aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-04-17target-arm: Provide correct syndrome information for cpreg access trapsPeter Maydell5-7/+184
For exceptions taken to AArch64, if a coprocessor/system register access fails due to a trap or enable bit then the syndrome information must include details of the failing instruction (crn/crm/opc1/opc2 fields, etc). Make the decoder construct the syndrome information at translate time so it can be passed at runtime to the access-check helper function and used as required. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
2014-04-17target-arm: Define exception record for AArch64 exceptionsPeter Maydell4-41/+56
For AArch32 exceptions, the only information provided about the cause of an exception is the individual exception type (data abort, undef, etc), which we store in cs->exception_index. For AArch64, the CPU provides much more detail about the cause of the exception, which can be found in the syndrome register. Create a set of fields in CPUARMState which must be filled in whenever an exception is raised, so that exception entry can correctly fill in the syndrome register for the guest. This includes the information which in AArch32 appears in the DFAR and IFAR (fault address registers) and the DFSR and IFSR (fault status registers) for data aborts and prefetch aborts, since if we end up taking the MMU fault to AArch64 rather than AArch32 this will need to end up in different system registers. This patch does a refactoring which moves the setting of the AArch32 DFAR/DFSR/IFAR/IFSR from the point where the exception is raised to the point where it is taken. (This is no change for cores with an MMU, retains the existing clearly incorrect behaviour for ARM946 of trashing the MP access permissions registers which share the c5_data and c5_insn state fields, and has no effect for v7M because we don't implement its MPU fault status or address registers.) As a side effect of the cleanup we fix a bug in the AArch64 linux-user mode code where we were passing a 64 bit fault address through the 32 bit c6_data/c6_insn fields: it now goes via the always-64-bit exception.vaddress. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
2014-04-17target-arm: Implement AArch64 DAIF system registerPeter Maydell2-1/+21
Implement the DAIF system register which is a view of the DAIF bits in PSTATE. To avoid needing a readfn, we widen the daif field in CPUARMState to uint64_t. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
2014-04-17target-arm: Split out private-to-target functions into internals.hPeter Maydell8-20/+55
Currently cpu.h defines a mixture of functions and types needed by the rest of QEMU and those needed only by files within target-arm/. Split the latter out into a new header so they aren't needlessly exposed further than required. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
2014-04-17Merge remote-tracking branch 'remotes/rth/tcg-aarch-6-5' into stagingPeter Maydell3-558/+628
* remotes/rth/tcg-aarch-6-5: (25 commits) tcg-aarch64: Use tcg_out_mov in preference to tcg_out_movr tcg-aarch64: Prefer unsigned offsets before signed offsets for ldst tcg-aarch64: Introduce tcg_out_insn_3312, _3310, _3313 tcg-aarch64: Merge aarch64_ldst_get_data/type into tcg_out_op tcg-aarch64: Introduce tcg_out_insn_3507 tcg-aarch64: Support stores of zero tcg-aarch64: Implement TCG_TARGET_HAS_new_ldst tcg-aarch64: Pass qemu_ld/st arguments directly tcg-aarch64: Use TCGMemOp in qemu_ld/st tcg-aarch64: Use ADR to pass the return address to the ld/st helpers tcg-aarch64: Use tcg_out_call for qemu_ld/st tcg-aarch64: Avoid add with zero in tlb load tcg-aarch64: Implement tcg_register_jit tcg-aarch64: Introduce tcg_out_insn_3314 tcg-aarch64: Reuse LR in translated code tcg-aarch64: Use CBZ and CBNZ tcg-aarch64: Create tcg_out_brcond tcg-aarch64: Use symbolic names for branches tcg-aarch64: Use adrp in tcg_out_movi tcg-aarch64: Special case small constants in tcg_out_movi ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-17Open 2.1 development treePeter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-17Update version for v2.0.0 releasev2.0.0Peter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-16tcg-aarch64: Use tcg_out_mov in preference to tcg_out_movrRichard Henderson1-9/+7
It's the more canonical interface. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Prefer unsigned offsets before signed offsets for ldstRichard Henderson1-5/+6
The assembler seems to prefer them, perhaps we should too. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Introduce tcg_out_insn_3312, _3310, _3313Richard Henderson1-87/+89
Replace aarch64_ldst_op_data with AArch64LdstType, as it wasn't encoded for the proper shift for the field and was confusing. Merge aarch64_ldst_op_data, AArch64LdstType, and a few stray opcode bits into a single I3312_* argument, eliminating some magic numbers from the helper functions. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Merge aarch64_ldst_get_data/type into tcg_out_opRichard Henderson1-83/+32
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Introduce tcg_out_insn_3507Richard Henderson1-24/+33
Cleaning up the implementation of REV and REV16 at the same time. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Support stores of zeroRichard Henderson1-16/+19
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Implement TCG_TARGET_HAS_new_ldstRichard Henderson2-60/+31
