aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2023-03-21docs/system/arm/cpu-features.rst: Fix formattingPeter Maydell1-42/+34
The markup for the Arm CPU feature documentation is incorrect, and results in the HTML not rendering correctly -- the first line of each description is rendered in boldface as if it were part of the option name. Reformat to match the styling used in cpu-models-x86.rst.inc. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1479 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230316105808.1414003-1-peter.maydell@linaro.org Reviewed-by: Cornelia Huck <cohuck@redhat.com>
2023-03-21hw/usb/imx: Fix out of bounds access in imx_usbphy_read()Guenter Roeck1-2/+17
The i.MX USB Phy driver does not check register ranges, resulting in out of bounds accesses if an attempt is made to access non-existing PHY registers. Add range check and conditionally report bad accesses to fix the problem. While at it, also conditionally log attempted writes to non-existing or read-only registers. Reported-by: Qiang Liu <cyruscyliu@gmail.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Qiang Liu <cyruscyliu@gmail.com> Message-id: 20230316234926.208874-1-linux@roeck-us.net Link: https://gitlab.com/qemu-project/qemu/-/issues/1408 Fixes: 0701a5efa015 ("hw/usb: Add basic i.MX USB Phy support") Signed-off-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-21contrib/elf2dmp: add PE name check and Windows Server 2022 supportViktor Prutyanov2-2/+41
Since its inception elf2dmp has checked MZ signatures within an address space above IDT[0] interrupt vector and took first PE image found as Windows Kernel. But in Windows Server 2022 memory dump this address space range is full of invalid PE fragments and the tool must check that PE image is 'ntoskrnl.exe' actually. So, introduce additional validation by checking image name from Export Directory against 'ntoskrnl.exe'. Signed-off-by: Viktor Prutyanov <viktor@daynix.com> Tested-by: Yuri Benditovich <yuri.benditovich@daynix.com> Reviewed-by: Annie Li <annie.li@oracle.com> Message-id: 20230222211246.883679-4-viktor@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-21contrib/elf2dmp: move PE dir search to pe_get_data_dir_entryViktor Prutyanov1-29/+42
Move out PE directory search functionality to be reused not only for Debug Directory processing but for arbitrary PE directory. Signed-off-by: Viktor Prutyanov <viktor@daynix.com> Reviewed-by: Annie Li <annie.li@oracle.com> Message-id: 20230222211246.883679-3-viktor@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-21contrib/elf2dmp: fix code styleViktor Prutyanov3-53/+57
Originally elf2dmp were added with some code style issues, especially in pe.h header, and some were introduced by 2d0fc797faaa73fbc1d30f5f9e90407bf3dd93f0. Fix them now. Signed-off-by: Viktor Prutyanov <viktor@daynix.com> Reviewed-by: Annie Li <annie.li@oracle.com> Message-id: 20230222211246.883679-2-viktor@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-21hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settingsPeter Maydell1-2/+4
The cadence UART attempts to avoid allowing the guest to set invalid baud rate register values in the uart_write() function. However it does the "mask to the size of the register field" and "check for invalid values" in the wrong order, which means that a malicious guest can get a bogus value into the register by setting also some high bits in the value, and cause QEMU to crash by division-by-zero. Do the mask before the bounds check instead of afterwards. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com> Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Qiang Liu <cyruscyliu@gmail.com> Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org
2023-03-21target/arm: Add Neoverse-N1 registersChen Baozi1-0/+69
Add implementation defined registers for neoverse-n1 which would be accessed by TF-A. Since there is no DSU in Qemu, CPUCFR_EL1.SCU bit is set to 1 to avoid DSU registers definition. Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> Message-id: 20230313033936.585669-1-chenbaozi@phytium.com.cn Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-20Merge tag 'edk2-stable202302-20230320-pull-request' of ↵Peter Maydell19-533/+516
