aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-11-19iotests: Add new test 220 for max compressed cluster offsetEric Blake
If you have a capable file system (tmpfs is good, ext4 not so much; run ./check with TEST_DIR pointing to a good location so as not to skip the test), it's actually possible to create a qcow2 file that expands to a sparse 512T image with just over 38M of content. The test is not the world's fastest (qemu crawling through 256M bits of refcount table to find the next cluster to allocate takes several seconds, as does qemu-img check reporting millions of leaked clusters); but it DOES catch the problem that the previous patch just fixed where writing a compressed cluster to a full image ended up overwriting the wrong cluster. Suggested-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19qcow2: Don't allow overflow during cluster allocationEric Blake
Our code was already checking that we did not attempt to allocate more clusters than what would fit in an INT64 (the physical maximimum if we can access a full off_t's worth of data). But this does not catch smaller limits enforced by various spots in the qcow2 image description: L1 and normal clusters of L2 are documented as having bits 63-56 reserved for other purposes, capping our maximum offset at 64PB (bit 55 is the maximum bit set). And for compressed images with 2M clusters, the cap drops the maximum offset to bit 48, or a maximum offset of 512TB. If we overflow that offset, we would write compressed data into one place, but try to decompress from another, which won't work. It's actually possible to prove that overflow can cause image corruption without this patch; I'll add the iotests separately in the next commit. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19qcow2: Document some maximum size constraintsEric Blake
Although off_t permits up to 63 bits (8EB) of file offsets, in practice, we're going to hit other limits first. Document some of those limits in the qcow2 spec (some are inherent, others are implementation choices of qemu), and how choice of cluster size can influence some of the limits. While we cannot map any uncompressed virtual cluster to any address higher than 64 PB (56 bits) (due to the current L1/L2 field encoding stopping at bit 55), qemu's cap of 8M for the refcount table can still access larger host addresses for some combinations of large clusters and small refcount_order. For comparison, ext4 with 4k blocks caps files at 16PB. Another interesting limit: for compressed clusters, the L2 layout requires an ever-smaller maximum host offset as cluster size gets larger, down to a 512 TB maximum with 2M clusters. In particular, note that with a cluster size of 8k or smaller, the L2 entry for a compressed cluster could technically point beyond the 64PB mark, but when you consider that with 8k clusters and refcount_order = 0, you cannot access beyond 512T without exceeding qemu's limit of an 8M cap on the refcount table, it is unlikely that any image in the wild has attempted to do so. To be safe, let's document that bits beyond 55 in a compressed cluster must be 0. Signed-off-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19vvfat: Fix memory leakKevin Wolf
Don't leak 'cluster' in the mapping == NULL case. Found by Coverity (CID 1055918). Fixes: 8d9401c2791ee2d2805b741b1ee3006041edcd3e Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Liam Merwick <liam.merwick@oracle.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-19fdc: fix segfault in fdctrl_stop_transfer() when DMA is disabledMark Cave-Ayland
Commit c8a35f1cf0f "fdc: use IsaDma interface instead of global DMA_* functions" accidentally introduced a segfault in fdctrl_stop_transfer() for non-DMA transfers. If fdctrl->dma_chann has not been configured then the fdctrl->dma interface reference isn't initialised during isabus_fdc_realize(). Unfortunately fdctrl_stop_transfer() unconditionally references the DMA interface when finishing the transfer causing a NULL pointer dereference. Fix the issue by adding a check in fdctrl_stop_transfer() so that the DMA interface reference and release method is only invoked if fdctrl->dma_chann has been set. (This issue was discovered by Martin testing a recent change in the NetBSD installer under qemu-system-sparc) Cc: qemu-stable@nongnu.org Reported-by: Martin Husemann <martin@duskware.de> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19nvme: fix oob access issue(CVE-2018-16847)Li Qiang
