aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2021-04-30target/arm: Remove log2_esize parameter to gen_mte_checkNRichard Henderson3-11/+10
The log2_esize parameter is not used except trivially. Drop the parameter and the deferral to gen_mte_check1. This fixes a bug in that the parameters as documented in the header file were the reverse from those in the implementation. Which meant that translate-sve.c was passing the parameters in the wrong order. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416183106.1516563-10-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-30target/arm: Simplify sve mte checkingRichard Henderson1-58/+26
Now that mte_check1 and mte_checkN have been merged, we can merge sve_cont_ldst_mte_check1 and sve_cont_ldst_mte_checkN. Which means that we can eliminate the function pointer into sve_ldN_r and sve_stN_r, calling sve_cont_ldst_mte_check directly. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416183106.1516563-9-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-30target/arm: Rename mte_probe1 to mte_probeRichard Henderson3-7/+7
For consistency with the mte_check1 + mte_checkN merge to mte_check, rename the probe function as well. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416183106.1516563-8-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-30target/arm: Merge mte_check1, mte_checkNRichard Henderson5-38/+14
The mte_check1 and mte_checkN functions are now identical. Drop mte_check1 and rename mte_checkN to mte_check. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416183106.1516563-7-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-30target/arm: Replace MTEDESC ESIZE+TSIZE with SIZEM1Richard Henderson4-18/+14
After recent changes, mte_checkN does not use ESIZE, and mte_check1 never used TSIZE. We can combine the two into a single field: SIZEM1. Choose to pass size - 1 because size == 0 is never used, our immediate need in mte_probe_int is for the address of the last byte (ptr + size - 1), and since almost all operations are powers of 2, this makes the immediate constant one bit smaller. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416183106.1516563-6-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-30test/tcg/aarch64: Add mte-5Richard Henderson2-1/+45
Buglink: https://bugs.launchpad.net/bugs/1921948 Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416183106.1516563-5-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-30target/arm: Fix unaligned checks for mte_check1, mte_probe1Richard Henderson1-74/+35
We were incorrectly assuming that only the first byte of an MTE access is checked against the tags. But per the ARM, unaligned accesses are pre-decomposed into single-byte accesses. So by the time we reach the actual MTE check in the ARM pseudocode, all accesses are aligned. We cannot tell a priori whether or not a given scalar access is aligned, therefore we must at least check. Use mte_probe_int, which is already set up for checking multiple granules. Buglink: https://bugs.launchpad.net/bugs/1921948 Tested-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416183106.1516563-4-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-30target/arm: Split out mte_probe_intRichard Henderson1-12/+40
Split out a helper function from mte_checkN to perform all of the checking and address manpulation. So far, just use this in mte_checkN itself. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416183106.1516563-3-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-30target/arm: Fix mte_checkNRichard Henderson1-22/+18
We were incorrectly assuming that only the first byte of an MTE access is checked against the tags. But per the ARM, unaligned accesses are pre-decomposed into single-byte accesses. So by the time we reach the actual MTE check in the ARM pseudocode, all accesses are aligned. Therefore, the first failure is always either the first byte of the access, or the first byte of the granule. In addition, some of the arithmetic is off for last-first -> count. This does not become directly visible until a later patch that passes single bytes into this function, so ptr == ptr_last. Buglink: https://bugs.launchpad.net/bugs/1921948 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416183106.1516563-2-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: tweaked a comment] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-30target/arm: Make Thumb store insns UNDEF for Rn==1111Peter Maydell1-0/+16
The Arm ARM specifies that for Thumb encodings of the various plain store insns, if the Rn field is 1111 then we must UNDEF. This is different from the Arm encodings, where this case is either UNPREDICTABLE or has well-defined behaviour. The exclusive stores, store-release and STRD do not have this UNDEF case for any encoding. Enforce the UNDEF for this case in the Thumb plain store insns. Fixes: https://bugs.launchpad.net/qemu/+bug/1922887 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210408162402.5822-1-peter.maydell@linaro.org
