aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-05-01aspeed/smc: Add extra controls to request DMACédric Le Goater
The AST2600 SPI controllers have a set of bits to request/grant DMA access. Add a new SMC feature for these controllers and use it to check access to the DMA registers. Cc: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-Id: <20210407171637.777743-16-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-05-01aspeed/smc: Add a 'features' attribute to the object classCédric Le Goater
It will simplify extensions of the SMC model. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-Id: <20210407171637.777743-15-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-05-01hw/misc/aspeed_xdma: Add AST2600 supportCédric Le Goater
When we introduced support for the AST2600 SoC, the XDMA controller was forgotten. It went unnoticed because it's not used under emulation. But the register layout being different, the reset procedure is bogus and this breaks kexec. Add a AspeedXDMAClass to take into account the register differences. Cc: Eddie James <eajames@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Eddie James <eajames@linux.ibm.com> Message-Id: <20210407171637.777743-14-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-05-01tests/acceptance: Test ast2600 machineJoel Stanley
This tests a Debian multi-soc arm32 Linux kernel on the AST2600 based Tacoma BMC machine. There is no root file system so the test terminates when boot reaches the stage where it attempts and fails to mount something. Cc: Cleber Rosa <crosa@redhat.com> Cc: Wainer dos Santos Moschetta <wainersm@redhat.com> Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Tested-by: Cédric Le Goater <clg@kaod.org> [ clg : - removed comment - removed ending self.vm.shutdown() ] Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210304123951.163411-3-joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Message-Id: <20210407171637.777743-13-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-05-01tests/acceptance: Test ast2400 and ast2500 machinesJoel Stanley
Test MTD images from the OpenBMC project on AST2400 and AST2500 SoCs from ASPEED, by booting Palmetto and Romulus BMC machines. The images are fetched from OpenBMC's release directory on github. Cc: Cleber Rosa <crosa@redhat.com> Cc: Wainer dos Santos Moschetta <wainersm@redhat.com> Co-developed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Tested-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Cleber Rosa <crosa@redhat.com> Tested-by: Cleber Rosa <crosa@redhat.com> [ clg : - removed comment - removed ending self.vm.shutdown() ] Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210304123951.163411-2-joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Message-Id: <20210407171637.777743-12-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-05-01tests/qtest: Add test for Aspeed HACEJoel Stanley
This adds a test for the Aspeed Hash and Crypto (HACE) engine. It tests the currently implemented behavior of the hash functionality. The tests are similar, but are cut/pasted instead of broken out into a common function so the assert machinery produces useful output when a test fails. Co-developed-by: Cédric Le Goater <clg@kaod.org> Co-developed-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com> Acked-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Joel Stanley <joel@jms.id.au> Message-Id: <20210409000253.1475587-4-joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-05-01aspeed: Integrate HACEJoel Stanley
Add the hash and crypto engine model to the Aspeed socs. Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com> Signed-off-by: Joel Stanley <joel@jms.id.au> Message-Id: <20210409000253.1475587-3-joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-05-01hw: Model ASPEED's Hash and Crypto EngineJoel Stanley
The HACE (Hash and Crypto Engine) is a device that offloads MD5, SHA1, SHA2, RSA and other cryptographic algorithms. This initial model implements a subset of the device's functionality; currently only MD5/SHA hashing, and on the ast2600's scatter gather engine. Co-developed-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> [ clg: - fixes for 32-bit and OSX builds ] Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210409000253.1475587-2-joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-05-01hw/arm/aspeed: Do not sysbus-map mmio flash region directly, use aliasPhilippe Mathieu-Daudé
The flash mmio region is exposed as an AddressSpace. AddressSpaces must not be sysbus-mapped, therefore map the region using an alias. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> [ clg : Fix DMA_FLASH_ADDR() ] Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210312182851.1922972-3-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210407171637.777743-6-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-05-01aspeed/i2c: Rename DMA address spaceCédric Le Goater
