9pfs: improve v9fs_walk() tracing

'Twalk' is the most important request type in the 9p protocol to look out
for when debugging 9p communication. That's because it is the only part
of the 9p protocol which actually deals with human-readable path names,
whereas all other 9p request types work on numeric file IDs (FIDs) only.

Improve tracing of 'Twalk' requests, e.g. let's say client wanted to walk
to "/home/bob/src", then improve trace output from:

  v9fs_walk tag 0 id 110 fid 0 newfid 1 nwnames 3

to:

  v9fs_walk tag=0 id=110 fid=0 newfid=1 nwnames=3 wnames={home, bob, src}

To achieve this, add a new helper function trace_v9fs_walk_wnames() which
converts the received V9fsString array of individual path elements into a
comma-separated string presentation for being passed to the tracing system.
As this conversion is somewhat expensive, this conversion function is only
called if tracing of event 'v9fs_walk' is currently enabled.

Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <E1tJamT-007Cqk-9E@kylie.crudebyte.com>

block: remove unused BLOCK_OP_TYPE_DATAPLANE

BLOCK_OP_TYPE_DATAPLANE prevents BlockDriverState from being used by
virtio-blk/virtio-scsi with IOThread. Commit b112a65c52aa ("block:
declare blockjobs and dataplane friends!") eliminated the main reason
for this blocker in 2014.

Nowadays the block layer supports I/O from multiple AioContexts, so
there is even less reason to block IOThread users. Any legitimate
reasons related to interference would probably also apply to
non-IOThread users.

The only remaining users are bdrv_op_unblock(BLOCK_OP_TYPE_DATAPLANE)
calls after bdrv_op_block_all(). If we remove BLOCK_OP_TYPE_DATAPLANE
their behavior doesn't change.

Existing bdrv_op_block_all() callers that don't explicitly unblock
BLOCK_OP_TYPE_DATAPLANE seem to do so simply because no one bothered to
rather than because it is necessary to keep BLOCK_OP_TYPE_DATAPLANE
blocked.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250203182529.269066-1-stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

iotests: Add (NBD-based) tests for inactive nodes

This tests different types of operations on inactive block nodes
(including graph changes, block jobs and NBD exports) to make sure that
users manually activating and inactivating nodes doesn't break things.

Support for inactive nodes in other export types will have to come with
separate test cases because they have different dependencies like blkio
or root permissions and we don't want to disable this basic test when
they are not fulfilled.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20250204211407.381505-17-kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

iotests: Add qsd-migrate case

Test that it's possible to migrate a VM that uses an image on shared
storage through qemu-storage-daemon.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250204211407.381505-16-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

iotests: Add filter_qtest()

The open-coded form of this filter has been copied into enough tests
that it's better to move it into iotests.py.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250204211407.381505-15-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

nbd/server: Support inactive nodes

In order to support running an NBD export on inactive nodes, we must
make sure to return errors for any operations that aren't allowed on
inactive nodes. Reads are the only operation we know we need for
inactive images, so to err on the side of caution, return errors for
everything else, even if some operations could possibly be okay.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20250204211407.381505-14-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block/export: Add option to allow export of inactive nodes

Add an option in BlockExportOptions to allow creating an export on an
inactive node without activating the node. This mode needs to be
explicitly supported by the export type (so that it doesn't perform any
operations that are forbidden for inactive nodes), so this patch alone
doesn't allow this option to be successfully used yet.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250204211407.381505-13-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Drain nodes before inactivating them

So far the assumption has always been that if we try to inactivate a
node, it is already idle. This doesn't hold true any more if we allow
inactivating exported nodes because we can't know when new external
requests come in.

Drain the node around setting BDRV_O_INACTIVE so that requests can't
start operating on an active node and then in the middle it suddenly
becomes inactive. With this change, it's enough for exports to check
for new requests that they operate on an active node (or, like reads,
are allowed even on an inactive node).

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20250204211407.381505-12-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block/export: Don't ignore image activation error in blk_exp_add()

Currently, block exports can't handle inactive images correctly.
Incoming write requests would run into assertion failures. Make sure
that we return an error when creating an export can't activate the
image.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250204211407.381505-11-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Support inactive nodes in blk_insert_bs()

Device models have a relatively complex way to set up their block
backends, in which blk_attach_dev() sets blk->disable_perm = true.
We want to support inactive images in exports, too, so that
qemu-storage-daemon can be used with migration. Because they don't use
blk_attach_dev(), they need another way to set this flag. The most
convenient is to do this automatically when an inactive node is attached
to a BlockBackend that can be inactivated.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250204211407.381505-10-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Add blockdev-set-active QMP command

The system emulator tries to automatically activate and inactivate block
nodes at the right point during migration. However, there are still
cases where it's necessary that the user can do this manually.

Images are only activated on the destination VM of a migration when the
VM is actually resumed. If the VM was paused, this doesn't happen
automatically. The user may want to perform some operation on a block
device (e.g. taking a snapshot or starting a block job) without also
resuming the VM yet. This is an example where a manual command is
necessary.

Another example is VM migration when the image files are opened by an
external qemu-storage-daemon instance on each side. In this case, the
process that needs to hand over the images isn't even part of the
migration and can't know when the migration completes. Management tools
need a way to explicitly inactivate images on the source and activate
them on the destination.

This adds a new blockdev-set-active QMP command that lets the user
change the status of individual nodes (this is necessary in
qemu-storage-daemon because it could be serving multiple VMs and only
one of them migrates at a time). For convenience, operating on all
devices (like QEMU does automatically during migration) is offered as an
option, too, and can be used in the context of single VM.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250204211407.381505-9-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Add option to create inactive nodes

In QEMU, nodes are automatically created inactive while expecting an
incoming migration (i.e. RUN_STATE_INMIGRATE). In qemu-storage-daemon,
the notion of runstates doesn't exist. It also wouldn't necessarily make
sense to introduce it because a single daemon can serve multiple VMs
that can be in different states.

Therefore, allow the user to explicitly open images as inactive with a
new option. The default is as before: Nodes are usually active, except
when created during RUN_STATE_INMIGRATE.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250204211407.381505-8-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Fix crash on block_resize on inactive node

In order for block_resize to fail gracefully on an inactive node instead
of crashing with an assertion failure in bdrv_co_write_req_prepare()
(called from bdrv_co_truncate()), we need to check for inactive nodes
also when they are attached as a root node and make sure that
BLK_PERM_RESIZE isn't among the permissions allowed for inactive nodes.
To this effect, don't enumerate the permissions that are incompatible
with inactive nodes any more, but allow only BLK_PERM_CONSISTENT_READ
for them.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250204211407.381505-7-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Don't attach inactive child to active node

An active node makes unrestricted use of its children and would possibly
run into assertion failures when it operates on an inactive child node.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250204211407.381505-6-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

migration/block-active: Remove global active flag

Block devices have an individual active state, a single global flag
can't cover this correctly. This becomes more important as we allow
users to manually manage which nodes are active or inactive.

Now that it's allowed to call bdrv_inactivate_all() even when some
nodes are already inactive, we can remove the flag and just
unconditionally call bdrv_inactivate_all() and, more importantly,
bdrv_activate_all() before we make use of the nodes.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250204211407.381505-5-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Inactivate external snapshot overlays when necessary

Putting an active block node on top of an inactive one is strictly
speaking an invalid configuration and the next patch will turn it into a
hard error.

However, taking a snapshot while disk images are inactive after
completing migration has an important use case: After migrating to a
file, taking an external snapshot is what is needed to take a full VM
snapshot.

In order for this to keep working after the later patches, change
creating a snapshot such that it automatically inactivates an overlay
that is added on top of an already inactive node.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250204211407.381505-4-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Allow inactivating already inactive nodes

What we wanted to catch with the assertion is cases where the recursion
finds that a child was inactive before its parent. This should never
happen. But if the user tries to inactivate an image that is already
inactive, that's harmless and we don't want to fail the assertion.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250204211407.381505-3-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Add 'active' field to BlockDeviceInfo

This allows querying from QMP (and also HMP) whether an image is
currently active or inactive (in the sense of BDRV_O_INACTIVE).

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250204211407.381505-2-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block-backend: Fix argument order when calling 'qapi_event_send_block_io_error()'

Commit 7452162adec25c10 introduced 'qom-path' argument to BLOCK_IO_ERROR
event but when the event is instantiated in 'send_qmp_error_event()' the
arguments for 'device' and 'qom_path' in
qapi_event_send_block_io_error() were reversed :

Generated code for sending event:

  void qapi_event_send_block_io_error(const char *qom_path,
                                      const char *device,
                                      const char *node_name,
                                      IoOperationType operation,
                                      [...]

