aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-10-16io: cope with websock 'Connection' header having multiple valuesDaniel P. Berrange
The noVNC server sends a header "Connection: keep-alive, Upgrade" which fails our simple equality test. Split the header on ',', trim whitespace and then check for 'upgrade' token. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16io: get rid of bounce buffering in websock write pathDaniel P. Berrange
Currently most outbound I/O on the websock channel gets copied into the rawoutput buffer, and then immediately copied again into the encoutput buffer, with a header prepended. Now that qio_channel_websock_encode accepts a struct iovec, we can trivially remove this bounce buffering and write directly to encoutput. In doing so, we also now correctly validate the encoutput size against the QIO_CHANNEL_WEBSOCK_MAX_BUFFER limit. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16io: pass a struct iovec into qio_channel_websock_encodeDaniel P. Berrange
Instead of requiring use of another Buffer, pass a struct iovec into qio_channel_websock_encode, which gives callers more flexibility in how they process data. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16io: get rid of qio_channel_websock_encode helper methodDaniel P. Berrange
The qio_channel_websock_encode method is only used in one place, everything else calls qio_channel_websock_encode_buffer directly. It can also be pushed up a level into the qio_channel_websock_writev method, since every other caller of qio_channel_websock_write_wire has already filled encoutput. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16io: simplify websocket ping reply handlingDaniel P. Berrange
We must ensure we don't get flooded with ping replies if the outbound channel is slow. Currently we do this by keeping the ping reply in a separate temporary buffer and only writing it if the encoutput buffer is completely empty. This is overly pessimistic, as it is reasonable to add a ping reply to the encoutput buffer even if it has previous data in it, as long as that previous data doesn't include a ping reply. To track this better, put the ping reply directly into the encoutput buffer, and then record the size of encoutput at this time in pong_remain. As we write encoutput to the underlying channel, we can decrement the pong_remain counter. Once it hits zero, we can accept further ping replies for transmission. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16io: monitor encoutput buffer size from websocket GSourceDaniel P. Berrange
The websocket GSource is monitoring the size of the rawoutput buffer to determine if the channel can accepts more writes. The rawoutput buffer, however, is merely a temporary staging buffer before data is copied into the encoutput buffer. Thus its size will always be zero when the GSource runs. This flaw causes the encoutput buffer to grow without bound if the other end of the underlying data channel doesn't read data being sent. This can be seen with VNC if a client is on a slow WAN link and the guest OS is sending many screen updates. A malicious VNC client can act like it is on a slow link by playing a video in the guest and then reading data very slowly, causing QEMU host memory to expand arbitrarily. This issue is assigned CVE-2017-15268, publically reported in https://bugs.launchpad.net/qemu/+bug/1718964 Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16sockets: Handle race condition between binds to the same portKnut Omang
If an offset of ports is specified to the inet_listen_saddr function(), and two or more processes tries to bind from these ports at the same time, occasionally more than one process may be able to bind to the same port. The condition is detected by listen() but too late to avoid a failure. This function is called by socket_listen() and used by all socket listening code in QEMU, so all cases where any form of dynamic port selection is used should be subject to this issue. Add code to close and re-establish the socket when this condition is observed, hiding the race condition from the user. Also clean up some issues with error handling to allow more accurate reporting of the cause of an error. This has been developed and tested by means of the test-listen unit test in the previous commit. Enable the test for make check now that it passes. Reviewed-by: Bhavesh Davda <bhavesh.davda@oracle.com> Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com> Reviewed-by: Girish Moodalbail <girish.moodalbail@oracle.com> Signed-off-by: Knut Omang <knut.omang@oracle.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16sockets: factor out create_fast_reuse_socketKnut Omang
Another refactoring step to prepare for fixing the problem exposed with the test-listen test in the previous commit Signed-off-by: Knut Omang <knut.omang@oracle.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16sockets: factor out a new try_bind() functionKnut Omang
