120.761728-2-berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/functional/test_virtio_version: Check for the availability of the machine

Use self_set_machine() to set and check for the availability of the
default pc machine (so that the test is not failing if the machine
has not been included in the QEMU binary).

Message-ID: <20241128120142.593408-1-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/functional/test_acpi_bits: Turn the test into a QemuSystemTest

By using QemuSystemTest as a base class, we can use the set_machine()
command to check whether the required machine is available in the
binary (otherwise this test is failing when QEMU has been compiled
without the default 'pc' machine type).

Message-ID: <20241128115019.591362-1-thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

Merge tag 'chr-pull-request' of https://gitlab.com/marcandre.lureau/qemu into staging

chardev patch queue

# -----BEGIN PGP SIGNATURE-----
#
# iQJQBAABCAA6FiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmdNp4EcHG1hcmNhbmRy
# ZS5sdXJlYXVAcmVkaGF0LmNvbQAKCRDa6OEJdZac5WsaD/92DwK0nKM7HqbqQOHN
# lR715V8ve16+mWYZnWA4jQvclFUigg0Xbxl6d6adsK5QnW2nDGgjf3cXsCngUx7K
# jNCmynQrpmUx7a7BRgXylEl5zN/HLeVvk2Qb4Jg8EAkRK0utK1Aerlx6CV2fzbR/
# zDslP+C7ELk9evNwWx6PZRgeOii0sL7lto67J4a5Iri2IU4yi9zI/irEIxeE4cDT
# P3KFXYsgbm86VC6HaOBWw5+d5JyPr2hVHxvKMpI4YNyU/f2RHdhfqgsLS1gms2Yz
# JBuh8DpIq0E+rdQp4ofH5SBPuOFxg7SgDFAyqgHerDd4uAwUafyOfAEVy2hpZmNT
# 3JlavSMb2SFhWboMUu9B+gRHC+sc7YCoPZEhaIaciW3XaC/S1JJi/fvB8gcugBDs
# lgTUIDEsXLMcgXaFNKbRXpuLG5eXRnzaQ4Y9Gr/3yEvY8eSZ6+x3EDwSMGfg/Ta1
# OW+h09AvWfJR5eZ13x+5CCMFRs8RgQN/D+mxYt3cZ/SdNSBci/4By54IGEgGCCM8
# xoTAqcd2kbpHg2S/MTx7O7OPNC38TbUaOWDR6u0qO0ZXqZA6OdlC+g/Z1uu7ZMqA
# FkOTQZuDDgOOhpsmLy4v3nKmFBQNJAPVyfph88DE1QyrU5nVCS55lyTy/ZH2hayL
# RCVbI20jrgEJoi44EFdFu6QP/Q==
# =0vex
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 02 Dec 2024 12:26:41 GMT
# gpg:                using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg:                issuer "marcandre.lureau@redhat.com"
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full]
# gpg:                 aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full]
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276  F62D DAE8 E109 7596 9CE5

* tag 'chr-pull-request' of https://gitlab.com/marcandre.lureau/qemu:
  chardev/char-mux: make boolean bit check instead of find_next_bit()
  chardev/char-mux: shift unsigned long to avoid 32-bit overflow

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

chardev/char-mux: make boolean bit check instead of find_next_bit()

This patch simplifies (and makes less confusing) bit checks by
replacing `find_next_bit()` calls with boolean AND operation.

Resolves: Coverity CID 1563776
Signed-off-by: Roman Penyaev <r.peniaev@gmail.com>
Reviewed-by: "Marc-André Lureau" <marcandre.lureau@redhat.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
Cc: qemu-devel@nongnu.org
Message-ID: <20241129103239.464061-3-r.peniaev@gmail.com>

chardev/char-mux: shift unsigned long to avoid 32-bit overflow

Allthough the size of MAX_MUX is equal to 4 and likely will never
change, this patch changes type of constant to unsigned long to
be on the safe side.

Also add a static compile check that MAX_MUX never bigger than
`sizeof(d->mux_bitset) * BITS_PER_BYTE`.

Signed-off-by: Roman Penyaev <r.peniaev@gmail.com>
Reviewed-by: "Marc-André Lureau" <marcandre.lureau@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
Cc: qemu-devel@nongnu.org
Message-ID: <20241129103239.464061-2-r.peniaev@gmail.com>

Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging

* amd_iommu: fix clang failure on non-KVM targets
* target/i386/hvf: fix advertised 1G page support
* megasas: fix CDB length

# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmdIokMUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroOpbAf/dxoD/vCFfuMPanIbP4quQGWFTKAo
# x4qlis07s730EWoNzdT42eER+GWcZiT4LhSwAt3EPqjANpnNwcoOGsc5hlJp8emI
# /UbJII90AKLhoJV2gj1xGbRwN1vBJmuBrUQSrLC+5tEr5gFLdHixnlH4pjXGfuF6
# 9eAutgxjRzMiYczsPCev5gbtnvetodP2u9okeQwpQd7N9siCbKx+pB6a67KdvOYn
# tmH0se4ai5w9J4Xnagus/goA5VK5dli6ukvYhLps/LQHj2r7XT6AcPMO7KwFlJkW
# INW0qEzYqa95iH5pNW2lgmJcCn3rp7g1WFVCCocpecp1WpsweVyzMRhGsA==
# =DHEO
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 28 Nov 2024 17:02:59 GMT
# gpg:                using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg:                issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
  scsi: megasas: Internal cdbs have 16-byte length
  hvf: complete 1G page support
  amd_iommu: Fix kvm_enable_x2apic link error with clang in non-KVM builds

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'pull-9p-20241128' of https://github.com/cschoenebeck/qemu into staging

* Fix open-unlink-fstat idiom on Linux guests.

* Add test to verify this behaviour.

* Cleanup patches.

# -----BEGIN PGP SIGNATURE-----
#
# iQJLBAABCgA1FiEEltjREM96+AhPiFkBNMK1h2Wkc5UFAmdIvDkXHHFlbXVfb3Nz
# QGNydWRlYnl0ZS5jb20ACgkQNMK1h2Wkc5X8ixAApDPStDxYf1CGdLirInHGp77i
# 0MlBsuaP00f8bZyCLJCFgax2+ogXD72Ptw2thDDMtkMsg9lqZwOtG5I4cJGC3TK2
# J4ZXpg/mg0bY+4o2gvnyeKv8BFl5wE91pdIeFX8ufQ+L2WE+fasWOn38TFB/T/8Z
# 1naN4A8Mu5F9myJ+F6pIYlJfkgbZniNib9BgSMG8pYI6uayWD+YVjR139ozWCf1c
# vhFFpLrwW4j3DOC0WblghQmiMwhXo1QxNAEq0x31/eoD1+calJAwhWsLWksuVIqR
# 6wbGPfNVozgk9l7owYB5Gams5zVJRfLD5LCAitUx2qqMMzxuD3QldLjOmFA/8XdG
# +2/ROBeXJ51blCAMFdp9IwTKzimvuWVL3kXbcQ3n+D459iBZzqW+9w4EYVYShpp6
# uwAAkW9fwVR/U7ERG3n8D6Cw1B9Scvtjksw/VCe9XUNFp6H66K/OXy8NFmnZZk9K
# K9SYkKOVixwZDqMoGoLsoxx0DbakYL+lBYrl6qVZUPRLOjJ+JvLAoblJ0ZmUgsl2
# lXG7vO96+LyRvVjqPoi2D7+MHrmFoeRgWjzZqFqWOakXBHCKcCEVzpAoB4eYyQrj
# rXC5BNhdu9yIa7Dy7V6tFoXPdN1is90bJs92DYTsOG1KdU2DviAUSZk4MjTJzQWN
# 3fvOcZPFq74228CWrN4=
# =XP1U
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 28 Nov 2024 18:53:45 GMT
# gpg:                using RSA key 96D8D110CF7AF8084F88590134C2B58765A47395
# gpg:                issuer "qemu_oss@crudebyte.com"
# gpg: Good signature from "Christian Schoenebeck <qemu_oss@crudebyte.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: ECAB 1A45 4014 1413 BA38  4926 30DB 47C3 A012 D5F4
#      Subkey fingerprint: 96D8 D110 CF7A F808 4F88  5901 34C2 B587 65A4 7395