2021-04-30hw/arm/smmuv3: Support 16K translation granuleKunkun Jiang1-2/+4
The driver can query some bits in SMMUv3 IDR5 to learn which translation granules are supported. Arm recommends that SMMUv3 implementations support at least 4K and 64K granules. But in the vSMMUv3, there seems to be no reason not to support 16K translation granule. In addition, if 16K is not supported, vSVA will failed to be enabled in the future for 16K guest kernel. So it'd better to support it. Signed-off-by: Kunkun Jiang <jiangkunkun@huawei.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-30Open 6.1 development treePeter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-29Update version for v6.0.0 releasev6.0.0Peter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-26Update version for v6.0.0-rc5 releasev6.0.0-rc5Peter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-26hw/block/nvme: fix invalid msix exclusive uninitKlaus Jensen1-1/+2
Commit 1901b4967c3f changed the nvme device from using a bar exclusive for MSI-x to sharing it on bar0. Unfortunately, the msix_uninit_exclusive_bar() call remains in nvme_exit() which causes havoc when the device is removed with, say, device_del. Fix this. Additionally, a subregion is added but it is not removed on exit which causes a reference to linger and the drive to never be unlocked. Fixes: 1901b4967c3f ("hw/block/nvme: move msix table and pba to BAR 0") Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-23target/s390x: fix s390_probe_access to check PAGE_WRITE_ORG for writeabilityAlex Bennée1-1/+1
We can remove PAGE_WRITE when (internally) marking a page read-only because it contains translated code. This can get confused when we are executing signal return code on signal stacks. Fixes: e56552cf07 ("target/s390x: Implement the MVPG condition-code-option bit") Found-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Message-id: 20210422154427.13038-1-alex.bennee@linaro.org Cc: Cornelia Huck <cohuck@redhat.com> Cc: Thomas Huth <thuth@redhat.com> Cc: David Hildenbrand <david@redhat.com> Cc: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-23net: check the existence of peer before trying to padJason Wang4-3/+8
There could be case that peer is NULL. This can happen when during network device hot-add where net device needs to be added first. So the patch check the existence of peer before trying to do the pad. Fixes: 969e50b61a285 ("net: Pad short frames to minimum size before sending from SLiRP/TAP") Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Stefan Weil <sw@weilnetz.de> Message-id: 20210423031803.1479-1-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-20Update version for v6.0.0-rc4 releasev6.0.0-rc4Peter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-20qga: fix guest-get-disks regressionMarc-André Lureau1-0/+1
Commit 54aa3de72 ("qapi: Use QAPI_LIST_PREPEND() where possible") inadvertently removed the has_dependencies from the partition disk info, resulting in empty list being returned. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1950833 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20210420125831.233092-1-marcandre.lureau@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-20target/mips/rel6_translate: Change license to GNU LGPL v2.1 (or later)Philippe Mathieu-Daudé1-5/+4
When adding this file and its new content in commit 3f7a927847a ("target/mips: LSA/DLSA R6 decodetree helpers") I did 2 mistakes: 1: Listed authors who haven't been involved in its development, 2: Used an incorrect GNU GPLv2 license text (using 'and' instead of 'or'). Instead of correcting the GNU GPLv2 license text, replace the license by the 'GNU LGPL v2.1 or later' one, to be coherent with the other translation files in the target/mips/ folder. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210420100633.1752440-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-20migration: Deprecate redundant query-migrate result @blockedMarkus Armbruster1-2/+7
Result @blocked is true when and only when result @blocked-reasons is present. It's always non-empty when present. @blocked is redundant. It was introduced in commit 3af8554bd0 "migration: Add blocker information", and has not been released. This gives us a chance to fix the interface with minimal fuss. Unfortunately, we're already too close to the release to risk dropping it. Deprecate it instead. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20210420051907.891470-1-armbru@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-19mptsas: Remove unused MPTSASState 'pending' field (CVE-2021-3392)Michael Tokarev2-7/+0