A refactoring step to prepare for the problem exposed by the test-listen test in the previous commit. Simplify and reorganize the IPv6 specific extra measures and move it out of the for loop to increase code readability. No semantic changes. Signed-off-by: Knut Omang <knut.omang@oracle.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2017-10-14' into ↵Peter Maydell
staging nbd patches for 2017-10-14 - Marc-André Lureau - NBD: use g_new() family of functions - Vladimir Sementsov-Ogievskiy - first half of 00/13 nbd minimal structured read # gpg: Signature made Sun 15 Oct 2017 01:38:47 BST # gpg: using RSA key 0xA7A16B4A2527436A # gpg: Good signature from "Eric Blake <eblake@redhat.com>" # gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" # gpg: aka "[jpeg image of size 6874]" # Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A * remotes/ericb/tags/pull-nbd-2017-10-14: nbd: header constants indenting nbd/server: simplify reply transmission nbd/server: refactor nbd_co_send_simple_reply parameters nbd/server: do not use NBDReply structure nbd/server: structurize simple reply header sending nbd: rename some simple-request related objects to be _simple_ block/nbd-client: refactor nbd_co_receive_reply block/nbd-client: assert qiov len once in nbd_co_request NBD: use g_new() family of functions Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-10-16Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging # gpg: Signature made Fri 13 Oct 2017 14:49:22 BST # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: block/throttle.c: add bdrv_co_drain_begin/end callbacks block: rename bdrv_co_drain to bdrv_co_drain_begin block: add bdrv_co_drain_end callback Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-10-16Merge remote-tracking branch ↵Peter Maydell
'remotes/stefanberger/tags/pull-tpm-2017-10-04-3' into staging Merge tpm 2017/10/04 v3 # gpg: Signature made Fri 13 Oct 2017 12:37:07 BST # gpg: using RSA key 0x75AD65802A0B4211 # gpg: Good signature from "Stefan Berger <stefanb@linux.vnet.ibm.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: B818 B9CA DF90 89C2 D5CE C66B 75AD 6580 2A0B 4211 * remotes/stefanberger/tags/pull-tpm-2017-10-04-3: specs: Describe the TPM support in QEMU tpm: Move tpm_cleanup() to right place tpm: Added support for TPM emulator tpm-passthrough: move reusable code to utils tpm-backend: Move realloc_buffer() implementation to tpm-tis model tpm-backend: Add new API to read backend TpmInfo tpm-backend: Made few interface methods optional tpm-backend: Initialize and free data members in it's own methods tpm-backend: Move thread handling inside TPMBackend tpm-backend: Remove unneeded member variable from backend class tpm: Use EMSGSIZE instead of EBADMSG to compile on OpenBSD Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-10-16Merge remote-tracking branch 'remotes/elmarco/tags/vu-pull-request' into stagingPeter Maydell
# gpg: Signature made Thu 12 Oct 2017 21:52:28 BST # gpg: using RSA key 0xDAE8E10975969CE5 # gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" # gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5 * remotes/elmarco/tags/vu-pull-request: libvhost-user: Support VHOST_USER_SET_SLAVE_REQ_FD libvhost-user: Update and fix feature and request lists vhost-user-bridge: Only process received packets on started queues libvhost-user: vu_queue_started Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-10-13nbd: header constants indentingVladimir Sementsov-Ogievskiy
Prepare indenting for the following commit. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <20171012095319.136610-9-vsementsov@virtuozzo.com> Signed-off-by: Eric Blake <eblake@redhat.com>
2017-10-13nbd/server: simplify reply transmissionVladimir Sementsov-Ogievskiy
Send qiov via qio_channel_writev_all instead of calling nbd_write twice with a cork. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20171012095319.136610-8-vsementsov@virtuozzo.com> [eblake: rebase to tweaks earlier in series] Signed-off-by: Eric Blake <eblake@redhat.com>
2017-10-13nbd/server: refactor nbd_co_send_simple_reply parametersVladimir Sementsov-Ogievskiy
Pass client and buffer (*data) parameters directly, to make the function consistent with further structured reply sending functions. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20171012095319.136610-7-vsementsov@virtuozzo.com> Signed-off-by: Eric Blake <eblake@redhat.com>
2017-10-13nbd/server: do not use NBDReply structureVladimir Sementsov-Ogievskiy
NBDReply structure will be upgraded in future patches to handle both simple and structured replies and will be used only in the client Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20171012095319.136610-6-vsementsov@virtuozzo.com> [eblake: rebase to tweaks earlier in series] Signed-off-by: Eric Blake <eblake@redhat.com>
2017-10-13block/throttle.c: add bdrv_co_drain_begin/end callbacksManos Pitsidianakis
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Manos Pitsidianakis <el13635@mail.ntua.gr> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-10-13block: rename bdrv_co_drain to bdrv_co_drain_beginManos Pitsidianakis
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Manos Pitsidianakis <el13635@mail.ntua.gr> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-10-13block: add bdrv_co_drain_end callbackManos Pitsidianakis