Call inside send_qmp_error_event():

     qapi_event_send_block_io_error(blk_name(blk),
                                    blk_get_attached_dev_path(blk),
                                    bs ? bdrv_get_node_name(bs) : NULL, optype,
                                    [...]

This results into reporting the QOM path as the device alias and vice
versa which in turn breaks libvirt, which expects the device alias being
either a valid alias or empty (which would make libvirt do the lookup by
node-name instead).

Cc: qemu-stable@nongnu.org
Fixes: 7452162adec2 ("qapi: add qom-path to BLOCK_IO_ERROR event")
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Message-ID: <09728d784888b38d7a8f09ee5e9e9c542c875e1e.1737973614.git.pkrempa@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

scripts/qemu-gdb: Support coroutine dumps in coredumps

Dumping coroutines don't yet work with coredumps.  Let's make it work.

We still kept most of the old code because they can be either more
flexible, or prettier.  Only add the fallbacks when they stop working.

Currently the raw unwind is pretty ugly, but it works, like this:

  (gdb) qemu bt
  #0  process_incoming_migration_co (opaque=0x0) at ../migration/migration.c:788
  #1  0x000055ae6c0dc4d9 in coroutine_trampoline (i0=-1711718576, i1=21934) at ../util/coroutine-ucontext.c:175
  #2  0x00007f9f59d72f40 in ??? () at /lib64/libc.so.6
  #3  0x00007ffd549214a0 in ??? ()
  #4  0x0000000000000000 in ??? ()
  Coroutine at 0x7f9f4c57c748:
  #0  0x55ae6c0dc9a8 in qemu_coroutine_switch<+120> () at ../util/coroutine-ucontext.c:321
  #1  0x55ae6c0da2f8 in qemu_aio_coroutine_enter<+356> () at ../util/qemu-coroutine.c:293
  #2  0x55ae6c0da3f1 in qemu_coroutine_enter<+34> () at ../util/qemu-coroutine.c:316
  #3  0x55ae6baf775e in migration_incoming_process<+43> () at ../migration/migration.c:876
  #4  0x55ae6baf7ab4 in migration_ioc_process_incoming<+490> () at ../migration/migration.c:1008
  #5  0x55ae6bae9ae7 in migration_channel_process_incoming<+145> () at ../migration/channel.c:45
  #6  0x55ae6bb18e35 in socket_accept_incoming_migration<+118> () at ../migration/socket.c:132
  #7  0x55ae6be939ef in qio_net_listener_channel_func<+131> () at ../io/net-listener.c:54
  #8  0x55ae6be8ce1a in qio_channel_fd_source_dispatch<+78> () at ../io/channel-watch.c:84
  #9  0x7f9f5b26728c in g_main_context_dispatch_unlocked.lto_priv<+315> ()
  #10  0x7f9f5b267555 in g_main_context_dispatch<+36> ()
  #11  0x55ae6c0d91a7 in glib_pollfds_poll<+90> () at ../util/main-loop.c:287
  #12  0x55ae6c0d9235 in os_host_main_loop_wait<+128> () at ../util/main-loop.c:310
  #13  0x55ae6c0d9364 in main_loop_wait<+203> () at ../util/main-loop.c:589
  #14  0x55ae6bac212a in qemu_main_loop<+41> () at ../system/runstate.c:835
  #15  0x55ae6bfdf522 in qemu_default_main<+19> () at ../system/main.c:37
  #16  0x55ae6bfdf55f in main<+40> () at ../system/main.c:48
  #17  0x7f9f59d42248 in __libc_start_call_main<+119> ()
  #18  0x7f9f59d4230b in __libc_start_main_impl<+138> ()

Signed-off-by: Peter Xu <peterx@redhat.com>
Message-ID: <20241212204801.1420528-4-peterx@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

scripts/qemu-gdb: Simplify fs_base fetching for coroutines

There're a bunch of code trying to fetch fs_base in different ways.  IIUC
the simplest way instead is "$fs_base".  It also has the benefit that it'll
work for both live gdb session or coredumps.

Signed-off-by: Peter Xu <peterx@redhat.com>
Message-ID: <20241212204801.1420528-3-peterx@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

scripts/qemu-gdb: Always do full stack dump for python errors

It's easier for either debugging plugin errors, or issue reports.

Signed-off-by: Peter Xu <peterx@redhat.com>
Message-ID: <20241212204801.1420528-2-peterx@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Fix leak in send_qmp_error_event

ASAN detected a leak when running the ahci-test
/ahci/io/dma/lba28/retry:

Direct leak of 35 byte(s) in 1 object(s) allocated from:
    #0 in malloc
    #1 in __vasprintf_internal
    #2 in vasprintf
    #3 in g_vasprintf
    #4 in g_strdup_vprintf
    #5 in g_strdup_printf
    #6 in object_get_canonical_path ../qom/object.c:2096:19
    #7 in blk_get_attached_dev_id_or_path ../block/block-backend.c:1033:12
    #8 in blk_get_attached_dev_path ../block/block-backend.c:1047:12
    #9 in send_qmp_error_event ../block/block-backend.c:2140:36
    #10 in blk_error_action ../block/block-backend.c:2172:9
    #11 in ide_handle_rw_error ../hw/ide/core.c:875:5
    #12 in ide_dma_cb ../hw/ide/core.c:894:13
    #13 in dma_complete ../system/dma-helpers.c:107:9
    #14 in dma_blk_cb ../system/dma-helpers.c:129:9
    #15 in blk_aio_complete ../block/block-backend.c:1552:9
    #16 in blk_aio_write_entry ../block/block-backend.c:1619:5
    #17 in coroutine_trampoline ../util/coroutine-ucontext.c:175:9

Plug the leak by freeing the device path string.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20241111145214.8261-1-farosas@suse.de>
[PMD: Use g_autofree]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20241111170333.43833-3-philmd@linaro.org>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Improve blk_get_attached_dev_id() docstring

Expose the method docstring in the header, and mention
returned value must be free'd by caller.

Reported-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20241111170333.43833-2-philmd@linaro.org>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

vpc: Read images exported from Azure correctly

It was found that 'qemu-nbd' is not able to work with some disk images
exported from Azure. Looking at the 512b footer (which contains VPC
metadata):

00000000  63 6f 6e 65 63 74 69 78  00 00 00 02 00 01 00 00  |conectix........|
00000010  ff ff ff ff ff ff ff ff  2e c7 9b 96 77 61 00 00  |............wa..|
00000020  00 07 00 00 57 69 32 6b  00 00 00 01 40 00 00 00  |....Wi2k....@...|
00000030  00 00 00 01 40 00 00 00  28 a2 10 3f 00 00 00 02  |....@...(..?....|
00000040  ff ff e7 47 8c 54 df 94  bd 35 71 4c 94 5f e5 44  |...G.T...5qL._.D|
00000050  44 53 92 1a 00 00 00 00  00 00 00 00 00 00 00 00  |DS..............|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

we can see that Azure uses a different 'Creator application' --
'wa\0\0' (offset 0x1c, likely reads as 'Windows Azure') and QEMU uses this
field to determine how it can get image size. Apparently, Azure uses 'new'
method, just like Hyper-V.

Overall, it seems that only VPC and old QEMUs need to be ignored as all new
creator apps seem to have reliable current_size. Invert the logic and make
'current_size' method the default to avoid adding every new creator app to
the list.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Message-ID: <20241212134504.1983757-3-vkuznets@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

vpc: Split off vpc_ignore_current_size() helper

In preparation to making changes to the logic deciding whether CHS or
'current_size' need to be used in determining the image size, split off
vpc_ignore_current_size() helper.

No functional change intended.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Message-ID: <20241212134504.1983757-2-vkuznets@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

target/hppa: Update SeaBIOS-hppa

Update to lastest SeaBIOS-hppa which sets up the
LMMIO range for the internal artist graphic card.

Signed-off-by: Helge Deller <deller@gmx.de>

hw/pci-host/astro: Add LMMIO range support

Each Astro on 64-bit machines supports up to four LMMIO regions.
Those regions are used by graphic cards and other PCI devices which
need to map huge memory areas. The LMMIO regions are configured and
set up by SeaBIOS-hppa and then used as-is by the operating systems
(Linux, HP-UX).

With this addition it's now possible to add other PCI graphic
cards on the command line, e.g. with "-device ati-vga".

