aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2020-06-09hw/timer/grlib_gptimer: Display frequency in decimalPhilippe Mathieu-Daudé1-1/+1
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Message-Id: <20200331105048.27989-6-f4bug@amsat.org>
2020-06-09hw/misc/grlib_ahb_apb_pnp: Add trace events on read accessesPhilippe Mathieu-Daudé2-2/+15
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Message-Id: <20200331105048.27989-5-f4bug@amsat.org>
2020-06-09hw/misc/grlib_ahb_apb_pnp: Fix AHB PnP 8-bit accessesPhilippe Mathieu-Daudé1-0/+4
The Plug & Play region of the AHB/APB bridge can be accessed by various word size, however the implementation is clearly restricted to 32-bit: static uint64_t grlib_ahb_pnp_read(void *opaque, hwaddr offset, unsigned size) { AHBPnp *ahb_pnp = GRLIB_AHB_PNP(opaque); return ahb_pnp->regs[offset >> 2]; } Similarly to commit 0fbe394a64 with the APB PnP registers, set the MemoryRegionOps::impl min/max fields to 32-bit, so memory.c::access_with_adjusted_size() can adjust when the access is not 32-bit. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Message-Id: <20200331105048.27989-4-f4bug@amsat.org>
2020-06-09hw/misc/grlib_ahb_apb_pnp: Avoid crash when writing to AHB PnP registersPhilippe Mathieu-Daudé1-0/+7
Similarly to commit 158b659451 with the APB PnP registers, guests can crash QEMU when writting to the AHB PnP registers: $ echo 'writeb 0xfffff042 69' | qemu-system-sparc -M leon3_generic -S -bios /etc/magic -qtest stdio [I 1571938309.932255] OPENED [R +0.063474] writeb 0xfffff042 69 Segmentation fault (core dumped) (gdb) bt #0 0x0000000000000000 in () #1 0x0000562999110df4 in memory_region_write_with_attrs_accessor (mr=mr@entry=0x56299aa28ea0, addr=66, value=value@entry=0x7fff6abe13b8, size=size@entry=1, shift=<optimized out>, mask=mask@entry=255, attrs=...) at memory.c:503 #2 0x000056299911095e in access_with_adjusted_size (addr=addr@entry=66, value=value@entry=0x7fff6abe13b8, size=size@entry=1, access_size_min=<optimized out>, access_size_max=<optimized out>, access_fn=access_fn@entry= 0x562999110d70 <memory_region_write_with_attrs_accessor>, mr=0x56299aa28ea0, attrs=...) at memory.c:539 #3 0x0000562999114fba in memory_region_dispatch_write (mr=mr@entry=0x56299aa28ea0, addr=66, data=<optimized out>, op=<optimized out>, attrs=attrs@entry=...) at memory.c:1482 #4 0x00005629990c0860 in flatview_write_continue (fv=fv@entry=0x56299aa7d8a0, addr=addr@entry=4294963266, attrs=..., ptr=ptr@entry=0x7fff6abe1540, len=len@entry=1, addr1=<optimized out>, l=<optimized out>, mr=0x56299aa28ea0) at include/qemu/host-utils.h:164 #5 0x00005629990c0a76 in flatview_write (fv=0x56299aa7d8a0, addr=4294963266, attrs=..., buf=0x7fff6abe1540, len=1) at exec.c:3165 #6 0x00005629990c4c1b in address_space_write (as=<optimized out>, addr=<optimized out>, attrs=..., attrs@entry=..., buf=buf@entry=0x7fff6abe1540, len=len@entry=1) at exec.c:3256 #7 0x000056299910f807 in qtest_process_command (chr=chr@entry=0x5629995ee920 <qtest_chr>, words=words@entry=0x56299acfcfa0) at qtest.c:437 Instead of crashing, log the access as unimplemented. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Message-Id: <20200331105048.27989-3-f4bug@amsat.org>
2020-06-09hw/sparc64/niagara: Remove duplicated NIAGARA_UART_BASE definitionPhilippe Mathieu-Daudé1-1/+0
NIAGARA_UART_BASE is already defined few lines earlier. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200608172144.20461-3-f4bug@amsat.org>
2020-06-09hw/sparc64/niagara: Map the UART device unconditionallyPhilippe Mathieu-Daudé1-4/+2
The UART is present on the machine regardless there is a character device connected to it. Map it unconditionally. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200608172144.20461-4-f4bug@amsat.org>
2020-06-09hw/sparc/leon3: Map the UART device unconditionallyPhilippe Mathieu-Daudé1-10/+8
The UART is present on the chipset regardless there is a character device connected to it. Map it unconditionally. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Message-Id: <20200608172144.20461-2-f4bug@amsat.org>
2020-06-09hw/misc/empty_slot: Name the slots when createdPhilippe Mathieu-Daudé3-5/+9
Directly set the slot name when creating the device, to display the device name in trace events. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200510152840.13558-8-f4bug@amsat.org>
2020-06-09hw/misc/empty_slot: Move the 'hw/misc' and cover in MAINTAINERSPhilippe Mathieu-Daudé7-9/+9
