aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-12-17softfloat: Add flag specific to convert non-nan to intRichard Henderson
PowerPC has this flag, and it's easier to compute it here than after the fact. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20211119160502.17432-7-richard.henderson@linaro.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17softfloat: Add flag specific to sqrt(-x)Richard Henderson
PowerPC has this flag, and it's easier to compute it here than after the fact. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20211119160502.17432-6-richard.henderson@linaro.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17softfloat: Add flags specific to Inf / Inf and 0 / 0Richard Henderson
PowerPC has these flags, and it's easier to compute them here than after the fact. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20211119160502.17432-5-richard.henderson@linaro.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17softfloat: Add flag specific to Inf * 0Richard Henderson
PowerPC has this flag, and it's easier to compute it here than after the fact. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20211119160502.17432-4-richard.henderson@linaro.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17softfloat: Add flag specific to Inf - InfRichard Henderson
PowerPC has this flag, and it's easier to compute it here than after the fact. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20211119160502.17432-3-richard.henderson@linaro.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17softfloat: Extend float_exception_flags to 16 bitsRichard Henderson
We will shortly have more than 8 bits of exceptions. Repack the existing flags into low bits and reformat to hex. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20211119160502.17432-2-richard.henderson@linaro.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17Link new ppc-spapr-hcalls.rst file to pseries.rst.Leonardo Garcia
Signed-off-by: Leonardo Garcia <lagarcia@br.ibm.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <7d3c8bad1ca76eb13d6ce2b16dd9a821edcdb27b.1638982486.git.lagarcia@br.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17docs: Rename ppc-spapr-hcalls.txt to ppc-spapr-hcalls.rst.Leonardo Garcia
Signed-off-by: Leonardo Garcia <lagarcia@br.ibm.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <7f13e40e05ddb411697b0777b0e37757f76905e9.1638982486.git.lagarcia@br.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17docs: rSTify ppc-spapr-hcalls.txtLeonardo Garcia
Signed-off-by: Leonardo Garcia <lagarcia@br.ibm.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> [ clg: - replaced lingua by terminology - add a new line at EOF ] Message-Id: <e20319dcf0ec37bedd915c740c3813eb0e58ead4.1638982486.git.lagarcia@br.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17docs: Introducing pseries documentation.Leonardo Garcia
The purpose of this document is to substitute the content currently available in the QEMU wiki at [0]. This initial version does contain some additional content as well. Whenever this documentation gets upstream and is reflected in [1], the QEMU wiki will be edited to point to this documentation, so that we only need to keep it updated in one place. 0. https://wiki.qemu.org/Documentation/Platforms/POWER 1. https://qemu.readthedocs.io/en/latest/system/ppc/pseries.html Signed-off-by: Leonardo Garcia <lagarcia@br.ibm.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <66b6fdde52062fdf4f4b4dc35a9f06a899c88293.1638981899.git.lagarcia@br.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17ppc/pnv.c: fix "system-id" FDT when -uuid is setDaniel Henrique Barboza
Setting -uuid in the pnv machine does not work: ./qemu-system-ppc64 -machine powernv8,accel=tcg -uuid 7ff61ca1-a4a0-4bc1-944c-abd114a35e80 qemu-system-ppc64: error creating device tree: (fdt_property_string(fdt, "system-id", buf)): FDT_ERR_BADSTATE This happens because we're using fdt_property_string(), which is a sequential write function that is supposed to be used when we're building a new FDT, in a case where read/writing into an existing FDT. Fix it by using fdt_setprop_string() instead. Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20211207094858.744386-1-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17docs/system/ppc/powernv.rst: document KVM support statusDaniel Henrique Barboza