Signed-off-by: Helge Deller <deller@gmx.de>

hw/hppa: Avoid creation of artist if disabled on command line

Do not create the artist graphic card if the user disabled it
with "-global artist.disable=true" on the command line.

Signed-off-by: Helge Deller <deller@gmx.de>

artist: Allow disabling artist on command line

Allow users to disable the artist graphic card on the command line
with the option "-global artist.disable=true".
This change allows to use other graphic cards when using Linux, e.g.
by adding "-device ati-vga".

Signed-off-by: Helge Deller <deller@gmx.de>

hw/hppa: Wire up Diva GSP card

Until now we used a standard serial-pci device to emulate a HP serial
console.  This worked nicely with 32-bit Linux and 32-bit HP-UX, but
64-bit HP-UX crashes with it and expects either a Diva GSP card, or a real
64-bit capable PCI graphic card (which we don't have yet).
In order to continue with 64-bit HP-UX, switch over to the recently
added Diva GSP card emulation.

Signed-off-by: Helge Deller <deller@gmx.de>

hw/char: Add emulation of Diva GSP PCI management boards

The Diva GSP ("Guardian Service Processor") PCI boards are Remote
Management cards for PA-RISC machines.  They come with built-in 16550A
UARTs for serial consoles and modem functionalities, as well as a
mailbox-like memory area for hardware auto-reboot functionality.

Latest generation HP PA-RISC server machines use those Diva cards
for console output.

Signed-off-by: Helge Deller <deller@gmx.de>

Merge tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu into staging

UI/chardev-related patch queue

# -----BEGIN PGP SIGNATURE-----
#
# iQJQBAABCAA6FiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmeg+mwcHG1hcmNhbmRy
# ZS5sdXJlYXVAcmVkaGF0LmNvbQAKCRDa6OEJdZac5X9JD/4ie4unhYkWEaJLR5ks
# eVRE2ZrwrO1HF2HkFHgs9UN/G6Pl4o/YaPzICQkManJOhbJvOcp8hReOrSETrOLg
# iiYHr3DH+H1nRzPgH+Nuvj3IRnl2EdypfgHbWVmvMQQ7u0vwpUiraTHEqy2PvTqO
# ougTl0lf4v4NB1CHWDTbs6IT4/hMwXM4/pP1ztXvdWeJxKUUTKb9SSOlmjkdT/Ou
# kZqDr/aonWxvQs6t3HeauNkiIIq21pVAIDUoDr338hTK4/EPhxOwaTpZ0b2RATA6
# ldpcS7VNfsMe8aJI3nsRaRz5NkWNDnQgejGkIxxXo3xj8c/rhZMyqrrqYaqFleVW
# 0ahh6eY0qxc+Z7HJ+SxU8oDUzNjOw+14NeUlHTd+qRnZVasWXZlB7wYTxlbLKCHP
# KtbAm8KsdWrKokMkupRCHiI0je3QXlhX3TGEUS5HHcknjhvmkEzCcEYy0gYuyLRq
# +e79xdC/IyylZvzM/SXQXWEtb3GmBhi5pQmcRftTgISNxryXFfYXeOOQhgvJQS2L
# 8/Ul/rIEvhecj1me/wzOK1bDGzFae8xYSM2z7v/EAm4I59N8N8aomnN3sHeaeLlG
# UwWGpq9Z3igoWaM88/h8EktA0Kk8s9YBXZoKvGwVQPglEqEeWEwvrGKEM2Le7kYF
# eHM+osrJFf2iD42v6AnYVARhIA==
# =1pl1
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 03 Feb 2025 12:18:36 EST
# gpg:                using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg:                issuer "marcandre.lureau@redhat.com"
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full]
# gpg:                 aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full]
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276  F62D DAE8 E109 7596 9CE5

* tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu:
  dbus: add -audio dbus nsamples option
  plugins: fix -Werror=maybe-uninitialized false-positive
  ui/dbus: clarify the kind of win32 handle that is shared
  ui/dbus: on win32, allow ANONYMOUS with p2p
  qemu-options.hx: describe hub chardev and aggregation of several backends
  tests/unit/test-char: add unit tests for hub chardev backend
  chardev/char-hub: implement backend chardev aggregator
  chardev/char-pty: send CHR_EVENT_CLOSED on disconnect

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'qtest-20250203-pull-request' of https://gitlab.com/farosas/qemu into staging

Qtest pull request

- fw-cfg: DMA support and new vmcoreinfo test
- accel detection via QOM for non-KVM accels
- use virtio modern for vhost-user

# -----BEGIN PGP SIGNATURE-----
#
# iQJEBAABCAAuFiEEqhtIsKIjJqWkw2TPx5jcdBvsMZ0FAmeg8+cQHGZhcm9zYXNA
# c3VzZS5kZQAKCRDHmNx0G+wxnS1jD/9/xx8i9fQgA9znEZmzMvQ0xXrlUz8jQkA8
# yd/iCZT1ue4ff39XA/Z01J/lUaHFV5x4xV4/YL+I0IcMddwIuI3xXexAEyO76rRC
# dRxjKrq20s2W6VPnOT0NHBnvpNnYoQDunIZxY+16QMWajTRbA45G8R7W4dWWOhLQ
# 2sWNuQHsj1lQ4lZMYlaMuFZC31PgFgPiEwIfS2NHST3WfxJVPpsLU5/Pc8UGs6fd
# Sq58jXPS1Akhov7IuC8VG/icjnDpMe3f7OFWQ8u8MC5OhwFNnD7aNnf6V7LmM4f+
# vhwLPewKxS3KQ2j1Vt2iWGebxlJHDbvifaBpIiVIibaHvtzcOdwK/bK0i+ji3oTk
# NgDB80+UKEUGzj0A+BNMcI+ZMonRT2wmBucWdGCosEG1FUlDONdX2a8Zs5Cfxipe
# N2a30OmIfbHo905JLYbTw5SXFSyWdYTSgXOEyNlXjq/B+v3qtpdrHXtMOJaXfk/V
# Ln0pKT/mDKx/haiooJdMheJpvRDYxFUHub1MrqnVWWeoiTS2wRwu9QAbFusNwyrk
# cEYQRPwuX0AnGk6swRUVLdd7HHeeNDZtVBr30Gi1hzQUZRsfW/YmKunoXJ38XAoG
# ZD/7VdTgmpQcoXNBJFnyi9Ie6NSWZwgNmZmZn3yWQtV5ACWIt0cqwF8POh8TOY25
# 5mVQly/UAA==
# =FJP7
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 03 Feb 2025 11:50:47 EST
# gpg:                using RSA key AA1B48B0A22326A5A4C364CFC798DC741BEC319D
# gpg:                issuer "farosas@suse.de"
# gpg: Good signature from "Fabiano Rosas <farosas@suse.de>" [unknown]
# gpg:                 aka "Fabiano Almeida Rosas <fabiano.rosas@suse.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: AA1B 48B0 A223 26A5 A4C3  64CF C798 DC74 1BEC 319D

* tag 'qtest-20250203-pull-request' of https://gitlab.com/farosas/qemu:
  tests/qtest/vhost-user-test: Use modern virtio for vhost-user tests
  tests/qtest: Make qtest_has_accel() generic
  tests/qtest: Extract qtest_qom_has_concrete_type() helper
  tests/qtest/vmcoreinfo: add a unit test to exercize basic vmcoreinfo function
  tests/qtest/libqos: add DMA support for writing and reading fw_cfg files
  libqos/fw_cfg: refactor file directory iteraton to make it more reusable

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

dbus: add -audio dbus nsamples option

Allow to set the number of audio samples per read/write to dbus.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

plugins: fix -Werror=maybe-uninitialized false-positive

../contrib/plugins/cache.c:638:9: error: ‘l2_cache’ may be used uninitialized [-Werror=maybe-uninitialized]
  638 |         append_stats_line(rep, l1_dmem_accesses, l1_dmisses,
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Is a false-positive, since cores > 1, so the variable is set in the
above loop.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>

ui/dbus: clarify the kind of win32 handle that is shared

"-display dbus" hands over a file mapping handle to the peer
process (not a file handle).

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

ui/dbus: on win32, allow ANONYMOUS with p2p

GLib doesn't implement EXTERNAL on win32 at the moment, and disables
ANONYMOUS by default. zbus dropped support for COOKIE_SHA1 in 5.0,
making it no longer possible to connect to qemu -display dbus.