Add an entry for the 'empty_slot' device. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200510152840.13558-7-f4bug@amsat.org>
2020-06-09hw/misc/empty_slot: Convert debug printf() to trace eventPhilippe Mathieu-Daudé2-11/+12
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200510152840.13558-6-f4bug@amsat.org>
2020-06-09hw/misc/empty_slot: Add a 'name' qdev propertyPhilippe Mathieu-Daudé1-1/+6
Add a 'name' qdev property so when multiple slots are accessed, we can notice which one is accessed. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200510152840.13558-5-f4bug@amsat.org>
2020-06-09hw/misc/empty_slot: Convert 'size' field as qdev propertyPhilippe Mathieu-Daudé1-6/+9
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200510152840.13558-4-f4bug@amsat.org>
2020-06-09hw/misc/empty_slot: Lower address space priorityPhilippe Mathieu-Daudé1-1/+1
Empty slots model RAZ/WI access on a bus. Since we can still (hot) plug devices on the bus, lower the slot priority, so device added later is accessed first. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200510152840.13558-3-f4bug@amsat.org>
2020-06-09hw/sparc/sun4m: Use UnimplementedDevice for I/O devicesPhilippe Mathieu-Daudé2-4/+8
These devices are not slots on a bus, but real I/O devices that we do not implement. As the ISDN ROM would be a ROMD device, also model it as UnimplementedDevice. Reviewed-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200510152840.13558-2-f4bug@amsat.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2020-06-08Merge remote-tracking branch ↵Peter Maydell1-0/+2
'remotes/vivier2/tags/linux-user-for-5.1-pull-request' into staging linux-user pull request 20200605-v2 Implement F_OFD_ fcntl() command, /proc/cpuinfo for hppa Fix socket(), prnctl() error codes, underflow in target_mremap, epoll_create() strace, oldumount for alpha User-mode build dependencies improvement # gpg: Signature made Sat 06 Jun 2020 14:15:36 BST # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/linux-user-for-5.1-pull-request: stubs: Restrict ui/win32-kbd-hook to system-mode hw/core: Restrict CpuClass::get_crash_info() to system-mode target/s390x: Restrict CpuClass::get_crash_info() to system-mode target/i386: Restrict CpuClass::get_crash_info() to system-mode arch_init: Remove unused 'qapi-commands-misc.h' include exec: Assert CPU migration is not used on user-only build target/riscv/cpu: Restrict CPU migration to system-mode stubs/Makefile: Reduce the user-mode object list util/Makefile: Reduce the user-mode object list tests/Makefile: Restrict some softmmu-only tests tests/Makefile: Only display TCG-related tests when TCG is available configure: Avoid building TCG when not needed Makefile: Only build virtiofsd if system-mode is enabled linux-user: implement OFD locks linux-user/mmap.c: fix integer underflow in target_mremap linux-user/strace.list: fix epoll_create{,1} -strace output linux-user: Add support for /proc/cpuinfo on hppa platform linux-user: return target error codes for socket() and prctl() linux-user, alpha: fix oldumount syscall Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05Merge remote-tracking branch ↵Peter Maydell13-25/+1967
'remotes/pmaydell/tags/pull-target-arm-20200605' into staging target-arm queue: hw/ssi/imx_spi: Handle tx burst lengths other than 8 correctly hw/input/pxa2xx_keypad: Replace hw_error() by qemu_log_mask() hw/arm/pxa2xx: Replace printf() call by qemu_log_mask() target/arm: Convert crypto insns to gvec hw/adc/stm32f2xx_adc: Correct memory region size and access size tests/acceptance: Add a boot test for the xlnx-versal-virt machine docs/system: Document Aspeed boards raspi: Add model of the USB controller target/arm: Convert 2-reg-and-shift and 1-reg-imm Neon insns to decodetree # gpg: Signature made Fri 05 Jun 2020 17:48:39 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20200605: (29 commits) target/arm: Convert Neon one-register-and-immediate insns to decodetree target/arm: Convert VCVT fixed-point ops to decodetree target/arm: Convert Neon VSHLL, VMOVL to decodetree target/arm: Convert Neon narrowing shifts with op==9 to decodetree target/arm: Convert Neon narrowing shifts with op==8 to decodetree target/arm: Convert VQSHLU, VQSHL 2-reg-shift insns to decodetree target/arm: Convert Neon VSRA, VSRI, VRSHR, VRSRA 2-reg-shift insns to decodetree target/arm: Convert Neon VSHR 2-reg-shift insns to decodetree target/arm: Convert Neon VSHL and VSLI 2-reg-shift insn to decodetree raspi2 acceptance test: add test for dwc-hsotg (dwc2) USB host wire in the dwc-hsotg (dwc2) USB host controller emulation usb: add short-packet handling to usb-storage driver dwc-hsotg (dwc2) USB host controller emulation dwc-hsotg (dwc2) USB host controller state definitions dwc-hsotg (dwc2) USB host controller register definitions raspi: add BCM2835 SOC MPHI emulation docs/system: Document Aspeed boards tests/acceptance: Add a boot test for the xlnx-versal-virt machine hw/adc/stm32f2xx_adc: Correct memory region size and access size target/arm: Split helper_crypto_sm3tt ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/core: Restrict CpuClass::get_crash_info() to system-modePhilippe Mathieu-Daudé1-0/+2