Currently, the nvme_cmb_ops mr doesn't check the addr and size. This can lead an oob access issue. This is triggerable in the guest. Add check to avoid this issue. Fixes CVE-2018-16847. Reported-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19MAINTAINERS: clarify some of the tagsCornelia Huck
The MAINTAINERS file is a bit sparse on information about what the different designators are. Let's add some more information to give contributors a better idea about what the different roles are. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20181026105711.29605-1-cohuck@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19Merge remote-tracking branch ↵Peter Maydell
'remotes/amarkovic/tags/mips-queue-november-2018-v2' into staging MIPS queue for QEMU 3.1-rc2 - v2 # gpg: Signature made Sat 17 Nov 2018 18:30:46 GMT # gpg: using RSA key D4972A8967F75A65 # gpg: Good signature from "Aleksandar Markovic <amarkovic@wavecomp.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 8526 FBF1 5DA3 811F 4A01 DD75 D497 2A89 67F7 5A65 * remotes/amarkovic/tags/mips-queue-november-2018-v2: MAINTAINERS: Add Stefan Markovic as a MIPS reviewer target/mips: Disable R5900 support target/mips: Rename MMI-related functions target/mips: Rename MMI-related opcodes target/mips: Rename MMI-related masks target/mips: Guard check_insn with INSN_R5900 check target/mips: Guard check_insn_opc_user_only with INSN_R5900 check target/mips: Fix decoding mechanism of special R5900 opcodes target/mips: Fix decoding mechanism of R5900 DIV1 and DIVU1 target/mips: Fix decoding mechanism of R5900 MFLO1, MFHI1, MTLO1 and MTHI1 linux-user: Update MIPS specific prctl() implementation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19Merge remote-tracking branch 'remotes/riscv/tags/riscv-for-master-3.1-rc2' ↵Peter Maydell
into staging RISC-V Patches for 3.1-rc2 This pull request contains four patches that aren't really related to each other aside from all being bug fixes that I think should go in for 3.1.0: * The second half of Alistair's memory leak patch set that I missed last week. * A fix to make fclass.d availiable only on RV64IFD systems (without this it's availiable on RV32IFD systems, truncating the result). * A fix to make sfence.vm availiable only in priv-1.9.1, and sfence.vma only availiable in priv-1.10. * A change to respect fences in user-mode emulators, which were previously treated as NOPs. As usual, this builds and boot Linux for me. I don't think I have anything else planned for 3.1.0, but I may be wrong as things are a bit hectic this week. # gpg: Signature made Tue 13 Nov 2018 23:48:38 GMT # gpg: using RSA key EF4CA1502CCBAB41 # gpg: Good signature from "Palmer Dabbelt <palmer@dabbelt.com>" # gpg: aka "Palmer Dabbelt <palmer@sifive.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 00CE 76D1 8349 60DF CE88 6DF8 EF4C A150 2CCB AB41 * remotes/riscv/tags/riscv-for-master-3.1-rc2: RISC-V: Respect fences for user-only emulators target/riscv: Fix sfence.vm/a both available in any priv version target/riscv: Fix FCLASS_D being treated as RV64 only hw/riscv/virt: Free the test device tree node name Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-17MAINTAINERS: Add Stefan Markovic as a MIPS reviewerAleksandar Markovic
Add Stefan Markovic as a MIPS reviewer. He had several key contributions to QEMU for MIPS this year. He is a meticulous person with the ability to think and act on many levels. Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
2018-11-17target/mips: Disable R5900 supportAleksandar Markovic
Disable R5900 support. There are some outstanding issues related to ABI support and emulation accuracy, that were not understood well during review process. Disable to avoid backward compatibility issues. Reverts commit ed4f49ba9bb56ebca6987b1083255daf6c89b5de. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
2018-11-17target/mips: Rename MMI-related functionsAleksandar Markovic
Rename MMI-related functions. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
2018-11-17target/mips: Rename MMI-related opcodesAleksandar Markovic
Rename MMI-related opcodes. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
2018-11-17target/mips: Rename MMI-related masksAleksandar Markovic
Rename MMI-related masks. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
2018-11-17target/mips: Guard check_insn with INSN_R5900 checkFredrik Noring
Explicitely mark handling of PREF instruction for R5900 as treating the same as NOP. Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Fredrik Noring <noring@nocrew.org> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
2018-11-17target/mips: Guard check_insn_opc_user_only with INSN_R5900 checkFredrik Noring