Since p2p connections are gated by existing QMP (or a D-Bus connection),
qemu -display dbus p2p can accept authentication with ANONYMOUS.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

tests/qtest/vhost-user-test: Use modern virtio for vhost-user tests

All other vhost-user tests here use modern virtio, too, so let's
adjust the vhost-user-net test accordingly.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250203124346.169607-1-thuth@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Fabiano Rosas <farosas@suse.de>

tests/qtest: Make qtest_has_accel() generic

Since commit b14a0b7469f ("accel: Use QOM classes for accel types")
accelerators are registered as QOM objects. Use QOM as a generic
API to query for available accelerators. This is in particular
useful to query hardware accelerators such HFV, Xen or WHPX which
otherwise have their definitions poisoned in "exec/poison.h".

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250130103728.536-3-philmd@linaro.org>
Signed-off-by: Fabiano Rosas <farosas@suse.de>

tests/qtest: Extract qtest_qom_has_concrete_type() helper

Extract qtest_qom_has_concrete_type() out of qtest_has_device()
in order to re-use it in the following commit.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250130103728.536-2-philmd@linaro.org>
Signed-off-by: Fabiano Rosas <farosas@suse.de>

tests/qtest/vmcoreinfo: add a unit test to exercize basic vmcoreinfo function

A new qtest is written that exercizes the fw-cfg DMA based read and write ops
to write values into vmcoreinfo fw-cfg file and read them back and verify that
they are the same.

Signed-off-by: Ani Sinha <anisinha@redhat.com>
Message-ID: <20250120043847.954881-4-anisinha@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>

tests/qtest/libqos: add DMA support for writing and reading fw_cfg files

At present, the libqos/fw_cfg.c library does not support the modern DMA
interface which is required to write to the fw_cfg files. It only uses the IO
interface. Implement read and write methods based on DMA. This will enable
developers to add tests that writes to the fw_cfg file(s). The structure of
the code is taken from edk2 fw_cfg implementation. It has been tested by
writing a qtest that writes to a fw_cfg file.

Signed-off-by: Ani Sinha <anisinha@redhat.com>
Message-ID: <20250120043847.954881-3-anisinha@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>

libqos/fw_cfg: refactor file directory iteraton to make it more reusable

fw-cfg file directory iteration code can be used by other functions that may
want to implement fw-cfg file operations. Refactor it into a smaller helper
so that it can be reused.

No functional change.

Signed-off-by: Ani Sinha <anisinha@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20250120043847.954881-2-anisinha@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>

qemu-options.hx: describe hub chardev and aggregation of several backends

This adds a few lines describing `hub` aggregator configuration
for aggregation of several backend devices with a single frontend
device.

Signed-off-by: Roman Penyaev <r.peniaev@gmail.com>
Reviewed-by: "Marc-André Lureau" <marcandre.lureau@redhat.com>
Cc: qemu-devel@nongnu.org
Message-ID: <20250123085327.965501-5-r.peniaev@gmail.com>

tests/unit/test-char: add unit tests for hub chardev backend

This commit introduces a new test function `char_hub_test` to validate
the functionality and constraints of the "hub" chardev backend in QEMU.
The test includes multiple scenarios:

1. Invalid hub creation:
   - Creating a hub without defining `chardevs.N` (expects an error).
   - Creating a hub with an embedded multiplexer (`mux=on`) or a chardev
     already in use (expects errors).

2. Max backend limit:
   - Ensures the hub does not accept more backends than the maximum
     allowed, with appropriate error handling.

3. Valid hub creation and data aggregation:
   - Successfully creating a hub with two ring buffer backends.
   - Verifying data aggregation from backends to a frontend and vice versa.
   - Ensuring correct error handling for attempts to attach a hub multiple
     times or remove busy chardevs.

4. Extended EAGAIN simulation (non-Windows only):
   - Simulates a setup with three backends, including a pipe, to test
     EAGAIN handling and watcher behavior.
   - Verifies data flow and recovery in scenarios involving buffer
     overflows and drained pipes.

The test also ensures correct cleanup of chardevs in all cases, covering
both valid and invalid configurations.

Signed-off-by: Roman Penyaev <r.peniaev@gmail.com>
Reviewed-by: "Marc-André Lureau" <marcandre.lureau@redhat.com>
Cc: qemu-devel@nongnu.org
Message-ID: <20250123085327.965501-4-r.peniaev@gmail.com>

chardev/char-hub: implement backend chardev aggregator

This patch implements a new chardev backend `hub` device, which
aggregates input from multiple backend devices and forwards it to a
single frontend device. Additionally, `hub` device takes the output
from the frontend device and sends it back to all the connected
backend devices. This allows for seamless interaction between
different backend devices and a single frontend interface.

The idea of the change is trivial: keep list of backend devices
(up to 4), init them on demand and forward data buffer back and
forth.

The following is QEMU command line example:

   -chardev pty,path=/tmp/pty,id=pty0 \
   -chardev vc,id=vc0 \
   -chardev hub,id=hub0,chardevs.0=pty0,chardevs.1=vc0 \
   -device virtconsole,chardev=hub0 \
   -vnc 0.0.0.0:0

Which creates 2 backend devices: text virtual console (`vc0`) and a
pseudo TTY (`pty0`) connected to the single virtio hvc console with
the backend aggregator (`hub0`) help. `vc0` renders text to an image,
which can be shared over the VNC protocol.  `pty0` is a pseudo TTY
backend which provides biderectional communication to the virtio hvc
console.

'chardevs.N' list syntax is used for the sake of compatibility with
the representation of JSON lists in 'key=val' pairs format of the
util/keyval.c, despite the fact that modern QAPI way of parsing,
namely qobject_input_visitor_new_str(), is not used. Choice of keeping
QAPI list syntax may help to smoothly switch to modern parsing in the
future.

Signed-off-by: Roman Penyaev <r.peniaev@gmail.com>
Reviewed-by: "Marc-André Lureau" <marcandre.lureau@redhat.com>
Cc: qemu-devel@nongnu.org
Message-ID: <20250123085327.965501-3-r.peniaev@gmail.com>

chardev/char-pty: send CHR_EVENT_CLOSED on disconnect

Change makes code symmetric to the code, which handles
the "connected" state, i.e. send CHR_EVENT_CLOSED when
state changes from "connected" to "disconnected".

This behavior is similar to char-socket, for example.

Signed-off-by: Roman Penyaev <r.peniaev@gmail.com>
Reviewed-by: "Marc-André Lureau" <marcandre.lureau@redhat.com>
Reviewed-by: "Alex Bennée" <alex.bennee@linaro.org>
Cc: qemu-devel@nongnu.org
Message-ID: <20250123085327.965501-2-r.peniaev@gmail.com>

Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging

Pull request

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCAAdFiEEhpWov9P5fNqsNXdanKSrs4Grc8gFAmeb4h0ACgkQnKSrs4Gr
# c8jqngf/WC+QeP9FPTp0yYF7+W25OrOejMpvCggfZAXCoTs1ruApab0OrYYQFFyb
# iJUece0p4hvcrbxScyCWyHn9g2BDnQGGXAjTIzGzZ56sNdySMYB4XdZ1UeikQwh8
# gHwWAb5G0x5Q2P8LMp3xVkbceeiw+WfiE/KiKsjio3OfBGoOC32LEdC6+QvOw2hs
# Q5mnHUZG4I1YXMkJQh7M/BF4oE+weKMhD2IHrZtRPygjsK6Zv99J8W7yLa2HeSVz
# So5vzYV+2A4FOdomSn9iExNb16jImV2Zl5tIAe60hVQ6fvMT0OCCWmQtgUi78MDK
# bnp+VWj8a0Rm2vJeWX54pu0b6vo1Vg==
# =NOSK
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 30 Jan 2025 15:33:33 EST
# gpg:                using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [ultimate]
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>" [ultimate]
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* tag 'block-pull-request' of https://gitlab.com/stefanha/qemu:
  parallels: fix ext_off assertion failure due to overflow

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'hw-misc-20250131' of https://github.com/philmd/qemu into staging

Misc HW patches

- Remove uses of &first_cpu in rx-gdbsim and loongson3_virt machines (Philippe)
- Convert few legacy qemu_allocate_irqs to qemu_init_irqs (Philippe)
- Add tracing events in i2c-echo device (Titus)
- Fix debug format string in USB EHCI (Zoltan)
- Rework loader API to remove its target_words_bigendian() call (Philippe)
- QOMify OMAP MMC device (Peter)
- Remove legacy SD Card APIs (Peter)