https://gitlab.com/kraxel/qemu into staging update edk2 to 202302 stable tag # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmQYKWwACgkQTLbY7tPo # cTinlA/9EVWaAyb7UV56My5Zbo41okXev8xmZV8R0G2xAbGaM22v/mPZaifA9Iqn # JG19Go4xzTmX12Ttg/Def30Bu2RcjHfHccYycUQ7brd40rS8Gc2QYZX4p9NltUda # dJOMB4e+7MKkavCrqfiHB6LWGMk27cT5puvMkmt65+/WsoBV1gcc0SmFK8tWIM3N # dZqGdPr9ml72+fv7Cf7crShGEfwV/d3LkJ30Zccq0mbS08QcLm1SbyIB2+SdCyrE # 35okXRJePACdh7rOWQgWrYAy1CTb54Vup7Fraq0a9NjfknKoQBxWt0w1L95d3p0d # i8j0Yl1G5rD+Ybqvz/KgDLVNpKddttpkD1CECfZynOioHvwXWODrcJCKF9xsXcRR # 9Lmeq090ottEbrYXln/clAjwNnF5ALNMEdvmOBZnFBG1H1bxTMI7VwWZEwRBQ5nu # qtJf11oxuF9Lsi8OzIFcWx0hHkUmIrjCvnyNrVdxoMVPHcXXz1yD8MVV8vgg4jcL # Fs/s9h62ymv0n3L0OYbgCfXgVWgomcgAkWfHcv+k8sEyzRa2v2wQ9zyVMnjelNkJ # i/YEn+dupaZ20a6cLoYGQGBOACJ3iHyd1wZ0XzwSYYMq50X/ESRXAo5XofCAhzuz # 5LQ3VgzQevFOuRwwqjnAwaZHt5M6Ysj0V28iYpMBJDsk+sMP5nM= # =7oxT # -----END PGP SIGNATURE----- # gpg: Signature made Mon 20 Mar 2023 09:37:48 GMT # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * tag 'edk2-stable202302-20230320-pull-request' of https://gitlab.com/kraxel/qemu: edk2: update firmware binaries edk2: replace build scripts edk2: update submodule to edk2-stable202302 acpi: disable tests/data/acpi updates bios-tables-test: use 128M numa nodes on aarch64 acpi: enable tests/data/acpi updates Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-20Merge tag 'pull-request-2023-03-20' of https://gitlab.com/thuth/qemu into ↵Peter Maydell65-2140/+2952
staging * Mark Nios II as orphan * Many s390x emulation fixes * Disable flaky complete_in_standby blockjob unit test * White space cleanups in various files # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmQYVEoRHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbWu/A//QdVG7wS66lhdkPPu/GN+eDNaNsTzPPZd # YwH0bpy2YoopInwa1ggZ1zPatmbSOVUcKjUfNYLcQzUBQnmeFtpuAF+4IGDhYfa+ # agkjWvmrCrIww4Wn+OLdLReW1+GtRlKZKu7xbYKkeLyqr9SHUD2lNUZ5RXj2t9Lw # BXkPDXkMFqfVDzHtAxyXL7Z7yk3UTnZKBjDxiwE3tZ4S+N4r7m/TvNHiopI2bTVg # JeDTxN40ylbOlBfOLC/qhlLUVnyBsDalIfKffIdLZ5Qn+FnKfZhkt9km4i7OL+ZX # 1wKnTh/J8OCYqHOyhJdZGT8QxZH79qDm12/nKXzIQkxtJoKuz6Fm5FY3ZJNrb+IJ # ybxSpAFBJB/8sUjbzl8ZjGxbZecIyEBKT518+oBoqjNcy3n8/m2BhBFr6f6F4cJC # kdTnRS0XYKGLbJLz0+VBARE7hoHNckYsup/DGscppyYKNA6rFXbq/MI3+oMGAnPw # Ua/+gXU/hwq8TPg97A7O0hS4TKSKMtdZFEDmAGzkejVHvm/3BvcYrVoKDljnUAQV # SaERp/Elefbt3EufkuZp77AwLU8RcEFscitEIACmLbmwm3aKpqS+R2u1EJ4ZcoFT # dHUBkokXW1/i+FtNRmjEKV9z398cNYXGEDLPfMnFbknHwbS53pqeQqqlvUidltGk # LWviyiqKihk= # =tYCc # -----END PGP SIGNATURE----- # gpg: Signature made Mon 20 Mar 2023 12:40:42 GMT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2023-03-20' of https://gitlab.com/thuth/qemu: (24 commits) replace TABs with spaces qemu/osdep: Switch position of "extern" and "G_NORETURN" tests/unit/test-blockjob: Disable complete_in_standby test target/s390x/tcg/mem_helper: Remove bad assert() statement tests/tcg/s390x: Test unaligned accesses target/s390x: Update do_unaligned_access() comment target/s390x: Handle STGRL to non-aligned addresses target/s390x: Handle STRL to non-aligned addresses target/s390x: Handle CLRL and CLGFRL with non-aligned addresses target/s390x: Handle CGRL and CLGRL with non-aligned addresses target/s390x: Handle CRL and CGFRL with non-aligned addresses target/s390x: Handle LLGFRL from non-aligned addresses target/s390x: Handle LRL and LGFRL from non-aligned addresses target/s390x: Handle LGRL from non-aligned addresses target/s390x: Handle EXECUTE of odd addresses target/s390x: Handle branching to odd addresses tests/tcg/s390x: Add ex-relative-long.c target/s390x: Fix EXECUTE of relative long instructions tests/tcg/s390x: Add rxsbg.c target/s390x: Fix R[NOX]SBG with T=1 ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-20replace TABs with spacesYeqi Fu32-2084/+2084
Bring the files in line with the QEMU coding style, with spaces for indentation. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/378 Signed-off-by: Yeqi Fu <fufuyqqqqqq@gmail.com> Message-Id: <20230315032649.57568-1-fufuyqqqqqq@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20qemu/osdep: Switch position of "extern" and "G_NORETURN"Bernhard Beschow1-1/+1