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Tested-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200522172510.25784-13-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2020-06-05Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20200605' into stagingPeter Maydell3-12/+5
s390x update: - enhance s390x documentation - allow ORBs without prefetch specified for vfio-ccw - various cleanups and enhancements # gpg: Signature made Fri 05 Jun 2020 16:32:43 BST # gpg: using RSA key C3D0D66DC3624FF6A8C018CEDECF6B93C6F02FAF # gpg: issuer "cohuck@redhat.com" # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [marginal] # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full] # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full] # gpg: aka "Cornelia Huck <cohuck@kernel.org>" [marginal] # gpg: aka "Cornelia Huck <cohuck@redhat.com>" [marginal] # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20200605: target/s390x: Restrict system-mode declarations target/s390x/helper: Clean ifdef'ry target/s390x: Only compile decode_basedisp() on system-mode MAINTAINERS: add Thomas as additional s390x maintainer docs/s390x: document vfio-ccw vfio-ccw: allow non-prefetch ORBs docs/s390x: document 3270 docs/s390x: document the virtual css s390x: pv: Fix KVM_PV_PREP_RESET command wrapper name s390x/kvm: help valgrind in several places Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05wire in the dwc-hsotg (dwc2) USB host controller emulationPaul Zimmerman1-1/+20
Wire the dwc-hsotg (dwc2) emulation into Qemu Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Reviewed-by: Philippe Mathieu-Daude <f4bug@amsat.org> Message-id: 20200520235349.21215-7-pauldzim@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05usb: add short-packet handling to usb-storage driverPaul Zimmerman1-1/+14
The dwc-hsotg (dwc2) USB host depends on a short packet to indicate the end of an IN transfer. The usb-storage driver currently doesn't provide this, so fix it. I have tested this change rather extensively using a PC emulation with xhci, ehci, and uhci controllers, and have not observed any regressions. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200520235349.21215-6-pauldzim@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05dwc-hsotg (dwc2) USB host controller emulationPaul Zimmerman4-0/+1473
Add the dwc-hsotg (dwc2) USB host controller emulation code. Based on hw/usb/hcd-ehci.c and hw/usb/hcd-ohci.c. Note that to use this with the dwc-otg driver in the Raspbian kernel, you must pass the option "dwc_otg.fiq_fsm_enable=0" on the kernel command line. Emulation of slave mode and of descriptor-DMA mode has not been implemented yet. These modes are seldom used. I have used some on-line sources of information while developing this emulation, including: http://www.capital-micro.com/PDF/CME-M7_Family_User_Guide_EN.pdf which has a pretty complete description of the controller starting on page 370. https://sourceforge.net/p/wive-ng/wive-ng-mt/ci/master/tree/docs/DataSheets/RT3050_5x_V2.0_081408_0902.pdf which has a description of the controller registers starting on page 130. Thanks to Felippe Mathieu-Daude for providing a cleaner method of implementing the memory regions for the controller registers. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200520235349.21215-5-pauldzim@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05dwc-hsotg (dwc2) USB host controller state definitionsPaul Zimmerman1-0/+190
Add the dwc-hsotg (dwc2) USB host controller state definitions. Mostly based on hw/usb/hcd-ehci.h. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200520235349.21215-4-pauldzim@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05raspi: add BCM2835 SOC MPHI emulationPaul Zimmerman3-0/+209