It improves 'info mtree' output. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407171637.777743-5-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-05-01aspeed/i2c: Fix DMA address maskCédric Le Goater
The RAM memory region is now used for DMAs accesses instead of the memory address space region. Mask off the top bits of the DMA address to reflect this change. Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210407171637.777743-4-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-05-01aspeed/smc: Remove unused "sdram-base" propertyCédric Le Goater
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407171637.777743-3-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-05-01aspeed/smc: Use the RAM memory region for DMAsCédric Le Goater
Instead of passing the memory address space region, simply use the RAM memory region instead. This simplifies RAM accesses. This patch breaks migration compatibility. Fixes: c4e1f0b48322 ("aspeed/smc: Add support for DMAs") Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20210407171637.777743-2-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-04-29Update version for v6.0.0 releasev6.0.0Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-26Update version for v6.0.0-rc5 releasev6.0.0-rc5Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-26hw/block/nvme: fix invalid msix exclusive uninitKlaus Jensen
Commit 1901b4967c3f changed the nvme device from using a bar exclusive for MSI-x to sharing it on bar0. Unfortunately, the msix_uninit_exclusive_bar() call remains in nvme_exit() which causes havoc when the device is removed with, say, device_del. Fix this. Additionally, a subregion is added but it is not removed on exit which causes a reference to linger and the drive to never be unlocked. Fixes: 1901b4967c3f ("hw/block/nvme: move msix table and pba to BAR 0") Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-23target/s390x: fix s390_probe_access to check PAGE_WRITE_ORG for writeabilityAlex Bennée
We can remove PAGE_WRITE when (internally) marking a page read-only because it contains translated code. This can get confused when we are executing signal return code on signal stacks. Fixes: e56552cf07 ("target/s390x: Implement the MVPG condition-code-option bit") Found-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Message-id: 20210422154427.13038-1-alex.bennee@linaro.org Cc: Cornelia Huck <cohuck@redhat.com> Cc: Thomas Huth <thuth@redhat.com> Cc: David Hildenbrand <david@redhat.com> Cc: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-23net: check the existence of peer before trying to padJason Wang
There could be case that peer is NULL. This can happen when during network device hot-add where net device needs to be added first. So the patch check the existence of peer before trying to do the pad. Fixes: 969e50b61a285 ("net: Pad short frames to minimum size before sending from SLiRP/TAP") Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Stefan Weil <sw@weilnetz.de> Message-id: 20210423031803.1479-1-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-20Update version for v6.0.0-rc4 releasev6.0.0-rc4Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-20qga: fix guest-get-disks regressionMarc-André Lureau
Commit 54aa3de72 ("qapi: Use QAPI_LIST_PREPEND() where possible") inadvertently removed the has_dependencies from the partition disk info, resulting in empty list being returned. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1950833 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20210420125831.233092-1-marcandre.lureau@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-20target/mips/rel6_translate: Change license to GNU LGPL v2.1 (or later)Philippe Mathieu-Daudé
When adding this file and its new content in commit 3f7a927847a ("target/mips: LSA/DLSA R6 decodetree helpers") I did 2 mistakes: 1: Listed authors who haven't been involved in its development, 2: Used an incorrect GNU GPLv2 license text (using 'and' instead of 'or'). Instead of correcting the GNU GPLv2 license text, replace the license by the 'GNU LGPL v2.1 or later' one, to be coherent with the other translation files in the target/mips/ folder. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210420100633.1752440-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-20migration: Deprecate redundant query-migrate result @blockedMarkus Armbruster