Fixes the Windows build under msys2 using GCC 12 which fails with the following error: [184/579] Compiling C++ object qga/vss-win32/qga-vss.dll.p/install.cpp.obj FAILED: qga/vss-win32/qga-vss.dll.p/install.cpp.obj "c++" "-m64" "-mcx16" "-Iqga/vss-win32/qga-vss.dll.p" "-Iqga/vss-win32" "-I../src/qga/vss-win32" "-I." "-Iqapi" "-Itrace" "-Iui" "-Iui/shader" "-IC:/msys64/mingw64/include/glib-2.0" "-IC:/msys64/mingw64/lib/glib-2.0/include" "-fdiagnostics-color=auto" "-Wall" "-Winvalid-pch" "-Wnon-virtual-dtor" "-Werror" "-std=gnu++11" "-g" "-iquote" "." "-iquote" "C:/msys64/home/shentey/Projects/qemu/src" "-iquote" "C:/msys64/home/shentey/Projects/qemu/src/include" "-iquote" "C:/msys64/home/shentey/Projects/qemu/src/tcg/i386" "-D__STDC_LIMIT_MACROS" "-D__STDC_CONSTANT_MACROS" "-D__STDC_FORMAT_MACROS" "-fno-pie" "-no-pie" "-D_GNU_SOURCE" "-D_FILE_OFFSET_BITS=64" "-D_LARGEFILE_SOURCE" "-fno-strict-aliasing" "-fno-common" "-fwrapv" "-Wundef" "-Wwrite-strings" "-Wtype-limits" "-Wformat-security" "-Wformat-y2k" "-Winit-self" "-Wignored-qualifiers" "-Wempty-body" "-Wendif-labels" "-Wexpansion-to-defined" "-Wimplicit-fallthrough=2" "-Wmissing-format-attribute" "-Wno-missing-include-dirs" "-Wno-shift-negative-value" "-Wno-psabi" "-fstack-protector-strong" "-Wno-unknown-pragmas" "-Wno-delete-non-virtual-dtor" "-Wno-non-virtual-dtor" -MD -MQ qga/vss-win32/qga-vss.dll.p/install.cpp.obj -MF "qga/vss-win32/qga-vss.dll.p/install.cpp.obj.d" -o qga/vss-win32/qga-vss.dll.p/install.cpp.obj "-c" ../src/qga/vss-win32/install.cpp In file included from C:/msys64/mingw64/lib/glib-2.0/include/glibconfig.h:9, from C:/msys64/mingw64/include/glib-2.0/glib/gtypes.h:34, from C:/msys64/mingw64/include/glib-2.0/glib/galloca.h:34, from C:/msys64/mingw64/include/glib-2.0/glib.h:32, from C:/msys64/home/shentey/Projects/qemu/src/include/glib-compat.h:32, from C:/msys64/home/shentey/Projects/qemu/src/include/qemu/osdep.h:144, from ../src/qga/vss-win32/install.cpp:13: C:/msys64/mingw64/include/glib-2.0/glib/gmacros.h:1075:21: error: standard attributes in middle of decl-specifiers 1075 | # define G_NORETURN [[noreturn]] | ^ C:/msys64/home/shentey/Projects/qemu/src/include/qemu/osdep.h:240:8: note: in expansion of macro 'G_NORETURN' 240 | extern G_NORETURN | ^~~~~~~~~~ C:/msys64/mingw64/include/glib-2.0/glib/gmacros.h:1075:21: note: standard attributes must precede the decl-specifiers to apply to the declaration, or follow them to apply to the type 1075 | # define G_NORETURN [[noreturn]] | ^ C:/msys64/home/shentey/Projects/qemu/src/include/qemu/osdep.h:240:8: note: in expansion of macro 'G_NORETURN' 240 | extern G_NORETURN | ^~~~~~~~~~ C:/msys64/mingw64/include/glib-2.0/glib/gmacros.h:1075:21: error: attribute ignored [-Werror=attributes] 1075 | # define G_NORETURN [[noreturn]] | ^ C:/msys64/home/shentey/Projects/qemu/src/include/qemu/osdep.h:240:8: note: in expansion of macro 'G_NORETURN' 240 | extern G_NORETURN | ^~~~~~~~~~ C:/msys64/mingw64/include/glib-2.0/glib/gmacros.h:1075:21: note: an attribute that appertains to a type-specifier is ignored 1075 | # define G_NORETURN [[noreturn]] | ^ C:/msys64/home/shentey/Projects/qemu/src/include/qemu/osdep.h:240:8: note: in expansion of macro 'G_NORETURN' 240 | extern G_NORETURN | ^~~~~~~~~~ cc1plus.exe: all warnings being treated as errors Apparently it also fixes the compilation with Clang 15 (see https://gitlab.com/qemu-project/qemu/-/issues/1541 ). Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1541 Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-Id: <20230318185931.181659-1-shentey@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20tests/unit/test-blockjob: Disable complete_in_standby testPeter Maydell1-1/+8