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmedOmkACgkQ4+MsLN6t
# wN4qHhAAtL3vmk6hQgKD76bSaB3CDEdHsnS7qqeRVVmbr7pQL9D6yyXzkjJBzZtk
# nG7ubhoS5WFeKswzD8tY/mgP25hntnq38TNrRxDrpRNdFYF+a2cncpRGfgzk0z/9
# nme/BuUx6fNowV8MVGLNOLvaDCeDHl9biTLJmcQyqwlHy9l9Wi6DSa6Xi9ZQWlHi
# fxYVeuQ7HYlKwhiu3mqpfNeauIgMSWz8V48ETCrFnjMWmiF1k1L0GccWDS8zpPDk
# QkdOxHC4eVMxk0d2458eUXeqo/izfzoc7Z9hW6W8cyI69y4m011xqANd/udTS03E
# HMcG9Ks0E+Yw8NGoErOP7zu8yFVEzCn2BKhH/wrUHBC2UfP99vNR/b8LNkg25y19
# IItOkMban0Oyr9KaNb1Ga+3pZIsyyil+shSYNHpWkfqk+TUpZkMUSaVHA9r1oB3V
# u/dOO/lPLaWMvftKVXRl3K/Lfz4WF5cWjza5RratnzbBqqwr03CwjjBEuZIX/5ww
# ATj/fV10OSHScxCqauYp8uuNSgEOKaJCJe2uEMaLvxn/O9ka0FQZ5CLUJ0yIKs/t
# Tg4sS0QLgmpaXwSnscKoVE7aHWNFT1WomHI4SjWbwUQhmm0DmPizBZ2yX8dnSR24
# ubtzmxNYFWScrUTGQvbMhkU6I+Sc0Ca8APmPxErNV2mzF4p3CPE=
# =Jvwi
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 31 Jan 2025 16:02:33 EST
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'hw-misc-20250131' of https://github.com/philmd/qemu: (36 commits)
  hw/sd: Remove unused SDState::enable
  hw/sd: Remove unused legacy functions, stop killing mammoths
  hw/sd: Remove unused 'enable' method from SDCardClass
  hw/sd/omap_mmc: Untabify
  hw/sd/omap_mmc: Remove unused coverswitch qemu_irq
  hw/arm/omap1: Inline creation of MMC
  hw/sd/omap_mmc: Use similar API for "wire up omap_clk" to other OMAP devices
  hw/sd/omap_mmc: Convert to SDBus API
  hw/sd/omap_mmc: Convert output qemu_irqs to gpio and sysbus IRQ APIs
  hw/sd/omap_mmc: Convert remaining 'struct omap_mmc_s' uses to OMAPMMCState
  hw/sd/omap_mmc: Do a minimal conversion to QDev
  hw/loader: Pass ELFDATA endian order argument to load_elf()
  hw/loader: Pass ELFDATA endian order argument to load_elf_as()
  hw/loader: Pass ELFDATA endian order argument to load_elf_ram_sym()
  hw/loader: Clarify local variable name in load_elf_ram_sym()
  hw/loader: Remove unused load_elf_ram()
  hw/avr/boot: Replace load_elf_ram_sym() -> load_elf_as()
  hw/usb/hcd-ehci: Fix debug printf format string
  hw/misc/i2c-echo: add tracing
  hw/char/pci-multi: Convert legacy qemu_allocate_irqs to qemu_init_irq
  ...

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'hppa-system-mfdiag-for-v10-pull-request' of https://github.com/hdeller/qemu-hppa into staging

hppa 64-bit mfdiag improvements

The 64-bit hppa qemu emulation still fails to boot 64-bit HP-UX.
This patch series improves the emulation a lot, since it enables us to boot
64-bit HP-UX installer silently up until an endless loop where the machine
reports that it's up an running (it crashed before). This still needs further
analysis, but it's a big step forward.

Main changes to archieve this includes:
- Implementing diagnose registers (especially %dr2 for space-register hashing)
- a new SeaBIOS-hppa version 18, which includes those fixes and enhancements:
  - Fix IRT table entries to use slot number
  - Increase PCI alignment for memory bars to 64k
  - Fix PDC_CACHE/PDC_CACHE_RET_SPID return value
  - Allow up to 256 GB RAM on 64-bit machines

V2:
- fix linux-user build by adding missing "#ifndef CONFIG_USER_ONLY ... #endif"

# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCZ5yWTwAKCRD3ErUQojoP
# X1p5AP4iSfKlBsUZrww2/M1ArqB9jZuJBO1kdZ7OcCN2Jn0yxgEAx0CPUof7NnZV
# EY7u3Qq4E8ZnOk4XgHt06bsdNcJN+gc=
# =RoAh
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 31 Jan 2025 04:22:23 EST
# gpg:                using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg:                 aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D  25F8 3E5F 3D04 A7A2 4603
#      Subkey fingerprint: BCE9 123E 1AD2 9F07 C049  BBDE F712 B510 A23A 0F5F

* tag 'hppa-system-mfdiag-for-v10-pull-request' of https://github.com/hdeller/qemu-hppa:
  target/hppa: Update SeaBIOS-hppa to version 18
  target/hppa: Implement space register hashing for 64-bit HP-UX
  target/hppa: 64-bit CPUs start with space register hashing enabled
  target/hppa: Add instruction decoding for mfdiag and mtdiag
  target/hppa: Drop diag_getshadowregs_pa2 and diag_putshadowregs_pa2
  target/hppa: Add CPU diagnose registers
  disas/hppa: implement mfdiag/mtdiag disassembly
  hppa: Sync contents of hppa_hardware.h header file with SeaBIOS-hppa
  MAINTAINERS: Add myself as HPPA maintainer

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

hw/sd: Remove unused SDState::enable

Now that sd_enable() has been removed, SD::enable is set to true in
sd_instance_init() and then never changed. So we can remove it.

Note that the VMSTATE_UNUSED() size argument should be '1', not
'sizeof(bool)', as noted in the CAUTION comment in vmstate.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250128104519.3981448-12-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/sd: Remove unused legacy functions, stop killing mammoths

The sdcard_legacy.h header defines function prototypes for the "legacy"
SD card API, which was used by non-qdevified SD controller models.
We've now converted the only remaining non-qdev SD controller, so
we can drop the legacy API.

Entirely unused functions:
  sd_init(), sd_set_cb(), sd_enable()

Functions which now become static inside sd.c (they are the
underlying implementations of methods on SDCardClass):
  sd_do_command(), sd_write_byte(), sd_read_byte()

Removal of sd_init() means that we can also remove the
me_no_qdev_me_kill_mammoth_with_rocks flag, the codepaths that were
only reachable when it was set, and the inserted_cb and readonly_cb
qemu_irq lines that went with that.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250128104519.3981448-11-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/sd: Remove unused 'enable' method from SDCardClass

The SDCardClass has an 'enable' method, but nothing actually invokes it.
The underlying implementation is sd_enable(), which is documented
in sdcard_legacy.h as something that should not be used and was only
present for the benefit of the now-removed nseries boards. Unlike
all the other method pointers in SDCardClass, this one doesn't have
an sdbus_foo() function wrapper in hw/sd/core.c.

Remove the unused method.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250128104519.3981448-10-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/sd/omap_mmc: Untabify

This is a very old source file, and still has some lingering
hard-coded tabs; untabify it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250128104519.3981448-9-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/sd/omap_mmc: Remove unused coverswitch qemu_irq

The coverswitch qemu_irq is never connected to anything, and the only thing
we do with it is set it in omap_mmc_reset(). Remove it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250128104519.3981448-8-peter.maydell@linaro.org>
[PMD: Remove unused 'coverswitch' field]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/arm/omap1: Inline creation of MMC

Our style for other conversions of OMAP devices to qdev has been to
inline the creation and wiring into omap310_mpu_init() -- see for
instance the handling of omap-intc, omap-gpio and omap_i2c. Do
the same for omap-mmc.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250128104519.3981448-7-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/sd/omap_mmc: Use similar API for "wire up omap_clk" to other OMAP devices

The approach we've settled on for handling the omap_clk wiring for
OMAP devices converted to QDev is to have a function omap_foo_set_clk()
whose implementation just sets the field directly in the device's
state struct. (See the "TODO" comment near the top of omap.h.)
Make omap_mmc do the same.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250128104519.3981448-6-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/sd/omap_mmc: Convert to SDBus API

Convert the OMAP MMC controller to the new SDBus API:
 * the controller creates an SDBus bus
 * instead of sd_foo functions on the SDState object, call
   sdbus_foo functions on the SDBus
 * the board code creates a proper TYPE_SD_CARD object and attaches
   it to the controller's SDBus, instead of the controller creating
   a card directly via sd_init() that never gets attached to any bus
 * because the SD card object is on a bus, it gets reset automatically
   by the "traverse the qbus tree resetting things" code, and we don't
   need to manually reset the card from the controller reset function

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250128104519.3981448-5-peter.maydell@linaro.org>
[PMD: Include "hw/sd/sd.h" instead of "hw/sd/sdcard_legacy.h",
      create bus in omap_mmc_initfn() instead of omap_mmc_realize()]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/sd/omap_mmc: Convert output qemu_irqs to gpio and sysbus IRQ APIs

The omap_mmc device has three outbound qemu_irq lines:
 * one actual interrupt line
 * two which connect to the DMA controller and are signalled for
   TX and RX DMA

Convert these to a sysbus IRQ and two named GPIO outputs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250128104519.3981448-4-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/sd/omap_mmc: Convert remaining 'struct omap_mmc_s' uses to OMAPMMCState

Mechanically convert the remaining uses of 'struct omap_mmc_s' to
'OMAPMMCState'.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250128104519.3981448-3-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/sd/omap_mmc: Do a minimal conversion to QDev

Do a minimal conversion of the omap_mmc device model to QDev.