BlockDriverState has a bdrv_co_drain() callback but no equivalent for the end of the drain. The throttle driver (block/throttle.c) needs a way to mark the end of the drain in order to toggle io_limits_disabled correctly, thus bdrv_co_drain_end is needed. Signed-off-by: Manos Pitsidianakis <el13635@mail.ntua.gr> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-10-13specs: Describe the TPM support in QEMUStefan Berger
This patch adds a description of the current TPM support in QEMU to the specs. Several public specs are referenced via their landing page on the trustedcomputinggroup.org website. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2017-10-13tpm: Move tpm_cleanup() to right placeAmarnath Valluri
As Emulator TPM backend uses chardev, tpm cleanup should happen before chardev similar to other vhost-users. Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com> Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2017-10-13tpm: Added support for TPM emulatorAmarnath Valluri
This change introduces a new TPM backend driver that can communicate with swtpm(software TPM emulator) using unix domain socket interface. QEMU talks to the TPM emulator using QEMU's socket-based chardev backend device. Swtpm uses two Unix sockets for communications, one for plain TPM commands and responses, and one for out-of-band control messages. QEMU passes the data socket to be used over the control channel. The swtpm and associated tools can be found here: https://github.com/stefanberger/swtpm The swtpm's control channel protocol specification can be found here: https://github.com/stefanberger/swtpm/wiki/Control-Channel-Specification Usage: # setup TPM state directory mkdir /tmp/mytpm chown -R tss:root /tmp/mytpm /usr/bin/swtpm_setup --tpm-state /tmp/mytpm --createek # Ask qemu to use TPM emulator with given tpm state directory qemu-system-x86_64 \ [...] \ -chardev socket,id=chrtpm,path=/tmp/swtpm-sock \ -tpmdev emulator,id=tpm0,chardev=chrtpm \ -device tpm-tis,tpmdev=tpm0 \ [...] Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2017-10-13tpm-passthrough: move reusable code to utilsAmarnath Valluri
Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com> Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2017-10-13tpm-backend: Move realloc_buffer() implementation to tpm-tis modelAmarnath Valluri
buffer reallocation is very unlikely to be backend specific. Hence move inside the tis. Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com> Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2017-10-13tpm-backend: Add new API to read backend TpmInfoAmarnath Valluri
TPM configuration options are backend implementation details and shall not be part of base TPMBackend object, and these shall not be accessed directly outside of the class, hence added a new interface method, get_tpm_options() to TPMDriverOps., which shall be implemented by the derived classes to return configured tpm options. A new tpm backend api - tpm_backend_query_tpm() which uses _get_tpm_options() to prepare TpmInfo. Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com> Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2017-10-13tpm-backend: Made few interface methods optionalAmarnath Valluri
This allows backend implementations left optional interface methods. For mandatory methods assertion checks added. Took the opportunity to remove unused methods: - tpm_backend_get_desc() - TPMDriverOps->handle_startup_error Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Stefan Berger<stefanb@linux.vnet.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2017-10-13tpm-backend: Initialize and free data members in it's own methodsAmarnath Valluri
Initialize and free TPMBackend data members in it's own instance_init() and instance_finalize methods. Took the opportunity to remove unneeded destroy() method from TpmDriverOps interface as TPMBackend is a Qemu Object, we can use object_unref() inplace of tpm_backend_destroy() to free the backend object, hence removed destroy() from TPMDriverOps interface. Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2017-10-13tpm-backend: Move thread handling inside TPMBackendAmarnath Valluri
Move thread handling inside TPMBackend, this way backend implementations need not to maintain their own thread life cycle, instead they needs to implement 'handle_request()' class method that always been called from a thread. This change made tpm_backend_int.h kind of useless, hence removed it. Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2017-10-13tpm-backend: Remove unneeded member variable from backend classAmarnath Valluri
TPMDriverOps inside TPMBackend is not required, as it is supposed to be a class member. The only possible reason for keeping in TPMBackend was, to get the backend type in tpm.c where dedicated backend api, tpm_backend_get_type() is present. Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2017-10-13tpm: Use EMSGSIZE instead of EBADMSG to compile on OpenBSDStefan Berger