Add BCM2835 SOC MPHI (Message-based Parallel Host Interface) emulation. It is very basic, only providing the FIQ interrupt needed to allow the dwc-otg USB host controller driver in the Raspbian kernel to function. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Acked-by: Philippe Mathieu-Daude <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20200520235349.21215-2-pauldzim@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/adc/stm32f2xx_adc: Correct memory region size and access sizePhilippe Mathieu-Daudé1-1/+3
The ADC region size is 256B, split as: - [0x00 - 0x4f] defined - [0x50 - 0xff] reserved All registers are 32-bit (thus when the datasheet mentions the last defined register is 0x4c, it means its address range is 0x4c .. 0x4f. This model implementation is also 32-bit. Set MemoryRegionOps 'impl' fields. See: 'RM0033 Reference manual Rev 8', Table 10.13.18 "ADC register map". Reported-by: Seth Kintigh <skintigh@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200603055915.17678-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/arm/pxa2xx: Replace printf() call by qemu_log_mask()Philippe Mathieu-Daudé1-17/+49
Replace printf() calls by qemu_log_mask(), which is disabled by default. This avoid flooding the terminal when fuzzing the device. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200525114123.21317-3-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/input/pxa2xx_keypad: Replace hw_error() by qemu_log_mask()Philippe Mathieu-Daudé1-3/+7
hw_error() calls exit(). This a bit overkill when we can log the accesses as unimplemented or guest error. When fuzzing the devices, we don't want the whole process to exit. Replace some hw_error() calls by qemu_log_mask() (missed in commit 5a0001ec7e). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200525114123.21317-2-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/ssi/imx_spi: Removed unnecessary cast of rx data received from slaveEden Mikitas1-1/+1
When inserting the value retrieved (rx) from the spi slave, rx is pushed to rx_fifo after being cast to uint8_t. rx_fifo is a fifo32, and the rx register the driver uses is also 32 bit. This zeroes the 24 most significant bits of rx. This proved problematic with devices that expect to use the whole 32 bits of the rx register. Signed-off-by: Eden Mikitas <e.mikitas@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/ssi/imx_spi: changed while statement to prevent underflowEden Mikitas1-1/+1
The while statement in question only checked if tx_burst is not 0. tx_burst is a signed int, which is assigned the value put by the guest driver in ECSPI_CONREG. The burst length can be anywhere between 1 and 4096, and since tx_burst is always decremented by 8 it could possibly underflow, causing an infinite loop. Signed-off-by: Eden Mikitas <e.mikitas@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05vfio-ccw: allow non-prefetch ORBsJared Rossi1-10/+3
Remove the explicit prefetch check when using vfio-ccw devices. This check does not trigger in practice as all Linux channel programs are intended to use prefetch. Newer Linux kernel versions do not require to force the PFCH flag with vfio-ccw devices anymore. Signed-off-by: Jared Rossi <jrossi@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Message-Id: <20200512181535.18630-2-jrossi@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-06-05s390x: pv: Fix KVM_PV_PREP_RESET command wrapper nameJanosch Frank2-2/+2
s390_pv_perf_clear_reset() is not a very helpful name since that function needs to be called for a normal and a clear reset via diag308. Let's instead name it s390_pv_prep_reset() which reflects the purpose of the function a bit better. Signed-off-by: Janosch Frank <frankja@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20200505124159.24099-1-frankja@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-06-05Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200605-pull-request' ↵Peter Maydell2-5/+11
into staging vga: ati security fix, cirrus cleanup. # gpg: Signature made Fri 05 Jun 2020 12:27:13 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20200605-pull-request: hw/display/cirrus_vga: Fix code mis-indentation ati-vga: check mm_index before recursive call (CVE-2020-13800) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/block: Let the NVMe emulated device be target-agnosticPhilippe Mathieu-Daudé2-5/+3
Now than the non-target specific memory_region_msync() function is available, use it to make this device target-agnostic. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20200508062456.23344-4-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05hw/display/cirrus_vga: Fix code mis-indentationPhilippe Mathieu-Daudé1-3/+3