Result @blocked is true when and only when result @blocked-reasons is present. It's always non-empty when present. @blocked is redundant. It was introduced in commit 3af8554bd0 "migration: Add blocker information", and has not been released. This gives us a chance to fix the interface with minimal fuss. Unfortunately, we're already too close to the release to risk dropping it. Deprecate it instead. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20210420051907.891470-1-armbru@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-19mptsas: Remove unused MPTSASState 'pending' field (CVE-2021-3392)Michael Tokarev
While processing SCSI i/o requests in mptsas_process_scsi_io_request(), the Megaraid emulator appends new MPTSASRequest object 'req' to the 's->pending' queue. In case of an error, this same object gets dequeued in mptsas_free_request() only if SCSIRequest object 'req->sreq' is initialised. This may lead to a use-after-free issue. Since s->pending is actually not used, simply remove it from MPTSASState. Cc: qemu-stable@nongnu.org Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> Message-id: 20210419134247.1467982-1-f4bug@amsat.org Message-Id: <20210416102243.1293871-1-mjt@msgid.tls.msk.ru> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392) Fixes: e351b826112 ("hw: Add support for LSI SAS1068 (mptsas) device") [PMD: Reworded description, added more tags] Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20210417' into staging Fixes for rc4: * Fix compile failures of C++ files with new glib headers * mps3-an547: Use correct Cortex-M55 CPU and don't disable its FPU * accel/tcg: Fix assertion failure executing from non-RAM with -icount # gpg: Signature made Sat 17 Apr 2021 20:39:58 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210417: accel/tcg: avoid re-translating one-shot instructions target/arm: drop CF_LAST_IO/dc->condjump check hw/arm/armsse: Make SSE-300 use Cortex-M55 hw/arm/armsse: Give SSE-300 its own Property array include/qemu/osdep.h: Move system includes to top osdep: protect qemu/osdep.h with extern "C" osdep: include glib-compat.h before other QEMU headers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17accel/tcg: avoid re-translating one-shot instructionsAlex Bennée
By definition a single instruction is capable of being an IO instruction. This avoids a problem of triggering a cpu_io_recompile on a non-recorded translation which then fails because it expects tcg_tb_lookup() to succeed unconditionally. The normal use case requires a TB to be able to resolve machine state. The other users of tcg_tb_lookup() are able to tolerate a missing TB if the machine state has been resolved by other means - which in the single-shot case is always true because machine state is synced at the start of a block. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210415162454.22056-1-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17target/arm: drop CF_LAST_IO/dc->condjump checkAlex Bennée
This is a left over erroneous check from the days front-ends handled io start/end themselves. Regardless just because IO could be performed on the last instruction doesn't obligate the front end to do so. This fixes an abort faced by the aspeed execute-in-place support which will necessarily trigger this state (even before the one-shot CF_LAST_IO fix). The test still seems to hang once it attempts to boot the Linux kernel but I suspect this is an unrelated issue with icount and the timer handling code. The original intention of the cpu_abort (added in commit 2e70f6efa8b9 when the icount stuff was first added) seems to have been to act as an assert() to catch an unhandled corner case where the generated code would be something like: conditional branch to condlabel if its cc failed implementation of the insn (a conditional branch or trap) code emitted by gen_io_end() condlabel: gen_goto_tb or equivalent thing to go to next insn At runtime the cc-failed case would skip over the code emitted by gen_io_end(), leaving the can_do_io flag incorrectly set. In commit ba3e7926691ed33 we switched to an implementation which always clears can_do_io at the start of the following TB instead of trying to clear it at the end of a TB that did IO. So the corner case that this cpu_abort() was trying to flag is no longer possible, because the gen_io_end() call has been deleted. We can therefore safely remove the no-longer-valid assertion. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210416170207.12504-1-alex.bennee@linaro.org Cc: Cédric Le Goater <clg@kaod.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17hw/arm/armsse: Make SSE-300 use Cortex-M55Peter Maydell
The SSE-300 has a Cortex-M55 (which was the whole reason for us modelling it), but we forgot to actually update the code to let it have a different CPU type from the IoTKit and SSE-200. Add CPU type as a field for ARMSSEInfo instead of hardcoding it to always use a Cortex-M33. Buglink: https://bugs.launchpad.net/qemu/+bug/1923861 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416104010.13228-1-peter.maydell@linaro.org
