aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2024-01-23linux-user/elfload: test return value of getrlimitThomas Weißschuh1-2/+2
Should getrlimit() fail the value of dumpsize.rlimit_cur may not be initialized. Avoid reading garbage data by checking the return value of getrlimit. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de> Message-Id: <20240120-qemu-user-dumpable-v3-1-6aa410c933f1@t-8ch.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-01-23linux-user/riscv: Adjust vdso signal frame cfa offsetsRichard Henderson3-4/+4
A typo in sizeof_reg put the registers at the wrong offset. Simplify the expressions to use positive addresses from the start of uc_mcontext instead of negative addresses from the end of uc_mcontext. Reported-by: Vineet Gupta <vineetg@rivosinc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-01-23tcg/s390x: Fix encoding of VRIc, VRSa, VRSc insnsRichard Henderson1-3/+3
While the format names the second vector register 'v3', it is still in the second position (bits 12-15) and the argument to RXB must match. Example error: - e7 00 00 10 2a 33 verllf %v16,%v0,16 + e7 00 00 10 2c 33 verllf %v16,%v16,16 Cc: qemu-stable@nongnu.org Reported-by: Michael Tokarev <mjt@tls.msk.ru> Fixes: 22cb37b4172 ("tcg/s390x: Implement vector shift operations") Fixes: 79cada8693d ("tcg/s390x: Implement tcg_out_dup*_vec") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2054 Reviewed-by: Thomas Huth <thuth@redhat.com> Tested-by: Michael Tokarev <mjt@tls.msk.ru> Message-Id: <20240117213646.159697-2-richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-01-23linux-user: Fixed cpu restore with pc 0 on SIGBUSRobbin Ehn1-2/+3
Commit f4e1168198 (linux-user: Split out host_sig{segv,bus}_handler) introduced a bug, when returning from host_sigbus_handler the PC is never set. Thus cpu_loop_exit_restore is called with a zero PC and we immediate get a SIGSEGV. Signed-off-by: Robbin Ehn <rehn@rivosinc.com> Fixes: f4e1168198 ("linux-user: Split out host_sig{segv,bus}_handler") Reviewed-by: Palmer Dabbelt <palmer@rivosinc.com> Message-Id: <33f27425878fb529b9e39ef22c303f6e0d90525f.camel@rivosinc.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-01-23tcg: Make the cleanup-on-error path uniqueSamuel Tardieu1-3/+3
By calling `error_setg_errno()` before jumping to the cleanup-on-error path at the `fail` label, the cleanup path is clearer. Signed-off-by: Samuel Tardieu <sam@rfc1149.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20231219182212.455952-3-sam@rfc1149.net> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-01-23tcg: Remove unreachable codeSamuel Tardieu1-3/+1
The `fail_rx`/`fail` block is only entered while `buf_rx` is equal to its initial value `MAP_FAILED`. The `munmap(buf_rx, size);` was never executed. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2030 Signed-off-by: Samuel Tardieu <sam@rfc1149.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20231219182212.455952-2-sam@rfc1149.net> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-01-22block/io: clear BDRV_BLOCK_RECURSE flag after recursing in bdrv_co_block_statusFiona Ebner1-0/+10
Using fleecing backup like in [0] on a qcow2 image (with metadata preallocation) can lead to the following assertion failure: > bdrv_co_do_block_status: Assertion `!(ret & BDRV_BLOCK_ZERO)' failed. In the reproducer [0], it happens because the BDRV_BLOCK_RECURSE flag will be set by the qcow2 driver, so the caller will recursively check the file child. Then the BDRV_BLOCK_ZERO set too. Later up the call chain, in bdrv_co_do_block_status() for the snapshot-access driver, the assertion failure will happen, because both flags are set. To fix it, clear the recurse flag after the recursive check was done. In detail: > #0 qcow2_co_block_status Returns 0x45 = BDRV_BLOCK_RECURSE | BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID. > #1 bdrv_co_do_block_status Because of the data flag, bdrv_co_do_block_status() will now also set BDRV_BLOCK_ALLOCATED. Because of the recurse flag, bdrv_co_do_block_status() for the bdrv_file child will be called, which returns 