* tag 'pull-9p-20241128' of https://github.com/cschoenebeck/qemu:
  tests/9p: also check 'Tgetattr' in 'use-after-unlink' test
  9pfs: fix 'Tgetattr' after unlink
  9pfs: remove obsolete comment in v9fs_getattr()
  tests/9p: add missing Rgetattr response name
  tests/9p: fix Rreaddir response name
  tests/9p: add 'use-after-unlink' test
  9pfs: cleanup V9fsFidState

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

tests/9p: also check 'Tgetattr' in 'use-after-unlink' test

This verifies expected behaviour of previous bug fix patch.

Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <7017658155c517b9665b75333a97c79aa2d4f3df.1732465720.git.qemu_oss@crudebyte.com>

9pfs: fix 'Tgetattr' after unlink

With a valid file ID (FID) of an open file, it should be possible to send
a 'Tgettattr' 9p request and successfully receive a 'Rgetattr' response,
even if the file has been removed in the meantime. Currently this would
fail with ENOENT.

I.e. this fixes the following misbehaviour with a 9p Linux client:

  open("/home/tst/filename", O_RDWR|O_CREAT|O_EXCL, 0600) = 3
  unlink("/home/tst/filename") = 0
  fstat(3, 0x23aa1a8) = -1 ENOENT (No such file or directory)

Expected results:

  open("/home/tst/filename", O_RDWR|O_CREAT|O_EXCL, 0600) = 3
  unlink("/home/tst/filename") = 0
  fstat(3, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0

This is because 9p server is always using a path name based lstat() call
which fails as soon as the file got removed. So to fix this, use fstat()
whenever we have an open file descriptor already.

Fixes: 00ede4c2529b ("virtio-9p: getattr server implementation...")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/103
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <4c41ad47f449a5cc8bfa9285743e029080d5f324.1732465720.git.qemu_oss@crudebyte.com>

9pfs: remove obsolete comment in v9fs_getattr()

The comment claims that we'd only support basic Tgetattr fields. This is
no longer true, so remove this comment.

Fixes: e06a765efbe3 ("hw/9pfs: Add st_gen support in getattr reply")
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <fb364d12045217a4c6ccd0dd6368103ddb80698b.1732465720.git.qemu_oss@crudebyte.com>

tests/9p: add missing Rgetattr response name

'Tgetattr' 9p request and its 'Rgetattr' response types are already used
by test client, however this response type is yet missing in function
rmessage_name(), so add it.

Fixes: a6821b828404 ("tests/9pfs: compare QIDs in fs_walk_none() test")
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <e183da80d390cfd7d55bdbce92f0ff6e3e5cdced.1732465720.git.qemu_oss@crudebyte.com>

tests/9p: fix Rreaddir response name

All 9p response types are prefixed with an "R", therefore fix
"READDIR" -> "RREADDIR" in function rmessage_name().

Fixes: 4829469fd9ff ("tests/virtio-9p: added readdir test")
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <daad7af58b403aaa2487c566032beca36664b30e.1732465720.git.qemu_oss@crudebyte.com>

tests/9p: add 'use-after-unlink' test

After removing a file from the file system, we should still be able to
work with the file if we already had it open before removal.

As a first step we verify that it is possible to write to an unlinked
file, as this is what already works. This test is extended later on
after having fixed other use cases after unlink that are not working
yet.

Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <3d6449d4df25bcdd3e807eff169f46f1385e5257.1732465720.git.qemu_oss@crudebyte.com>

9pfs: cleanup V9fsFidState

Drop V9fsFidState's 'next' member, which is no longer used since:

f5265c8f917e ('9pfs: use GHashTable for fid table')

Fixes: f5265c8f917e ('9pfs: use GHashTable for fid table')
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <E1tE4v2-0051EH-Ni@kylie.crudebyte.com>

scsi: megasas: Internal cdbs have 16-byte length

Host drivers do not necessarily set cdb_len in megasas io commands.
With commits 6d1511cea0 ("scsi: Reject commands if the CDB length
exceeds buf_len") and fe9d8927e2 ("scsi: Add buf_len parameter to
scsi_req_new()"), this results in failures to boot Linux from affected
SCSI drives because cdb_len is set to 0 by the host driver.
Set the cdb length to its actual size to solve the problem.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Fiona Ebner <f.ebner@proxmox.com>
Link: https://lore.kernel.org/r/20230228171129.4094709-1-linux@roeck-us.net
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

hvf: complete 1G page support

Hvf on x86 only supported 2MiB large pages, but never bothered to strip
out the 1GiB page size capability from -cpu host. With QEMU 8.0.0 this
became a problem because OVMF started to use 1GiB pages by default.

Let's just unconditionally add 1GiB page walk support to the walker.

With this fix applied, I can successfully run OVMF again.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1603
Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reported-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Reported-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Phil Dennis-Jordan <phil@philjordan.eu>
Link: https://lore.kernel.org/r/20230420225258.58009-1-agraf@csgraf.de
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

amd_iommu: Fix kvm_enable_x2apic link error with clang in non-KVM builds

Commit b12cb3819 (amd_iommu: Check APIC ID > 255 for XTSup) throws
linking error for the `kvm_enable_x2apic` when kvm is disabled
and Clang is used for compilation.

This issue comes up because Clang does not remove the function callsite
(kvm_enable_x2apic in this case) during optimization when if condition
have variable. Intel IOMMU driver solves this issue by creating separate
if condition for checking variables, which causes call site being
optimized away by virtue of `kvm_irqchip_is_split()` being defined as 0.
Implement same solution for the AMD driver.