The blockjob/complete_in_standby test is flaky and fails intermittently in CI: 172/621 qemu:unit / test-blockjob ERROR 0.26s killed by signal 6 SIGABRT 11:03:46 MALLOC_PERTURB_=176 G_TEST_SRCDIR=/Users/pm215/src/qemu-for-merges/tests/unit G_TEST_BUILDDIR=/Users/pm215/src/qemu-for-merges/build/all/tests/unit /Users/pm215/src/qemu-for-merges/build/all/tests/unit/test-blockjob --tap -k ----------------------------------- output ----------------------------------- stdout: # random seed: R02S8c79d6e1c01ce0b25475b2210a253242 1..9 # Start of blockjob tests ok 1 /blockjob/ids stderr: Assertion failed: (job->status == JOB_STATUS_STANDBY), function test_complete_in_standby, file ../../tests/unit/test-blockjob.c, line 499. Seen on macOS/x86_64, FreeBSD 13/x86_64, msys2-64bit, eg: https://gitlab.com/qemu-project/qemu/-/jobs/3872508803 https://gitlab.com/qemu-project/qemu/-/jobs/3950667240 Disable this subtest until somebody has time to investigate. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20230317143534.1481947-1-peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x/tcg/mem_helper: Remove bad assert() statementThomas Huth1-1/+0
The "assert(!nonfault)" statement can be triggered by running the "mvpg" s390x kvm-unit-test with TCG. According to Richard: "... the assert looks backward. We should only arrive there if nonfault was true for the probe (otherwise the probe would have raised the exception directly). I would think we could just remove the assert." Fixes: 4049431478 ("target/s390x: Fix s390_probe_access for user-only") Suggested-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230317135737.597570-1-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20edk2: update firmware binariesGerd Hoffmann8-0/+0
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2023-03-20edk2: replace build scriptsGerd Hoffmann6-528/+511
Remove Makefile.edk2 and the edk2*.sh scripts and replace them with a python script (which already handles fedora rpm builds) and a config file for it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2023-03-20edk2: update submodule to edk2-stable202302Gerd Hoffmann2-2/+2
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-03-20acpi: disable tests/data/acpi updatesGerd Hoffmann1-1/+0
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2023-03-20bios-tables-test: use 128M numa nodes on aarch64Gerd Hoffmann3-3/+3
Recent edk2 versions don't boot with very small numa nodes. Bump the size from 64M to 128M. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2023-03-20acpi: enable tests/data/acpi updatesGerd Hoffmann1-0/+1
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2023-03-20tests/tcg/s390x: Test unaligned accessesIlya Leoshkevich17-3/+311
Add a number of small test that check whether accessing unaligned addresses in various ways leads to a specification exception. Run these test both in softmmu and user configurations; expect a PGM in one case and SIGILL in the other. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230316164428.275147-13-iii@linux.ibm.com> [thuth: Added -Wl,--build-id=none to LDFLAGS] Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Update do_unaligned_access() commentIlya Leoshkevich1-2/+2
Relative long instructions now depend on do_unaligned_access() too. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-12-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle STGRL to non-aligned addressesIlya Leoshkevich2-5/+6
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-11-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle STRL to non-aligned addressesIlya Leoshkevich2-7/+8
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-10-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle CLRL and CLGFRL with non-aligned addressesIlya Leoshkevich1-1/+2
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-9-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle CGRL and CLGRL with non-aligned addressesIlya Leoshkevich1-1/+2
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-8-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle CRL and CGFRL with non-aligned addressesIlya Leoshkevich1-1/+2
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-7-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle LLGFRL from non-aligned addressesIlya Leoshkevich2-4/+5
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-6-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle LRL and LGFRL from non-aligned addressesIlya Leoshkevich2-8/+9