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Pass qemu_ld/st arguments directlyRichard Henderson1-32/+17
Instead of passing them the "args" array. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Use TCGMemOp in qemu_ld/stRichard Henderson1-68/+63
Making the bswap conditional on the memop instead of a compile-time test. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Use ADR to pass the return address to the ld/st helpersRichard Henderson1-2/+9
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Use tcg_out_call for qemu_ld/stRichard Henderson1-4/+2
In some cases, a direct branch will be in range. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Avoid add with zero in tlb loadRichard Henderson1-9/+19
Some guest env are small enough to reach the tlb with only a 12-bit addition. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Implement tcg_register_jitRichard Henderson1-15/+69
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Introduce tcg_out_insn_3314Richard Henderson1-67/+33
Combines 4 other inline functions and tidies the prologue. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Reuse LR in translated codeRichard Henderson2-33/+33
It's obviously call-clobbered, but is otherwise unused. Repurpose it as the TCG temporary. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Use CBZ and CBNZRichard Henderson1-2/+24
A compare and branch against zero happens at the start of every single TB. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Create tcg_out_brcondRichard Henderson1-20/+14
Rearrange code to put the compare and branch in the same place. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Use symbolic names for branchesRichard Henderson1-31/+43
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Use adrp in tcg_out_moviRichard Henderson1-0/+23
Loading an qemu pointer as an immediate happens often. E.g. - exit_tb $0x7fa8140013 + exit_tb $0x7f81ee0013 ... - : d2800260 mov x0, #0x13 - : f2b50280 movk x0, #0xa814, lsl #16 - : f2c00fe0 movk x0, #0x7f, lsl #32 + : 90ff1000 adrp x0, 0x7f81ee0000 + : 91004c00 add x0, x0, #0x13 Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Special case small constants in tcg_out_moviRichard Henderson1-0/+10
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Use ORRI in tcg_out_moviRichard Henderson1-31/+39
The subset of logical immediates that we support is quite quick to test, and such constants are quite common to want to load. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Use MOVN in tcg_out_moviRichard Henderson1-13/+50
When profitable, initialize the register with MOVN instead of MOVZ, before setting the remaining lanes with MOVK. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Use TCGType and TCGMemOp constantsRichard Henderson1-35/+38
Rather than raw constants that could mean anything. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Use intptr_t apropriatelyRichard Henderson1-5/+5
As opposed to tcg_target_long. Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-16tcg-aarch64: Properly detect SIGSEGV writesRichard Henderson1-6/+19
Since the kernel doesn't pass any info on the reason for the fault, disassemble the instruction to detect a store. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-04-14Update version for v2.0.0-rc3 releasev2.0.0-rc3Peter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14Revert "fix return check for KVM_GET_DIRTY_LOG ioctl"Michael Tokarev1-1/+1
This reverts commit b533f658a98325d0e47b36113bd9f5bcc046fdae. The original code was wrong, because effectively it ignored errors from kernel, because kernel does not return -1 on error case but returns -errno, and does not return -EPERM for this particular ioctl. But in some cases kernel actually returned unsuccessful result, namely, when the dirty bitmap in requested slot does not exist it returns -ENOENT. With new code this condition becomes an error when it shouldn't be. Revert that patch instead of fixing it properly this late in the release process. I disagree with this approach, but let's make things move _somewhere_, instead of arguing endlessly whch of the 2 proposed fixes is better. Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Message-id: 1397477644-902-1-git-send-email-mjt@msgid.tls.msk.ru Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell2-1/+1
acpi: SSDT update This has a fix by Igor for a regression introduced by bridge hotplug code. Expected test files were updated accordingly. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon 14 Apr 2014 13:13:35 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: acpi-test: update expected files acpi: fix incorrect encoding for 0x{F-1}FFFF Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14ide: Correct improper smart self test counter reset in ide core.Benoît Canet1-1/+1
The SMART self test counter was incorrectly being reset to zero, not 1. This had the effect that on every 21st SMART EXECUTE OFFLINE: * We would write off the beginning of a dynamically allocated buffer * We forgot the SMART history Fix this. Signed-off-by: Benoit Canet <benoit@irqsave.net> Message-id: 1397336390-24664-1-git-send-email-benoit.canet@irqsave.net Reviewed-by: Markus Armbruster <armbru@redhat.com> Cc: qemu-stable@nongnu.org Acked-by: Kevin Wolf <kwolf@redhat.com> [PMM: tweaked commit message as per suggestions from Markus] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14acpi-test: update expected filesMichael S. Tsirkin1-0/+0