In this commit we do the bare minimum to produce a working device:
 * add the SysBusDevice parent_obj and the usual type boilerplate
 * omap_mmc_init() now returns a DeviceState*
 * reset is handled by sysbus reset, so the SoC reset function
   doesn't need to call omap_mmc_reset() any more
 * code that should obviously be in init/realize is moved there
   from omap_mmc_init()

We leave various pieces of cleanup to later commits:
 * rationalizing 'struct omap_mmc_s *' to 'OMAPMMCState *'
 * using gpio lines rather than having omap_mmc_init() directly
   set s->irq, s->dma
 * switching away from the legacy SD API and instead having
   the SD card plugged into a bus

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250128104519.3981448-2-peter.maydell@linaro.org>
[PMD: Do not add omap_mmc_realize()]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/loader: Pass ELFDATA endian order argument to load_elf()

Rather than passing a boolean 'is_big_endian' argument,
directly pass the ELFDATA, which can be unspecified using
the ELFDATANONE value.

Update the call sites:
  0                 -> ELFDATA2LSB
  1                 -> ELFDATA2MSB
  TARGET_BIG_ENDIAN -> TARGET_BIG_ENDIAN ? ELFDATA2MSB : ELFDATA2LSB

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250127113824.50177-7-philmd@linaro.org>

hw/loader: Pass ELFDATA endian order argument to load_elf_as()

Rather than passing a boolean 'is_big_endian' argument,
directly pass the ELFDATA, which can be unspecified using
the ELFDATANONE value.

Update the call sites:
  0 -> ELFDATA2LSB
  1 -> ELFDATA2MSB

Note, this allow removing the target_words_bigendian() call
in the GENERIC_LOADER device, where we pass ELFDATANONE.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250127113824.50177-6-philmd@linaro.org>

hw/loader: Pass ELFDATA endian order argument to load_elf_ram_sym()

Rather than passing a boolean 'is_big_endian' argument,
directly pass the ELFDATA, which can be unspecified using
the ELFDATANONE value.

Update the call sites:
  0 -> ELFDATA2LSB

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250127113824.50177-5-philmd@linaro.org>

hw/loader: Clarify local variable name in load_elf_ram_sym()

load_elf_ram_sym() compares target_data_order versus
host data_order. Rename 'data_order' -> 'host_data_order'
to ease code review. Avoid the preprocessor by directly
checking HOST_BIG_ENDIAN.

Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250127113824.50177-4-philmd@linaro.org>

hw/loader: Remove unused load_elf_ram()

Last use of load_elf_ram() was removed in commit 188e255bf8e
("hw/s390x: Remove the possibility to load the s390-netboot.img
binary"), remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20250127113824.50177-3-philmd@linaro.org>

hw/avr/boot: Replace load_elf_ram_sym() -> load_elf_as()

load_elf_ram_sym() with load_rom=true, sym_cb=NULL is
equivalent to load_elf_as(). Replace by the latter to
simplify.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250127113824.50177-2-philmd@linaro.org>

hw/usb/hcd-ehci: Fix debug printf format string

The variable is uint64_t so needs %PRIu64 instead of %d.

Fixes: 3ae7eb88c47 ("ehci: fix overflow in frame timer code")
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250124124713.64F8C4E6031@zero.eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/misc/i2c-echo: add tracing

This has been useful when debugging and unsure if the guest is
generating i2c traffic.

Signed-off-by: Titus Rwantare <titusr@google.com>
Reviewed-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250121105935.3069035-1-titusr@google.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/char/pci-multi: Convert legacy qemu_allocate_irqs to qemu_init_irq

There are a fixed number of PCI IRQs, known beforehand.
Allocate them within PCIMultiSerialState, and initialize
using qemu_init_irq(), allowing to remove the legacy
qemu_allocate_irqs() and qemu_free_irqs() calls.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250121182828.45088-1-philmd@linaro.org>

hw/sh4/r2d: Convert legacy qemu_allocate_irqs() to qemu_init_irqs()

The FPGA exposes a fixed set of IRQs. Hold them in the FPGA
state and initialize them in place calling qemu_init_irqs().

Move r2d_fpga_irq enums earlier so we can use NR_IRQS within
the r2d_fpga_t structure. r2d_fpga_init() returns r2d_fpga_t,
and we dereference irq from it in r2d_init().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250121182445.35309-1-philmd@linaro.org>

hw/ipack: Remove legacy qemu_allocate_irqs() use

No need to dynamically allocate IRQ when we know before hands
how many we'll use. Declare the 2 of them in IPackDevice state
and initialize them in the DeviceRealize handler.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250121155526.29982-4-philmd@linaro.org>

hw/ipack: Clarify KConfig symbols

Split IPACK Kconfig key as {IPACK, TPCI200, IP_OCTAL_232}

  - IPack is a bus
  - TPCI200 is a PCI device providing an IPack bus
  - IP-Octal232 is an IPack device plugged on an IPack bus

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Fabiano Rosas <farosas@suse.de>
Message-Id: <20250121155526.29982-3-philmd@linaro.org>

hw/irq: Introduce qemu_init_irqs() helper

While qemu_init_irq() initialize a single IRQ,
qemu_init_irqs() initialize an array of them.

Suggested-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250121155526.29982-2-philmd@linaro.org>

hw/mips/loongson3_bootp: Move to common_ss[]

loongson3_bootp.c doesn't contain any target-specific code
and can be build generically, move it to common_ss[].

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250115232952.31166-12-philmd@linaro.org>

hw/mips/loongson3_virt: Propagate %processor_id to init_boot_param()

Propagate %processor_id from mips_loongson3_virt_init() where
we have a reference to the first vCPU, so use it instead of
the &first_cpu global.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250115232952.31166-11-philmd@linaro.org>

hw/mips/loongson3_virt: Propagate processor_id to init_loongson_params()

Remove one &first_cpu use in hw/mips/loongson3_bootp.c.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250115232952.31166-10-philmd@linaro.org>

hw/mips/loongson3_bootp: Propagate processor_id to init_cpu_info()

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250115232952.31166-9-philmd@linaro.org>

hw/mips/loongson3_virt: Propagate cpu_count to init_boot_param()

Remove one use of the 'current_machine' global.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250115232952.31166-8-philmd@linaro.org>

hw/mips/loongson3: Propagate cpu_count to init_loongson_params()

Propagate the %cpu_count from the machine file, allowing
to remove the "hw/boards.h" dependency (which is machine
specific) from loongson3_bootp.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250115232952.31166-7-philmd@linaro.org>

hw/mips/loongson3_bootp: Include missing headers

MemMapEntry is declared in "exec/hwaddr.h", cpu_to_le32() in
"qemu/bswap.h". These headers are indirectly included via "cpu.h".
Include them explicitly in order to avoid when removing "cpu.h":

  In file included from ../../hw/mips/loongson3_bootp.c:27:
  hw/mips/loongson3_bootp.h:234:14: error: unknown type name 'MemMapEntry'
    234 | extern const MemMapEntry virt_memmap[];
        |              ^
  hw/mips/loongson3_bootp.c:33:18: error: call to undeclared function 'cpu_to_le32'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
     33 |     c->cputype = cpu_to_le32(Loongson_3A);
        |                  ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250115232952.31166-6-philmd@linaro.org>

hw/mips/loongson3_virt: Pass CPU argument to get_cpu_freq_hz()

Pass the first vCPU as argument, allowing to remove
another &first_cpu global use.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250115232952.31166-5-philmd@linaro.org>

hw/mips/loongson3_virt: Have fw_conf_init() access local loaderparams

'loaderparams' is declared statically. Let fw_conf_init()
access its 'cpu_freq' and 'ram_size' fields.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250115232952.31166-4-philmd@linaro.org>

hw/mips/loongson3_virt: Invert vCPU creation order to remove &first_cpu

Create vCPUs from the last one to the first one.
No need to use the &first_cpu global since we already
have it referenced.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250115232952.31166-3-philmd@linaro.org>

hw/mips/loongson3_virt: Factor generic_cpu_reset() out

main_cpu_reset() is misleadingly named "main": it resets
all vCPUs, with a special case for the first vCPU.