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-5-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle LGRL from non-aligned addressesIlya Leoshkevich2-4/+5
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-4-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle EXECUTE of odd addressesIlya Leoshkevich1-2/+10
Generate a specification exception in the helper before trying to fetch the instruction. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-3-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle branching to odd addressesIlya Leoshkevich1-0/+9
Let branching happen and try to generate a new translation block with an odd address. Generate a specification exception in cpu_get_tb_cpu_state(). Reported-by: Harold Grovesteen <h.grovsteen@tx.rr.com> Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20tests/tcg/s390x: Add ex-relative-long.cIlya Leoshkevich2-0/+157
Test EXECUTE and EXECUTE RELATIVE LONG with relative long instructions as targets. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Message-Id: <20230316210751.302423-3-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Fix EXECUTE of relative long instructionsIlya Leoshkevich3-1/+14
The code uses the wrong base for relative addressing: it should use the target instruction address and not the EXECUTE's address. Fix by storing the target instruction address in the new CPUS390XState member and loading it from the code generated by gen_ri2(). Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20230316210751.302423-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20tests/tcg/s390x: Add rxsbg.cIlya Leoshkevich2-0/+49
Add a small test for RXSBG with T=1 to prevent regressions. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-Id: <20230316172205.281369-3-iii@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Fix R[NOX]SBG with T=1Ilya Leoshkevich1-0/+4
RXSBG usage in the "filetests" test from the wasmtime testsuite makes tcg_reg_alloc_op() attempt to temp_load() a TEMP_VAL_DEAD temporary, causing an assertion failure: 0x01000a70: ec14 b040 3057 rxsbg %r1, %r4, 0xb0, 0x40, 0x30 OP after optimization and liveness analysis: ---- 0000000001000a70 0000000000000004 0000000000000006 rotl_i64 tmp2,r4,$0x30 dead: 1 2 pref=0xffff and_i64 tmp2,tmp2,$0x800000000000ffff dead: 1 pref=0xffff [xor_i64 tmp3,tmp3,tmp2 dead: 1 2 pref=0xffff] and_i64 cc_dst,tmp3,$0x800000000000ffff sync: 0 dead: 0 1 2 pref=0xffff mov_i64 psw_addr,$0x1000a76 sync: 0 dead: 0 1 pref=0xffff mov_i32 cc_op,$0x6 sync: 0 dead: 0 1 pref=0xffff call lookup_tb_ptr,$0x6,$1,tmp8,env dead: 1 pref=none goto_ptr tmp8 dead: 0 set_label $L0 exit_tb $0x7fffe809d183 ../tcg/tcg.c:3865: tcg fatal error The reason is that tmp3 does not have an initial value, which confuses the register allocator. This also affects the correctness of the results. Fix by assigning R1 to it. Exposed by commit e2e641fa3d5 ("tcg: Change default temp lifetime to TEMP_TB"). Fixes: d6c6372e186e ("target-s390: Implement R[NOX]SBG") Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20230316172205.281369-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20tests/tcg/s390x: Add PSW modification testsIlya Leoshkevich6-0/+204
Add several small tests that check the PSW modification instructions: * lpsw.S checks whether LPSW works correctly in the "happy" case. * lpswe-early.S checks whether early exceptions are recognized and whether the correct ILC and old PSW are stored when they happen. * ssm-early.S, stosm-early.S and exrl-ssm-early.S check the special handling of SSM and STOSM with respect to early exceptions. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-Id: <20230315020408.384766-4-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Implement Early Exception RecognitionIlya Leoshkevich4-1/+45
Generate a specification exception if a reserved bit is set in the PSW mask or if the PSW address is out of bounds dictated by the addressing mode. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20230315020408.384766-3-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Fix LPSWIlya Leoshkevich1-10/+12