Fixes: b12cb3819baf (amd_iommu: Check APIC ID > 255 for XTSup)
Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com>
Signed-off-by: Santosh Shukla <santosh.shukla@amd.com>
Tested-by: Phil Dennis-Jordan <phil@philjordan.eu>
Link: https://lore.kernel.org/r/20241114114509.15350-1-sarunkod@amd.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Merge tag 'for_upstream' of https://git./virt/kvm/mst/qemu into staging

virtio,pc,pci: bug fixes, new test

Some small bug fixes, notably a fix for a regression
in cpu hotplug after migration. I also included a
new test, just to help make sure we don't regress cxl.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
# -----BEGIN PGP SIGNATURE-----
#
# iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmdHJRIPHG1zdEByZWRo
# YXQuY29tAAoJECgfDbjSjVRpTkQIAJYFpFTPRnO8mA6gurfheB7Jt0ywAMrjKWfg
# uEkfZXXSQeCS8NBNPoZt7S8AE6xHE2a4b5lNWiS4a4coFmgTjtKPM8YsU01riyRk
# EasRxynGua2XGUWGK93r9L27v9zGz/vRC0Lujmw3VAUKGeL7a17KzmxwXLXe+DzS
# PgcI/H5hqoCDalT8aF6wOEDaWIHeo4dauDubYavW/+yaPtUvmy9MBkXbIV4iYqT5
# V6geeYIKW/yE/GHxxXOw/RE1FgpiZhebtQP26jPTSk0z/JaV5S0DNYs07joXmbaU
# fW5LSLgH3+oDI/GIhvsZ6hP87rVXBdaAogeJqT8SsuChBR55TpY=
# =B7KB
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 27 Nov 2024 13:56:34 GMT
# gpg:                using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469
# gpg:                issuer "mst@redhat.com"
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full]
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>" [full]
# Primary key fingerprint: 0270 606B 6F3C DF3D 0B17  0970 C350 3912 AFBE 8E67
#      Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA  8A0D 281F 0DB8 D28D 5469

* tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu:
  vhost: fail device start if iotlb update fails
  bios-tables-test: Add data for complex numa test (GI, GP etc)
  bios-tables-test: Add complex SRAT / HMAT test for GI GP
  bios-tables-test: Allow for new acpihmat-generic-x test data.
  qapi/qom: Change Since entry for AcpiGenericPortProperties to 9.2
  hw/acpi: Fix size of HID in build_append_srat_acpi_device_handle()
  qapi: fix device-sync-config since-version
  hw/cxl: Check for zero length features in cmd_features_set_feature()
  tests/acpi: update expected blobs
  Revert "hw/acpi: Make CPUs ACPI `presence` conditional during vCPU hot-unplug"
  Revert "hw/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug states"
  qtest: allow ACPI DSDT Table changes
  vhost_net: fix assertion triggered by batch of host notifiers processing

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'pull-request-2024-11-27' of https://gitlab.com/thuth/qemu into staging

* Two small doc updates
* Fix the flaky loongarch64 and sh4 functional tests
* Refuse to compile with old XCode versions that don't work anymore
* Remove an unused function from PCI code

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmdG9WcRHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbVwTRAAgOWsUiqscFk7x+G1EcxE21Cii1s3kj2t
# BYjzsl+sHzu2/aiazYfRbYOwUoXDU5kshfA0Df5KIQs2o1VBFt+v9z5vEAMjZ1tT
# j3LfazCUb4pmwS4wiD1DeEgrbCzrQ/B5grvyJsf7eB9pIxnGt+R1FGdpyDoKv8HB
# fTm6tkWKf6Mn8vJm/S+dJkoZu4ToBIOl2Q/s3/NxSf6a07FvY1QERCHndKGI90kE
# 0jodq+lb1UotaqicmlenSY33FGWWH2aeiSWGnsZRzDPLedmTBvY6hnkHtB2u+0kF
# D13ZF8oxc1pdviMXu978YRdKHmQacQ0RZVoJ6UxEf7tsDI4dEI87enVTBueGgv3z
# iz4wDDg6i/5kn12eOkjv3YgzcSF37kS/4aHltxyyuZBVT1tBsZ++zz5eCfTcO9wa
# mYElg1KDmWjmzs/HwtRb/07Bws7TIxxBUICKCA39GFpAKq6mssNAWujmhtB18AAC
# 8+tyCOz1KbseJR1oO2+I5biWBLOfAtHrBdSYIIM7yn+FWXC81kYhmT+/6hhkvl0u
# OHamRK8Kmpi71wRkm+3C/J+A1XDirXywteNIpsJXaAIEdSFzWRZdVMKblaHtqxET
# DwMdYRZ9u45phg5b+lTbDLBgsSf93NnrqyyIG7/6mS2CLwQ1x6o+NnleIJluNxSC
# kROh/xwUydo=
# =6+P3
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 27 Nov 2024 10:33:11 GMT
# gpg:                using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg:                issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2024-11-27' of https://gitlab.com/thuth/qemu:
  hw/pci: Remove unused pci_irq_pulse() method
  tests/functional: Remove sleep workarounds from sh4 test
  .gitlab-ci.d/cirrus: Remove the wrong CPU and RAM settings from the macOS job
  meson.build: Refuse XCode versions < v15.0
  tests/functional: Fix the running test case causes loongarch64 to hang
  docs: Document that hvf on Arm is supported
  docs/devel/testing/functional: Clarify that we have to use the build folder

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

hw/pci: Remove unused pci_irq_pulse() method

Last use of pci_irq_pulse() was removed 7 years ago in commit
5e9aa92eb1 ("hw/block: Fix pin-based interrupt behaviour of NVMe").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20241122103418.539-1-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/functional: Remove sleep workarounds from sh4 test

These were introduced in the avocado tests to workaround read issues
when interacting with console. They are no longer necessary and we can
use the expected login string instead.

Test always passes now. Remove skipUnless test on QEMU_TEST_FLAKY_TESTS.

Signed-off-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20241122141827.2039984-1-clg@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

.gitlab-ci.d/cirrus: Remove the wrong CPU and RAM settings from the macOS job

The macOS runner ignores them and always uses 4 CPUs and 12 GiB of
RAM, so remove our setting to avoid wrong expectations.

Message-ID: <20241125124342.187594-1-thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

meson.build: Refuse XCode versions < v15.0

According to our support policy, we only support the two latest
major versions of macOS, and we already removed compatibility code
for older versions. However, it's still possible that people install
an older version of XCode on a recent version of macOS - which won't
be able to compile QEMU anymore, see for example the ticket here:

https://gitlab.com/qemu-project/qemu/-/issues/2694

Thus let's set the expectations right and refuse older versions of
XCode that do not match the two latest versions of macOS anymore.

Message-ID: <20241126081054.244365-1-thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/functional: Fix the running test case causes loongarch64 to hang

There is a bug in the process of resolving the serial port base address
in the fdt of the loongarch VM UEFI. When both serial port information
and rng-seed information are chosen in the fdt, there is a probability
that the serial port base address cannot be resolved correctly.
This problem can be fixed by updating UEFI.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2686
Signed-off-by: Xianglai Li <lixianglai@loongson.cn>
Message-ID: <20241127013438.2206426-1-lixianglai@loongson.cn>
Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

docs: Document that hvf on Arm is supported

hvf on Arm is supported since commit a1477da3ddeb ("hvf: Add Apple
Silicon support").

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Alexander Graf <agraf@csgraf.de>
Message-ID: <20241127-build-v1-1-65b8162733f0@daynix.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

docs/devel/testing/functional: Clarify that we have to use the build folder

Make it clear that the commands have to be run from the folder with the
build, and use the python3 from our pyvenv to make sure that the
pycotap module is available.

Message-ID: <20241112115302.470527-1-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

Update version for v9.2.0-rc2 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

vhost: fail device start if iotlb update fails

While starting a vhost device, updating iotlb entries
via 'vhost_device_iotlb_miss' may return an error.

qemu-kvm: vhost_device_iotlb_miss:
700871,700871: Fail to update device iotlb

Fail device start when such an error occurs.

Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Message-Id: <20241107113247.46532-1-ppandit@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>

bios-tables-test: Add data for complex numa test (GI, GP etc)

Given this is a new configuration, there are affects on APIC, CEDT
and DSDT, but the key elements are in SRAT (plus related data in
HMAT).  The configuration has node to exercise many different combinations.

0) CPUs + Memory
1) GI only
2) GP only
3) CPUS only
4) Memory only
5) CPUs + HP memory

GI node, GP Node, Memory only node, hotplug memory
only node, latency and bandwidth such that in Linux Access0
(any initiator) and Access1 (CPU initiators only) given different
answers.  Following cropped to remove details of each entry.

[000h 0000 004h]                   Signature : "SRAT"    [System Resource Affinity Table]
...
[030h 0048 001h]               Subtable Type : 00 [Processor Local APIC/SAPIC Affinity]
...
[032h 0050 001h]     Proximity Domain Low(8) : 00
[033h 0051 001h]                     Apic ID : 00
...
[040h 0064 001h]               Subtable Type : 00 [Processor Local APIC/SAPIC Affinity]
...
[042h 0066 001h]     Proximity Domain Low(8) : 03
[043h 0067 001h]                     Apic ID : 01
...
[050h 0080 001h]               Subtable Type : 00 [Processor Local APIC/SAPIC Affinity]
...
[052h 0082 001h]     Proximity Domain Low(8) : 05
[053h 0083 001h]                     Apic ID : 02
...
[060h 0096 001h]               Subtable Type : 01 [Memory Affinity]
...
[062h 0098 004h]            Proximity Domain : 00000000
...
[068h 0104 008h]                Base Address : 0000000000000000
[070h 0112 008h]              Address Length : 00000000000A0000
...
[088h 0136 001h]               Subtable Type : 01 [Memory Affinity]
...
[08Ah 0138 004h]            Proximity Domain : 00000000
...
[090h 0144 008h]                Base Address : 0000000000100000
[098h 0152 008h]              Address Length : 0000000003F00000
...
[0B0h 0176 001h]               Subtable Type : 01 [Memory Affinity]
...
[0B2h 0178 004h]            Proximity Domain : 00000004
...
[0B8h 0184 008h]                Base Address : 0000000004000000
[0C0h 0192 008h]              Address Length : 0000000004000000
... some zero length entries follow...

[1A0h 0416 001h]               Subtable Type : 05 [Generic Initiator Affinity]
[1A1h 0417 001h]                      Length : 20

[1A2h 0418 001h]                   Reserved1 : 00
[1A3h 0419 001h]          Device Handle Type : 01
[1A4h 0420 004h]            Proximity Domain : 00000001
[1A8h 0424 010h]               Device Handle : 00 00 01 02 00 00 00 00 00 00 00 00 00 00 00 00
[1B8h 0440 004h]       Flags (decoded below) : 00000001
                                     Enabled : 1
                  Architectural Transactions : 0
[1BCh 0444 004h]                   Reserved2 : 00000000

[1C0h 0448 001h]               Subtable Type : 06 [Generic Port Affinity]
[1C1h 0449 001h]                      Length : 20

[1C2h 0450 001h]                   Reserved1 : 00
[1C3h 0451 001h]          Device Handle Type : 00
[1C4h 0452 004h]            Proximity Domain : 00000002
[1C8h 0456 010h]               Device Handle : 41 43 50 49 30 30 31 36 40 00 00 00 00 00 00 00
[1D8h 0472 004h]       Flags (decoded below) : 00000001
                                     Enabled : 1
                  Architectural Transactions : 0
[1DCh 0476 004h]                   Reserved2 : 00000000

[1E0h 0480 001h]               Subtable Type : 01 [Memory Affinity]
...
[1E2h 0482 004h]            Proximity Domain : 00000005
...
[1E8h 0488 008h]                Base Address : 0000000100000000
[1F0h 0496 008h]              Address Length : 0000000090000000

Example block from HMAT:
[0F0h 0240 002h]              Structure Type : 0001 [System Locality Latency and Bandwidth Information]
[0F2h 0242 002h]                    Reserved : 0000
[0F4h 0244 004h]                      Length : 00000078
[0F8h 0248 001h]       Flags (decoded below) : 00
                            Memory Hierarchy : 0
                   Use Minimum Transfer Size : 0
                    Non-sequential Transfers : 0
[0F9h 0249 001h]                   Data Type : 03
[0FAh 0250 001h]       Minimum Transfer Size : 00
[0FBh 0251 001h]                   Reserved1 : 00
[0FCh 0252 004h] Initiator Proximity Domains # : 00000004
[100h 0256 004h]  Target Proximity Domains # : 00000006
[104h 0260 004h]                   Reserved2 : 00000000
[108h 0264 008h]             Entry Base Unit : 0000000000000004
[110h 0272 004h] Initiator Proximity Domain List : 00000000
[114h 0276 004h] Initiator Proximity Domain List : 00000001
[118h 0280 004h] Initiator Proximity Domain List : 00000003
[11Ch 0284 004h] Initiator Proximity Domain List : 00000005
[120h 0288 004h] Target Proximity Domain List : 00000000
[124h 0292 004h] Target Proximity Domain List : 00000001
[128h 0296 004h] Target Proximity Domain List : 00000002
[12Ch 0300 004h] Target Proximity Domain List : 00000003
[130h 0304 004h] Target Proximity Domain List : 00000004
[134h 0308 004h] Target Proximity Domain List : 00000005
[138h 0312 002h]                       Entry : 00C8
[13Ah 0314 002h]                       Entry : 0000
[13Ch 0316 002h]                       Entry : 0032
[13Eh 0318 002h]                       Entry : 0000
[140h 0320 002h]                       Entry : 0032
[142h 0322 002h]                       Entry : 0064
[144h 0324 002h]                       Entry : 0019
[146h 0326 002h]                       Entry : 0000
[148h 0328 002h]                       Entry : 0064
[14Ah 0330 002h]                       Entry : 0000
[14Ch 0332 002h]                       Entry : 00C8
[14Eh 0334 002h]                       Entry : 0019
[150h 0336 002h]                       Entry : 0064
[152h 0338 002h]                       Entry : 0000
[154h 0340 002h]                       Entry : 0032
[156h 0342 002h]                       Entry : 0000
[158h 0344 002h]                       Entry : 0032
[15Ah 0346 002h]                       Entry : 0064
[15Ch 0348 002h]                       Entry : 0064
[15Eh 0350 002h]                       Entry : 0000
[160h 0352 002h]                       Entry : 0032
[162h 0354 002h]                       Entry : 0000
[164h 0356 002h]                       Entry : 0032
[166h 0358 002h]                       Entry : 00C8

Note the zeros represent entries where the target node has no
memory.  These could be surpressed but it isn't 'wrong' to provide
them and it is (probably) permissible under ACPI to hotplug memory
into these nodes later.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20241107123446.902801-6-Jonathan.Cameron@huawei.com>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

bios-tables-test: Add complex SRAT / HMAT test for GI GP

Add a test with 6 nodes to exercise most interesting corner cases of SRAT
and HMAT generation including the new Generic Initiator and Generic Port
Affinity structures. More details of the set up in the following patch
adding the table data.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20241107123446.902801-5-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

bios-tables-test: Allow for new acpihmat-generic-x test data.