Factor generic_cpu_reset() out of main_cpu_reset(),
allowing to remove one &first_cpu use.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250115232952.31166-2-philmd@linaro.org>

hw/rx/rx-gdbsim: Remove unnecessary uses of &first_cpu

rx_gdbsim_init() has access to the single CPU via:

  RxGdbSimMachineState {
    RX62NState {
      RXCPU cpu;
      ...
    } mcu;
  } s;

Directly use that instead of the &first_cpu global.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250110180442.82687-1-philmd@linaro.org>

target/hppa: Update SeaBIOS-hppa to version 18

This is SeaBIOS for the hppa architecture v18.
It allows us to emulate up to 256 GB RAM on 64-bit
guests and to boot HP-UX 64-bit one step further.

Fixes:
- Fix PDC_CACHE/PDC_CACHE_RET_SPID return value for space
  register hashing on 64-bit HP-UX
- Fix IRT table entries to use slot number
- Increase PCI alignment for memory bars to 64k

New PDC functions & general enhancements:
- Allow up to 256 GB RAM on 64-bit machines

Signed-off-by: Helge Deller <deller@gmx.de>

target/hppa: Implement space register hashing for 64-bit HP-UX

The Linux kernel turns space-register hashing off unconditionally at
bootup.  That code was provided by HP at the beginning of the PA-RISC
Linux porting effort, and I don't know why it was decided then why Linux
should not use space register hashing.
32-bit HP-UX versions seem to not use space register hashing either.

But for 64-bit HP-UX versions, Sven Schnelle noticed that space register
hashing needs to be enabled and is required, otherwise the HP-UX kernel
will crash badly.

On 64-bit CPUs space register hashing is controlled by a bit in diagnose
register %dr2.  Since we want to support Linux and 32- and 64-bit HP-UX,
we need to fully emulate the diagnose registers and handle specifically
the bit in %dr2.

This patch adds the code to calculate the gva memory mask based on the
space-register hashing bit in %dr2 and the PSW_W (64-bit) flag.
The value is cached in the gva_offset_mask variable in CPUArchState
and recalculated at every modification of the CPU PSW or %dr2.

Signed-off-by: Helge Deller <deller@gmx.de>
Suggested-by: Sven Schnelle <svens@stackframe.org>
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

parallels: fix ext_off assertion failure due to overflow

This error was discovered by fuzzing qemu-img.

When ph.ext_off has a sufficiently large value, the operation
le64_to_cpu(ph.ext_off) << BDRV_SECTOR_BITS in
parallels_read_format_extension() can cause an overflow in int64_t.
This overflow triggers the assert(ext_off > 0)
check in block/parallels-ext.c: parallels_read_format_extension(),
leading to a crash.

This commit adds a check to prevent overflow when shifting ph.ext_off
by BDRV_SECTOR_BITS, ensuring that the value remains within a valid range.

Reported-by: Leonid Reviakin <L.reviakin@fobos-nt.ru>
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
Reviewed-by: Denis V. Lunev <den@openvz.org>
Message-ID: <20241212104212.513947-2-gerben@altlinux.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging

trivial patches for 2025-01-30

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEZKoqtTHVaQM2a/75gqpKJDselHgFAmebf70ACgkQgqpKJDse
# lHgmWw/8DZXr5+Aar9FJZIUZWqxBxRzNjnvKEGQPCKI+Iqi3qkwOHij3Tr06vERM
# upWZ/6Gx6v8SFjlfCv4VvtAHwflLOFqBzDxrCRDiZqNuLDaXuLnTMF1H8teg4ciM
# 7uPjvI17LDgoBEDR27divxcLcP4dDI5RMkAndzyL1U9OGugO4vgmDUAuXkNzqBFS
# tnWQmay3VTDVNtd4YJvhqJM5UR/4mSHlISlZpbzpF2Pxd2Job6IHYEzmre+0iteQ
# TukjKkSQ7os7jEV984zVmwZnqCZrq6iIjX0nY6d1wWeDLjRMzLNqHuZ7jYVYDMWr
# G/HdXp7BfGW1kG67W86MWWVW6O96DsyN5e76pMdlu8DjDs1/hiTA02cUEa2x2Alw
# 3ngblJMC2JhvmuMLZStJf3zTb1GABijQJdfEYjUJ1FEY0dhVuK5teeTRjql7xjnw
# tHtaxn11ahifZ++kRAeZyinkkUlKLOcV8xoGqmv8uRjy6XepFASFkSj/jEbyohKF
# BGGvUVT1cp0Krr9TOAEnrhYEpXgHjxsR0PqTphH1wQojr/AyYTBwSy/wGWPbMvQQ
# u/hHoJ/RgiiSf5HW/PRUbWrTdgYPg8Ej/9n7geAZSk2e9hfGI6Ii88XOmrZefQ+4
# 2GQ+a3I2n4LQ1cyzrGZgUncwLClIpqN/WtRsUNEFQs6zrcvG52U=
# =2d/y
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 30 Jan 2025 08:33:49 EST
# gpg:                using RSA key 64AA2AB531D56903366BFEF982AA4A243B1E9478
# gpg: Good signature from "Michael Tokarev <mjt@debian.org>" [unknown]
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>" [unknown]
# gpg:                 aka "Michael Tokarev <mjt@tls.msk.ru>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 9D8B E14E 3F2A 9DD7 9199  28F1 61AD 3D98 ECDF 2C8E
#      Subkey fingerprint: 64AA 2AB5 31D5 6903 366B  FEF9 82AA 4A24 3B1E 9478

* tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu:
  hw/i386/pc: Remove unused pc_compat_2_3 declarations
  licenses: Remove SPDX tags not being license identifier for Linaro
  tests/functional/test_mips_malta: Fix comment about endianness of the test
  gdbstub/user-target: fix gdbserver int format (%d -> %x)
  vvfat: create_long_filename: fix out-of-bounds array access
  net/dump: Correctly compute Ethernet packet offset
  net: Fix announce_self

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'pull-request-2025-01-30' of https://gitlab.com/thuth/qemu into staging

* Convert more avocado tests to the functional framework
* Fix the broken aarch64_tcg_plugins test
* Add test for 64-bit mac99 machine
* Add a Linux-based test for the 40p machine
* Fix issues with record/replay of some s390x instructions
* Fix node.js crashes on emulated s390x due to a bug in the MVC instruction
* Enable virtio-balloon-pci and virtio-mem-pci on s390x
* Fix a libslirp v4.9.0 compilation problem