While processing SCSI i/o requests in mptsas_process_scsi_io_request(), the Megaraid emulator appends new MPTSASRequest object 'req' to the 's->pending' queue. In case of an error, this same object gets dequeued in mptsas_free_request() only if SCSIRequest object 'req->sreq' is initialised. This may lead to a use-after-free issue. Since s->pending is actually not used, simply remove it from MPTSASState. Cc: qemu-stable@nongnu.org Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> Message-id: 20210419134247.1467982-1-f4bug@amsat.org Message-Id: <20210416102243.1293871-1-mjt@msgid.tls.msk.ru> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392) Fixes: e351b826112 ("hw: Add support for LSI SAS1068 (mptsas) device") [PMD: Reworded description, added more tags] Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17Merge remote-tracking branch ↵Peter Maydell7-22/+57
'remotes/pmaydell/tags/pull-target-arm-20210417' into staging Fixes for rc4: * Fix compile failures of C++ files with new glib headers * mps3-an547: Use correct Cortex-M55 CPU and don't disable its FPU * accel/tcg: Fix assertion failure executing from non-RAM with -icount # gpg: Signature made Sat 17 Apr 2021 20:39:58 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210417: accel/tcg: avoid re-translating one-shot instructions target/arm: drop CF_LAST_IO/dc->condjump check hw/arm/armsse: Make SSE-300 use Cortex-M55 hw/arm/armsse: Give SSE-300 its own Property array include/qemu/osdep.h: Move system includes to top osdep: protect qemu/osdep.h with extern "C" osdep: include glib-compat.h before other QEMU headers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17accel/tcg: avoid re-translating one-shot instructionsAlex Bennée1-1/+1
By definition a single instruction is capable of being an IO instruction. This avoids a problem of triggering a cpu_io_recompile on a non-recorded translation which then fails because it expects tcg_tb_lookup() to succeed unconditionally. The normal use case requires a TB to be able to resolve machine state. The other users of tcg_tb_lookup() are able to tolerate a missing TB if the machine state has been resolved by other means - which in the single-shot case is always true because machine state is synced at the start of a block. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210415162454.22056-1-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17target/arm: drop CF_LAST_IO/dc->condjump checkAlex Bennée1-5/+0
This is a left over erroneous check from the days front-ends handled io start/end themselves. Regardless just because IO could be performed on the last instruction doesn't obligate the front end to do so. This fixes an abort faced by the aspeed execute-in-place support which will necessarily trigger this state (even before the one-shot CF_LAST_IO fix). The test still seems to hang once it attempts to boot the Linux kernel but I suspect this is an unrelated issue with icount and the timer handling code. The original intention of the cpu_abort (added in commit 2e70f6efa8b9 when the icount stuff was first added) seems to have been to act as an assert() to catch an unhandled corner case where the generated code would be something like: conditional branch to condlabel if its cc failed implementation of the insn (a conditional branch or trap) code emitted by gen_io_end() condlabel: gen_goto_tb or equivalent thing to go to next insn At runtime the cc-failed case would skip over the code emitted by gen_io_end(), leaving the can_do_io flag incorrectly set. In commit ba3e7926691ed33 we switched to an implementation which always clears can_do_io at the start of the following TB instead of trying to clear it at the end of a TB that did IO. So the corner case that this cpu_abort() was trying to flag is no longer possible, because the gen_io_end() call has been deleted. We can therefore safely remove the no-longer-valid assertion. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210416170207.12504-1-alex.bennee@linaro.org Cc: Cédric Le Goater <clg@kaod.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17hw/arm/armsse: Make SSE-300 use Cortex-M55Peter Maydell1-2/+5
The SSE-300 has a Cortex-M55 (which was the whole reason for us modelling it), but we forgot to actually update the code to let it have a different CPU type from the IoTKit and SSE-200. Add CPU type as a field for ARMSSEInfo instead of hardcoding it to always use a Cortex-M33. Buglink: https://bugs.launchpad.net/qemu/+bug/1923861 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416104010.13228-1-peter.maydell@linaro.org
2021-04-17hw/arm/armsse: Give SSE-300 its own Property arrayPeter Maydell1-3/+14
SSE-300 currently shares the SSE-200 Property array. This is bad principally because the default values of the CPU0_FPU and CPU0_DSP properties disable the FPU and DSP on the CPU. That is correct for the SSE-200 but not the SSE-300. Give the SSE-300 its own Property array with the correct SSE-300 specific settings: * SSE-300 has only one CPU, so no CPU1* properties * SSE-300 CPU has FPU and DSP Buglink: https://bugs.launchpad.net/qemu/+bug/1923861 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210415182353.8173-1-peter.maydell@linaro.org
