aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-01-26xlnx-zynqmp-pmu: Add the CPU and memoryAlistair Francis
Connect the MicroBlaze CPU and the ROM and RAM memory regions. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2018-01-26xlnx-zynqmp-pmu: Initial commit of the ZynqMP PMUAlistair Francis
The Xilinx ZynqMP SoC has two main processing systems in it. The ARM processing system (which is already modeled in QEMU) and the MicroBlaze Power Management Unit (PMU). This is the inital work for adding support for the PMU. The PMU susbsystem runs along side the ARM system on hardware, but due to architecture limitations in QEMU the two instances are seperate for the time being. Let's follow the same setup we do with the ARM system, where there is an SoC device and a ZCU102 board. Although the PMU is less board specific we are still going to follow the same split as maybe in future we can connect the PMU device to the ARM ZCU102 board. As the machine will be fairly small let's keep them both together in one file. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2018-01-26microblaze: boot.c: Don't try to find NULL fileAlistair Francis
Previously if no device tree was passed to microblaze_load_kernel() then qemu_find_file() would try to find a NULL pointer. To avoid this put a check around qemu_find_file(). Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reported-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2018-01-25Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20180125' into staging target-arm queue: * target/arm: Fix address truncation in 64-bit pagetable walks * i.MX: Fix FEC/ENET receive functions * target/arm: preparatory refactoring for SVE emulation * hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending" * hw/intc/arm_gic: Fix C_RPR value on idle priority * hw/intc/arm_gic: Fix group priority computation for group 1 IRQs * hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1 * hw/arm/virt: Check that the CPU realize method succeeded * sdhci: fix a NULL pointer dereference due to uninitialized AddressSpace object * xilinx_spips: Correct usage of an uninitialized local variable * pl110: Implement vertical compare/next base interrupts # gpg: Signature made Thu 25 Jan 2018 12:59:25 GMT # gpg: using RSA key 0x3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20180125: (21 commits) pl110: Implement vertical compare/next base interrupts xilinx_spips: Correct usage of an uninitialized local variable sdhci: fix a NULL pointer dereference due to uninitialized AddresSpace object hw/arm/virt: Check that the CPU realize method succeeded hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1 hw/intc/arm_gic: Fix group priority computation for group 1 IRQs hw/intc/arm_gic: Fix C_RPR value on idle priority hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending" target/arm: Simplify fp_exception_el for user-only target/arm: Hoist store to flags output in cpu_get_tb_cpu_state target/arm: Move cpu_get_tb_cpu_state out of line target/arm: Add ARM_FEATURE_SVE vmstate: Add VMSTATE_UINT64_SUB_ARRAY target/arm: Add aa{32, 64}_vfp_{dreg, qreg} helpers target/arm: Change the type of vfp.regs target/arm: Use pointers in neon tbl helper target/arm: Use pointers in neon zip/uzp helpers target/arm: Use pointers in crypto helpers target/arm: Mark disas_set_insn_syndrome inline i.MX: Fix FEC/ENET receive funtions ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-signed' into ↵Peter Maydell
staging qemu-sparc update # gpg: Signature made Thu 25 Jan 2018 13:44:58 GMT # gpg: using RSA key 0x5BC2C56FAE0F321F # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" # Primary key fingerprint: CC62 1AB9 8E82 200D 915C C9C4 5BC2 C56F AE0F 321F * remotes/mcayland/tags/qemu-sparc-signed: sun4u: implement power device sparc64: convert hw/sparc64/sparc64.c from DPRINTF macros to trace events sabre: convert from SABRE_DPRINTF macro to trace-events apb: rename apb.c to sabre.c sun4u: rename apb variables and constants apb: rename QOM type from TYPE_APB to TYPE_SABRE apb: QOMify sabre PCI host bridge apb: change pbm_pci_host prefix functions to use sabre_pci prefix apb: rename APB functions to use sabre prefix simba: rename PBMPCIBridge and QOM types to reflect simba naming apb: split simba PCI bridge into hw/pci-bridge/simba.c sparc/leon3 irqmp: fix IRQ software ack Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25Merge remote-tracking branch 'remotes/kraxel/tags/vga-20180125-pull-request' ↵Peter Maydell