Currently LPSW does not invert the mask bit 12 and incorrectly copies the BA bit into the address. Fix by generating code similar to what s390_cpu_load_normal() does. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Co-developed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20230315020408.384766-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20MAINTAINERS: Mark the Nios II CPU as orphanThomas Huth1-3/+3
Marek and Chris haven't been active for Nios II since years (the last time seems to have been in 2017), and we've got unhandled severe Nios II bug tickets in the bug tracker since a long time, so to avoid wrong expectations of people who are looking at the MAINTAINERS file, it's maybe best to mark the Nios II entry as orphan nowadays. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230313183352.274744-1-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-17Merge tag 'trivial-branch-for-8.0-pull-request' of ↵Peter Maydell5-13/+18
https://gitlab.com/laurent_vivier/qemu into staging Trivial branch pull request 20230317 Fix doc Fix sh4 cpu log output # -----BEGIN PGP SIGNATURE----- # # iQJGBAABCAAwFiEEzS913cjjpNwuT1Fz8ww4vT8vvjwFAmQUdowSHGxhdXJlbnRA # dml2aWVyLmV1AAoJEPMMOL0/L748ylwP/RisLo3XrvNBVuDW/cLh7vhFcaeSqEzH # /RfdJ0DeqreXQYiwqsUS+YrtBARpBwuvBk1RGg46chx3IZJp7fmfLjs0sSSiESsR # kL8tJqRFFdCXmpmUWQqmluiCEBLllq8uDHMaAyXh95V2VRt4vrR8K2x3GW0yrarS # 4BvMdTAJBmjjpXRZ+/NY88EEEqCHgliWTHm+JKLj7II5duUYZO+r0XpCQELFdHig # uEYOupSUm/H4X8VuKuqNG1YGUz9c8X7nYZ+lgKLNH/i8vco+dPSoL4fZvG1ts/NH # kcA+EdGNDJZdvhOUDlvebSIZ9uuVjxy4WD8CIJQ5A2LGSdmv4KUJjQWGBw/r5B/B # e+uhrFnXJPrRSytSohB0iEzlrETBHAzq1yzoc7TYy70SzHtBylR0Xxwxnaq2N9ux # k4wyeXF6toX49RiZ0UmoYO82vtPqg1LOsmYDYWKNzgWbRsTIVJAXuAwBAVIzOgJV # hs93YO3gCaIjh8n/V43VvQzborNhp0xf6Ch7F0cgD1klAAKX1ICX4Mn2Qj7tPmgh # GUsdTpleaFTpsKxgpNP1eU5QYtI9ZcGBhAhsSV9SSnrRsWo1dlppZJkUWEndIHGr # iUnP5OPLtWU5tM2WbVNb3pio/4xrzft3lu4DKH2IecZbBHF11FpK6f9mrlOagAz0 # V/3JSBg10dZQ # =3s21 # -----END PGP SIGNATURE----- # gpg: Signature made Fri 17 Mar 2023 14:17:48 GMT # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * tag 'trivial-branch-for-8.0-pull-request' of https://gitlab.com/laurent_vivier/qemu: docs/sphinx/kerneldoc.py: Honour --enable-werror target/sh4: Honor QEMU_LOG_FILENAME with QEMU_LOG=cpu exec/memory: Fix kernel-doc warning Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-17Merge tag '20230316-xtensa' of https://github.com/OSLL/qemu-xtensa into stagingPeter Maydell3-2/+9
target/xtensa updates for v8.0: - enable testing big-endian xtensa cores # -----BEGIN PGP SIGNATURE----- # # iQJHBAABCgAxFiEEK2eFS5jlMn3N6xfYUfnMkfg/oEQFAmQTd6gTHGpjbXZia2Jj # QGdtYWlsLmNvbQAKCRBR+cyR+D+gRCowEACpQULqjxkpd23bd5uYQYsuJRzbSblF # 6xux3IK5kD2y8vjzVegTs1XdZNhNzLRfEOijy+DxP1+5S6jRoACRkv0zKaBigbfA # C7pLTxKGXk4OLA1sEdAXZ8jTBxDNQG542kF/PSPUHLxbJyb+lH+4707vb/kgQQdz # nhCVfK75hqW2leohWsEES1jPxazyqu5PLMr9zPa0yfhbUU3g1AgTzFHAVrocP5mN # QKsaSwP5fwnF2ozTRM7MhHJj9iLlX0IYxeAcA22kUhr6kaAmL4SQdpwiREbCgOts # XE2Hpo+W5WQRw1B94au0spMZwYGDhFeApLhHRAI6hpLlOyTzC1bHV0yetHEWxLI4 # yPO4gCrkM+bIC5ErywTaCrTfCbaJkmMsz7epFLpawAfEtBTysfOzQEdVYcDKA7DO # uP1qvW3moIOFLJl+s8c5RQzuSP2kB7Ziox92p6bG9o4XM5Wp0SQU201xKuWkwoC2 # VLsd04IopaDQZdMkErqv9+moebI3w3s9zebbzjDicBA+JfgeOltEWp8tIMAXDTx6 # Rk+A6qh7VW73AACwP10GOtC2bslFCokgsuDuabFDC1w6bhWxgBv2bNk+8WJgR8Oe # BQKZgtH5XmnpTVZCrpgLQhJBWO+shVLm6sOy+wkTKuOwksn/ADd+q2QwAvKKWU6J # o+E0K5KnN3p4Qw== # =v5XD # -----END PGP SIGNATURE----- # gpg: Signature made Thu 16 Mar 2023 20:10:16 GMT # gpg: using RSA key 2B67854B98E5327DCDEB17D851F9CC91F83FA044 # gpg: issuer "jcmvbkbc@gmail.com" # gpg: Good signature from "Max Filippov <filippov@cadence.com>" [unknown] # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" [full] # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" [full] # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * tag '20230316-xtensa' of https://github.com/OSLL/qemu-xtensa: tests/tcg/xtensa: allow testing big-endian cores tests/tcg/xtensa: add linker.ld to CLEANFILES Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-16Merge tag 'migration-20230316-pull-request' of ↵Peter Maydell5-18/+21