Avoid using check_opc_user_only() as a decision making code wrt various architectures. Use ctx->insn_flags checks instead. Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Fredrik Noring <noring@nocrew.org> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
2018-11-17target/mips: Fix decoding mechanism of special R5900 opcodesFredrik Noring
MOVN, MOVZ, MFHI, MFLO, MTHI, MTLO, MULT, MULTU, DIV, DIVU, DMULT, DMULTU, DDIV, DDIVU and JR are decoded in decode_opc_special_tx79 instead of the generic decode_opc_special_legacy. Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Fredrik Noring <noring@nocrew.org> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
2018-11-17target/mips: Fix decoding mechanism of R5900 DIV1 and DIVU1Fredrik Noring
DIV1 and DIVU1 are generated in gen_div1_tx79 instead of the generic gen_muldiv. Signed-off-by: Fredrik Noring <noring@nocrew.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
2018-11-17target/mips: Fix decoding mechanism of R5900 MFLO1, MFHI1, MTLO1 and MTHI1Fredrik Noring
MFLO1, MFHI1, MTLO1 and MTHI1 are generated in gen_HILO1_tx79 instead of the generic gen_HILO. Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Fredrik Noring <noring@nocrew.org> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
2018-11-17linux-user: Update MIPS specific prctl() implementationStefan Markovic
Perform needed checks before actual prctl() PR_SET_FP_MODE and PR_GET_FP_MODE work based on kernel implementation. Also, update necessary hflags. Reviewed-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
2018-11-16Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/fixes-31-20181116-pull-request' into staging ui: add rendernode arg for egl-headless (fixes permission issues with libvirt) # gpg: Signature made Fri 16 Nov 2018 13:29:15 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-31-20181116-pull-request: help: Provide help for egl-headless ui: Allow specifying 'rendernode' display option for egl-headless qapi: Add "rendernode" display option for egl-headless Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-16help: Provide help for egl-headlessErik Skultety
EGL headless has been missing from QEMU's help or man page, we should mention that such a thing exists, especially since projects like libvirt might rely on that. This patch also adds the newly introduced option for egl-headless 'rendernode'. Signed-off-by: Erik Skultety <eskultet@redhat.com> Message-id: 87ef678b0934d3abba66c46c9e65b57119d29295.1542362949.git.eskultet@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-16ui: Allow specifying 'rendernode' display option for egl-headlessErik Skultety
As libvirt can't predict which rendernode QEMU would pick, it won't adjust the permissions on the device, hence QEMU getting "Permission denied" when opening the DRI device. Therefore, enable 'rendernode' option for egl-headless display type. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1648236 Signed-off-by: Erik Skultety <eskultet@redhat.com> Message-id: 27f4617f19aa1072114f10f1aa9dd199735ef982.1542362949.git.eskultet@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-16qapi: Add "rendernode" display option for egl-headlessErik Skultety
Unlike SPICE, egl-headless doesn't offer a way of specifying the DRM node used for OpenGL, hence QEMU always selecting the first one that is available. Thus, add the 'rendernode' option for egl-headless to QAPI. Signed-off-by: Erik Skultety <eskultet@redhat.com> Message-id: 7658e15eca72d520e7a5fb1c2e724702d83d4f7f.1542362949.git.eskultet@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-16Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell
staging # gpg: Signature made Fri 16 Nov 2018 03:38:58 GMT # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: net/filter-rewriter.c: Fix coverity static analysis issue Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-16net/filter-rewriter.c: Fix coverity static analysis issueZhang Chen
The original code just follow the TCP state diagram, but in this case, we can skip the TCPS_TIME_WAIT state to simplify the implementation. Signed-off-by: Zhang Chen <zhangckid@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2018-11-15Merge remote-tracking branch ↵Peter Maydell
'remotes/stefanberger/tags/pull-tpm-2018-11-15-1' into staging Merge tpm 2018/11/15 v1 # gpg: Signature made Thu 15 Nov 2018 14:03:45 GMT # gpg: using RSA key 75AD65802A0B4211 # gpg: Good signature from "Stefan Berger <stefanb@linux.vnet.ibm.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: B818 B9CA DF90 89C2 D5CE C66B 75AD 6580 2A0B 4211 * remotes/stefanberger/tags/pull-tpm-2018-11-15-1: tests: tpm: Use g_test_message rather than fprintf tpm: use loop iterator to set sts data field Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-15linux-user/sparc/signal.c: Remove dead codePeter Maydell