EBADMSG was only added to OpenBSD very recently. To make QEMU compilable on older OpenBSD versions use EMSGSIZE instead when a mismatch between number of received bytes and message size indicated in the header was found. Return -EMSGSIZE and convert all other errnos in the same functions to return the negative errno. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2017-10-12nbd/server: structurize simple reply header sendingVladimir Sementsov-Ogievskiy
Use packed structure instead of pointer arithmetics. Also, merge two redundant traces into one. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20171012095319.136610-5-vsementsov@virtuozzo.com> [eblake: tweak and mention impact on traces, fix errp usage] Signed-off-by: Eric Blake <eblake@redhat.com>
2017-10-12nbd: rename some simple-request related objects to be _simple_Vladimir Sementsov-Ogievskiy
To be consistent when their _structured_ analogs will be introduced. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <20171012095319.136610-4-vsementsov@virtuozzo.com> [eblake: also tweak trace message contents] Signed-off-by: Eric Blake <eblake@redhat.com>
2017-10-12block/nbd-client: refactor nbd_co_receive_replyVladimir Sementsov-Ogievskiy
Pass handle parameter directly, as the whole request isn't needed. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <20171012095319.136610-3-vsementsov@virtuozzo.com> Signed-off-by: Eric Blake <eblake@redhat.com>
2017-10-12block/nbd-client: assert qiov len once in nbd_co_requestVladimir Sementsov-Ogievskiy
Also improve the assertion: check that qiov is NULL for other commands than CMD_READ and CMD_WRITE. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <20171012095319.136610-2-vsementsov@virtuozzo.com> Signed-off-by: Eric Blake <eblake@redhat.com>
2017-10-12NBD: use g_new() family of functionsMarc-André Lureau
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20171006235023.11952-22-f4bug@amsat.org> Signed-off-by: Eric Blake <eblake@redhat.com>
2017-10-12Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20171012' into staging target-arm queue: * v8M: SG, BLXNS, secure-return * v8M: fixes for coverity issues in previous patches * arm: fix armv7m_init() declaration to match definition * watchdog/aspeed: fix variable type to store reload value # gpg: Signature made Thu 12 Oct 2017 17:02:49 BST # gpg: using RSA key 0x3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20171012: nvic: Fix miscalculation of offsets into ITNS array nvic: Add missing 'break' target/arm: Implement SG instruction corner cases target/arm: Support some Thumb insns being always unconditional target-arm: Simplify insn_crosses_page() target/arm: Pull Thumb insn word loads up to top level target-arm: Don't check for "Thumb2 or M profile" for not-Thumb1 target/arm: Implement secure function return target/arm: Implement BLXNS target/arm: Implement SG instruction target/arm: Add M profile secure MMU index values to get_a32_user_mem_index() arm: fix armv7m_init() declaration to match definition watchdog/aspeed: fix variable type to store reload value Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-10-12nvic: Fix miscalculation of offsets into ITNS arrayPeter Maydell
This calculation of the first exception vector in the ITNS<n> register being accessed: int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ; is incorrect, because offset is in bytes, so we only want to multiply by 8. Spotted by Coverity (CID 1381484, CID 1381488), though it is not correct that it actually overflows the buffer, because we have a 'startvec + i < s->num_irq' guard. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1507650856-11718-1-git-send-email-peter.maydell@linaro.org
2017-10-12libvhost-user: Support VHOST_USER_SET_SLAVE_REQ_FDDr. David Alan Gilbert
Allow the qemu to pass us a slave fd. We don't do anything with it yet. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20171002191521.15748-5-dgilbert@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
2017-10-12libvhost-user: Update and fix feature and request listsDr. David Alan Gilbert
Update the ProtocolFeature and UserRequest lists to match hw/virtio/vhost-user.c. Fix the text labelling in libvhost-user.c to match the list. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20171002191521.15748-4-dgilbert@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
2017-10-12vhost-user-bridge: Only process received packets on started queuesDr. David Alan Gilbert
Only process received packets if the queue has been started. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20171002191521.15748-3-dgilbert@redhat.com> Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
2017-10-12libvhost-user: vu_queue_startedDr. David Alan Gilbert
Add a vu_queue_started method to complement vu_queue_enabled. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20171002191521.15748-2-dgilbert@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
2017-10-12nvic: Add missing 'break'Peter Maydell
Coverity points out that we forgot the 'break' for the SAU_CTRL write case (CID1381683). This has no actual visible consequences because it happens that the following case is effectively a no-op. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1507742676-9908-1-git-send-email-peter.maydell@linaro.org Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2017-10-12target/arm: Implement SG instruction corner casesPeter Maydell