https://gitlab.com/juan.quintela/qemu into staging Migration Pull request Hi This is just fixes for migration. - Fix rdma (dave) - Remove unused variable (Zhijian) - Fix AVX512 and XBZRLE (Matheus) - Fix migration preempt (Peter) - Fix populate_vfio_info (Steve) - Fix multifd send trace (Wei) Please apply. Later, Juan. # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEGJn/jt6/WMzuA0uC9IfvGFhy1yMFAmQTMa0ACgkQ9IfvGFhy # 1yMKCBAAyHcE4TO3NrFpG87nGbLhr1zjXkLEKGuAA/E6NKKrf+OrSV2Wq0aBEO/B # +yAAiXEPsjheh7gwS8FkgAgIj6PwRTtlKae/Tr0JtraukxYT4qzubkaw3X2VjEwf # uJ8/I+BZOLBUxlZHYoyDP4CWX7elEMlzKdcShcpJCLTgLjxFXjQ9lZwQBgu51cF2 # YitYRDMsVMr77y20eTqCUrLPcSgTM+8h3PtdyDRH2D+KF1IEkjGmSuF8lBc2WiN+ # BiuW6RlaLjhQiBuWNbkrjdulArnim9qhIT5didJuE7p9L50WFSqZs3EV7a4fJjUl # 1TWJ4k/fzcYf5GF1ypVBrZ1WWCsyJe/fd8ZddGyz9Xpu6Ml7BevVA+0oGeBDYaDB # T7o2TrHzz2vYCl20jwPbUeafjN8MppBdtHaJ2pP0nA3cPZHPziU2BE9D2/AUxMib # ICrNe+nVqXUKqx8qZrRPzIBsnoAgmhkNC/k8T7VEhfmm+s6C+xEE0eyhE299TYJn # ETpQCqiDPCDlkC8iL3OAd8Nn8kucT7EL7qcV2PcpWxgKPc7mCCNIHdpfpM2aZduJ # 0S/m19ICS8PSWSjFpSK2/vKLOyjA1PKA869iXFD+OOPb8jY5piTYOrj1gowkRjMx # JOOVDX04lBxbgUVaZnC+iLuh/ZlMRFv2GFAHIk66XDsmUOzRddI= # =Lwbm # -----END PGP SIGNATURE----- # gpg: Signature made Thu 16 Mar 2023 15:11:41 GMT # gpg: using RSA key 1899FF8EDEBF58CCEE034B82F487EF185872D723 # gpg: Good signature from "Juan Quintela <quintela@redhat.com>" [full] # gpg: aka "Juan Quintela <quintela@trasno.org>" [full] # Primary key fingerprint: 1899 FF8E DEBF 58CC EE03 4B82 F487 EF18 5872 D723 * tag 'migration-20230316-pull-request' of https://gitlab.com/juan.quintela/qemu: migration: fix populate_vfio_info migration/multifd: correct multifd_send_thread to trace the flags migration/rdma: Remove deprecated variable rdma_return_path migration/xbzrle: fix out-of-bounds write with axv512 migration/xbzrle: use ctz64 to avoid undefined result migration/rdma: Fix return-path case migration: Wait on preempt channel in preempt thread Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-16Merge tag 'seabios-1.16.2-20230316-pull-request' of ↵Peter Maydell13-0/+0
https://gitlab.com/kraxel/qemu into staging update seabios to 1.16.2 # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmQS8cMACgkQTLbY7tPo # cTjbEBAAkM1vhtNYOSKEHVBzSvJjkdV5wr3+WBaglLOpH9H30pRoGLGP8RpF9pUA # 6fib7/gKNvTtQSCCp31aiK9M6zi3KV51VFcPFoiZfsAwGwuWHDnYGAa2GXssFya+ # kCzErlMFUfJM64rX+/VRktMMfMIV+dNPyWaJyD44Hzds+EpoHfdyZlxlOyBqJ3ju # eV2CVutXtfUQ4H5eG7feWjPfv+ih4TeC9dPlQuU/nAd8HBt4gDjBhf7zy4pz5De5 # teUJYNuLYLZZxiD4sUw/OqZ9C9j5JBaIz4wZBsiHRSa6d7M+su+QQPGg3CIqFtqo # Q9m/ITD+B1tgB6k928q6IPZkMVSqKeflEQHPDcDiEYJ4TNQ2h5r/QdCGQoGXdPJ4 # /fmyovZ/9pxCs3BecRXytrYyT4R4HY7DsjxnTMyMgnRiuj9BlJgYJDiJCQyN9DDW # mHO1AWD+UrKy1k9MzAx9t3GFDeUga997g9jPfLjbJRJwagbHWLbTAB1QEK8E6lZ1 # V5LKX/DYfrw9A1XWFuDCx0L4FJ43dtEGzBBwcoZd01Kpe9va9QS56cdKadGlrPv+ # WYeX+js+1ufSFYagoH6QfFgaShgq+CaXEzDccBJRdFqDqWh8ah6zaHTQRRvjn/33 # brT/XAVBGsLCjZ2Soa2oTd9OBL+pFDbyU+uVcY2ahGGMeSJZH8k= # =0SRX # -----END PGP SIGNATURE----- # gpg: Signature made Thu 16 Mar 2023 10:38:59 GMT # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * tag 'seabios-1.16.2-20230316-pull-request' of https://gitlab.com/kraxel/qemu: update seabios binaries to 1.16.2 update seabios submodule to 1.16.2 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-16migration: fix populate_vfio_infoSteve Sistare1-1/+1
Include CONFIG_DEVICES so that populate_vfio_info is instantiated for CONFIG_VFIO. Without it, the 'info migrate' command never returns info about vfio. Fixes: 43bd0bf30f ("migration: Move populate_vfio_info() into a separate file") Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2023-03-16migration/multifd: correct multifd_send_thread to trace the flagsWei Wang1-1/+2
The p->flags could be updated via the send_prepare callback, e.g. OR-ed with MULTIFD_FLAG_ZLIB via zlib_send_prepare. Assign p->flags to the local "flags" before the send_prepare callback could only get partial of p->flags. Fix it by moving the assignment of p->flags to the local flags after the callback, so that the correct flags can be traced. Fixes: ab7cbb0b9a3b ("multifd: Make no compression operations into its own structure") Signed-off-by: Wei Wang <wei.w.wang@intel.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2023-03-16migration/rdma: Remove deprecated variable rdma_return_pathLi Zhijian1-2/+1