The test to be added exercises many corner cases of the SRAT and HMAT table
generation.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20241107123446.902801-4-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

qapi/qom: Change Since entry for AcpiGenericPortProperties to 9.2

This feature was only applied during the 9.2 cycle, so reflect
that rather than 9.1.

Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Closes: https://lore.kernel.org/qemu-devel/ZyngEiwmYeZ-DvCy@redhat.com/
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20241107123446.902801-3-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

hw/acpi: Fix size of HID in build_append_srat_acpi_device_handle()

The size should always be 8 so hard code that. By coincidience the
incorrect use of sizeof(char *) is 8 on 64 bit hosts, but was caught
by CI testing with i686 as the host.

Reported-by: Michael S. Tsirkin <mst@redhat.com>
Closes: https://lore.kernel.org/qemu-devel/20241104110025-mutt-send-email-mst@kernel.org/
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20241107123446.902801-2-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

qapi: fix device-sync-config since-version

Actually it comes in 9.2, not 9.1.

Fixes: 3f98408e2e ("qapi: introduce device-sync-config")
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-Id: <20241108071957.727286-1-vsementsov@yandex-team.ru>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

hw/cxl: Check for zero length features in cmd_features_set_feature()

Zero length data for features doesn't make any sense so exclude that case
early. This fixes the undefined behavior reported by coverity for a zero
length memcpy().

Resolves CID 1564900 and 1564901

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20241108175814.1248278-1-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

tests/acpi: update expected blobs

Expected AML return to the state before
  bf1ecc8dad606 (w/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug states)
droping not needed CPRS and _STA logic that broke cpu hotplug

@@ -2887,7 +2887,6 @@ DefinitionBlock ("", "DSDT", 1, "BOCHS ", "BXPC    ", 0x00000001)
CRMV,   1,
CEJ0,   1,
CEJF,   1,
-                CPRS,   1,
Offset (0x05),
CCMD,   8
     }
@@ -2922,16 +2921,9 @@ DefinitionBlock ("", "DSDT", 1, "BOCHS ", "BXPC    ", 0x00000001)
Acquire (\_SB.PCI0.PRES.CPLK, 0xFFFF)
\_SB.PCI0.PRES.CSEL = Arg0
Local0 = Zero
-                If ((\_SB.PCI0.PRES.CPRS == One))
+                If ((\_SB.PCI0.PRES.CPEN == One))
{
-                    If ((\_SB.PCI0.PRES.CPEN == One))
-                    {
-                        Local0 = 0x0F
-                    }
-                    Else
-                    {
-                        Local0 = 0x0D
-                    }
+                    Local0 = 0x0F
}

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20241112170258.2996640-5-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

Revert "hw/acpi: Make CPUs ACPI `presence` conditional during vCPU hot-unplug"

This reverts commit 2d6cfbaf174b91dfa9a50065f7494634afb39c23.

The patch is supposed to be part of ARM CPU hotplug series and has not value
on its own without it. The series however is still in RFC stage and outside
of scope 9.2 release.

On top of that it introduces not needed callback that pokes directly into
CPU state without any need for that. Instead properties and AML generator
option should be used to configure static platform depended vCPU presence
state.

Drop the patch so that corrected version could be posted along with
ARM CPU hotplug series and properly reviewed in relevant context.
That also helps us to keep history cleaner with new patch being
against original code vs a string of fixups on top of current mess.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20241112170258.2996640-4-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

Revert "hw/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug states"

This reverts commit bf1ecc8dad6061914730a2a2d57af6b37c3a4f8d
which broke cpu hotplug in x86 after migration to older QEMU

Fixes: bf1ecc8dad606 (w/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug states)
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20241112170258.2996640-3-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

qtest: allow ACPI DSDT Table changes

list changed files in tests/qtest/bios-tables-test-allowed-diff.h

Message-ID: <20241106100047.18901c9d@imammedo.users.ipa.redhat.com>
Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20241112170258.2996640-2-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

vhost_net: fix assertion triggered by batch of host notifiers processing

When the backend of vhost_net restarts during the vm is running, vhost_net
is stopped and started. The virtio_device_grab_ioeventfd() fucntion in
vhost_net_enable_notifiers() will result in a call to
virtio_bus_set_host_notifier()(assign=false).

And now virtio_device_grab_ioeventfd() is batched in a single transaction
with virtio_bus_set_host_notifier()(assign=true).

This triggers the following assertion:

kvm_mem_ioeventfd_del: error deleting ioeventfd: Bad file descriptor

This patch moves virtio_device_grab_ioeventfd() out of the batch to fix
this problem.

To be noted that the for loop to release ioeventfd should start from i+1,
not i, because the i-th ioeventfd has already been released in
vhost_dev_disable_notifiers_nvqs().

Fixes: 6166799f6 ("vhost_net: configure all host notifiers in a single MR transaction")
Signed-off-by: Zuo Boqun <zuoboqun@baidu.com>
Reported-by: Gao Shiyuan <gaoshiyuan@baidu.com>
Message-Id: <20241115080312.3184-1-zuoboqun@baidu.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

Merge tag 'pull-ppc-for-9.2-2-20241127' of https://gitlab.com/npiggin/qemu into staging

* Assorted small ppc fixes

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEETkN92lZhb0MpsKeVZ7MCdqhiHK4FAmdF/gUACgkQZ7MCdqhi
# HK55/xAAw1AXhd+B9JODn6bpDzIvG1yZN81X7xm5WtVQwb9GgBlacBMgVRZQvulX
# 0TH0GBe2/+NkIgr/8c2j2NN3VwME86w56R7E9XFStwh9Q+80vJNT898023gAeN7k
# qiy+XBroUBkJJhuJOYXMCsgg7j0eTaCdVJxqytKBtr4vQnxRfkgKLeHKyMSF0uNu
# geRg76V3elleDNIhSood8GJ/O+Boom9Dvrsj7FwxIfTRnT8d1cwUV599fOJMYW/A
# EOquM54eREhCymVOMTx3gpJAMQXMGJ9LKR6AuIWEu1t4J9KJD27I5a56ASjz8BcO
# RH6DeqDVSauv25NqWKk4388xYTzd1zTScG4X7qdLcoLwy+wjyB90mvbLFmpuNjrG
# bR5BALRF0OtJ2SQ+DHM8h0OPQANl33c0YCU5GHMsFMiAkPJPaZWib1VrzeU8JzjW
# nUbKPE6htYh6Ee6dyGq/E1SP7QgmJTavZ/aY8j5e5iyJBWEZuS80TZ8FYv6ETFp7
# 5SHpRcvREZs4GO8vWwh8yNuepvQ5O6iK79kQUjcdREvRjT419m50cfJwyMxhG16r
# IeNkny7YtfX7s90s8zhw3WQECmBpfKqvzXtFZPORdge2MJSHFmYpnip9uLp1r1pU
# 1BUe1m1vubqd6/2JLw0FLIIqjuEv9VLDh4HI6ehG/7G7gwnwlRc=
# =Acg2
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 26 Nov 2024 16:57:41 GMT
# gpg:                using RSA key 4E437DDA56616F4329B0A79567B30276A8621CAE
# gpg: Good signature from "Nicholas Piggin <npiggin@gmail.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4E43 7DDA 5661 6F43 29B0  A795 67B3 0276 A862 1CAE