Put in a more accessible place the reasoning behind our decision to officially drop KVM support in the powernv machine. Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20211130133153.444601-3-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17ppc/pnv.c: add a friendly warning when accel=kvm is usedDaniel Henrique Barboza
If one tries to use -machine powernv9,accel=kvm in a Power9 host, a cryptic error will be shown: qemu-system-ppc64: Register sync failed... If you're using kvm-hv.ko, only "-cpu host" is possible qemu-system-ppc64: kvm_init_vcpu: kvm_arch_init_vcpu failed (0): Invalid argument Appending '-cpu host' will throw another error: qemu-system-ppc64: invalid chip model 'host' for powernv9 machine The root cause is that in IBM PowerPC we have different specs for the bare-metal and the guests. The bare-metal follows OPAL, the guests follow PAPR. The kernel KVM modules presented in the ppc kernels implements PAPR. This means that we can't use KVM accel when using the powernv machine, which is the emulation of the bare-metal host. All that said, let's give a more informative error in this case. Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20211130133153.444601-2-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17docs: Minor updates on the powernv documentation.Leonardo Garcia
Signed-off-by: Leonardo Garcia <lagarcia@br.ibm.com> [ clg: replaced Power9 by POWER9 ] Message-Id: <c387f883b3db34d9fcb44ccac2ef11c35a25e18c.1637669345.git.lagarcia@br.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17pci-host: Allow extended config space access for PowerNV PHB4 modelChristophe Lombard
The PCIe extended configuration space on the device is not currently accessible to the host. if by default, it is still inaccessible for conventional for PCIe buses, add the current flag PCI_BUS_EXTENDED_CONFIG_SPACE on the root bus permits PCI-E extended config space access. Signed-off-by: Christophe Lombard <clombard@linux.vnet.ibm.com> Reviewed-by: Frederic Barrat <fbarrat@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20211109145053.43524-1-clombard@linux.vnet.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17ivshmem-test.c: enable test_ivshmem_server for ppc64 archDaniel Henrique Barboza
This test, if enabled by hand, was failing when the ivhsmem device was being declared as DEVICE_NATIVE_ENDIAN with the following error: /ppc64/ivshmem/pair: OK /ppc64/ivshmem/server: ** ERROR:/home/danielhb/qemu/tests/qtest/ivshmem-test.c:367:test_ivshmem_server: assertion failed (ret != 0): (0 != 0) Aborted After the endianness change done in the previous patch, we can verify in both a a Power 9 little-endian host and in a Power 8 big-endian host that this test is now passing: $ QTEST_QEMU_BINARY=./ppc64-softmmu/qemu-system-ppc64 ./tests/qtest/ivshmem-test -m slow /ppc64/ivshmem/single: OK /ppc64/ivshmem/hotplug: OK /ppc64/ivshmem/memdev: OK /ppc64/ivshmem/pair: OK /ppc64/ivshmem/server: OK Let's keep it that way by officially enabling it for ppc64. Acked-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211124092948.335389-3-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17ivshmem.c: change endianness to LITTLE_ENDIANDaniel Henrique Barboza
The ivshmem device, as with most PCI devices, uses little endian byte order. However, the endianness of its mmio_ops is marked as DEVICE_NATIVE_ENDIAN. This presents not only the usual problems with big endian hosts but also with PowerPC little endian hosts as well, since the Power architecture in QEMU uses big endian hardware (XIVE controller, PCI Host Bridges, etc) even if the host is in little endian byte order. As it is today, the IVPosition of the device will be byte swapped when running in Power BE and LE. This can be seen by changing the existing qtest 'ivshmem-test' to run in ppc64 hosts and printing the IVPOSITION regs in test_ivshmem_server() right after the VM ids assert. For x86_64 the VM id values read are '0' and '1', for ppc64 (tested in a Power8 RHEL 7.9 BE server) and ppc64le (tested in a Power9 RHEL 8.6 LE server) the ids will be '0' and '0x1000000'. Change this device to LITTLE_ENDIAN fixes the issue for Power hosts of both endianness, and every other big-endian architecture that might use this device, without impacting x86 users. Fixes: cb06608e17f8 ("ivshmem: convert to memory API") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/168 Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211124092948.335389-2-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17target/ppc: Implement Vector Mask Move insnsMatheus Ferst