Coverity complains (CID 1390847) about some dead code in do_sigreturn(). This is an if (err) clause that can never be true, copied from the kernel (where __get_user returns an error). The one code path that could report an error is in the currently commented-out pseudocode for handling FPU register restoring, so move the if into that comment (and fix the broken indent in the comment in the process). (The new position for the error check is also the semantically correct one -- we should not restore the signal mask from the signal frame if we get an error here, so the check must be done before set_sigmask(), not after.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-id: 20181115114616.26265-1-peter.maydell@linaro.org
2018-11-15make-release: add skiboot .version fileMichael Roth
This is needed to build skiboot from tarball-distributed sources since the git data the make_release.sh script relies on to generate it is not available. Cc: qemu-stable@nongnu.org Reported-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20181109161352.29873-1-mdroth@linux.vnet.ibm.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-15Merge remote-tracking branch ↵Peter Maydell
'remotes/stsquad/tags/pull-testing-fixes-for-3.1-141118-1' into staging Testing tweaks: - split MacOSX build - fix for readdir() failures in check-tcg # gpg: Signature made Wed 14 Nov 2018 13:08:24 GMT # gpg: using RSA key FBD0DB095A9E2A44 # gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" # Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44 * remotes/stsquad/tags/pull-testing-fixes-for-3.1-141118-1: tests/tcg/multiarch: fix 32bit linux-test on 64bit host .travis.yml: split MacOSX builds and reduce target list Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-15Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20181114' into stagingPeter Maydell
Fix error handling during zpci device creation. # gpg: Signature made Wed 14 Nov 2018 10:08:43 GMT # gpg: using RSA key DECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # gpg: aka "Cornelia Huck <cohuck@kernel.org>" # gpg: aka "Cornelia Huck <cohuck@redhat.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20181114: s390x/pci: properly fail if the zPCI device cannot be created Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-14tests: tpm: Use g_test_message rather than fprintfStefan Berger
Display a message during the test using g_test_message rather than fprintf. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
2018-11-14tpm: use loop iterator to set sts data fieldPrasad J Pandit
When TIS request is done, set 'sts' data field across all localities. Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
2018-11-14tests/tcg/multiarch: fix 32bit linux-test on 64bit hostLaurent Vivier
Fix: TEST linux-test on i386 .../tests/tcg/multiarch/linux-test.c:201: readdir readdir() calls getdents64() to have the list of the entries in a directory, and getdents64() can return 64bit d_off values (with ext4, for instance) that will not fit in the 32bit d_off field of the readdir() dirent structure. To avoid that, use readdir64() to use a 64bit d_off field too. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
2018-11-14.travis.yml: split MacOSX builds and reduce target listAlex Bennée
We have reached the point where the MacOSX build was regularly timing out. So as before I've reduced the target list to "major" architectures to try and bring the build time down. I've added an additional MacOSX build with the latest XCode with a minimal list of "most likely" targets on MacOS. Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
2018-11-13RISC-V: Respect fences for user-only emulatorsPalmer Dabbelt
Our current fence implementation ignores fences for the user-only configurations. This is incorrect but unlikely to manifest: it requires multi-threaded user-only code that takes advantage of the weakness in the host's memory model and can be inlined by TCG. This patch simply treats fences the same way for all our emulators. I've given it to testing as I don't want to construct a test that would actually trigger the failure. Our fence implementation has an additional deficiency where we map all RISC-V fences to full fences. Now that we have a formal memory model for RISC-V we can start to take advantage of the strength bits on our fence instructions. This requires a bit more though, so I'm going to split it out because the implementation is still correct without taking advantage of these weaker fences. Thanks to Richard Henderson for pointing out both of the issues. Signed-off-by: Palmer Dabbelt <palmer@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2018-11-13target/riscv: Fix sfence.vm/a both available in any priv versionBastian Koppelmann