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmebewIRHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbUfZQ//WHrZNVQNe0d+wOtAa5Zj4X9RpadHeGO9
# WCKtBWZ1tDADHiVkZzU6L6q/LYM5FcAOE+Kah/xr8rtf6he+LCYQ0RDHbgY6/oUE
# t9TkIeph59+MMvBXWJ8flngaoVtxe8l2aYem8wk3ATPZtHyMQAZ5PAjY3+WYQAGc
# gm13k1AMD4mA6mBUOs67QSitTqBQsunKpb1IvpyBjtv9NBl61L8h5hWn0bsxa8yC
# 3KKZhw6Nclc8RVe33e6ZDrHrBi9klORd6Z+7fJ4w8Yj+C48ogfbQx+Zvb82jXhRe
# 2qGdVb6cF7LVQ5D3pECBK7yo4Lkd7MYnNvn+EmbTXhj1y5MSPdokP6k0ZWkhhkCP
# 2kIY0o5tFipdxkdDpCptU3gYJLdQFbNX2MqDFY0KeurLDGe4o6jIoRNmdZ67TJei
# zleLlcEatoyRqpCKqTNMDVeWgza3ngykhiQIrG9PMPCRQET0N4qY6db35hzDujLI
# NVuI1traCLawfCDYiMnU59dOxWSHy1bwSfnUxhZ92+Fl3AOb6c6PzhpkIGl/grwT
# 8T8EcjFyA4hpaHHKjCeNgSrKt9N0Ka2G3l9oF8eWwJm4KAlwtYBDvfVb+juGBP9+
# 8gW0lXA8tYy/P5XgPQ0N5Z8coc1xUrYBhC7v70ud3ponMmmTdhRnosey2cOFUGsN
# /U7avgXIm0Q=
# =rEzl
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 30 Jan 2025 08:13:38 EST
# gpg:                using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg:                issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2025-01-30' of https://gitlab.com/thuth/qemu:
  net/slirp: libslirp 4.9.0 compatibility
  tests/functional/test_mips_malta: Convert the mips big endian replay tests
  tests/functional/test_mips64el_malta: Convert the mips64el replay tests
  tests/functional/test_mipsel_malta: Convert the mipsel replay tests
  tests/functional: Add the ReplayKernelBase class
  tests/functional: Add a decorator for skipping long running tests
  tests/functional: Extend PPC 40p test with Linux boot
  s390x/s390-virtio-ccw: Support plugging PCI-based virtio memory devices
  virtio-mem-pci: Allow setting nvectors, so we can use MSI-X
  virtio-balloon-pci: Allow setting nvectors, so we can use MSI-X
  hw/s390x/s390-virtio-ccw: Fix a record/replay deadlock
  tests/tcg/s390x: Test modifying code using the MVC instruction
  target/s390x: Fix MVC not always invalidating translation blocks
  target/s390x: Fix PPNO execution with icount
  tests/functional/test_mips_malta: Fix comment about endianness of the test
  tests/functional: Add a ppc64 mac99 test
  tests/functional: Fix the aarch64_tcg_plugins test
  tests/functional: Convert the migration avocado test
  tests/functional: Fix broken decorators with lamda functions
  tests/functional/qemu_test/decorators: Fix bad check for imports

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'migration-20250129-pull-request' of https://gitlab.com/farosas/qemu into staging

Migration pull request

- Purge of ram_save_target_page_legacy
- Cleanups to postcopy, json writer, migration states
- New migration mode cpr-transfer
- Fix for a -Werror=maybe-uninitialized instance in savevm

# -----BEGIN PGP SIGNATURE-----
#
# iQJEBAABCAAuFiEEqhtIsKIjJqWkw2TPx5jcdBvsMZ0FAmeaT8EQHGZhcm9zYXNA
# c3VzZS5kZQAKCRDHmNx0G+wxndXrEACTT+rdoEvOsNs4nM2a67GjxUoQZVTAWn+8
# lYhhNZLA4E+qHwpHTDCwyfyvCe615r72+bF7QO1KTrYeXGJg4SPk5kbEhCDqqjEu
# SGqrlPwkC1x3WkTvb228iDddDQ8dccko3Sy6wAyz0o8dtp5p4iK+57qzB/84u94L
# y3zQ+owOo9OLnXgdfMpN99HGQSvPR7CbP/2L293IrMCuPDUo9XhI7ARNS/phbT3Z
# aDl10WGHKz1SJWOkPj137E6+xMKuCmOZDTufTcTaHfyliD04JRWgEZVnKJxKJDxd
# 9e+lzHvXuYfO7YO11fr7DttPRnLEfjipELVTxrudM92eZ95XwdL4+ggfBTGHt76P
# yFUrp7G8qsUjWd+DHPmoo6Gx71zPbE6v9J2NMn2/1k4WdPOYy7HTmDgCkRirRTvV
# irYkHtdSFFsj3c0g4P4mhOzXnvUkGXzgrjteM5hlLy3bjSeZz9VMZADjiGqFGVPb
# 6euPcLLa9oynkoP5UXmFd/9PjWcgnfIbQu2MVlIyWhjvTGZKSGecVZmH5pWTJuBV
# xCbab1jYprRFpUIAMo94rgvRQRosomS1+GjGndFkX5++dTTlFSqpDLSGcEnPSGRx
# o9n+IldNiqh2vjN1bj60pLfmrHN/F+hsGTsDJlW+kfeyBXBkGArg1rDjN5ae7GvD
# UZK0N+OG0g==
# =jwOI
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 29 Jan 2025 10:56:49 EST
# gpg:                using RSA key AA1B48B0A22326A5A4C364CFC798DC741BEC319D
# gpg:                issuer "farosas@suse.de"
# gpg: Good signature from "Fabiano Rosas <farosas@suse.de>" [unknown]
# gpg:                 aka "Fabiano Almeida Rosas <fabiano.rosas@suse.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: AA1B 48B0 A223 26A5 A4C3  64CF C798 DC74 1BEC 319D

* tag 'migration-20250129-pull-request' of https://gitlab.com/farosas/qemu: (42 commits)
  migration: refactor ram_save_target_page functions
  migration: Trivial cleanup on JSON writer of vmstate_save()
  migration: Merge precopy/postcopy on switchover start
  migration: Always set DEVICE state
  migration: Cleanup qemu_savevm_state_complete_precopy()
  migration: Unwrap qemu_savevm_state_complete_precopy() in postcopy
  migration: Notify COMPLETE once for postcopy
  migration: Take BQL slightly longer in postcopy_start()
  migration: Drop cached migration state in migration_maybe_pause()
  migration: Adjust locking in migration_maybe_pause()
  migration: Adjust postcopy bandwidth during switchover
  migration: Synchronize all CPU states only for non-iterable dump
  migration: Drop inactivate_disk param in qemu_savevm_state_complete*
  migration: Avoid two src-downtime-end tracepoints for postcopy
  migration: Optimize postcopy on downtime by avoiding JSON writer
  migration: Do not construct JSON description if suppressed
  migration: Remove postcopy implications in should_send_vmdesc()
  migration: cpr-transfer documentation
  migration-test: cpr-transfer
  tests/qtest: assert qmp connected
  ...

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

net/slirp: libslirp 4.9.0 compatibility

Update the code in net/slirp.c to be compatible with
libslirp 4.9.0, which deprecated slirp_pollfds_fill()
and started using slirp_os_socket type for sockets
(which is a 64-bit integer on win64) for all callbacks
starting with version 6 of the interface.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Message-ID: <20250130123253.864681-1-mjt@tls.msk.ru>
[thuth: Added some spaces to make checkpatch.pl happy]
Signed-off-by: Thomas Huth <thuth@redhat.com>

target/hppa: 64-bit CPUs start with space register hashing enabled

Turn on space register hashing for 64-bit CPUs when reset.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

target/hppa: Add instruction decoding for mfdiag and mtdiag

Add 32- and 64-bit instruction decoding of the mfdiag and mtdiag
instructions which modify the diagnose registers.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

target/hppa: Drop diag_getshadowregs_pa2 and diag_putshadowregs_pa2

diag_getshadowregs_pa2() and diag_putshadowregs_pa2() were added in
commit 3bdf20819e68 based on some analysis of ODE code, but now they
conflict with the generic mfdiag/mtdiag instructions. I believe the
former analysis was wrong, so remove them again. Note that all diag
instructions are badly documented, so most things are based on reverse
engineering and thus may be wrong.

Signed-off-by: Helge Deller <deller@gmx.de>
Fixes: 3bdf20819e68 ("target/hppa: Add diag instructions to set/restore shadow registers")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

target/hppa: Add CPU diagnose registers

Add the diagnose registers (%dr) to the CPUArchState. Those are mostly
undocumented and control cache behaviour, memory behaviour, reset button
management and many other related internal CPU things.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

disas/hppa: implement mfdiag/mtdiag disassembly

The various PA-RISC CPUs implement different CPU-specific diag
instructions (mfdiag, mtdiag, mfcpu, mtcpu, ...) to access CPU-internal
diagnose/configuration registers, e.g. for cache control, managing space
register hashing, control front panel LEDs and read status of the
hardware reset button.

Those instructions are mostly undocumented, but are used by ODE, HP-UX
and Linux.

This patch adds some neccessary instructions for PCXL and PCXU CPUs.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

hppa: Sync contents of hppa_hardware.h header file with SeaBIOS-hppa

The hppa_hardware.h header file holds many constants for addresses and
offsets which are needed while building the firmware (SeaBIOS-hppa) and
while setting up the virtual machine in QEMU.

This patch brings it in sync between both source code repositories.

Signed-off-by: Helge Deller <deller@gmx.de>
Acked-by: Richard Henderson <richard.henderson@linaro.org>