Implement the following PowerISA v3.1 instructions: mtvsrbm: Move to VSR Byte Mask mtvsrhm: Move to VSR Halfword Mask mtvsrwm: Move to VSR Word Mask mtvsrdm: Move to VSR Doubleword Mask mtvsrqm: Move to VSR Quadword Mask mtvsrbmi: Move to VSR Byte Mask Immediate Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Matheus Ferst <matheus.ferst@eldorado.org.br> Message-Id: <20211203194229.746275-4-matheus.ferst@eldorado.org.br> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17target/ppc: Implement Vector Extract MaskMatheus Ferst
Implement the following PowerISA v3.1 instructions: vextractbm: Vector Extract Byte Mask vextracthm: Vector Extract Halfword Mask vextractwm: Vector Extract Word Mask vextractdm: Vector Extract Doubleword Mask vextractqm: Vector Extract Quadword Mask Signed-off-by: Matheus Ferst <matheus.ferst@eldorado.org.br> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20211203194229.746275-3-matheus.ferst@eldorado.org.br> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17target/ppc: Implement Vector Expand MaskMatheus Ferst
Implement the following PowerISA v3.1 instructions: vexpandbm: Vector Expand Byte Mask vexpandhm: Vector Expand Halfword Mask vexpandwm: Vector Expand Word Mask vexpanddm: Vector Expand Doubleword Mask vexpandqm: Vector Expand Quadword Mask Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Matheus Ferst <matheus.ferst@eldorado.org.br> Message-Id: <20211203194229.746275-2-matheus.ferst@eldorado.org.br> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17target/ppc: ppc_store_fpscr doesn't update bits 0 to 28 and 52Lucas Mateus Castro (alqotel)
This commit fixes the difference reported in the bug in the reserved bit 52, it does this by adding this bit to the mask of bits to not be directly altered in the ppc_store_fpscr function (the hardware used to compare to QEMU was a Power9). The bits 0 to 27 were also added to the mask, as they are marked as reserved in the PowerISA and bit 28 is a reserved extension of the DRN field (bits 29:31) but can't be set using mtfsfi, while the other DRN bits may be set using mtfsfi instruction, so bit 28 was also added to the mask. Although this is a difference reported in the bug, since it's a reserved bit it may be a "don't care" case, as put in the bug report. Looking at the ISA it doesn't explicitly mention this bit can't be set, like it does for FEX and VX, so I'm unsure if this is necessary. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/266 Signed-off-by: Lucas Mateus Castro (alqotel) <lucas.araujo@eldorado.org.br> Message-Id: <20211201163808.440385-4-lucas.araujo@eldorado.org.br> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17test/tcg/ppc64le: test mtfsfLucas Mateus Castro (alqotel)
Added tests for the mtfsf to check if FI bit of FPSCR is being set and if exception calls are being made correctly. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Lucas Mateus Castro (alqotel) <lucas.araujo@eldorado.org.br> Message-Id: <20211201163808.440385-3-lucas.araujo@eldorado.org.br> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17target/ppc: Fixed call to deferred exceptionLucas Mateus Castro (alqotel)
mtfsf, mtfsfi and mtfsb1 instructions call helper_float_check_status after updating the value of FPSCR, but helper_float_check_status checks fp_status and fp_status isn't updated based on FPSCR and since the value of fp_status is reset earlier in the instruction, it's always 0. Because of this helper_float_check_status would change the FI bit to 0 as this bit checks if the last operation was inexact and float_flag_inexact is always 0. These instructions also don't throw exceptions correctly since helper_float_check_status throw exceptions based on fp_status. This commit created a new helper, helper_fpscr_check_status that checks FPSCR value instead of fp_status and checks for a larger variety of exceptions than do_float_check_status. Since fp_status isn't used, gen_reset_fpstatus() was removed. The hardware used to compare QEMU's behavior to was a Power9. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Lucas Mateus Castro (alqotel) <lucas.araujo@eldorado.org.br> Message-Id: <20211201163808.440385-2-lucas.araujo@eldorado.org.br> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-17hw/ppc/mac.h: Remove MAX_CPUS macroPeter Maydell