sfence.vm has been replaced in priv v1.10 spec by sfence.vma. Reported-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
2018-11-13target/riscv: Fix FCLASS_D being treated as RV64 onlyBastian Koppelmann
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
2018-11-13hw/riscv/virt: Free the test device tree node nameAlistair Francis
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
2018-11-13Update version for v3.1.0-rc1 releasev3.1.0-rc1Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-13s390x/pci: properly fail if the zPCI device cannot be createdDavid Hildenbrand
Right now, errors during realize()/pre_plug/plug of the zPCI device would result in QEMU crashing instead of failing nicely when creating a zPCI device for a PCI device. Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Collin Walling <walling@linux.ibm.com> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20181113121710.18490-1-david@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-11-13Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2018-11-12-tag' ↵Peter Maydell
into staging qemu-ga patch queue for 3.1.0 * add missing #include guards for guest-agent-core.h * fix leaks introduced with recent win32 enablement of disk info in guest-get-fsinfo # gpg: Signature made Tue 13 Nov 2018 02:52:12 GMT # gpg: using RSA key 3353C9CEF108B584 # gpg: Good signature from "Michael Roth <flukshun@gmail.com>" # gpg: aka "Michael Roth <mdroth@utexas.edu>" # gpg: aka "Michael Roth <mdroth@linux.vnet.ibm.com>" # Primary key fingerprint: CEAC C9E1 5534 EBAB B82D 3FA0 3353 C9CE F108 B584 * remotes/mdroth/tags/qga-pull-2018-11-12-tag: qga: Add multiple include guard to guest-agent-core.h qga-win: fix leaks of build_guest_disk_info() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-13Merge remote-tracking branch ↵Peter Maydell
'remotes/vivier2/tags/linux-user-for-3.1-pull-request' into staging - gdb signal handling fix - add SO_REUSEPORT - remove dead-code # gpg: Signature made Mon 12 Nov 2018 20:48:23 GMT # gpg: using RSA key F30C38BD3F2FBE3C # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" # gpg: aka "Laurent Vivier <laurent@vivier.eu>" # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/linux-user-for-3.1-pull-request: linux-user: Add support for SO_REUSEPORT linux-user: Clean up nios2 main loop signal handling linux-user: Don't call gdb_handlesig() before queue_signal() linux-user: Remove dead error-checking code Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-13Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20181113' into staging target/arm queue: * Remove no-longer-needed workaround for small SAU regions for v8M * Remove antique TODO comment * MAINTAINERS: Add an entry for the 'collie' machine * hw/arm/sysbus-fdt: Only call match_fn callback if the type matches * Fix infinite recursion in tlbi_aa64_vmalle1_write() * ARM KVM: fix various bugs in handling of guest debugging * Correctly implement handling of HCR_EL2.{VI, VF} * Hyp mode R14 is shared with User and System * Give Cortex-A15 and -A7 the EL2 feature # gpg: Signature made Tue 13 Nov 2018 10:51:53 GMT # gpg: using RSA key 3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20181113: target/arm/cpu: Give Cortex-A15 and -A7 the EL2 feature target/arm: Hyp mode R14 is shared with User and System target/arm: Correctly implement handling of HCR_EL2.{VI, VF} target/arm: Track the state of our irq lines from the GIC explicitly Revert "target/arm: Implement HCR.VI and VF" arm: fix aa64_generate_debug_exceptions to work with EL2 arm: use symbolic MDCR_TDE in arm_debug_target_el tests/guest-debug: fix scoping of failcount target/arm64: kvm debug set target_el when passing exception to guest target/arm64: hold BQL when calling do_interrupt() target/arm64: properly handle DBGVR RESS bits target/arm: Fix typo in tlbi_aa64_vmalle1_write hw/arm/sysbus-fdt: Only call match_fn callback if the type matches MAINTAINERS: Add an entry for the 'collie' machine target/arm: Remove antique TODO comment target/arm: Remove workaround for small SAU regions Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-13target/arm/cpu: Give Cortex-A15 and -A7 the EL2 featurePeter Maydell