2021-04-17include/qemu/osdep.h: Move system includes to topPeter Maydell1-7/+13
Mostly osdep.h puts the system includes at the top of the file; but there are a couple of exceptions where we include a system header halfway through the file. Move these up to the top with the rest so that all the system headers we include are included before we include os-win32.h or os-posix.h. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416135543.20382-4-peter.maydell@linaro.org Message-id: 20210414184343.26235-1-peter.maydell@linaro.org
2021-04-17osdep: protect qemu/osdep.h with extern "C"Paolo Bonzini4-3/+17
System headers may include templates if compiled with a C++ compiler, which cause the compiler to complain if qemu/osdep.h is included within a C++ source file's 'extern "C"' block. Add an 'extern "C"' block directly to qemu/osdep.h, so that system headers can be kept out of it. There is a stray declaration early in qemu/osdep.h, which needs to be special cased. Add a definition in qemu/compiler.h to make it look nice. config-host.h, CONFIG_TARGET, exec/poison.h and qemu/compiler.h are included outside the 'extern "C"' block; that is not an issue because they consist entirely of preprocessor directives. This allows us to move the include of osdep.h in our two C++ source files outside the extern "C" block they were previously using for it, which in turn means that they compile successfully against newer versions of glib which insist that glib.h is *not* inside an extern "C" block. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416135543.20382-3-peter.maydell@linaro.org [PMM: Moved disas/arm-a64.cc osdep.h include out of its extern "C" block; explained in commit message why we're doing this] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17osdep: include glib-compat.h before other QEMU headersPaolo Bonzini1-1/+7
glib-compat.h is sort of like a system header, and it needs to include system headers (glib.h) that may dislike being included under 'extern "C"'. Move it right after all system headers and before all other QEMU headers. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416135543.20382-2-peter.maydell@linaro.org [PMM: Added comment about why glib-compat.h is special] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-14Update version for v6.0.0-rc3 releasev6.0.0-rc3Peter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-14qapi/qom.json: Do not use CONFIG_VIRTIO_CRYPTO in common codeThomas Huth1-2/+2
The ObjectType enum and ObjectOptions are included from qapi-types-qom.h into common code. We should not use target-specific config switches like CONFIG_VIRTIO_CRYPTO here, since this is not defined in common code and thus the enum will look differently between common and target specific code. For this case, it's hopefully enough to check for CONFIG_VHOST_CRYPTO only (which is a host specific config switch, i.e. it's the same on all targets). Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210412160710.639800-1-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13Merge remote-tracking branch ↵Peter Maydell1-4/+16
'remotes/dgilbert-gitlab/tags/pull-virtiofs-20210413' into staging virtiofs: Fix feature negotiation (for 6.0) A 6.0 fix for feature negotiation on vhost-user. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> # gpg: Signature made Tue 13 Apr 2021 16:21:41 BST # gpg: using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full] # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert-gitlab/tags/pull-virtiofs-20210413: vhost-user-fs: fix features handling Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2021-04-13' ↵Peter Maydell1-0/+11
into staging Block patches for 6.0-rc3: - Use-after-free fix for block/nbd.c # gpg: Signature made Tue 13 Apr 2021 14:35:48 BST # gpg: using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40 # gpg: issuer "mreitz@redhat.com" # gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full] # Primary key fingerprint: 91BE B60A 30DB 3E88 57D1 1829 F407 DB00 61D5 CF40 * remotes/maxreitz/tags/pull-block-2021-04-13: block/nbd: fix possible use after free of s->connect_thread Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13Merge remote-tracking branch ↵Peter Maydell2-4/+10
'remotes/pmaydell/tags/pull-target-arm-20210413' into staging target-arm queue: * Fix MPC setting for AN524 SRAM block * sphinx: qapidoc: Wrap "If" section body in a paragraph node # gpg: Signature made Tue 13 Apr 2021 13:07:12 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210413: sphinx: qapidoc: Wrap "If" section body in a paragraph node hw/arm/mps2-tz: Assert if more than one RAM is attached to an MPC hw/arm/mps2-tz: Fix MPC setting for AN524 SRAM block Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13vhost-user-fs: fix features handlingAnton Kuchin1-4/+16