The mac.h header defines a MAX_CPUS macro. This is confusingly named, because it suggests it's a generic setting, but in fact it's used by only the g3beige and mac99 machines. It's also using a single macro for two values which aren't inherently the same -- if one of these two machines was updated to support SMP configurations then it would want a different max_cpus value to the other. Since the macro is used in only two places, just expand it out and get rid of it. If hypothetical future work to support SMP in these boards needs a compile-time-known limit on the number of CPUs, we can give it a suitable name at that point. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20211105184216.120972-1-peter.maydell@linaro.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-16Merge tag 'qemu-slof-20211112' of github.com:aik/qemu into ppc-nextCédric Le Goater
* tag 'qemu-slof-20211112' of github.com:aik/qemu: pseries: Update SLOF firmware image Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-12-14Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into stagingRichard Henderson
Pull request An infinite loop fix for the userspace NVMe driver. # gpg: Signature made Thu 09 Dec 2021 07:21:08 AM PST # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] * tag 'block-pull-request' of https://gitlab.com/stefanha/qemu: block/nvme: fix infinite loop in nvme_free_req_queue_cb() Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-12-14Open 6.3 development treeRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-12-14Update version for v6.2.0 releasev6.2.0Richard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-12-09block/nvme: fix infinite loop in nvme_free_req_queue_cb()Stefan Hajnoczi
When the request free list is exhausted the coroutine waits on q->free_req_queue for the next free request. Whenever a request is completed a BH is scheduled to invoke nvme_free_req_queue_cb() and wake up waiting coroutines. 1. nvme_get_free_req() waits for a free request: while (q->free_req_head == -1) { ... trace_nvme_free_req_queue_wait(q->s, q->index); qemu_co_queue_wait(&q->free_req_queue, &q->lock); ... } 2. nvme_free_req_queue_cb() wakes up the coroutine: while (qemu_co_enter_next(&q->free_req_queue, &q->lock)) { ^--- infinite loop when free_req_head == -1 } nvme_free_req_queue_cb() and the coroutine form an infinite loop when q->free_req_head == -1. Fix this by checking q->free_req_head in nvme_free_req_queue_cb(). If the free request list is exhausted, don't wake waiting coroutines. Eventually an in-flight request will complete and the BH will be scheduled again, guaranteeing forward progress. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20211208152246.244585-1-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-12-07Update version for v6.2.0-rc4 releasev6.2.0-rc4Richard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-12-07Merge tag 'pull-target-arm-20211207' of ↵Richard Henderson
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * Fix calculation of ICH_MISR_EL2.LRENP to avoid incorrect generation of maintenance interrupts # gpg: Signature made Tue 07 Dec 2021 09:18:50 AM PST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] * tag 'pull-target-arm-20211207' of https://git.linaro.org/people/pmaydell/qemu-arm: gicv3: fix ICH_MISR's LRENP computation Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-12-07gicv3: fix ICH_MISR's LRENP computationDamien Hedde
According to the "Arm Generic Interrupt Controller Architecture Specification GIC architecture version 3 and 4" (version G: page 345 for aarch64 or 509 for aarch32): LRENP bit of ICH_MISR is set when ICH_HCR.LRENPIE==1 and ICH_HCR.EOIcount is non-zero. When only LRENPIE was set (and EOI count was zero), the LRENP bit was wrongly set and MISR value was wrong. As an additional consequence, if an hypervisor set ICH_HCR.LRENPIE, the maintenance interrupt was constantly fired. It happens since patch 9cee1efe92 ("hw/intc: Set GIC maintenance interrupt level to only 0 or 1") which fixed another bug about maintenance interrupt (most significant bits of misr, including this one, were ignored in the interrupt trigger). Fixes: 83f036fe3d ("hw/intc/arm_gicv3: Add accessors for ICH_ system registers") Signed-off-by: Damien Hedde <damien.hedde@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20211207094427.3473-1-damien.hedde@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-12-07Merge tag 'pull-tcg-20211207' of https://gitlab.com/rth7680/qemu into stagingRichard Henderson