into staging vga: fix for CVE-2018-5683 # gpg: Signature made Thu 25 Jan 2018 09:33:23 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20180125-pull-request: vga: check the validation of memory addr when draw text Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25sun4u: implement power deviceMark Cave-Ayland
This inbuilt device contains a single 4-byte register, of which bit 24 is used to power down the machine on a real Ultra 5. The power device exists at offset 0x724000 on a real machine, but due to the current configuration of the BARs in QEMU it must be located lower in PCI IO space. For the moment we place the power device at offset 0x7240 as a reminder of its original location and raise the base PCI IO address from 0x4000 to 0x8000. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-25sparc64: convert hw/sparc64/sparc64.c from DPRINTF macros to trace eventsMark Cave-Ayland
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-25pl110: Implement vertical compare/next base interruptsLinus Walleij
This implements rudimentary support for interrupt generation on the PL110. I am working on a new DRI/KMS driver for Linux and since that uses the blanking interrupt, we need something to fire here. Without any interrupt support Linux waits for a while and then gives ugly messages about the vblank not working in the console (it does not hang perpetually or anything though, DRI is pretty forgiving). I solved it for now by setting up a timer to fire at 60Hz and pull the interrupts for "vertical compare" and "next memory base" at this interval. This works fine and fires roughly the same number of IRQs on QEMU as on the hardware and leaves the console clean and nice. People who want to create more accurate emulation can probably work on top of this if need be. It is certainly closer to the hardware behaviour than what we have today anyway. Cc: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Message-id: 20180123225654.5764-1-linus.walleij@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: folded long lines] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25xilinx_spips: Correct usage of an uninitialized local variableFrancisco Iglesias
Coverity found that the variable tx_rx in the function xilinx_spips_flush_txfifo was being used uninitialized (CID 1383841). This patch corrects this by always initializing tx_rx to zeros. Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-id: 20180124215708.30400-1-frasse.iglesias@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25sdhci: fix a NULL pointer dereference due to uninitialized AddresSpace objectPhilippe Mathieu-Daudé
missed in 60765b6ceeb4. Thread 1 "qemu-system-aarch64" received signal SIGSEGV, Segmentation fault. address_space_init (as=0x0, root=0x55555726e410, name=name@entry=0x555555e3f0a7 "sdhci-dma") at memory.c:3050 3050 as->root = root; (gdb) bt #0 address_space_init (as=0x0, root=0x55555726e410, name=name@entry=0x555555e3f0a7 "sdhci-dma") at memory.c:3050 #1 0x0000555555af62c3 in sdhci_sysbus_realize (dev=<optimized out>, errp=0x7fff7f931150) at hw/sd/sdhci.c:1564 #2 0x00005555558b25e5 in zynqmp_sdhci_realize (dev=0x555557051520, errp=0x7fff7f931150) at hw/sd/zynqmp-sdhci.c:151 #3 0x0000555555a2e7f3 in device_set_realized (obj=0x555557051520, value=<optimized out>, errp=0x7fff7f931270) at hw/core/qdev.c:966 #4 0x0000555555ba3f74 in property_set_bool (obj=0x555557051520, v=<optimized out>, name=<optimized out>, opaque=0x555556e04a20, errp=0x7fff7f931270) at qom/object.c:1906 #5 0x0000555555ba51f4 in object_property_set (obj=obj@entry=0x555557051520, v=v@entry=0x5555576dbd60, name=name@entry=0x555555dd6306 "realized", errp=errp@entry=0x7fff7f931270) at qom/object.c:1102 Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180123132051.24448-1-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25hw/arm/virt: Check that the CPU realize method succeededPeter Maydell
We were passing a NULL error pointer to the object_property_set_bool() call that realizes the CPU object. This meant that we wouldn't detect failure, and would plough blindly on to crash later trying to use a NULL CPU object pointer. Detect errors and fail instead. In particular, this will be necessary to detect the user error of using "-cpu host" without "-enable-kvm" once we make the host CPU type be registered unconditionally rather than only in kvm_arch_init(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1Luc MICHEL