2021-04-17hw/arm/armsse: Give SSE-300 its own Property arrayPeter Maydell
SSE-300 currently shares the SSE-200 Property array. This is bad principally because the default values of the CPU0_FPU and CPU0_DSP properties disable the FPU and DSP on the CPU. That is correct for the SSE-200 but not the SSE-300. Give the SSE-300 its own Property array with the correct SSE-300 specific settings: * SSE-300 has only one CPU, so no CPU1* properties * SSE-300 CPU has FPU and DSP Buglink: https://bugs.launchpad.net/qemu/+bug/1923861 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210415182353.8173-1-peter.maydell@linaro.org
2021-04-17include/qemu/osdep.h: Move system includes to topPeter Maydell
Mostly osdep.h puts the system includes at the top of the file; but there are a couple of exceptions where we include a system header halfway through the file. Move these up to the top with the rest so that all the system headers we include are included before we include os-win32.h or os-posix.h. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416135543.20382-4-peter.maydell@linaro.org Message-id: 20210414184343.26235-1-peter.maydell@linaro.org
2021-04-17osdep: protect qemu/osdep.h with extern "C"Paolo Bonzini
System headers may include templates if compiled with a C++ compiler, which cause the compiler to complain if qemu/osdep.h is included within a C++ source file's 'extern "C"' block. Add an 'extern "C"' block directly to qemu/osdep.h, so that system headers can be kept out of it. There is a stray declaration early in qemu/osdep.h, which needs to be special cased. Add a definition in qemu/compiler.h to make it look nice. config-host.h, CONFIG_TARGET, exec/poison.h and qemu/compiler.h are included outside the 'extern "C"' block; that is not an issue because they consist entirely of preprocessor directives. This allows us to move the include of osdep.h in our two C++ source files outside the extern "C" block they were previously using for it, which in turn means that they compile successfully against newer versions of glib which insist that glib.h is *not* inside an extern "C" block. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416135543.20382-3-peter.maydell@linaro.org [PMM: Moved disas/arm-a64.cc osdep.h include out of its extern "C" block; explained in commit message why we're doing this] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17osdep: include glib-compat.h before other QEMU headersPaolo Bonzini
glib-compat.h is sort of like a system header, and it needs to include system headers (glib.h) that may dislike being included under 'extern "C"'. Move it right after all system headers and before all other QEMU headers. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416135543.20382-2-peter.maydell@linaro.org [PMM: Added comment about why glib-compat.h is special] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-14Update version for v6.0.0-rc3 releasev6.0.0-rc3Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-14qapi/qom.json: Do not use CONFIG_VIRTIO_CRYPTO in common codeThomas Huth
The ObjectType enum and ObjectOptions are included from qapi-types-qom.h into common code. We should not use target-specific config switches like CONFIG_VIRTIO_CRYPTO here, since this is not defined in common code and thus the enum will look differently between common and target specific code. For this case, it's hopefully enough to check for CONFIG_VHOST_CRYPTO only (which is a host specific config switch, i.e. it's the same on all targets). Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210412160710.639800-1-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13Merge remote-tracking branch ↵Peter Maydell
'remotes/dgilbert-gitlab/tags/pull-virtiofs-20210413' into staging virtiofs: Fix feature negotiation (for 6.0) A 6.0 fix for feature negotiation on vhost-user. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> # gpg: Signature made Tue 13 Apr 2021 16:21:41 BST # gpg: using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full] # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert-gitlab/tags/pull-virtiofs-20210413: vhost-user-fs: fix features handling Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2021-04-13' ↵Peter Maydell