0x16 = BDRV_BLOCK_ALLOCATED | BDRV_BLOCK_OFFSET_VALID | BDRV_BLOCK_ZERO. Now the return value inherits the zero flag. Returns 0x57 = BDRV_BLOCK_RECURSE | BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | BDRV_BLOCK_ALLOCATED | BDRV_BLOCK_ZERO. > #2 bdrv_co_common_block_status_above > #3 bdrv_co_block_status_above > #4 bdrv_co_block_status > #5 cbw_co_snapshot_block_status > #6 bdrv_co_snapshot_block_status > #7 snapshot_access_co_block_status > #8 bdrv_co_do_block_status Return value is propagated all the way up to here, where the assertion failure happens, because BDRV_BLOCK_RECURSE and BDRV_BLOCK_ZERO are both set. > #9 bdrv_co_common_block_status_above > #10 bdrv_co_block_status_above > #11 block_copy_block_status > #12 block_copy_dirty_clusters > #13 block_copy_common > #14 block_copy_async_co_entry > #15 coroutine_trampoline [0]: > #!/bin/bash > rm /tmp/disk.qcow2 > ./qemu-img create /tmp/disk.qcow2 -o preallocation=metadata -f qcow2 1G > ./qemu-img create /tmp/fleecing.qcow2 -f qcow2 1G > ./qemu-img create /tmp/backup.qcow2 -f qcow2 1G > ./qemu-system-x86_64 --qmp stdio \ > --blockdev qcow2,node-name=node0,file.driver=file,file.filename=/tmp/disk.qcow2 \ > --blockdev qcow2,node-name=node1,file.driver=file,file.filename=/tmp/fleecing.qcow2 \ > --blockdev qcow2,node-name=node2,file.driver=file,file.filename=/tmp/backup.qcow2 \ > <<EOF > {"execute": "qmp_capabilities"} > {"execute": "blockdev-add", "arguments": { "driver": "copy-before-write", "file": "node0", "target": "node1", "node-name": "node3" } } > {"execute": "blockdev-add", "arguments": { "driver": "snapshot-access", "file": "node3", "node-name": "snap0" } } > {"execute": "blockdev-backup", "arguments": { "device": "snap0", "target": "node1", "sync": "full", "job-id": "backup0" } } > EOF Signed-off-by: Fiona Ebner <f.ebner@proxmox.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Message-id: 20240116154839.401030-1-f.ebner@proxmox.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2024-01-22coroutine-ucontext: Save fake stack for pooled coroutineAkihiko Odaki1-9/+26
Coroutine may be pooled even after COROUTINE_TERMINATE if CONFIG_COROUTINE_POOL is enabled and fake stack should be saved in such a case to keep AddressSanitizerUseAfterReturn working. Even worse, I'm seeing stack corruption without fake stack being saved. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20240117-asan-v2-1-26f9e1ea6e72@daynix.com>
2024-01-21target/hexagon: reduce scope of def_regnum, remove dead assignmentBrian Cain1-3/+1
This is intended to address a coverity finding: CID 1527408. Signed-off-by: Brian Cain <bcain@quicinc.com> Reviewed-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Message-Id: <20240114234453.4114587-1-bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Remove old dectree.pyTaylor Simpson6-839/+0
Now that we are using QEMU decodetree.py, remove the old decoder Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20240115221443.365287-4-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Use QEMU decodetree (16-bit instructions)Taylor Simpson5-12/+188
Section 10.3 of the Hexagon V73 Programmer's Reference Manual A duplex is encoded as a 32-bit instruction with bits [15:14] set to 00. The sub-instructions that comprise a duplex are encoded as 13-bit fields in the duplex. Create a decoder for each subinstruction class (a, l1, l2, s1, s2). Extend gen_trans_funcs.py to handle all instructions rather than filter by instruction class. There is a g_assert_not_reached() in decode_insns() in decode.c to verify we never try to use the old decoder on 16-bit instructions. Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20240115221443.365287-3-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Use QEMU decodetree (32-bit instructions)Taylor Simpson7-14/+439