When C_CTRL.CBPR is 1, the Non-Secure view of C_BPR is altered: - A Non-Secure read of C_BPR should return the BPR value plus 1, saturated to 7, - A Non-Secure write should be ignored. Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr> Message-id: 20180119145756.7629-6-luc.michel@greensocs.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: fixed comment typo] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25hw/intc/arm_gic: Fix group priority computation for group 1 IRQsLuc MICHEL
When determining the group priority of a group 1 IRQ, if C_CTRL.CBPR is 0, the non-secure BPR value is used. However, this value must be incremented by one so that it matches the secure world number of implemented priority bits (NS world has one less priority bit compared to the Secure world). Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr> Message-id: 20180119145756.7629-5-luc.michel@greensocs.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: add assert, as the gicv3 code has] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25hw/intc/arm_gic: Fix C_RPR value on idle priorityLuc MICHEL
When there is no active interrupts in the GIC, a read to the C_RPR register should return the value of the "Idle priority", which is either the maximum value an IRQ priority field can be set to, or 0xff. Since the QEMU GIC model implements all the 8 priority bits, the Idle priority is 0xff. Internally, when there is no active interrupt, the running priority value is 0x100. The gic_get_running_priority function returns an uint8_t and thus, truncate this value to 0x00 when returning it. This is wrong since a value of 0x00 correspond to the maximum possible priority. This commit fixes the returned value when the internal value is 0x100. Note that it is correct for the Non-Secure view to return 0xff even though from the NS world point of view, only 7 priority bits are implemented. The specification states that the Idle priority can be 0xff even when not all the 8 priority bits are implemented. This has been verified against a real GICv2 hardware on a Xilinx ZynqMP based board. Regarding the ARM11MPCore version of the GIC, the specification is not clear on that point, so this commit does not alter its behavior. Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr> Message-id: 20180119145756.7629-4-luc.michel@greensocs.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and ↵Luc MICHEL
pending" In the GIC, when an IRQ is acknowledged, its state goes from "pending" to: - "active" if the corresponding IRQ pin has been de-asserted - "active and pending" otherwise. The GICv2 manual states that when a IRQ becomes active (or active and pending), the GIC should either signal another (higher priority) IRQ to the CPU if there is one, or de-assert the CPU IRQ pin. The current implementation of the GIC in QEMU does not check if the IRQ is already active when looking for pending interrupts with sufficient priority in gic_update(). This can lead to signaling an interrupt that is already active. This usually happens when splitting priority drop and interrupt deactivation. On priority drop, the IRQ stays active until deactivation. If it becomes pending again, chances are that it will be incorrectly selected as best_irq in gic_update(). This commit fixes this by checking if the IRQ is not already active when looking for best_irq in gic_update(). Note that regarding the ARM11MPCore GIC version, the corresponding manual is not clear on that point, but it has has no priority drop/interrupt deactivation separation, so this case should not happen. Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr> Message-id: 20180119145756.7629-3-luc.michel@greensocs.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25target/arm: Simplify fp_exception_el for user-onlyRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180119045438.28582-16-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25target/arm: Hoist store to flags output in cpu_get_tb_cpu_stateRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180119045438.28582-15-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25target/arm: Move cpu_get_tb_cpu_state out of lineRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180119045438.28582-14-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25target/arm: Add ARM_FEATURE_SVERichard Henderson
