aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-06-05wire in the dwc-hsotg (dwc2) USB host controller emulationPaul Zimmerman
Wire the dwc-hsotg (dwc2) emulation into Qemu Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Reviewed-by: Philippe Mathieu-Daude <f4bug@amsat.org> Message-id: 20200520235349.21215-7-pauldzim@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05usb: add short-packet handling to usb-storage driverPaul Zimmerman
The dwc-hsotg (dwc2) USB host depends on a short packet to indicate the end of an IN transfer. The usb-storage driver currently doesn't provide this, so fix it. I have tested this change rather extensively using a PC emulation with xhci, ehci, and uhci controllers, and have not observed any regressions. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200520235349.21215-6-pauldzim@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05dwc-hsotg (dwc2) USB host controller emulationPaul Zimmerman
Add the dwc-hsotg (dwc2) USB host controller emulation code. Based on hw/usb/hcd-ehci.c and hw/usb/hcd-ohci.c. Note that to use this with the dwc-otg driver in the Raspbian kernel, you must pass the option "dwc_otg.fiq_fsm_enable=0" on the kernel command line. Emulation of slave mode and of descriptor-DMA mode has not been implemented yet. These modes are seldom used. I have used some on-line sources of information while developing this emulation, including: http://www.capital-micro.com/PDF/CME-M7_Family_User_Guide_EN.pdf which has a pretty complete description of the controller starting on page 370. https://sourceforge.net/p/wive-ng/wive-ng-mt/ci/master/tree/docs/DataSheets/RT3050_5x_V2.0_081408_0902.pdf which has a description of the controller registers starting on page 130. Thanks to Felippe Mathieu-Daude for providing a cleaner method of implementing the memory regions for the controller registers. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200520235349.21215-5-pauldzim@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05dwc-hsotg (dwc2) USB host controller state definitionsPaul Zimmerman
Add the dwc-hsotg (dwc2) USB host controller state definitions. Mostly based on hw/usb/hcd-ehci.h. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200520235349.21215-4-pauldzim@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05dwc-hsotg (dwc2) USB host controller register definitionsPaul Zimmerman
Import the dwc-hsotg (dwc2) register definitions file from the Linux kernel. This is a copy of drivers/usb/dwc2/hw.h from the mainline Linux kernel, the only changes being to the header, and two instances of 'u32' changed to 'uint32_t' to allow it to compile. Checkpatch throws a boatload of errors due to the tab indentation, but I would rather import it as-is than reformat it. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200520235349.21215-3-pauldzim@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05raspi: add BCM2835 SOC MPHI emulationPaul Zimmerman
Add BCM2835 SOC MPHI (Message-based Parallel Host Interface) emulation. It is very basic, only providing the FIQ interrupt needed to allow the dwc-otg USB host controller driver in the Raspbian kernel to function. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Acked-by: Philippe Mathieu-Daude <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20200520235349.21215-2-pauldzim@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05docs/system: Document Aspeed boardsCédric Le Goater
Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200602135050.593692-1-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05tests/acceptance: Add a boot test for the xlnx-versal-virt machineThomas Huth
As described by Edgar here: https://www.mail-archive.com/qemu-devel@nongnu.org/msg605124.html we can use the Ubuntu kernel for testing the xlnx-versal-virt machine. So let's add a boot test for this now. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20200525141237.15243-1-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/adc/stm32f2xx_adc: Correct memory region size and access sizePhilippe Mathieu-Daudé
The ADC region size is 256B, split as: - [0x00 - 0x4f] defined - [0x50 - 0xff] reserved All registers are 32-bit (thus when the datasheet mentions the last defined register is 0x4c, it means its address range is 0x4c .. 0x4f. This model implementation is also 32-bit. Set MemoryRegionOps 'impl' fields. See: 'RM0033 Reference manual Rev 8', Table 10.13.18 "ADC register map". Reported-by: Seth Kintigh <skintigh@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200603055915.17678-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05target/arm: Split helper_crypto_sm3ttRichard Henderson
Rather than passing an opcode to a helper, fully decode the operation at translate time. Use clear_tail_16 to zap the balance of the SVE register with the AdvSIMD write. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200514212831.31248-7-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05target/arm: Split helper_crypto_sha1_3regRichard Henderson
Rather than passing an opcode to a helper, fully decode the operation at translate time. Use clear_tail_16 to zap the balance of the SVE register with the AdvSIMD write. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200514212831.31248-6-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05target/arm: Convert sha1 and sha256 to gvec helpersRichard Henderson