The Decodetree Specification can be found here https://www.qemu.org/docs/master/devel/decodetree.html Covers all 32-bit instructions, including HVX We generate separate decoders for each instruction class. The reason will be more apparent in the next patch in this series. We add 2 new scripts gen_decodetree.py Generate the input to decodetree.py gen_trans_funcs.py Generate the trans_* functions used by the output of decodetree.py Since the functions generated by decodetree.py take DisasContext * as an argument, we add the argument to a couple of functions that didn't need it previously. We also set the insn field in DisasContext during decode because it is used by the trans_* functions. There is a g_assert_not_reached() in decode_insns() in decode.c to verify we never try to use the old decoder on 32-bit instructions Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20240115221443.365287-2-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Remove dead functions from hex_common.pyTaylor Simpson1-51/+0
These functions are no longer used after making the generators object oriented. Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20231210220712.491494-10-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Remove unused WRITES_PRED_REG attributeTaylor Simpson2-12/+0
This is the only remaining use of the is_written function. We will remove it in the subsequent commit. Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20231210220712.491494-9-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Make generators object oriented - gen_analyze_funcsTaylor Simpson2-157/+157
This patch conflicts with https://lists.gnu.org/archive/html/qemu-devel/2023-11/msg00729.html If that series goes in first, we'll rework this patch and vice versa. Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20231210220712.491494-8-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Make generators object oriented - gen_op_regsTaylor Simpson1-2/+4
Reviewed-by: Brian Cain <bcain@quicinc.com> Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Message-Id: <20231210220712.491494-7-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Make generators object oriented - gen_idef_parser_funcsTaylor Simpson1-16/+4
Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20231210220712.491494-6-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Make generators object oriented - gen_helper_funcsTaylor Simpson2-313/+103
Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20231210220712.491494-5-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Make generators object oriented - gen_helper_protosTaylor Simpson2-148/+8
Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20231210220712.491494-4-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Make generators object oriented - gen_tcg_funcsTaylor Simpson2-547/+683
The generators are generally a bunch of Python if-then-else statements based on the regtype and regid. Encapsulate regtype/regid into a class hierarchy. Clients lookup the register and invoke methods. This has several advantages for making the code easier to read, understand, and maintain - The class name makes it more clear what the operand does - All the methods for a given type of operand are together - Don't need hex_common.bad_register If a regtype/regid is missing, the lookup in hex_common.get_register will fail - We can remove the functions in hex_common that use regtype/regid (e.g., is_read) This patch creates the class hierarchy in hex_common and converts gen_tcg_funcs.py. The other scripts will be converted in subsequent patches in this series. Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20231210220712.491494-3-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Clean up handling of modifier registersTaylor Simpson4-16/+17
Currently, the register number (MuN) for modifier registers is the modifier register number rather than the index into hex_gpr. This patch changes MuN to the hex_gpr index, which is consistent with the handling of control registers. Note that HELPER(fcircadd) needs the CS register corresponding to the modifier register specified in the instruction. We create a TCGv variable "CS" to hold the value to pass to the helper. Reviewed-by: Brian Cain <bcain@quicinc.com> Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Message-Id: <20231210220712.491494-2-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Fix shadow variable when idef-parser is offTaylor Simpson1-3/+3