Not enabled anywhere so far. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180119045438.28582-11-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25vmstate: Add VMSTATE_UINT64_SUB_ARRAYRichard Henderson
At the same time, move VMSTATE_UINT32_SUB_ARRAY beside the other UINT32 definitions. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180119045438.28582-8-richard.henderson@linaro.org Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25target/arm: Add aa{32, 64}_vfp_{dreg, qreg} helpersRichard Henderson
Helpers that return a pointer into env->vfp.regs so that we isolate the logic of how to index the regs array for different cpu modes. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180119045438.28582-7-richard.henderson@linaro.org Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25target/arm: Change the type of vfp.regsRichard Henderson
All direct users of this field want an integral value. Drop all of the extra casting between uint64_t and float64. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180119045438.28582-6-richard.henderson@linaro.org Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25target/arm: Use pointers in neon tbl helperRichard Henderson
Rather than passing a regno to the helper, pass pointers to the vector register directly. This eliminates the need to pass in the environment pointer and reduces the number of places that directly access env->vfp.regs[]. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180119045438.28582-5-richard.henderson@linaro.org Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25target/arm: Use pointers in neon zip/uzp helpersRichard Henderson
Rather than passing regnos to the helpers, pass pointers to the vector registers directly. This eliminates the need to pass in the environment pointer and reduces the number of places that directly access env->vfp.regs[]. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20180119045438.28582-4-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25target/arm: Use pointers in crypto helpersRichard Henderson
Rather than passing regnos to the helpers, pass pointers to the vector registers directly. This eliminates the need to pass in the environment pointer and reduces the number of places that directly access env->vfp.regs[]. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20180119045438.28582-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25target/arm: Mark disas_set_insn_syndrome inlineRichard Henderson
If it isn't used when translate.h is included, we'll get a compiler Werror. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20180119045438.28582-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25i.MX: Fix FEC/ENET receive funtionsJean-Christophe Dubois
The actual imx_eth_enable_rx() function is buggy. It updates s->regs[ENET_RDAR] after calling qemu_flush_queued_packets(). qemu_flush_queued_packets() is going to call imx_XXX_receive() which itself is going to call imx_eth_enable_rx(). By updating s->regs[ENET_RDAR] after calling qemu_flush_queued_packets() we end up updating the register with an outdated value which might lead to disabling the receive function in the i.MX FEC/ENET device. This patch change the place where the register update is done so that the register value stays up to date and the receive function can keep running. Reported-by: Fyleo <fyleo45@gmail.com> Tested-by: Fyleo <fyleo45@gmail.com> Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Message-id: 20180113113445.2705-1-jcd@tribudubois.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Andrey Smirnov <andrew.smirnov@gmail.com> Tested-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25target/arm: Fix 32-bit address truncationArd Biesheuvel
Commit ("3b39d734141a target/arm: Handle page table walk load failures correctly") modified both versions of the page table walking code (i.e., arm_ldl_ptw and arm_ldq_ptw) to record the result of the translation in a temporary 'data' variable so that it can be inspected before being returned. However, arm_ldq_ptw() returns an uint64_t, and using a temporary uint32_t variable truncates the upper bits, corrupting the result. This causes problems when using more than 4 GB of memory in a TCG guest. So use a uint64_t instead. Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Message-id: 20180119194648.25501-1-ard.biesheuvel@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25Merge remote-tracking branch ↵Peter Maydell