Do not yet convert the helpers to loop over opr_sz, but the descriptor allows the vector tail to be cleared. Which fixes an existing bug vs SVE. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200514212831.31248-5-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05target/arm: Convert sha512 and sm3 to gvec helpersRichard Henderson
Do not yet convert the helpers to loop over opr_sz, but the descriptor allows the vector tail to be cleared. Which fixes an existing bug vs SVE. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200514212831.31248-4-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05target/arm: Convert rax1 to gvec helpersRichard Henderson
With this conversion, we will be able to use the same helpers with sve. This also fixes a bug in which we failed to clear the high bits of the SVE register after an AdvSIMD operation. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200514212831.31248-3-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05target/arm: Convert aes and sm4 to gvec helpersRichard Henderson
With this conversion, we will be able to use the same helpers with sve. In particular, pass 3 vector parameters for the 3-operand operations; for advsimd the destination register is also an input. This also fixes a bug in which we failed to clear the high bits of the SVE register after an AdvSIMD operation. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200514212831.31248-2-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/arm/pxa2xx: Replace printf() call by qemu_log_mask()Philippe Mathieu-Daudé
Replace printf() calls by qemu_log_mask(), which is disabled by default. This avoid flooding the terminal when fuzzing the device. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200525114123.21317-3-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/input/pxa2xx_keypad: Replace hw_error() by qemu_log_mask()Philippe Mathieu-Daudé
hw_error() calls exit(). This a bit overkill when we can log the accesses as unimplemented or guest error. When fuzzing the devices, we don't want the whole process to exit. Replace some hw_error() calls by qemu_log_mask() (missed in commit 5a0001ec7e). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200525114123.21317-2-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/ssi/imx_spi: Removed unnecessary cast of rx data received from slaveEden Mikitas
When inserting the value retrieved (rx) from the spi slave, rx is pushed to rx_fifo after being cast to uint8_t. rx_fifo is a fifo32, and the rx register the driver uses is also 32 bit. This zeroes the 24 most significant bits of rx. This proved problematic with devices that expect to use the whole 32 bits of the rx register. Signed-off-by: Eden Mikitas <e.mikitas@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/ssi/imx_spi: changed while statement to prevent underflowEden Mikitas
The while statement in question only checked if tx_burst is not 0. tx_burst is a signed int, which is assigned the value put by the guest driver in ECSPI_CONREG. The burst length can be anywhere between 1 and 4096, and since tx_burst is always decremented by 8 it could possibly underflow, causing an infinite loop. Signed-off-by: Eden Mikitas <e.mikitas@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05target/s390x: Restrict system-mode declarationsPhilippe Mathieu-Daudé
As these declarations are restricted to !CONFIG_USER_ONLY in helper.c, only declare them when system-mode emulation is used. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200526172427.17460-8-f4bug@amsat.org> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-06-05target/s390x/helper: Clean ifdef'ryPhilippe Mathieu-Daudé
All this code is guarded checking CONFIG_USER_ONLY definition. Drop the duplicated checks. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200526172427.17460-7-f4bug@amsat.org> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-06-05target/s390x: Only compile decode_basedisp() on system-modePhilippe Mathieu-Daudé
The decode_basedisp*() methods are only used in ioinst.c, which is only build in system-mode emulation. I/O instructions are privileged, and other S instructions are decoded elsewhere. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200526172427.17460-6-f4bug@amsat.org> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-06-05MAINTAINERS: add Thomas as additional s390x maintainerCornelia Huck
...because two people are better than one. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Acked-by: Thomas Huth <thuth@redhat.com> Cc: Thomas Huth <thuth@redhat.com> Message-Id: <20200525155855.225564-1-cohuck@redhat.com>
2020-06-05docs/s390x: document vfio-ccwCornelia Huck
Add a basic example for passing a dasd via vfio-ccw. Message-Id: <20200518075522.97643-1-cohuck@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-06-05vfio-ccw: allow non-prefetch ORBsJared Rossi
Remove the explicit prefetch check when using vfio-ccw devices. This check does not trigger in practice as all Linux channel programs are intended to use prefetch. Newer Linux kernel versions do not require to force the PFCH flag with vfio-ccw devices anymore. Signed-off-by: Jared Rossi <jrossi@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Message-Id: <20200512181535.18630-2-jrossi@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-06-05docs/s390x: document 3270Cornelia Huck