The common situation of the SG instruction is that it is executed from S&NSC memory by a CPU in NS state. That case is handled by v7m_handle_execute_nsc(). However the instruction also has defined behaviour in a couple of other cases: * SG instruction in NS memory (behaves as a NOP) * SG in S memory but CPU already secure (clears IT bits and does nothing else) * SG instruction in v8M without Security Extension (NOP) These can be implemented in translate.c. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1507556919-24992-10-git-send-email-peter.maydell@linaro.org
2017-10-12target/arm: Support some Thumb insns being always unconditionalPeter Maydell
A few Thumb instructions are always unconditional even inside an IT block (as opposed to being UNPREDICTABLE if used inside an IT block): BKPT, the v8M SG instruction, and the A profile HLT (debug halt) instruction. This means we need to suppress the jump-over-instruction-on-condfail code generation (though the IT state still advances as usual and subsequent insns in the IT block may be conditional). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1507556919-24992-9-git-send-email-peter.maydell@linaro.org
2017-10-12target-arm: Simplify insn_crosses_page()Peter Maydell
Recent changes have left insn_crosses_page() more complicated than it needed to be: * it's only called from thumb_tr_translate_insn() so we know for certain that we're looking at a Thumb insn * the caller's check for dc->pc >= dc->next_page_start - 3 means that dc->pc can't possibly be 4 aligned, so there's no need to check that (the check was partly there to ensure that we didn't treat an ARM insn as Thumb, I think) * we now have thumb_insn_is_16bit() which lets us do a precise check of the length of the next insn, rather than opencoding an inaccurate check Simplify it down to just loading the first half of the insn and calling thumb_insn_is_16bit() on it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1507556919-24992-8-git-send-email-peter.maydell@linaro.org
2017-10-12target/arm: Pull Thumb insn word loads up to top levelPeter Maydell
Refactor the Thumb decode to do the loads of the instruction words at the top level rather than only loading the second half of a 32-bit Thumb insn in the middle of the decode. This is simple apart from the awkward case of Thumb1, where the BL/BLX prefix and suffix instructions live in what in Thumb2 is the 32-bit insn space. To handle these we decode enough to identify whether we're looking at a prefix/suffix that we handle as a 16 bit insn, or a prefix that we're going to merge with the following suffix to consider as a 32 bit insn. The translation of the 16 bit cases then moves from disas_thumb2_insn() to disas_thumb_insn(). The refactoring has the benefit that we don't need to pass the CPUARMState* down into the decoder code any more, but the major reason for doing this is that some Thumb instructions must be always unconditional regardless of the IT state bits, so we need to know the whole insn before we emit the "skip this insn if the IT bits and cond state tell us to" code. (The always unconditional insns are BKPT, HLT and SG; the last of these is 32 bits.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1507556919-24992-7-git-send-email-peter.maydell@linaro.org
2017-10-12target-arm: Don't check for "Thumb2 or M profile" for not-Thumb1Peter Maydell
The code which implements the Thumb1 split BL/BLX instructions is guarded by a check on "not M or THUMB2". All we really need to check here is "not THUMB2" (and we assume that elsewhere too, eg in the ARCH(6T2) test that UNDEFs the Thumb2 insns). This doesn't change behaviour because all M profile cores have Thumb2 and so ARM_FEATURE_M implies ARM_FEATURE_THUMB2. (v6M implements a very restricted subset of Thumb2, but we can cross that bridge when we get to it with appropriate feature bits.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1507556919-24992-6-git-send-email-peter.maydell@linaro.org
2017-10-12target/arm: Implement secure function returnPeter Maydell
Secure function return happens when a non-secure function has been called using BLXNS and so has a particular magic LR value (either 0xfefffffe or 0xfeffffff). The function return via BX behaves specially when the new PC value is this magic value, in the same way that exception returns are handled. Adjust our BX excret guards so that they recognize the function return magic number as well, and perform the function-return unstacking in do_v7m_exception_exit(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1507556919-24992-5-git-send-email-peter.maydell@linaro.org
2017-10-12target/arm: Implement BLXNSPeter Maydell
Implement the BLXNS instruction, which allows secure code to call non-secure code. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1507556919-24992-4-git-send-email-peter.maydell@linaro.org
generated by cgit v1.2.3 (git 2.26.2) at 2024-11-25 08:41:43 +0000