'remotes/vivier2/tags/linux-user-for-2.12-pull-request' into staging # gpg: Signature made Tue 23 Jan 2018 14:47:41 GMT # gpg: using RSA key 0xF30C38BD3F2FBE3C # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" # gpg: aka "Laurent Vivier <laurent@vivier.eu>" # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/linux-user-for-2.12-pull-request: linux-user: implement renameat2 page_unprotect(): handle calls to pages that are PAGE_WRITE linux-user: Propagate siginfo_t through to handle_cpu_signal() linux-user: remove nmi.c and fw-path-provider.c linux-user: Add getcpu() support linux-user: Add AT_SECURE auxval linux-user: Fix sched_get/setaffinity conversion linux-user/mmap.c: Avoid choosing NULL as start address linux-user: Translate flags argument to dup3 syscall linux-user: Don't use CMSG_ALIGN(sizeof struct cmsghdr) linux-user: Fix length calculations in host_to_target_cmsg() linux-user: wrap fork() in a start/end exclusive section linux-user: Fix locking order in fork_start() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25vga: check the validation of memory addr when draw textlinzhecheng
Start a vm with qemu-kvm -enable-kvm -vnc :66 -smp 1 -m 1024 -hda redhat_5.11.qcow2 -device pcnet -vga cirrus, then use VNC client to connect to VM, and excute the code below in guest OS will lead to qemu crash: int main() { iopl(3); srand(time(NULL)); int a,b; while(1){ a = rand()%0x100; b = 0x3c0 + (rand()%0x20); outb(a,b); } return 0; } The above code is writing the registers of VGA randomly. We can write VGA CRT controller registers index 0x0C or 0x0D (which is the start address register) to modify the the display memory address of the upper left pixel or character of the screen. The address may be out of the range of vga ram. So we should check the validation of memory address when reading or writing it to avoid segfault. Signed-off-by: linzhecheng <linzhecheng@huawei.com> Message-id: 20180111132724.13744-1-linzhecheng@huawei.com Fixes: CVE-2018-5683 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-24Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches # gpg: Signature made Tue 23 Jan 2018 12:38:36 GMT # gpg: using RSA key 0x7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: (29 commits) iotests: Disable some tests for compat=0.10 iotests: Split 177 into two parts for compat=0.10 iotests: Make 059 pass on machines with little RAM iotests: Filter compat-dependent info in 198 iotests: Make 191 work with qcow2 options iotests: Make 184 image-less iotests: Make 089 compatible with compat=0.10 iotests: Fix 067 for compat=0.10 iotests: Fix 059's reference output iotests: Fix 051 for compat=0.10 iotests: Fix 020 for vmdk iotests: Skip 103 for refcount_bits=1 iotests: Forbid 020 for non-file protocols iotests: Drop format-specific in _filter_img_info iotests: Fix _img_info for backslashes block/vmdk: Add blkdebug events block/qcow: Add blkdebug events qcow2: No persistent dirty bitmaps for compat=0.10 block/vmdk: Fix , instead of ; at end of line qemu-iotests: Fix locking issue in 102 ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-24Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
virtio: quick fix Fixes a regression in virtio that's causing issues for many people. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 24 Jan 2018 17:20:24 GMT # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: Revert "qemu: add a cleanup callback function to EventNotifier" Revert "virtio: postpone the execution of event_notifier_cleanup function" Revert "virtio: improve virtio devices initialization time" Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-24sabre: convert from SABRE_DPRINTF macro to trace-eventsMark Cave-Ayland
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Michael S. Tsirkin <mst@redhat.com> CC: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> [for addition of trace-events to hw/pci-host] Acked-by: Michael S. Tsirkin <mst@redhat.com>
2018-01-24apb: rename apb.c to sabre.cMark Cave-Ayland
This is the final stage in correcting the naming convention with respect to sabre, APB and PBM. It is effectively a file rename from apb.c to sabre.c along with touching up a few constants to remove the remaining references to APB. Note that as part of the rename process the configuration variable CONFIG_PCI_APB is changed to CONFIG_PCI_SABRE. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24sun4u: rename apb variables and constantsMark Cave-Ayland