Fix stack spills for arm neon. # gpg: Signature made Tue 07 Dec 2021 06:33:57 AM PST # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [ultimate] * tag 'pull-tcg-20211207' of https://gitlab.com/rth7680/qemu: tcg/arm: Reduce vector alignment requirement for NEON Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-12-07tcg/arm: Reduce vector alignment requirement for NEONRichard Henderson
With arm32, the ABI gives us 8-byte alignment for the stack. While it's possible to realign the stack to provide 16-byte alignment, it's far easier to simply not encode 16-byte alignment in the VLD1 and VST1 instructions that we emit. Remove the assertion in temp_allocate_frame, limit natural alignment to the provided stack alignment, and add a comment. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1999878 Reported-by: Richard W.M. Jones <rjones@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210912174925.200132-1-richard.henderson@linaro.org> Message-Id: <20211206191335.230683-2-richard.henderson@linaro.org>
2021-12-06Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into stagingRichard Henderson
Pull request # gpg: Signature made Mon 06 Dec 2021 07:27:19 AM PST # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] * tag 'block-pull-request' of https://gitlab.com/stefanha/qemu: virtio-blk: Fix clean up of host notifiers for single MR transaction. Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-12-06Merge tag 'mips-20211206' of https://github.com/philmd/qemu into stagingRichard Henderson
MIPS fixes - Do not emit SD instruction on 32-bit CPU (Jiaxun Yang) - Correctly catch load_elf() errors on Boston board (Jiaxun Yang) - Revert bogus CLI fix for ISA VGA devices (Alex Bennée) # gpg: Signature made Mon 06 Dec 2021 03:03:24 AM PST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'mips-20211206' of https://github.com/philmd/qemu: Revert "vga: don't abort when adding a duplicate isa-vga device" hw/mips/boston: Fix load_elf() error detection hw/mips/bootloader: Fix write_ulong() Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-12-06virtio-blk: Fix clean up of host notifiers for single MR transaction.Mark Mielke
The code that introduced "virtio-blk: Configure all host notifiers in a single MR transaction" introduced a second loop variable to perform cleanup in second loop, but mistakenly still refers to the first loop variable within the second loop body. Fixes: d0267da61489 ("virtio-blk: Configure all host notifiers in a single MR transaction") Signed-off-by: Mark Mielke <mark.mielke@gmail.com> Message-id: CALm7yL08qarOu0dnQkTN+pa=BSRC92g31YpQQNDeAiT4yLZWQQ@mail.gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-12-06Revert "vga: don't abort when adding a duplicate isa-vga device"Alex Bennée
This reverts commit 7852a77f598635a67a222b6c1463c8b46098aed2. The check is bogus as it ends up finding itself and falling over. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/733 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20211206095209.2332376-1-alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-12-06hw/mips/boston: Fix load_elf() error detectionJiaxun Yang
load_elf() gives negative return in case of error, not zero. Fixes: 10e3f30ff73 ("hw/mips/boston: Allow loading elf kernel and dtb") Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20211130211729.7116-3-jiaxun.yang@flygoat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-12-06hw/mips/bootloader: Fix write_ulong()Jiaxun Yang
bl_gen_write_ulong uses sd for both 32 and 64 bit CPU, while sd is illegal on 32 bit CPUs. Replace sd with sw on 32bit CPUs. Fixes: 3ebbf86128f ("hw/mips: Add a bootloader helper") Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20211130211729.7116-2-jiaxun.yang@flygoat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-12-03Merge tag 'seabios-20211203-pull-request' of git://git.kraxel.org/qemu into ↵Richard Henderson
staging seabios: update from snapshot to final 1.15.0 release (no code changes). # gpg: Signature made Fri 03 Dec 2021 12:55:34 AM PST # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] * tag 'seabios-20211203-pull-request' of git://git.kraxel.org/qemu: seabios: update binaries to 1.15.0 seabios: update submodule to 1.15.0 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-12-03seabios: update binaries to 1.15.0Gerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-12-03seabios: update submodule to 1.15.0Gerd Hoffmann