Make virtio-fs take into account server capabilities. Just returning requested features assumes they all of then are implemented by server and results in setting unsupported configuration if some of them are absent. Signed-off-by: Anton Kuchin <antonkuchin@yandex-team.ru> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> With changes suggested by Stefan Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-04-13block/nbd: fix possible use after free of s->connect_threadVladimir Sementsov-Ogievskiy1-0/+11
If on nbd_close() we detach the thread (in nbd_co_establish_connection_cancel() thr->state becomes CONNECT_THREAD_RUNNING_DETACHED), after that point we should not use s->connect_thread (which is set to NULL), as running thread may free it at any time. Still nbd_co_establish_connection() does exactly this: it saves s->connect_thread to local variable (just for better code style) and use it even after yield point, when thread may be already detached. Fix that. Also check thr to be non-NULL on nbd_co_establish_connection() start for safety. After this patch "case CONNECT_THREAD_RUNNING_DETACHED" becomes impossible in the second switch in nbd_co_establish_connection(). Still, don't add extra abort() just before the release. If it somehow possible to reach this "case:" it won't hurt. Anyway, good refactoring of all this reconnect mess will come soon. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20210406155114.1057355-1-vsementsov@virtuozzo.com> Reviewed-by: Roman Kagan <rvkagan@yandex-team.ru> Signed-off-by: Max Reitz <mreitz@redhat.com>
2021-04-13Merge remote-tracking branch 'remotes/philmd/tags/mips-20210413' into stagingPeter Maydell3-1/+17
MIPS patches queue - Fix invalid Kconfig dependency - Fix missing migrated value - Fix TCG temporary leak # gpg: Signature made Tue 13 Apr 2021 11:10:11 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/mips-20210413: target/mips: Fix TCG temporary leak in gen_cache_operation() hw/isa/piix4: Migrate Reset Control Register hw/isa/Kconfig: Add missing dependency VIA VT82C686 -> APM Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.0-20210412' ↵Peter Maydell5-83/+10
into staging ppc patch queue for 2021-04-21 Here's what I hope is the last ppc related pull request for qemu-6.0. The 2 patches here revert a behavioural change that after further discussion we concluded was a bad idea (adding a timeout for possibly-failed hot unplug requests). Instead it implements a different approach to the original problem: we again let unplug requests the guest doesn't respond to remain pending indefinitely, but no longer allow those to block attempts to retry the same unplug again. The change is a bit more complex than I'd like for this late in the freeze. Nonetheless, I think it's important to merge this for 6.0, so we don't allow a release which has the probably-a-bad-idea timeout behaviour. # gpg: Signature made Mon 12 Apr 2021 06:25:58 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dg-gitlab/tags/ppc-for-6.0-20210412: spapr.c: always pulse guest IRQ in spapr_core_unplug_request() spapr: rollback 'unplug timeout' for CPU hotunplugs Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13target/mips: Fix TCG temporary leak in gen_cache_operation()Philippe Mathieu-Daudé1-0/+2
Fix a TCG temporary leak when translating CACHE opcode. Fixes: 0d74a222c27 ("make ITC Configuration Tags accessible to the CPU") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210406202857.1440744-1-f4bug@amsat.org>
2021-04-13hw/isa/piix4: Migrate Reset Control RegisterPhilippe Mathieu-Daudé1-1/+14
When adding the Reset register in commit 5790b757cfb we forgot to migrate it. While it is possible a VM using the PIIX4 is migrated just after requesting a system shutdown, it is very unlikely. However when restoring a migrated VM, we might have the RCR bit #4 set on the stack and when the VM resume it directly shutdowns. Add a post_load() migration handler and set the default RCR value to 0 for earlier versions, assuming the VM was not going to shutdown before migration. Fixes: 5790b757cfb ("piix4: Add the Reset Control Register") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20210324200334.729899-1-f4bug@amsat.org>
2021-04-13hw/isa/Kconfig: Add missing dependency VIA VT82C686 -> APMPhilippe Mathieu-Daudé1-0/+1
TYPE_VIA_PM calls apm_init() in via_pm_realize(), so requires APM to be selected. Reported-by: BALATON Zoltan <balaton@eik.bme.hu> Fixes: dd0ff8191ab ("isa: express SuperIO dependencies with Kconfig") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210302080531.913802-1-f4bug@amsat.org>
2021-04-13Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-20210412' ↵Peter Maydell6-55/+293