In order to reflect the previous change of TYPE_APB to TYPE_SABRE, update the corresponding variable names to keep the terminology consistent. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24apb: rename QOM type from TYPE_APB to TYPE_SABREMark Cave-Ayland
Similarly rename the corresponding APBState typedef to SabreState. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24apb: QOMify sabre PCI host bridgeMark Cave-Ayland
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24apb: change pbm_pci_host prefix functions to use sabre_pci prefixMark Cave-Ayland
This is the proper name for the PBM host bridge as referenced in the Sun documentation. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24apb: rename APB functions to use sabre prefixMark Cave-Ayland
As hinted in the comment at the top of the file, the naming convention for the APB types/QOM functions isn't correct. As a starting point we can at least rename the APB type and related functions to improve the readability of apb.c. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24simba: rename PBMPCIBridge and QOM types to reflect simba namingMark Cave-Ayland
Here we rename PBMPCIBridge to SimbaPCIBridge and the QOM type from TYPE_PBM_PCI_BRIDGE to TYPE_SIMBA_PCI_BRIDGE in improve the clarity of the device name. Also touch up the relevant spots in apb.c and various other function names as appropriate. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24apb: split simba PCI bridge into hw/pci-bridge/simba.cMark Cave-Ayland
Move the QOM type and macros into a new include/hw/pci-bridge/simba.h file, and add a new CONFIG_SIMBA Makefile.objs variable which is enabled for sparc64-softmmu builds only. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Michael S. Tsirkin <mst@redhat.com> CC: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24sparc/leon3 irqmp: fix IRQ software ackJean-Christophe Dubois
With the LEON3 IRQ controller IRQs can be acknowledged 2 ways: * Explicitly by software writing to the CLEAR_OFFSET register * Implicitly when the procesor is done running the trap handler attached to the IRQ. The actual IRQMP code only allows the implicit processor triggered IRQ ack. If software write explicitly to the CLEAR_OFFSET register, this will clear the pending bit in the register value but this will not lower the ongoing raised IRQ with the processor. The IRQ will be kept raised to the LEON processor until the related trap handler is run and the processor implicitly ack the interrupt. So with the actual IRQMP code trap handler have to be run even if the software has already done its job by clearing the pending bit. This feature has been tested on another LEON3 simulator (tsim_leon3 from Gaisler) and it turns out that the Qemu implementation is not equivalent to the tsim one. In tsim, if software does clear a pending interrupt before the related interrupt handler is triggered the said interrupt handler will not be called. This patch brings the Qemu IRQMP implementation in line with the tsim implementation by allowing IRQ to be acknowledged by software only. Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Fabien Chouteau <chouteau@adacore.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2018-01-24Revert "qemu: add a cleanup callback function to EventNotifier"Michael S. Tsirkin
This reverts commit f87d72f5c5bff0837d409a56bd34f439a90119ca as that is part of a patchset reported to break cleanup and migration. Cc: Gal Hammer <ghammer@redhat.com> Cc: Sitong Liu <siliu@redhat.com> Cc: Xiaoling Gao <xiagao@redhat.com> Suggested-by: Greg Kurz <groug@kaod.org> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Jose Ricardo Ziviani <joserz@linux.vnet.ibm.com> Reported-by: Daniel Henrique Barboza <danielhb@linux.vnet.ibm.com>
2018-01-24Revert "virtio: postpone the execution of event_notifier_cleanup function"Michael S. Tsirkin
This reverts commit 4fe6d78b2e241f41208dfb07605aace4becfc747 as it is reported to break cleanup and migration. Cc: Gal Hammer <ghammer@redhat.com> Cc: Sitong Liu <siliu@redhat.com> Cc: Xiaoling Gao <xiagao@redhat.com> Suggested-by: Greg Kurz <groug@kaod.org> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Jose Ricardo Ziviani <joserz@linux.vnet.ibm.com> Reported-by: Daniel Henrique Barboza <danielhb@linux.vnet.ibm.com>
2018-01-24Revert "virtio: improve virtio devices initialization time"Michael S. Tsirkin