into staging Block patches for 6.0-rc3: - Use-after-free fix for block/nbd.c # gpg: Signature made Tue 13 Apr 2021 14:35:48 BST # gpg: using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40 # gpg: issuer "mreitz@redhat.com" # gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full] # Primary key fingerprint: 91BE B60A 30DB 3E88 57D1 1829 F407 DB00 61D5 CF40 * remotes/maxreitz/tags/pull-block-2021-04-13: block/nbd: fix possible use after free of s->connect_thread Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20210413' into staging target-arm queue: * Fix MPC setting for AN524 SRAM block * sphinx: qapidoc: Wrap "If" section body in a paragraph node # gpg: Signature made Tue 13 Apr 2021 13:07:12 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210413: sphinx: qapidoc: Wrap "If" section body in a paragraph node hw/arm/mps2-tz: Assert if more than one RAM is attached to an MPC hw/arm/mps2-tz: Fix MPC setting for AN524 SRAM block Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13vhost-user-fs: fix features handlingAnton Kuchin
Make virtio-fs take into account server capabilities. Just returning requested features assumes they all of then are implemented by server and results in setting unsupported configuration if some of them are absent. Signed-off-by: Anton Kuchin <antonkuchin@yandex-team.ru> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> With changes suggested by Stefan Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-04-13block/nbd: fix possible use after free of s->connect_threadVladimir Sementsov-Ogievskiy
If on nbd_close() we detach the thread (in nbd_co_establish_connection_cancel() thr->state becomes CONNECT_THREAD_RUNNING_DETACHED), after that point we should not use s->connect_thread (which is set to NULL), as running thread may free it at any time. Still nbd_co_establish_connection() does exactly this: it saves s->connect_thread to local variable (just for better code style) and use it even after yield point, when thread may be already detached. Fix that. Also check thr to be non-NULL on nbd_co_establish_connection() start for safety. After this patch "case CONNECT_THREAD_RUNNING_DETACHED" becomes impossible in the second switch in nbd_co_establish_connection(). Still, don't add extra abort() just before the release. If it somehow possible to reach this "case:" it won't hurt. Anyway, good refactoring of all this reconnect mess will come soon. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20210406155114.1057355-1-vsementsov@virtuozzo.com> Reviewed-by: Roman Kagan <rvkagan@yandex-team.ru> Signed-off-by: Max Reitz <mreitz@redhat.com>
2021-04-13Merge remote-tracking branch 'remotes/philmd/tags/mips-20210413' into stagingPeter Maydell
MIPS patches queue - Fix invalid Kconfig dependency - Fix missing migrated value - Fix TCG temporary leak # gpg: Signature made Tue 13 Apr 2021 11:10:11 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/mips-20210413: target/mips: Fix TCG temporary leak in gen_cache_operation() hw/isa/piix4: Migrate Reset Control Register hw/isa/Kconfig: Add missing dependency VIA VT82C686 -> APM Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.0-20210412' ↵Peter Maydell
into staging ppc patch queue for 2021-04-21 Here's what I hope is the last ppc related pull request for qemu-6.0. The 2 patches here revert a behavioural change that after further discussion we concluded was a bad idea (adding a timeout for possibly-failed hot unplug requests). Instead it implements a different approach to the original problem: we again let unplug requests the guest doesn't respond to remain pending indefinitely, but no longer allow those to block attempts to retry the same unplug again. The change is a bit more complex than I'd like for this late in the freeze. Nonetheless, I think it's important to merge this for 6.0, so we don't allow a release which has the probably-a-bad-idea timeout behaviour. # gpg: Signature made Mon 12 Apr 2021 06:25:58 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dg-gitlab/tags/ppc-for-6.0-20210412: spapr.c: always pulse guest IRQ in spapr_core_unplug_request() spapr: rollback 'unplug timeout' for CPU hotunplugs Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13target/mips: Fix TCG temporary leak in gen_cache_operation()Philippe Mathieu-Daudé
Fix a TCG temporary leak when translating CACHE opcode. Fixes: 0d74a222c27 ("make ITC Configuration Tags accessible to the CPU") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210406202857.1440744-1-f4bug@amsat.org>
2021-04-13hw/isa/piix4: Migrate Reset Control RegisterPhilippe Mathieu-Daudé
When adding the Reset register in commit 5790b757cfb we forgot to migrate it. While it is possible a VM using the PIIX4 is migrated just after requesting a system shutdown, it is very unlikely. However when restoring a migrated VM, we might have the RCR bit #4 set on the stack and when the VM resume it directly shutdowns. Add a post_load() migration handler and set the default RCR value to 0 for earlier versions, assuming the VM was not going to shutdown before migration. Fixes: 5790b757cfb ("piix4: Add the Reset Control Register") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20210324200334.729899-1-f4bug@amsat.org>