into staging qemu-sparc queue # gpg: Signature made Mon 12 Apr 2021 23:13:12 BST # gpg: using RSA key CC621AB98E82200D915CC9C45BC2C56FAE0F321F # gpg: issuer "mark.cave-ayland@ilande.co.uk" # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" [full] # Primary key fingerprint: CC62 1AB9 8E82 200D 915C C9C4 5BC2 C56F AE0F 321F * remotes/mcayland/tags/qemu-sparc-20210412: tests/qtest: add tests for am53c974 device esp: ensure that do_cmd is set to zero before submitting an ESP select command esp: don't reset async_len directly in esp_select() if cancelling request esp: don't overflow cmdfifo if TC is larger than the cmdfifo size esp: don't overflow cmdfifo in get_cmd() esp: don't underflow cmdfifo in do_cmd() esp: ensure cmdfifo is not empty and current_dev is non-NULL esp: introduce esp_fifo_pop_buf() and use it instead of fifo8_pop_buf() esp: consolidate esp_cmdfifo_pop() into esp_fifo_pop() esp: consolidate esp_cmdfifo_push() into esp_fifo_push() esp: rework write_response() to avoid using the FIFO for DMA transactions esp: always check current_req is not NULL before use in DMA callbacks esp: fix setting of ESPState mig_version_id when launching QEMU with -S option Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13sphinx: qapidoc: Wrap "If" section body in a paragraph nodeJohn Snow1-1/+3
These sections need to be wrapped in a block-level element, such as Paragraph in order for them to be rendered into Texinfo correctly. Before (e.g.): <section ids="qapidoc-713"> <title>If</title> <literal>defined(CONFIG_REPLICATION)</literal> </section> became: .SS If \fBdefined(CONFIG_REPLICATION)\fP.SS \fBBlockdevOptionsReplication\fP (Object) ... After: <section ids="qapidoc-713"> <title>If</title> <paragraph> <literal>defined(CONFIG_REPLICATION)</literal> </paragraph> </section> becomes: .SS If .sp \fBdefined(CONFIG_REPLICATION)\fP .SS \fBBlockdevOptionsReplication\fP (Object) ... Reported-by: Markus Armbruster <armbru@redhat.com> Tested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210406141909.1992225-2-jsnow@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-12tests/qtest: add tests for am53c974 deviceMark Cave-Ayland3-0/+220
Use the autogenerated fuzzer test cases as the basis for a set of am53c974 regression tests. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-13-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: ensure that do_cmd is set to zero before submitting an ESP select commandMark Cave-Ayland1-0/+2
When a CDB has been received and is about to be submitted to the SCSI layer via one of the ESP select commands, ensure that do_cmd is set to zero before executing the command. Otherwise a guest executing 2 valid CDBs in quick sequence can invoke the SCSI .transfer_data callback again before do_cmd is set to zero by the callback function triggering an assert at the start of esp_transfer_data(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-12-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't reset async_len directly in esp_select() if cancelling requestMark Cave-Ayland1-1/+1
Instead let the SCSI layer invoke the .cancel callback itself to cancel and reset the request state. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-11-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't overflow cmdfifo if TC is larger than the cmdfifo sizeMark Cave-Ayland1-0/+1
If a guest transfers the message out/command phase data using DMA with a TC that is larger than the cmdfifo size then the cmdfifo overflows triggering an assert. Limit the size of the transfer to the free space available in cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1919036 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-10-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't overflow cmdfifo in get_cmd()Mark Cave-Ayland1-0/+2
If the guest tries to read a CDB using DMA and cmdfifo is not empty then it is possible to overflow cmdfifo. Since this can only occur by issuing deliberately incorrect instruction sequences, ensure that the maximum length of the CDB transferred to cmdfifo is limited to the available free space within cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-9-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't underflow cmdfifo in do_cmd()Mark Cave-Ayland1-2/+4
If the guest tries to execute a CDB when cmdfifo is not empty before the start of the message out phase then clearing the message out phase data will cause cmdfifo to underflow due to cmdfifo_cdb_offset being larger than the amount of data within. Since this can only occur by issuing deliberately incorrect instruction sequences, ensure that the maximum length of esp_fifo_pop_buf() is limited to the size of the data within cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-8-mark.cave-ayland@ilande.co.uk>
generated by cgit v1.1 at 2025-02-12 22:07:50 +0000