This reverts commit 6f0bb230722931d17fb284eee8efd40b9d653822. This reverts commit f87d72f5c5bff0837d409a56bd34f439a90119ca as that is reported to break cleanup and migration. Cc: Gal Hammer <ghammer@redhat.com> Cc: Sitong Liu <siliu@redhat.com> Cc: Xiaoling Gao <xiagao@redhat.com> Suggested-by: Greg Kurz <groug@kaod.org> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Jose Ricardo Ziviani <joserz@linux.vnet.ibm.com> Reported-by: Daniel Henrique Barboza <danielhb@linux.vnet.ibm.com>
2018-01-24Merge remote-tracking branch 'remotes/xtensa/tags/20180122-xtensa' into stagingPeter Maydell
target/xtensa updates: - make mini-bootloader independent of the initial CPU state; - add noMMU XTFPGA variants; - add two noMMU cores: de212 and sample_controller; - fix issues reported by coverity against xtensa translator and disassembler. # gpg: Signature made Mon 22 Jan 2018 20:00:01 GMT # gpg: using RSA key 0x51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <filippov@cadence.com>" # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20180122-xtensa: target/xtensa: disas/xtensa: fix coverity warnings target/xtensa: add sample_controller core target/xtensa: allow different default CPU for MMU/noMMU target/xtensa: add de212 core hw/xtensa/xtfpga: support noMMU cores hw/xtensa/xtfpga: extract flash configuration hw/xtensa: extract xtensa_create_memory_regions target/xtensa: fix default sysrom/sysram addresses hw/xtensa/xtfpga: clean up function/structure names hw/xtensa/xtfpga: rewrite mini bootloader Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-24Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging Pull request v2: * Drop merge failure from a previous pull request that broke virtio-blk on ARM guests * Add Parallels XML patch series # gpg: Signature made Mon 22 Jan 2018 16:00:40 GMT # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: block/parallels: add backing support to readv/writev block/parallels: replace some magic numbers block/parallels: move some structures into header configure: add dependency docs/interop/prl-xml: description of Parallels Disk format block: add block_set_io_throttle virtio-blk-pci QMP example Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-23linux-user: implement renameat2Andreas Schwab
This is needed for new architectures like RISC-V which do not provide any other rename-like syscall. Signed-off-by: Andreas Schwab <schwab@suse.de> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <mvm607su9qs.fsf@suse.de> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-01-23page_unprotect(): handle calls to pages that are PAGE_WRITEPeter Maydell
If multiple guest threads in user-mode emulation write to a page which QEMU has marked read-only because of cached TCG translations, the threads can race in page_unprotect: * threads A & B both try to do a write to a page with code in it at the same time (ie which we've made non-writeable, so SEGV) * they race into the signal handler with this faulting address * thread A happens to get to page_unprotect() first and takes the mmap lock, so thread B sits waiting for it to be done * A then finds the page, marks it PAGE_WRITE and mprotect()s it writable * A can then continue OK (returns from signal handler to retry the memory access) * ...but when B gets the mmap lock it finds that the page is already PAGE_WRITE, and so it exits page_unprotect() via the "not due to protected translation" code path, and wrongly delivers the signal to the guest rather than just retrying the access In particular, this meant that trying to run 'javac' in user-mode emulation would fail with a spurious guest SIGSEGV. Handle this by making page_unprotect() assume that a call for a page which is already PAGE_WRITE is due to a race of this sort and return a "fault handled" indication. Since this would cause an infinite loop if we ever called page_unprotect() for some other kind of fault than "write failed due to bad access permissions", tighten the condition in handle_cpu_signal() to check the signal number and si_code, and add a comment so that if somebody does ever find themselves debugging an infinite loop of faults they have some clue about why. (The trick for identifying the correct setting for current_tb_invalidated for thread B (needed to handle the precise-SMC case) is due to Richard Henderson. Paolo Bonzini suggested just relying on si_code rather than trying anything more complicated.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <1511879725-9576-3-git-send-email-peter.maydell@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>