* tag 'pull-ppc-for-9.2-2-20241127' of https://gitlab.com/npiggin/qemu:
  hw/ppc/pegasos2: Fix IRQ routing from pci.0
  ppc/spapr: fix drc index mismatch for partially enabled vcpus
  ppc/pnv: Add xscom- prefix to pervasive-control region name
  target/ppc: Fix THREAD_SIBLING_FOREACH for multi-socket
  ppc/pnv: Fix direct controls quiesce
  target/ppc: Fix non-maskable interrupt while halted

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'pull-target-arm-20241126' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
* target/arm/tcg/cpu32.c: swap ATCM and BTCM register names
* docs/system/arm: Fix broken links and missing feature names

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmdF/vUZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3m4VD/95q5242ldAFCDj3pftP7tZ
# DCdY+AZZiUc+2puCjUlxCaKyXkTr4ifwUe79RStbatW80JxGJbJHeRK1VA4dNlPD
# trl+6fN5gS6VpvIpkfS92qH8VDF2XfygPIjisCUf7MIsJCgLa9XEJ8lQvHcxgT2v
# VSYholfKrU5bsS5UIuMC+cNjTaLLgwEW0RSqvo0/ZTnOZgfLJk6PD938WV6kbHoA
# 6qbwLgoKoSaZDxmnKAxqMMsnMPAnYE4mSSQsawwa92f5zj7p6Pz9FjDBGRuBnBan
# JeSyW9C7X555BT5YxluEqicsOK+xGg58y3QrQuDRwXHUO3gCMBMS+CGapNPhA7rN
# sTIILk2JsGuer4w6Gz/xOIr/nyqufejJd91AVrfC782UXqfi1Gb/xYfsLOz4xSr5
# TzvXMmD/u0yna5OLc6S+eFY5+qWvuIUwty4OTBPN/txd+pzDnsdISMaqXfDl0Czj
# idUVN+xEVBhKvHCFcFt15iwSMgoQ62Vyh5EWyZ5kaeC/w5L6rt+B/Es3XBnx2XSi
# CTU6FQHPrgqbbjF9PIOPq8lavbXTKZ/KsXhCCQ02zh9wLG9JH9nnGLWB7uEIDd8N
# yrd5qp47FooJYisZcfI9SmAU7tcYHbaNmFmGTA2b9UPJW8SvNmzSdhKV/nPFV9JK
# MwJwXffOhI8kXobUrJo03A==
# =yUs5
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 26 Nov 2024 17:01:41 GMT
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# gpg:                 aka "Peter Maydell <peter@archaic.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20241126' of https://git.linaro.org/people/pmaydell/qemu-arm:
  docs/system/arm/aspeed: add missing model supermicrox11spi-bmc
  docs/system/arm/fby35: update link to product page
  docs/system/arm/: add FEAT_DoubleLock
  docs/system/arm/: add FEAT_MTE_ASYNC
  target/arm/tcg/: fix typo in FEAT name
  docs/system/arm/emulation: add FEAT_SSBS2
  docs/system/arm/emulation: fix typo in feature name
  docs/system/arm/emulation: mention armv9
  target/arm/tcg/cpu32.c: swap ATCM and BTCM register names

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

hw/ppc/pegasos2: Fix IRQ routing from pci.0

The MV64361 has two PCI buses one of which is used for AGP on
PegasosII. So far we only emulated the PCI bus on pci.1 but some
graphics cards are only recognised by some guests when connected to
pci.0 corresponding to the AGP port. So far the interrupts were not
routed from pci.0 so this patch fixes that allowing the use of both
PCI buses. On real board only INTA and INTB are connected for AGP but
to avoid surprises we connect all 4 PCI interrupt lines so pci.0 can
be used for all PCI cards as well.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>

ppc/spapr: fix drc index mismatch for partially enabled vcpus

In case when vcpus are explicitly enabled/disabled in a non-consecutive
order within a libvirt xml, it results in a drc index mismatch during
vcpu hotplug later because the existing logic uses vcpu id to derive the
corresponding drc index which is not correct. Use env->core_index to
derive a vcpu's drc index as appropriate to fix this issue.

For ex, for the given libvirt xml config:
  <vcpus>
    <vcpu id='0' enabled='yes' hotpluggable='no'/>
    <vcpu id='1' enabled='yes' hotpluggable='yes'/>
    <vcpu id='2' enabled='no' hotpluggable='yes'/>
    <vcpu id='3' enabled='yes' hotpluggable='yes'/>
    <vcpu id='4' enabled='no' hotpluggable='yes'/>
    <vcpu id='5' enabled='yes' hotpluggable='yes'/>
    <vcpu id='6' enabled='no' hotpluggable='yes'/>
    <vcpu id='7' enabled='no' hotpluggable='yes'/>
  </vcpus>

We see below error on guest console with "virsh setvcpus <domain> 5" :

pseries-hotplug-cpu: CPU with drc index 10000002 already exists

This patch fixes the issue by using correct drc index for explicitly
enabled vcpus during init.

Reported-by: Anushree Mathur <anushree.mathur@linux.vnet.ibm.com>
Tested-by: Anushree Mathur <anushree.mathur@linux.vnet.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>

ppc/pnv: Add xscom- prefix to pervasive-control region name

By convention, xscom regions get a xscom- prefix.

Fixes: 1adf24708bf7 ("hw/ppc: Add pnv nest pervasive common chiplet model")
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>

target/ppc: Fix THREAD_SIBLING_FOREACH for multi-socket

The THREAD_SIBLING_FOREACH macro wasn't excluding threads from other
chips. Add chip_index field to the thread state and add a check for the
new field in the macro.

Fixes: b769d4c8f4c6 ("target/ppc: Add initial flags and helpers for SMT support")
Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
[npiggin: set chip_index for spapr too]
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>

ppc/pnv: Fix direct controls quiesce

powernv CPUs have a set of control registers that can stop, start, and
do other things to control a thread's execution.

Using this interface to stop a thread puts it into a particular state
that can be queried, and is distinguishable from other things that might
stop the CPU (e.g., going idle, or being debugged via gdb, or stopped by
the monitor).

Add a new flag that can speficially distinguish this state where it is
stopped with control registers. This solves some hangs when rebooting
powernv machines when skiboot is modified to allow QEMU to use the CPU
control facility (that uses controls to bring all secondaries to a known
state).

Fixes: c8891955086 ("ppc/pnv: Implement POWER10 PC xscom registers for direct controls")
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>

target/ppc: Fix non-maskable interrupt while halted

The ppc (pnv and spapr) NMI injection code does not go through the
asynchronous interrupt path and set a bit in env->pending_interrupts
and raise an interrupt request that the cpu_exec() loop can see.
Instead it injects the exception directly into registers.

This can lead to cpu_exec() missing that the thread has work to do,
if a NMI is injected while it was idle.

Fix this by clearing halted when injecting the interrupt. Probably
NMI injection should be reworked to use the interrupt request interface,
but this seems to work as a minimal fix.