Adding -Werror=shadow=compatible-local causes Hexagon not to build when idef-parser is off. The "label" variable in CHECK_NOSHUF_PRED shadows a variable in the surrounding code. Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20231130183955.54314-1-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21tests/docker: Hexagon toolchain updateBrian Cain1-2/+2
This update includes support for privileged instructions. Signed-off-by: Brian Cain <bcain@quicinc.com> Reviewed-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Tested-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Message-Id: <20240114232354.4109231-1-bcain@quicinc.com>
2024-01-20Merge tag 'pull-request-2024-01-19' of https://gitlab.com/thuth/qemu into ↵Peter Maydell22-212/+121
staging - Fix s390x ISM reset - Remove deprecated CLI options -no-hpet, -no-acpi, -async-teardown, -chroot and -singlestep - Fix installation of the netbsd VM # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmWqk40RHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbVb+w//XuWdXzDDof0CsOMhMzBaKLznJ+Qbo4Wr # S5vNJsiJe3KfI3DJa/ZSO2+lwyFpMPjp3aRSm9rAaw2ErejtfGZMSHj5/BGYuHVM # x0VlHWnTEe/7NpG2mRwlxntPyYOtFCQ+xCo4YS9fpLLYSQFNhGMyOyfCobVZc1/A # TDFrS5v1Su1HgYNL6GuyXK8k56ytidBxhuYtfLkR01liUDU1rmTWFcLxrXUwI7Hr # nfamp/W6G9OJ3co0ysYChM8SvXQzCGPBxzGQjrcHpaL7otTW5yliJcNPwyzGdyLU # G+5AcdJ8wT+ONonf3KkUTbxS2J2OHzIGCZpqVWGU0h5Yv43zMpNATUmbUPM0H0l4 # mqtUf4bSyhNwClKdkEWJyvEwNRTIHxWerMgaNp9ntEM3Ac0/3HiOXV/DZOKL04Im # hRHRySSMlyo6Pnnn2fHj3naalKHNVikbvPVR3i8wdYuQ423D35cU8M+yJpJ3Bllt # 5YgScDkVjifan5SmWVdtQ9bgyrdeQHFa9V1iUjxQx5JfAv8w4RBmats8UYrYm/mF # Zrx/zdpL5wneslWwPqLp/gOb5lt8tF4vt0sLgpNa6SxI9Pgz/GhPvuhmfheML17l # znbGEx5q3vqivszZkm8penydut4rbpp6GcoftbI9sIgqfNuuY1d/FZRlb32RTdxH # 1TUiQfGQqbA= # =ytHA # -----END PGP SIGNATURE----- # gpg: Signature made Fri 19 Jan 2024 15:21:49 GMT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2024-01-19' of https://gitlab.com/thuth/qemu: tests/vm/netbsd: Remove missing py311-expat package cli: Remove deprecated '-singlestep' command line option hmp: Remove deprecated 'singlestep' command qapi: Remove deprecated 'singlestep' member of StatusInfo qemu-options: Remove the deprecated -chroot option qemu-options: Remove the deprecated -async-teardown option qemu-options: Remove the deprecated -no-acpi option qemu-options: Remove the deprecated -no-hpet option s390x/pci: drive ISM reset from subsystem reset s390x/pci: refresh fh before disabling aif s390x/pci: avoid double enable/disable of aif Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-19Merge tag 'hw-cpus-20240119' of https://github.com/philmd/qemu into stagingPeter Maydell50-522/+605
HW core patch queue . Deprecate unmaintained SH-4 models (Samuel) . HPET: Convert DPRINTF calls to trace events (Daniel) . Implement buffered block writes in Intel PFlash (Gerd) . Ignore ELF loadable segments with zero size (Bin) . ESP/NCR53C9x: PCI DMA fixes (Mark) . PIIX: Simplify Xen PCI IRQ routing (Bernhard) . Restrict CPU 'start-powered-off' property to sysemu (Phil) . target/alpha: Only build sys_helper.c on system emulation (Phil) . target/xtensa: Use generic instruction breakpoint API & add test (Max) . Restrict icount to system emulation (Phil) . Do not set CPUState TCG-specific flags in non-TCG accels (Phil) . Cleanup TCG tb_invalidate API (Phil) . Correct LoongArch/KVM include path (Bibo) . Do not ignore throttle errors in crypto backends (Phil) . MAINTAINERS updates (Raphael, Zhao) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmWqXbkACgkQ4+MsLN6t # wN6VVBAAkP/Bs2JfQYobPZVV868wceM97KeUJMXP2YWf6dSLpHRCQN5KtuJcACM9 # y3k3R7nMeVJSGmzl/1gF1G9JhjoCLoVLX/ejeBppv4Wq//9sEdggaQfdCwkhWw2o # IK/gPjTZpimE7Er4hPlxmuhSRuM1MX4duKFRRfuZpE7XY14Y7/Hk12VIG7LooO0x # 2Sl8CaU0DN7CWmRVDoUkwVx7JBy28UVarRDsgpBim7oKmjjBFnCJkH6B6NJXEiYr # z1BmIcHa87S09kG1ek+y8aZpG9iPC7nUWjPIQyJGhnfrnBuO7hQHwCLIjHHp5QBR # BoMr8YQNTI34/M/D8pBfg96LrGDjkQOfwRyRddkMP/jJcNPMAPMNGbfVaIrfij1e # T+jFF4gQenOvy1XKCY3Uk/a11P3tIRFBEeOlzzQg4Aje9W2MhUNwK2HTlRfBbrRr # V30R764FDmHlsyOu6/E3jqp4GVCgryF1bglPOBjVEU5uytbQTP8jshIpGVnxBbF+ # OpFwtsoDbsousNKVcO5+B0mlHcB9Ru9h11M5/YD/jfLMk95Ga90JGdgYpqQ5tO5Y # aqQhKfCKbfgKuKhysxpsdWAwHZzVrlSf+UrObF0rl2lMXXfcppjCqNaw4QJ0oedc # DNBxTPcCE2vWhUzP3A60VH7jLh4nLaqSTrxxQKkbx+Je1ERGrxs= # =KmQh # -----END PGP SIGNATURE----- # gpg: Signature made Fri 19 Jan 2024 11:32:09 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'hw-cpus-20240119' of https://github.com/philmd/qemu: (36 commits) configure: Add linux header compile support for LoongArch MAINTAINERS: Update hw/core/cpu.c entry MAINTAINERS: Update Raphael Norwitz email hw/elf_ops: Ignore loadable segments with zero size hw/scsi/esp-pci: set DMA_STAT_BCMBLT when BLAST command issued hw/scsi/esp-pci: synchronise setting of DMA_STAT_DONE with ESP completion interrupt hw/scsi/esp-pci: generate PCI interrupt from separate ESP and PCI sources hw/scsi/esp-pci: use correct address register for PCI DMA transfers target/riscv: Rename tcg_cpu_FOO() to include 'riscv' target/i386: Rename tcg_cpu_FOO() to include 'x86' hw/s390x: Rename cpu_class_init() to include 'sclp' hw/core/cpu: Rename cpu_class_init() to include 'common' accel: Rename accel_init_ops_interfaces() to include 'system' cpus: Restrict 'start-powered-off' property to system emulation system/watchpoint: Move TCG specific code to accel/tcg/ system/replay: Restrict icount to system emulation hw/pflash: implement update buffer for block writes hw/pflash: use ldn_{be,le}_p and stn_{be,le}_p hw/pflash: refactor pflash_data_write() hw/i386/pc_piix: Make piix_intx_routing_notifier_xen() more device independent ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-19Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingPeter Maydell18-300/+433
* vga: implement odd/even and byte/word/doubleword modes more accurately * vga: implement horizontal pel panning * KVM: add class property to configure KVM device node to use * fix various bugs in x86 TCG PC-relative translation * properly align huge pages on LoongArch * cleanup patches # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmWo8wkUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroMhHAf+KiYvN/gxrYnpSS7IfbFqx6MtQrwW # Hj9QsfgRF2sThRu6BveLMG7REwEtwFh7lMhUbiyR/mzuYN9cMmHDw4OE62WRrL86 # 3PAtzAaJ/Lzd8Qp4K4un+ZrFZvq8a83HvGRRTaF9wO6/9EwpqmqMTbrNlSSA08Gy # mnfXGEt0oYitJ3JUH0MI8y6EOh1mkIhEfGPeyJaGDZVW/m4ob+QIauNOOozYN7r6 # QK+2OU0HeJC5CIzi2o5kq5U0AydVO1iAp7OBxtclYaaSvRyhlpEmbdTIKCzzPlUx # vZthxbU2PgzUbME8fraUcd7GzT64++QOLDxNyZNEL8PCCcd0lRQ0EEukgA== # =Uz0X # -----END PGP SIGNATURE----- # gpg: Signature made Thu 18 Jan 2024 09:44:41 GMT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: tests/tcg: Don't #include <inttypes.h> in aarch64/system/vtimer.c qemu/osdep: Add huge page aligned support on LoongArch platform remove unnecessary casts from uintptr_t target/i386: pcrel: store low bits of physical address in data[0] target/i386: fix incorrect EIP in PC-relative translation blocks target/i386: Do not re-compute new pc with CF_PCREL io_uring: move LuringState typedef to block/aio.h Add class property to configure KVM device node to use vga: sort-of implement word and double-word access modes vga: use latches in odd/even mode too vga: reindent memory access code vga: optimize horizontal pel panning in 256-color modes vga: implement horizontal pel panning in graphics modes vga: mask addresses in non-VESA modes to 256k vga: introduce VGADisplayParams vga: use common endian swap macros Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-19configure: Add linux header compile support for LoongArchBibo Mao1-0/+1
When compiling qemu with system KVM mode for LoongArch, header files in directory linux-headers/asm-loongarch should be used firstly. Otherwise it fails to find kvm.h on system with old glibc, since latest kernel header files are not installed. This patch adds linux_arch definition for LoongArch system so that header files in directory linux-headers/asm-loongarch can be included. Fixes: 714b03c125 ("target/loongarch: Add loongarch kvm into meson build") Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240116013952.264474-1-maobibo@loongson.cn> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19MAINTAINERS: Update hw/core/cpu.c entryZhao Liu1-1/+2