commit 58b035c7354afc0c5351ea62264c01d74196ec26 acpi: fix incorrect encoding for 0x{F-1}FFFF changes the SSDT, update expected files accordingly. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-04-14acpi: fix incorrect encoding for 0x{F-1}FFFFIgor Mammedov1-1/+1
Fix typo in build_append_int() which causes integer truncation when it's in range 0x{F-1}FFFF by packing it as WordConst instead of required DWordConst. In partucular this fixes a regression: hotplug in slots 16,17,18 and 19 didn't work, since SSDT had code like this: If (And (Arg0, 0x0000)) { Notify (S80, Arg1) } Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Weil <sw@weilnetz.de>
2014-04-14configure: Make stack-protector test check both compile and linkPeter Maydell1-1/+4
Since we use the -fstack-protector argument at both compile and link time in the build, we must check that it works with both a compile and a link: * MacOSX only fails in the compile step, not linking * some gcc cross environments only fail at the link stage (if they require a libssp and it's not present for some reason) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1397232832-32301-1-git-send-email-peter.maydell@linaro.org Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2014-04-14vmxnet3: validate queues configuration read on migrationDmitry Fleytman1-0/+1
CVE-2013-4544 Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1396604722-11902-5-git-send-email-dmitry@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14vmxnet3: validate interrupt indices read on migrationDmitry Fleytman1-0/+2
CVE-2013-4544 Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1396604722-11902-4-git-send-email-dmitry@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14vmxnet3: validate queues configuration coming from guestDmitry Fleytman1-1/+18
CVE-2013-4544 Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1396604722-11902-3-git-send-email-dmitry@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-14vmxnet3: validate interrupt indices coming from guestDmitry Fleytman1-2/+34
CVE-2013-4544 Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1396604722-11902-2-git-send-email-dmitry@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-11qom: Fix crash with qom-list and link propertiesCole Robinson1-1/+2
Commit 9561fda8d90e176bef598ba87c42a1bd6ad03ef7 changed the type of 'opaque' for link properties, but missed updating this call site. Reproducer: ./x86_64-softmmu/qemu-system-x86_64 -qmp unix:./qmp.sock,server & ./scripts/qmp/qmp-shell ./qmp.sock (QEMU) qom-list path=//machine/i440fx/pci.0/child[2] Reported-by: Marcin Gibuła <m.gibula@beyond.pl> Signed-off-by: Cole Robinson <crobinso@redhat.com> Message-id: 2f8f007ce2152ac3b65f0811199662799c509225.1397155389.git.crobinso@redhat.com Acked-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-11virtio-net: fix guest-triggerable buffer overrunMichael S. Tsirkin1-1/+1
When VM guest programs multicast addresses for a virtio net card, it supplies a 32 bit entries counter for the number of addresses. These addresses are read into tail portion of a fixed macs array which has size MAC_TABLE_ENTRIES, at offset equal to in_use. To avoid overflow of this array by guest, qemu attempts to test the size as follows: - if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) { however, as mac_data.entries is uint32_t, this sum can overflow, e.g. if in_use is 1 and mac_data.entries is 0xffffffff then in_use + mac_data.entries will be 0. Qemu will then read guest supplied buffer into this memory, overflowing buffer on heap. CVE-2014-0150 Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1397218574-25058-1-git-send-email-mst@redhat.com Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-11Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell5-8/+29
Block patches for 2.0.0-rc3 # gpg: Signature made Fri 11 Apr 2014 13:37:34 BST using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: block-commit: speed is an optional parameter iscsi: Remember to set ret for iscsi_open in error case bochs: Fix catalog size check bochs: Fix memory leak in bochs_open() error path Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-11Merge remote-tracking branch 'remotes/kraxel/tags/pull-sdl-1' into stagingPeter Maydell1-8/+13
sdl2 relative mouse mode fixes. # gpg: Signature made Fri 11 Apr 2014 11:36:46 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-sdl-1: input: sdl2: Fix relative mode to match SDL1 behavior input: sdl2: Fix guest_cursor logic Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-11block-commit: speed is an optional parameterMax Reitz1-0/+4
As speed is an optional parameter for the QMP block-commit command, it should be set to 0 if not given (as it is undefined if has_speed is false), that is, the speed should not be limited. Cc: qemu-stable@nongnu.org Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-04-11iscsi: Remember to set ret for iscsi_open in error caseFam Zheng1-0/+1
Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-04-11bochs: Fix catalog size checkKevin Wolf3-6/+20
The old check was off by a factor of 512 and didn't consider cases where we don't get an exact division. This could lead to an out-of-bounds array access in seek_to_sector(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
generated by cgit v1.1 at 2025-02-16 05:27:08 +0000