Fixes: 3431648272d3 ("spapr: Add support for new NMI interface")
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>

docs/system/arm/aspeed: add missing model supermicrox11spi-bmc

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Message-id: 20241122225049.1617774-13-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

docs/system/arm/fby35: update link to product page

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241122225049.1617774-8-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

docs/system/arm/: add FEAT_DoubleLock

We already implement FEAT_DoubleLock (see commit f94a6df5dd6a7) when
the ID registers call for it. This feature is actually one that must
*not* be implemented in v9.0, but since our documentation lists
everything we can emulate, we should include FEAT_DoubleLock in the
list.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20241122225049.1617774-7-pierrick.bouvier@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: expand commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

docs/system/arm/: add FEAT_MTE_ASYNC

We already implement FEAT_MTE_ASYNC; we just forgot to list it
in the documentation.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241122225049.1617774-6-pierrick.bouvier@linaro.org
[PMM: expand commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/tcg/: fix typo in FEAT name

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241122225049.1617774-5-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

docs/system/arm/emulation: add FEAT_SSBS2

We implemented this at the same times as FEAT_SSBS, but forgot
to list it in the documentation.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241122225049.1617774-4-pierrick.bouvier@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: improve commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

docs/system/arm/emulation: fix typo in feature name

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241122225049.1617774-3-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

docs/system/arm/emulation: mention armv9

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241122225049.1617774-2-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/tcg/cpu32.c: swap ATCM and BTCM register names

According to Cortex-R5 r1p2 manual, register with opcode2=0 is
BTCM and with opcode2=1 is ATCM, - exactly the opposite from how
qemu labels them. Just swap the labels to avoid confusion, -
both registers are implemented as always-zero.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241121171602.3273252-1-mjt@tls.msk.ru
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCAAdFiEEIV1G9IJGaJ7HfzVi7wSWWzmNYhEFAmdFRyQACgkQ7wSWWzmN
# YhFU1Qf/T9bBOCrbQqbZSG7eKk8QuH35zcgNU7FzFTrGeVCc1bUMNYhiioqAFmE+
# h5h/3vmkmt+01vaTuimTRumI2SJnFFwggveJDWf+ICSl9MRtCXB5+w0n71vJ6gUO
# njm36pIl+aMkZIrsDc7lLewVouZkF8mAKP7mn9x53s5lX/HbXZSdPJmrkdUXtNT5
# d3nXlUkNhEWKL9dKIQ9dWYmj3l+tLfuYPiR8a+kKFMEwHlGBuFbNoVN03v5VvFyf
# Dmy1P1ZFApP0SsR4SiccXg7C8AslBC6wc7Bhd0aiKpGBnlt20mE9EJSVyrU8yP1p
# UTKzzB0QHN7Nnd6AcFRhWvo9C74mGg==
# =qP+q
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 26 Nov 2024 03:57:24 GMT
# gpg:                using RSA key 215D46F48246689EC77F3562EF04965B398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal]
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F  3562 EF04 965B 398D 6211

* tag 'net-pull-request' of https://github.com/jasowang/qemu:
  virtio-net: Add queues before loading them

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'migration-20241125-pull-request' of https://gitlab.com/peterx/qemu into staging

Migration pull for 9.2-rc2

- Fabiano's patch to remove double vmstate cleanup in postcopy
- Peter's patch to whitelist pipes in fd migration URIs

# -----BEGIN PGP SIGNATURE-----
#
# iIgEABYKADAWIQS5GE3CDMRX2s990ak7X8zN86vXBgUCZ0TqmRIccGV0ZXJ4QHJl
# ZGhhdC5jb20ACgkQO1/MzfOr1waJ7AD8Cb8tHkjFG25Q3ufRrkj3d05oVZDRU4lx
# 6bgku9xbUQ0A/1ruu96sy89q9t9facPHn+y/0xmmpBJMB5EJ1Jxunm0M
# =2Ctw
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 25 Nov 2024 21:22:33 GMT
# gpg:                using EDDSA key B9184DC20CC457DACF7DD1A93B5FCCCDF3ABD706
# gpg:                issuer "peterx@redhat.com"
# gpg: Good signature from "Peter Xu <xzpeter@gmail.com>" [marginal]
# gpg:                 aka "Peter Xu <peterx@redhat.com>" [marginal]
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: B918 4DC2 0CC4 57DA CF7D  D1A9 3B5F CCCD F3AB D706

* tag 'migration-20241125-pull-request' of https://gitlab.com/peterx/qemu:
  migration: Fix extra cleanup at postcopy listen
  migration: Allow pipes to keep working for fd migrations

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'pull-9.2-rc2-updates-251124-1' of https://gitlab.com/stsquad/qemu into staging

testing, docs and plugin updates for rc2

  - cleanup leftover avocado bits from functional test
  - ensure we keep functional logs for tests
  - improve test console handling to detect prompts
  - remove hacking timer.sleep() usage in functional tests
  - convert Aarch64 tuxrun tests to functional test
  - update Aarch64 tuxrun images to avoid corrupt blk I/O ops
  - auto-generate the TCG plugin API symbols to avoid missing them
  - fix rust pl011 model handling of DeviceID regs
  - update docs to refer to "commonly known identity"
  - convert aspeed tests to functional framework and remove hacky sleeps

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEZoWumedRZ7yvyN81+9DbCVqeKkQFAmdEZXEACgkQ+9DbCVqe
# KkRdMAf+JoSdKn3ck/eji270bZ2Y3evgDuP/qOZlcBtUJJ7+bUvhEOnBMApwKRD8
# u63hz7M4LIV5k3mezlEADf+oEpZ2FR3nIDM0dTY2CXYZm6av+0dNV0qFhXwjkslk
# aqJLiJYgNl3wsyn/ftYNLiBhCid0sOGMvEOFZI6ELBh5KH8eiNdyrsaD0GSmpwZi
# BsZUi8TOKy6EBeWnco/FLBV8ZVZUHuHNBl84jUY/8g7cxGMJfK8KoqMJ5XYoiQoJ
# 1dYDqFmoP24iQRks6K6beFRdS/CBet36Nhsv7We/gf17Msw5uFo7Cho+touRCMrK
# AmVKFdOX/OqJAHqlEKquYAD7bPjpaA==
# =Xa/M
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 25 Nov 2024 11:54:25 GMT
# gpg:                using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [full]
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8  DF35 FBD0 DB09 5A9E 2A44

* tag 'pull-9.2-rc2-updates-251124-1' of https://gitlab.com/stsquad/qemu: (28 commits)
  tests/functional: Remove sleep workarounds from Aspeed tests
  tests/functional: Convert Aspeed arm SDK tests
  tests/functional: Convert Aspeed aarch64 SDK tests
  docs: explicitly permit a "commonly known identity" with SoB
  rust/pl011: Fix range checks for device ID accesses
  plugins: eradicate qemu-plugins.symbols static file
  plugins: detect qemu plugin API symbols from header
  plugins: add missing export for qemu_plugin_num_vcpus
  tests/functional: update the aarch64 tuxrun tests
  tests/functional: Convert the Avocado aarch64 tuxrun tests
  tests/functional: avoid accessing log_filename on earlier failures
  tests/functional: add a QMP backdoor for debugging stalled tests
  tests/functional: remove time.sleep usage from tuxrun tests
  tests/functional: rewrite console handling to be bytewise
  tests/functional: require non-NULL success_message for console wait
  tests/functional: don't try to wait for the empty string
  tests/functional: logs details of console interaction operations
  tests/functional: enable debug logging for QEMUMachine
  tests/functional: honour requested test VM name in QEMUMachine
  tests/functional: put QEMUMachine logs in testcase log directory
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

virtio-net: Add queues before loading them

Call virtio_net_set_multiqueue() to add queues before loading their
states. Otherwise the loaded queues will not have handlers and elements
in them will not be processed.