Add some basic info how to use 3270 devices. Message-Id: <20200515151518.83950-3-cohuck@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-06-05docs/s390x: document the virtual cssCornelia Huck
Add some hints about "devno" rules. Message-Id: <20200515151518.83950-2-cohuck@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-06-05s390x: pv: Fix KVM_PV_PREP_RESET command wrapper nameJanosch Frank
s390_pv_perf_clear_reset() is not a very helpful name since that function needs to be called for a normal and a clear reset via diag308. Let's instead name it s390_pv_prep_reset() which reflects the purpose of the function a bit better. Signed-off-by: Janosch Frank <frankja@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20200505124159.24099-1-frankja@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-06-05s390x/kvm: help valgrind in several placesChristian Borntraeger
We need some little help in the code to reduce the valgrind noise. This patch does this with some designated initializers for the cpu model features and subfunctions. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20200429074201.100924-1-borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-06-05Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200605-pull-request' ↵Peter Maydell
into staging vga: ati security fix, cirrus cleanup. # gpg: Signature made Fri 05 Jun 2020 12:27:13 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20200605-pull-request: hw/display/cirrus_vga: Fix code mis-indentation ati-vga: check mm_index before recursive call (CVE-2020-13800) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging Pull request # gpg: Signature made Fri 05 Jun 2020 10:47:27 BST # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: block: Factor out bdrv_run_co() exec: Rename qemu_ram_writeback() as qemu_ram_msync() hw/block: Let the NVMe emulated device be target-agnostic memory: Extract memory_region_msync() from memory_region_writeback() memory: Rename memory_region_do_writeback -> memory_region_writeback fuzz: run the main-loop in fork-server process fuzz: add mangled object name to linker script fuzz: fix typo in i440fx-qtest-reboot arguments fuzz: add datadir for oss-fuzz compatability io_uring: use io_uring_cq_ready() to check for ready cqes io_uring: retry io_uring_submit() if it fails with errno=EINTR Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05block: Factor out bdrv_run_co()Vladimir Sementsov-Ogievskiy
We have a few bdrv_*() functions that can either spawn a new coroutine and wait for it with BDRV_POLL_WHILE() or use a fastpath if they are alreeady running in a coroutine. All of them duplicate basically the same code. Factor the common code into a new function bdrv_run_co(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-id: 20200520144901.16589-1-vsementsov@virtuozzo.com [Factor out bdrv_run_co_entry too] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05exec: Rename qemu_ram_writeback() as qemu_ram_msync()Philippe Mathieu-Daudé
Rename qemu_ram_writeback() as qemu_ram_msync() to better match what it does. Suggested-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20200508062456.23344-5-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05hw/block: Let the NVMe emulated device be target-agnosticPhilippe Mathieu-Daudé
Now than the non-target specific memory_region_msync() function is available, use it to make this device target-agnostic. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20200508062456.23344-4-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05memory: Extract memory_region_msync() from memory_region_writeback()Philippe Mathieu-Daudé
Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20200508062456.23344-3-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05memory: Rename memory_region_do_writeback -> memory_region_writebackPhilippe Mathieu-Daudé
We usually use '_do_' for internal functions. Rename memory_region_do_writeback() as memory_region_writeback(). Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20200508062456.23344-2-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05fuzz: run the main-loop in fork-server processAlexander Bulekov
Without this, the time since the last main-loop keeps increasing, as the fuzzer runs. The forked children need to handle all the "past-due" timers, slowing them down, over time. With this change, the parent/fork-server process runs the main-loop, while waiting on the child, ensuring that the timer events do not pile up, over time. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200512030133.29896-5-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05fuzz: add mangled object name to linker scriptAlexander Bulekov
Previously, we relied on "FuzzerTracePC*(.bss*)" to place libfuzzer's fuzzer::TPC object into our contiguous shared-memory region. This does not work for some libfuzzer builds, so this addition identifies the region by its mangled name: *(.bss._ZN6fuzzer3TPCE); Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200512030133.29896-4-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05fuzz: fix typo in i440fx-qtest-reboot argumentsAlexander Bulekov
Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200512030133.29896-3-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05fuzz: add datadir for oss-fuzz compatabilityAlexander Bulekov
This allows us to keep pc-bios in executable_dir/pc-bios, rather than executable_dir/../pc-bios, which is incompatible with oss-fuzz' file structure. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200512030133.29896-2-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05io_uring: use io_uring_cq_ready() to check for ready cqesStefano Garzarella
In qemu_luring_poll_cb() we are not using the cqe peeked from the CQ ring. We are using io_uring_peek_cqe() only to see if there are cqes ready, so we can replace it with io_uring_cq_ready(). Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Message-id: 20200519134942.118178-1-sgarzare@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05io_uring: retry io_uring_submit() if it fails with errno=EINTRStefano Garzarella
As recently documented [1], io_uring_enter(2) syscall can return an error (errno=EINTR) if the operation was interrupted by a delivery of a signal before it could complete. This should happen when IORING_ENTER_GETEVENTS flag is used, for example during io_uring_submit_and_wait() or during io_uring_submit() when IORING_SETUP_IOPOLL is enabled. We shouldn't have this problem for now, but it's better to prevent it. [1] https://github.com/axboe/liburing/commit/344355ec6619de8f4e64584c9736530b5346e4f4 Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Message-id: 20200519133041.112138-1-sgarzare@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05hw/display/cirrus_vga: Fix code mis-indentationPhilippe Mathieu-Daudé
While replacing fprintf() by qemu_log_mask() in commit 2b55f4d3504, we incorrectly used a 'tab = 4 spaces' alignment, leading to misindented new code. Fix now. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200529165436.23573-1-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-05ati-vga: check mm_index before recursive call (CVE-2020-13800)Prasad J Pandit
While accessing VGA registers via ati_mm_read/write routines, a guest may set 's->regs.mm_index' such that it leads to infinite recursion. Check mm_index value to avoid such recursion. Log an error message for wrong values. Reported-by: Ren Ding <rding@gatech.edu> Reported-by: Hanqing Zhao <hanqing@gatech.edu> Reported-by: Yi Ren <c4tren@gmail.com> Message-id: 20200604090830.33885-1-ppandit@redhat.com Suggested-by: BALATON Zoltan <balaton@eik.bme.hu> Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-04Merge remote-tracking branch ↵Peter Maydell
'remotes/alistair/tags/pull-riscv-to-apply-20200603' into staging This is a collection of RISC-V patches for 5.1. This incldues removing deprecated features and part of the OpenTitan support series. # gpg: Signature made Wed 03 Jun 2020 17:12:43 BST # gpg: using RSA key F6C4AC46D4934868D3B8CE8F21E10D29DF977054 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [full] # Primary key fingerprint: F6C4 AC46 D493 4868 D3B8 CE8F 21E1 0D29 DF97 7054 * remotes/alistair/tags/pull-riscv-to-apply-20200603: riscv: Initial commit of OpenTitan machine target/riscv: Add the lowRISC Ibex CPU target/riscv: Don't set PMP feature in the cpu init target/riscv: Disable the MMU correctly target/riscv: Don't overwrite the reset vector riscv/boot: Add a missing header include riscv: sifive_e: Manually define the machine docs: deprecated: Update the -bios documentation target/riscv: Drop support for ISA spec version 1.09.1 target/riscv: Remove the deprecated CPUs hw/riscv: spike: Remove deprecated ISA specific machines hw/riscv: virt: Remove the riscv_ prefix of the machine* functions hw/riscv: sifive_u: Remove the riscv_ prefix of the soc* functions riscv: Change the default behavior if no -bios option is specified riscv: Suppress the error report for QEMU testing with riscv_find_firmware() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-03riscv: Initial commit of OpenTitan machineAlistair Francis
This adds a barebone OpenTitan machine to QEMU. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com>
2020-06-03target/riscv: Add the lowRISC Ibex CPUAlistair Francis
Ibex is a small and efficient, 32-bit, in-order RISC-V core with a 2-stage pipeline that implements the RV32IMC instruction set architecture. For more details on lowRISC see here: https://github.com/lowRISC/ibex Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
2020-06-03target/riscv: Don't set PMP feature in the cpu initAlistair Francis
The PMP is enabled by default via the "pmp" property so there is no need for us to set it in the init function. As all CPUs have PMP support just remove the set_feature() call in the CPU init functions. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com>
2020-06-03target/riscv: Disable the MMU correctlyAlistair Francis
Previously if we didn't enable the MMU it would be enabled in the realize() function anyway. Let's ensure that if we don't want the MMU we disable it. We also don't need to enable the MMU as it will be enabled in realize() by default. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com>
2020-06-03target/riscv: Don't overwrite the reset vectorAlistair Francis
The reset vector is set in the init function don't set it again in realize. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-06 15:49:21 +0000