It's no longer needed since commit 44bcfd45e98 ("migration/rdma: destination: create the return patch after the first accept") Signed-off-by: Li Zhijian <lizhijian@fujitsu.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2023-03-16migration/xbzrle: fix out-of-bounds write with axv512Matheus Tavares Bernardino1-4/+3
xbzrle_encode_buffer_avx512() checks for overflows too scarcely in its outer loop, causing out-of-bounds writes: $ ../configure --target-list=aarch64-softmmu --enable-sanitizers --enable-avx512bw $ make tests/unit/test-xbzrle && ./tests/unit/test-xbzrle ==5518==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62100000b100 at pc 0x561109a7714d bp 0x7ffed712a440 sp 0x7ffed712a430 WRITE of size 1 at 0x62100000b100 thread T0 #0 0x561109a7714c in uleb128_encode_small ../util/cutils.c:831 #1 0x561109b67f6a in xbzrle_encode_buffer_avx512 ../migration/xbzrle.c:275 #2 0x5611099a7428 in test_encode_decode_overflow ../tests/unit/test-xbzrle.c:153 #3 0x7fb2fb65a58d (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x7a58d) #4 0x7fb2fb65a333 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x7a333) #5 0x7fb2fb65aa79 in g_test_run_suite (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x7aa79) #6 0x7fb2fb65aa94 in g_test_run (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x7aa94) #7 0x5611099a3a23 in main ../tests/unit/test-xbzrle.c:218 #8 0x7fb2fa78c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #9 0x5611099a608d in _start (/qemu/build/tests/unit/test-xbzrle+0x28408d) 0x62100000b100 is located 0 bytes to the right of 4096-byte region [0x62100000a100,0x62100000b100) allocated by thread T0 here: #0 0x7fb2fb823a06 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:153 #1 0x7fb2fb637ef0 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ef0) Fix that by performing the overflow check in the inner loop, instead. Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2023-03-16migration/xbzrle: use ctz64 to avoid undefined resultMatheus Tavares Bernardino1-2/+3
__builtin_ctzll() produces undefined results when the argument is 0. This can be seen through test-xbzrle, which produces the following warning: ../migration/xbzrle.c:265: runtime error: passing zero to ctz(), which is not a valid argument Replace __builtin_ctzll() with our ctz64() wrapper which properly handles 0. Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2023-03-16migration/rdma: Fix return-path caseDr. David Alan Gilbert1-3/+5
The RDMA code has return-path handling code, but it's only enabled if postcopy is enabled; if the 'return-path' migration capability is enabled, the return path is NOT setup but the core migration code still tries to use it and breaks. Enable the RDMA return path if either postcopy or the return-path capability is enabled. bz: https://bugzilla.redhat.com/show_bug.cgi?id=2063615 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Li Zhijian <lizhijian@fujitsu.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2023-03-16migration: Wait on preempt channel in preempt threadPeter Xu1-5/+6
QEMU main thread will wait until dest preempt channel established during processing the LISTEN command (within the whole postcopy PACKAGED data), by waiting on the semaphore postcopy_qemufile_dst_done. That's racy, because it's possible that the dest QEMU main thread hasn't yet accept()ed the new connection when processing the LISTEN event. The sem_wait() will yield the main thread without being able to run anything else including the accept() of the new socket, which can cause deadlock within the main thread. To avoid the race, move the "wait channel" from main thread to the preempt thread right at the start. Reported-by: Peter Maydell <peter.maydell@linaro.org> Fixes: 5655aab079 ("migration: Postpone postcopy preempt channel to be after main") Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
generated by cgit v1.1 at 2025-02-10 18:40:58 +0000