Cc: qemu-stable@nongnu.org
Fixes: 8c49756825da ("virtio-net: Add only one queue pair when realizing")
Reported-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>

migration: Fix extra cleanup at postcopy listen

After fixing the loadvm cleanup race the qemu_loadvm_state_cleanup()
is now being called twice in the postcopy listen thread.

Fixes: 4ce5622908 ("migration/multifd: Fix rb->receivedmap cleanup race")
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20241125191128.9120-1-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>

migration: Allow pipes to keep working for fd migrations

Libvirt may still use pipes for old file migrations in fd: URI form,
especially when loading old images dumped from Libvirt's compression
algorithms.

In that case, Libvirt needs to compress / uncompress the images on its own
over the migration binary stream, and pipes are passed over to QEMU for
outgoing / incoming migrations in "fd:" URIs.

For future such use case, it should be suggested to use mapped-ram when
saving such VM image. However there can still be old images that was
compressed in such way, so libvirt needs to be able to load those images,
uncompress them and use the same pipe mechanism to pass that over to QEMU.

It means, even if new file migrations can be gradually moved over to
mapped-ram (after Libvirt start supporting it), Libvirt still needs the
uncompressor for the old images to be able to load like before.

Meanwhile since Libvirt currently exposes the compression capability to
guest images, it may needs its own lifecycle management to move that over
to mapped-ram, maybe can be done after mapped-ram saved the image, however
Dan and PeterK raised concern on temporary double disk space consumption.
I suppose for now the easiest is to enable pipes for both sides of "fd:"
migrations, until all things figured out from Libvirt side on how to move
on.

And for "channels" QMP interface support on "migrate" / "migrate-incoming"
commands, we'll also need to move away from pipe. But let's leave that for
later too.

So far, still allow pipes to happen like before on both save/load sides,
just like we would allow sockets to pass.

Cc: qemu-stable <qemu-stable@nongnu.org>
Cc: Fabiano Rosas <farosas@suse.de>
Cc: Peter Krempa <pkrempa@redhat.com>
Cc: Daniel P. Berrangé <berrange@redhat.com>
Fixes: c55deb860c ("migration: Deprecate fd: for file migration")
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20241120160132.3659735-1-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>

Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into staging

Block layer patches

- Fix qmp_device_add() to not throw non-scalar options away (fixes
  iothread-vq-mapping being silently ignored in device_add)
- Fix qdev property crash with integer PCI addresses and JSON -device
- iotests: Fix mypy failure
- parallels: Avoid potential integer overflow
- ssh: libssh broke with non-blocking sessions, use a blocking one for now
- Fix crash in migration_is_running()

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCAAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmdES74RHGt3b2xmQHJl
# ZGhhdC5jb20ACgkQfwmycsiPL9abFQ//fGmBl3Jp99GWB1R0y49/hPhfj0166UGj
# zeEmhdy+k6gKywyhVy0Fj0xLztDTb/2bGflrwtDDxYA0PBLel461QSeJUzwDsn9h
# ZGLyFrosXgIPADP55RF1wJ6c+m13MX4jVy80Neh2jemhinMazjj3ADb4RdCf0B4M
# XoYOy96goDFPlzZNvr08dlaDvJaD5QmPYX8nK7TaZqZOSYvdSRWMuB+QQCPj+qEf
# UfpBo3beNsxedNu/1wKS1Nc6FVX7VHKoMzhDLAvxkYMBKcCg9l5lEAGrgp61O+79
# nYZmPtEG5RHsMNBCZtk8zZMIHPg2Ydxpj3jOV3eA0rF4Twk/fPrOOfBEUHT6PapX
# tCS1UJtgyQA2GTULiax3vKV4yBSpmUzbhjddNwBkW7uG1md67d17nqbjkEhHVxZL
# yMuauFRCx5onzE0TSgTYEMAmAgD9oawuGUqBiNCOqJlTbGZwJ9l7jtwP4Bl1gskk
# pWzL/PLP8MkVf50dcP0QBPNHn85/oZOwv5yNr2Z893qNQhh/0xqCEFwqSq2SJOkg
# vKd/bAusgmicoh1XD0o0+mv2ewZor/JghrU83YDPKWM1MmOwePZ8wRTx9pJtZWvq
# Pnc71397zppHIw7aIWKYDoyQ3aeaoTM/oY2Q5Y7et6c/FvGW5JtFjsPCGbgm9mw+
# +6JA51ujtYU=
# =oLdE
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 25 Nov 2024 10:04:46 GMT
# gpg:                using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6
# gpg:                issuer "kwolf@redhat.com"
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full]
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* tag 'for-upstream' of https://repo.or.cz/qemu/kevin:
  ssh: Do not switch session to non-blocking mode
  vl: use qmp_device_add() in qemu_create_cli_devices()
  qdev-monitor: avoid QemuOpts in QMP device_add
  tests/avocado/hotplug_blk: Fix addr in device_add command
  qdev: Fix set_pci_devfn() to visit option only once
  python: silence pylint raising-non-exception error
  python: disable too-many-positional-arguments warning
  iotests: correct resultclass type in ReproducibleTestRunner
  iotests: reflow ReproducibleTestRunner arguments
  parallels: fix possible int overflow

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCAAdFiEEIV1G9IJGaJ7HfzVi7wSWWzmNYhEFAmdEEtgACgkQ7wSWWzmN
# YhH5qAgAlKdcx/gFt4EBXtjVq/qbPluEGOQxvcRYLlN90rPLHPgCjAoT5ly3fIv1
# 4kCgcVZyG8SdGu1n0TzTTS9kg5tL7weQ9xEWwF0oyyuZABgAB7w/wpC8MHSkJFOn
# 2Tv+2Iab0dJ+e1pw71OMpE/YR5X2xq5vopsSHRtnyGWfRPGswJFwka+f8FS5DSiq
# 2CeNxADgTkPxJgDmOrNSsAPz8Rns77FAZdvDMqFjx1Lrqm8kPv9jzwOMO+a/2LpC
# t6OkpFzGjiiskPjSnSn/tzo4TfWYoABjJaI7b3vEqmNEJSTAaxltZNtSXZucctEt
# 1ihnFdjr/wPwGK/5Wu+qGnfDbFNxBw==
# =W4y1
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 25 Nov 2024 06:02:00 GMT
# gpg:                using RSA key 215D46F48246689EC77F3562EF04965B398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal]
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F  3562 EF04 965B 398D 6211

* tag 'net-pull-request' of https://github.com/jasowang/qemu:
  virtio-net: Copy received header to buffer
  virtio-net: Initialize hash reporting values
  virtio-net: Fix hash reporting when the queue changes
  virtio-net: Do not check for the queue before RSS
  virtio-net: Fix size check in dhclient workaround
  net: checksum: Convert data to void *

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

tests/functional: Remove sleep workarounds from Aspeed tests

These were introduced in the avocado tests to workaround read issues
when interacting with console. They are no longer necessary and we can
use the expected "login:" string or the command prompt now. Drop the
last use of exec_command.

Signed-off-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20241122090322.1934697-4-clg@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>