The Cortex-A15 and Cortex-A7 both have EL2; now we've implemented it properly we can enable the feature bit. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20181109173553.22341-3-peter.maydell@linaro.org
2018-11-13target/arm: Hyp mode R14 is shared with User and SystemPeter Maydell
Hyp mode is an exception to the general rule that each AArch32 mode has its own r13, r14 and SPSR -- it has a banked r13 and SPSR but shares its r14 with User and System mode. We were incorrectly implementing it as banked, which meant that on entry to Hyp mode r14 was 0 rather than the USR/SYS r14. We provide a new function r14_bank_number() which is like the existing bank_number() but provides the index into env->banked_r14[]; bank_number() provides the index to use for env->banked_r13[] and env->banked_cpsr[]. All the points in the code that were using bank_number() to index into env->banked_r14[] are updated for consintency: * switch_mode() -- this is the only place where we fix an actual bug * aarch64_sync_32_to_64() and aarch64_sync_64_to_32(): no behavioural change as we already special-cased Hyp R14 * kvm32.c: no behavioural change since the guest can't ever be in Hyp mode, but conceptually the right thing to do * msr_banked()/mrs_banked(): we can never get to the case that accesses banked_r14[] with tgtmode == ARM_CPU_MODE_HYP, so no behavioural change Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20181109173553.22341-2-peter.maydell@linaro.org
2018-11-13target/arm: Correctly implement handling of HCR_EL2.{VI, VF}Peter Maydell
In commit 8a0fc3a29fc2315325400 we tried to implement HCR_EL2.{VI,VF}, but we got it wrong and had to revert it. In that commit we implemented them as simply tracking whether there is a pending virtual IRQ or virtual FIQ. This is not correct -- these bits cause a software-generated VIRQ/VFIQ, which is distinct from whether there is a hardware-generated VIRQ/VFIQ caused by the external interrupt controller. So we need to track separately the HCR_EL2 bit state and the external virq/vfiq line state, and OR the two together to get the actual pending VIRQ/VFIQ state. Fixes: 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20181109134731.11605-4-peter.maydell@linaro.org
2018-11-13target/arm: Track the state of our irq lines from the GIC explicitlyPeter Maydell
Currently we track the state of the four irq lines from the GIC only via the cs->interrupt_request or KVM irq state. That means that we assume that an interrupt is asserted if and only if the external line is set. This assumption is incorrect for VIRQ and VFIQ, because the HCR_EL2.{VI,VF} bits allow assertion of VIRQ and VFIQ separately from the state of the external line. To handle this, start tracking the state of the external lines explicitly in a CPU state struct field, as is common practice for devices. The complicated part of this is dealing with inbound migration from an older QEMU which didn't have this state. We assume in that case that the older QEMU did not implement the HCR_EL2.{VI,VF} bits as generating interrupts, and so the line state matches the current state in cs->interrupt_request. (This is not quite true between commit 8a0fc3a29fc2315325400c7 and its revert, but that commit is broken and never made it into any released QEMU version.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20181109134731.11605-3-peter.maydell@linaro.org
2018-11-13Revert "target/arm: Implement HCR.VI and VF"Peter Maydell
This reverts commit 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f. The implementation of HCR.VI and VF in that commit is not correct -- they do not track the overall "is there a pending VIRQ or VFIQ" status, but whether there is a pending interrupt due to "this mechanism", ie the hypervisor having set the VI/VF bits. The overall pending state for VIRQ and VFIQ is effectively the logical OR of the inbound lines from the GIC with the VI and VF bits. Commit 8a0fc3a29fc231 would result in pending VIRQ/VFIQ possibly being lost when the hypervisor wrote to HCR. As a preliminary to implementing the HCR.VI/VF feature properly, revert the broken one entirely. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20181109134731.11605-2-peter.maydell@linaro.org
2018-11-13arm: fix aa64_generate_debug_exceptions to work with EL2Alex Bennée
The test was incomplete and incorrectly caused debug exceptions to be generated when returning to EL2 after a failed attempt to single-step an EL1 instruction. Fix this while cleaning up the function a little. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181109152119.9242-8-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-18 03:53:52 +0000