The hw/core/cpu.c was split as hw/core/cpu-common.c and hw/core/cpu-sysemu.c in the commit df4fd7d5c8a3 ("cpu: Split as cpu-common / cpu-sysemu"). Update the related entry. Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240115094852.3597165-2-zhao1.liu@linux.intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19MAINTAINERS: Update Raphael Norwitz emailRaphael Norwitz1-1/+1
I will be leaving Nutanix so updating my email in MAINTAINERS to my personal email for now. Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240111192846.111699-1-raphael.norwitz@nutanix.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19hw/elf_ops: Ignore loadable segments with zero sizeBin Meng1-36/+39
Some ELF files really do have segments of zero size, e.g.: Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align RISCV_ATTRIBUT 0x00000000000025b8 0x0000000000000000 0x0000000000000000 0x000000000000003e 0x0000000000000000 R 0x1 LOAD 0x0000000000001000 0x0000000080200000 0x0000000080200000 0x00000000000001d1 0x00000000000001d1 R E 0x1000 LOAD 0x00000000000011d1 0x00000000802001d1 0x00000000802001d1 0x0000000000000e37 0x0000000000000e37 RW 0x1000 LOAD 0x0000000000000120 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x1000 The current logic does not check for this condition, resulting in the incorrect assignment of 'lowaddr' as zero. There is already a piece of codes inside the segment traversal loop that checks for zero-sized loadable segments for not creating empty ROM blobs. Let's move this check to the beginning of the loop to cover both scenarios. Signed-off-by: Bin Meng <bmeng@tinylab.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240116155049.390301-1-bmeng@tinylab.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19hw/scsi/esp-pci: set DMA_STAT_BCMBLT when BLAST command issuedMark Cave-Ayland1-0/+1
Even though the BLAST command isn't fully implemented in QEMU, the DMA_STAT_BCMBLT bit should be set after the command has been issued to indicate that the command has completed. This fixes an issue with the DC390 DOS driver which issues the BLAST command as part of its normal error recovery routine at startup, and otherwise sits in a tight loop waiting for DMA_STAT_BCMBLT to be set before continuing. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Guenter Roeck <linux@roeck-us.net> Message-ID: <20240112131529.515642-5-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19hw/scsi/esp-pci: synchronise setting of DMA_STAT_DONE with ESP completion ↵Mark Cave-Ayland1-15/+13
interrupt The setting of DMA_STAT_DONE at the end of a DMA transfer can be configured to generate an interrupt, however the Linux driver manually checks for DMA_STAT_DONE being set and if it is, considers that a DMA transfer has completed. If DMA_STAT_DONE is set but the ESP device isn't indicating an interrupt then the Linux driver considers this to be a spurious interrupt. However this can occur in QEMU as there is a delay between the end of DMA transfer where DMA_STAT_DONE is set, and the ESP device raising its completion interrupt. This appears to be an incorrect assumption in the Linux driver as the ESP and PCI DMA interrupt sources are separate (and may not be raised exactly together), however we can work around this by synchronising the setting of DMA_STAT_DONE at the end of a DMA transfer with the ESP completion interrupt. In conjunction with the previous commit Linux is now able to correctly boot from an am53c974 PCI SCSI device on the hppa C3700 machine without emitting "iget: checksum invalid" and "Spurious irq, sreg=10" errors. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Guenter Roeck <linux@roeck-us.net> Message-ID: <20240112131529.515642-4-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19hw/scsi/esp-pci: generate PCI interrupt from separate ESP and PCI sourcesMark Cave-Ayland1-5/+27