Update seabios to the final release. No code changes compared to the snapshot merged a few weeks ago. shortlog 64f37cc530f1..rel-1.15.0 --------------------------------- Kevin O'Connor (1): docs: Note v1.15.0 release Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-12-02Merge tag 'ide-pull-request' of https://gitlab.com/jsnow/qemu into stagingRichard Henderson
Pull request # gpg: Signature made Wed 01 Dec 2021 10:17:38 PM PST # gpg: using RSA key F9B7ABDBBCACDF95BE76CBD07DEF8106AAFC390E # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" [full] * tag 'ide-pull-request' of https://gitlab.com/jsnow/qemu: tests/qtest/fdc-test: Add a regression test for CVE-2021-20196 hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 hw/block/fdc: Extract blk_create_empty_drive() Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-12-02tests/qtest/fdc-test: Add a regression test for CVE-2021-20196Philippe Mathieu-Daudé
Without the previous commit, when running 'make check-qtest-i386' with QEMU configured with '--enable-sanitizers' we get: AddressSanitizer:DEADLYSIGNAL ================================================================= ==287878==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000344 ==287878==The signal is caused by a WRITE memory access. ==287878==Hint: address points to the zero page. #0 0x564b2e5bac27 in blk_inc_in_flight block/block-backend.c:1346:5 #1 0x564b2e5bb228 in blk_pwritev_part block/block-backend.c:1317:5 #2 0x564b2e5bcd57 in blk_pwrite block/block-backend.c:1498:11 #3 0x564b2ca1cdd3 in fdctrl_write_data hw/block/fdc.c:2221:17 #4 0x564b2ca1b2f7 in fdctrl_write hw/block/fdc.c:829:9 #5 0x564b2dc49503 in portio_write softmmu/ioport.c:201:9 Add the reproducer for CVE-2021-20196. Suggested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20211124161536.631563-4-philmd@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2021-12-02hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196Philippe Mathieu-Daudé
Guest might select another drive on the bus by setting the DRIVE_SEL bit of the DIGITAL OUTPUT REGISTER (DOR). The current controller model doesn't expect a BlockBackend to be NULL. A simple way to fix CVE-2021-20196 is to create an empty BlockBackend when it is missing. All further accesses will be safely handled, and the controller state machines keep behaving correctly. Cc: qemu-stable@nongnu.org Fixes: CVE-2021-20196 Reported-by: Gaoning Pan (Ant Security Light-Year Lab) <pgn@zju.edu.cn> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Hanna Reitz <hreitz@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20211124161536.631563-3-philmd@redhat.com BugLink: https://bugs.launchpad.net/qemu/+bug/1912780 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/338 Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Hanna Reitz <hreitz@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
2021-12-02hw/block/fdc: Extract blk_create_empty_drive()Philippe Mathieu-Daudé
We are going to re-use this code in the next commit, so extract it as a new blk_create_empty_drive() function. Inspired-by: Hanna Reitz <hreitz@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20211124161536.631563-2-philmd@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2021-12-01Update version for v6.2.0-rc3 releasev6.2.0-rc3Richard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-12-01MAINTAINERS: Change my email addressEduardo Habkost
The ehabkost@redhat.com email address will stop working on 2021-12-01, change it to my personal email address. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20211129163053.2506734-1-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20211130204722.2732997-2-ehabkost@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-11-29Merge tag 'pull-ppc-20211129' of https://github.com/legoater/qemu into stagingRichard Henderson
ppc 6.2 queue: * Hash64 MMU fix for FreeBSD installer # gpg: Signature made Mon 29 Nov 2021 09:49:54 PM CET # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@kaod.org>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-ppc-20211129' of https://github.com/legoater/qemu: target/ppc: fix Hash64 MMU update of PTE bit R Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-02 07:52:43 +0000