2021-04-13hw/isa/Kconfig: Add missing dependency VIA VT82C686 -> APMPhilippe Mathieu-Daudé
TYPE_VIA_PM calls apm_init() in via_pm_realize(), so requires APM to be selected. Reported-by: BALATON Zoltan <balaton@eik.bme.hu> Fixes: dd0ff8191ab ("isa: express SuperIO dependencies with Kconfig") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210302080531.913802-1-f4bug@amsat.org>
2021-04-13Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-20210412' ↵Peter Maydell
into staging qemu-sparc queue # gpg: Signature made Mon 12 Apr 2021 23:13:12 BST # gpg: using RSA key CC621AB98E82200D915CC9C45BC2C56FAE0F321F # gpg: issuer "mark.cave-ayland@ilande.co.uk" # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" [full] # Primary key fingerprint: CC62 1AB9 8E82 200D 915C C9C4 5BC2 C56F AE0F 321F * remotes/mcayland/tags/qemu-sparc-20210412: tests/qtest: add tests for am53c974 device esp: ensure that do_cmd is set to zero before submitting an ESP select command esp: don't reset async_len directly in esp_select() if cancelling request esp: don't overflow cmdfifo if TC is larger than the cmdfifo size esp: don't overflow cmdfifo in get_cmd() esp: don't underflow cmdfifo in do_cmd() esp: ensure cmdfifo is not empty and current_dev is non-NULL esp: introduce esp_fifo_pop_buf() and use it instead of fifo8_pop_buf() esp: consolidate esp_cmdfifo_pop() into esp_fifo_pop() esp: consolidate esp_cmdfifo_push() into esp_fifo_push() esp: rework write_response() to avoid using the FIFO for DMA transactions esp: always check current_req is not NULL before use in DMA callbacks esp: fix setting of ESPState mig_version_id when launching QEMU with -S option Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13sphinx: qapidoc: Wrap "If" section body in a paragraph nodeJohn Snow
These sections need to be wrapped in a block-level element, such as Paragraph in order for them to be rendered into Texinfo correctly. Before (e.g.): <section ids="qapidoc-713"> <title>If</title> <literal>defined(CONFIG_REPLICATION)</literal> </section> became: .SS If \fBdefined(CONFIG_REPLICATION)\fP.SS \fBBlockdevOptionsReplication\fP (Object) ... After: <section ids="qapidoc-713"> <title>If</title> <paragraph> <literal>defined(CONFIG_REPLICATION)</literal> </paragraph> </section> becomes: .SS If .sp \fBdefined(CONFIG_REPLICATION)\fP .SS \fBBlockdevOptionsReplication\fP (Object) ... Reported-by: Markus Armbruster <armbru@redhat.com> Tested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210406141909.1992225-2-jsnow@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-12tests/qtest: add tests for am53c974 deviceMark Cave-Ayland
Use the autogenerated fuzzer test cases as the basis for a set of am53c974 regression tests. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-13-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: ensure that do_cmd is set to zero before submitting an ESP select commandMark Cave-Ayland
When a CDB has been received and is about to be submitted to the SCSI layer via one of the ESP select commands, ensure that do_cmd is set to zero before executing the command. Otherwise a guest executing 2 valid CDBs in quick sequence can invoke the SCSI .transfer_data callback again before do_cmd is set to zero by the callback function triggering an assert at the start of esp_transfer_data(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-12-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't reset async_len directly in esp_select() if cancelling requestMark Cave-Ayland
Instead let the SCSI layer invoke the .cancel callback itself to cancel and reset the request state. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-11-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't overflow cmdfifo if TC is larger than the cmdfifo sizeMark Cave-Ayland
If a guest transfers the message out/command phase data using DMA with a TC that is larger than the cmdfifo size then the cmdfifo overflows triggering an assert. Limit the size of the transfer to the free space available in cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1919036 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-10-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't overflow cmdfifo in get_cmd()Mark Cave-Ayland
If the guest tries to read a CDB using DMA and cmdfifo is not empty then it is possible to overflow cmdfifo. Since this can only occur by issuing deliberately incorrect instruction sequences, ensure that the maximum length of the CDB transferred to cmdfifo is limited to the available free space within cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-9-mark.cave-ayland@ilande.co.uk>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-24 12:53:42 +0000