The am53c974/dc390 PCI interrupt has two separate sources: the first is from the internal ESP device, and the second is from the PCI DMA transfer logic. Update the ESP interrupt handler so that it sets DMA_STAT_SCSIINT rather than driving the PCI IRQ directly, and introduce a new esp_pci_update_irq() function to generate the correct PCI IRQ level. In particular this fixes spurious interrupts being generated by setting DMA_STAT_DONE at the end of a transfer if DMA_CMD_INTE_D isn't set in the DMA_CMD register. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Guenter Roeck <linux@roeck-us.net> Message-ID: <20240112131529.515642-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19hw/scsi/esp-pci: use correct address register for PCI DMA transfersMark Cave-Ayland1-1/+1
The current code in esp_pci_dma_memory_rw() sets the DMA address to the value of the DMA_SPA (Starting Physical Address) register which is incorrect: this means that for each callback from the SCSI layer the DMA address is set back to the starting address. In the case where only a single SCSI callback occurs (currently for transfer lengths < 128kB) this works fine, however for larger transfers the DMA address wraps back to the initial starting address, corrupting the buffer holding the data transferred to the guest. Fix esp_pci_dma_memory_rw() to use the DMA_WAC (Working Address Counter) for the DMA address which is correctly incremented across multiple SCSI layer transfers. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Guenter Roeck <linux@roeck-us.net> Message-ID: <20240112131529.515642-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19target/riscv: Rename tcg_cpu_FOO() to include 'riscv'Philippe Mathieu-Daudé1-14/+14
The tcg_cpu_FOO() names are riscv specific, so rename them as riscv_tcg_cpu_FOO() (as other names in this file) to ease navigating the code. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20240111120221.35072-6-philmd@linaro.org>
2024-01-19target/i386: Rename tcg_cpu_FOO() to include 'x86'Philippe Mathieu-Daudé1-16/+16
The tcg_cpu_FOO() names are x86 specific, so rename them as x86_tcg_cpu_FOO() (as other names in this file) to ease navigating the code. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20240111120221.35072-5-philmd@linaro.org>
2024-01-19hw/s390x: Rename cpu_class_init() to include 'sclp'Philippe Mathieu-Daudé1-2/+2
cpu_class_init() is specific to s390x SCLP, so rename it as sclp_cpu_class_init() (as other names in this file) to ease navigating the code. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Message-ID: <20240111120221.35072-4-philmd@linaro.org>
2024-01-19hw/core/cpu: Rename cpu_class_init() to include 'common'Philippe Mathieu-Daudé1-2/+2
cpu_class_init() is common, so rename it as cpu_common_class_init() to ease navigating the code. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-ID: <20240111120221.35072-3-philmd@linaro.org>
2024-01-19accel: Rename accel_init_ops_interfaces() to include 'system'Philippe Mathieu-Daudé3-3/+3
accel_init_ops_interfaces() is system specific, so rename it as accel_system_init_ops_interfaces() to ease navigating the code. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20240111120221.35072-2-philmd@linaro.org>
2024-01-19cpus: Restrict 'start-powered-off' property to system emulationPhilippe Mathieu-Daudé1-1/+6
Since the CPUState::start-powered-off property is irrelevant to user emulation, restrict it to system emulation. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240111161817.43150-1-philmd@linaro.org>
2024-01-19system/watchpoint: Move TCG specific code to accel/tcg/Philippe Mathieu-Daudé3-124/+144
Keep system/watchpoint.c accelerator-agnostic by moving TCG specific code to accel/tcg/watchpoint.c. Update meson. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240111162032.43378-1-philmd@linaro.org>
2024-01-19system/replay: Restrict icount to system emulationPhilippe Mathieu-Daudé3-23/+9
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20231208113529.74067-7-philmd@linaro.org>
2024-01-19hw/pflash: implement update buffer for block writesGerd Hoffmann3-30/+89
Add an update buffer where all block updates are staged. Flush or discard updates properly, so we should never see half-completed block writes in pflash storage. Drop a bunch of FIXME comments ;) Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240108160900.104835-4-kraxel@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19hw/pflash: use ldn_{be,le}_p and stn_{be,le}_pGerd Hoffmann1-55/+8
Use the helper functions we have to read/write multi-byte values in correct byte order. Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240108160900.104835-3-kraxel@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19hw/pflash: refactor pflash_data_write()Gerd Hoffmann1-14/+16
Move the offset calculation, do it once at the start of the function and let the 'p' variable point directly to the memory location which should be updated. This makes it simpler to update other buffers than pfl->storage in an upcoming patch. No functional change. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240108160900.104835-2-kraxel@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19hw/i386/pc_piix: Make piix_intx_routing_notifier_xen() more device independentBernhard Beschow1-6/+3
This is a follow-up on commit 89965db43cce "hw/isa/piix3: Avoid Xen-specific variant of piix3_write_config()" which introduced piix_intx_routing_notifier_xen(). This function is implemented in board code but accesses the PCI configuration space of the PIIX ISA function to determine the PCI interrupt routes. Avoid this by reusing pci_device_route_intx_to_irq() which makes piix_intx_routing_notifier_xen() more device-agnostic. One remaining improvement would be making piix_intx_routing_notifier_xen() agnostic towards the number of PCI interrupt routes and move it to xen-hvm. This might be useful for possible Q35 Xen efforts but remains a future exercise for now. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240107231623.5282-1-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19hw/block: Deprecate the TC58128 block deviceSamuel Tardieu2-1/+2
The 16MiB flash device is only used by the deprecated shix machine. Its code it old and unmaintained, and has never been adapted to the QOM architecture. It still contains debug statements and uses global variables. It is time to deprecate it. Signed-off-by: Samuel Tardieu <sam@rfc1149.net> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240109083053.2581588-3-sam@rfc1149.net> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19target/sh4: Deprecate the shix machineSamuel Tardieu2-0/+6
The shix machine has been designed and used at Télécom Paris from 2003 to 2010. It had been added to QEMU in 2005 and has not been maintained since. Since nobody is using the physical board anymore nor interested in maintaining the QEMU port, it is time to deprecate it. Signed-off-by: Samuel Tardieu <sam@rfc1149.net> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240109083053.2581588-2-sam@rfc1149.net> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19util/async: Only call icount_notify_exit() if icount is enabledPhilippe Mathieu-Daudé3-9/+13
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20231208113529.74067-6-philmd@linaro.org>
2024-01-19target/arm: Ensure icount is enabled when emulating INST_RETIREDPhilippe Mathieu-Daudé1-0/+2
pmu_init() register its event checking the pm_event::supported() handler. For INST_RETIRED, the event is only registered and the bit enabled in the PMU Common Event Identification register when icount is enabled as ICOUNT_PRECISE. PMU events are TCG-only, hardware accelerators handle them directly. Unfortunately we register the events in non-TCG builds, leading to linking error such: ld: Undefined symbols: _icount_to_ns, referenced from: _instructions_ns_per in target_arm_helper.c.o clang: error: linker command failed with exit code 1 (use -v to see invocation) As a kludge, give a hint to the compiler by asserting the pm_event::get_count() and pm_event::ns_per_count() handler will only be called under this icount mode. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20231208113529.74067-5-philmd@linaro.org>
generated by cgit v1.1 at 2025-09-20 20:44:59 +0000