While replacing fprintf() by qemu_log_mask() in commit 2b55f4d3504, we incorrectly used a 'tab = 4 spaces' alignment, leading to misindented new code. Fix now. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200529165436.23573-1-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-05ati-vga: check mm_index before recursive call (CVE-2020-13800)Prasad J Pandit1-2/+8
While accessing VGA registers via ati_mm_read/write routines, a guest may set 's->regs.mm_index' such that it leads to infinite recursion. Check mm_index value to avoid such recursion. Log an error message for wrong values. Reported-by: Ren Ding <rding@gatech.edu> Reported-by: Hanqing Zhao <hanqing@gatech.edu> Reported-by: Yi Ren <c4tren@gmail.com> Message-id: 20200604090830.33885-1-ppandit@redhat.com Suggested-by: BALATON Zoltan <balaton@eik.bme.hu> Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-03riscv: Initial commit of OpenTitan machineAlistair Francis3-0/+190
This adds a barebone OpenTitan machine to QEMU. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com>
2020-06-03riscv: sifive_e: Manually define the machineAlistair Francis1-11/+30
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com>
2020-06-03hw/riscv: spike: Remove deprecated ISA specific machinesAlistair Francis1-217/+0
The ISA specific Spike machines have been deprecated in QEMU since 4.1, let's finally remove them. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
2020-06-03hw/riscv: virt: Remove the riscv_ prefix of the machine* functionsBin Meng1-10/+10
Remove the riscv_ prefix of the machine* functions. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1590072147-13035-2-git-send-email-bmeng.cn@gmail.com Message-Id: <1590072147-13035-2-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-06-03hw/riscv: sifive_u: Remove the riscv_ prefix of the soc* functionsBin Meng1-12/+12
To keep consistency with the machine* functions, remove the riscv_ prefix of the soc* functions. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1590072147-13035-1-git-send-email-bmeng.cn@gmail.com Message-Id: <1590072147-13035-1-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-06-03riscv: Change the default behavior if no -bios option is specifiedBin Meng1-27/+4
Per QEMU deprecated doc, QEMU 4.1 introduced support for the -bios option in QEMU for RISC-V for the virt machine and sifive_u machine. The default behavior has been that QEMU does not automatically load any firmware if no -bios option is included. Now 2 releases passed, it's time to change the default behavior to load the default OpenSBI firmware automatically. The firmware is included with the QEMU release and no user interaction is required. All a user needs to do is specify the kernel they want to boot with the -kernel option. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1588335545-649-1-git-send-email-bmeng.cn@gmail.com Message-Id: <1588335545-649-1-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-06-03riscv: Suppress the error report for QEMU testing with riscv_find_firmware()Bin Meng1-3/+11
We only ship plain binary bios images in the QEMU source. With Spike machine that uses ELF images as the default bios, running QEMU test will complain hence let's suppress the error report for QEMU testing. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Anup Patel <anup@brainfault.org> Message-Id: <1588348254-7241-6-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-06-01hw/mips: fuloong2e: Set preferred page size to 16KBHuacai Chen1-0/+1
Loongson processor prefers 16KB page size in system emulator, so let's define mc->minimum_page_bits to 14. Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Huacai Chen <chenhc@lemote.com> Reviewed-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Signed-off-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Message-Id: <1586337380-25217-2-git-send-email-chenhc@lemote.com>
2020-06-01hw/mips: Add CPU IRQ3 delivery for KVMHuacai Chen1-1/+1
Currently, KVM/MIPS only deliver I/O interrupt via IP2, this patch add IP3 delivery as well, because Loongson-3 based machine use both IRQ2 (CPU's IP2) and IRQ3 (CPU's IP3). Signed-off-by: Huacai Chen <chenhc@lemote.com> Co-developed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Signed-off-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Message-Id: <1588501221-1205-4-git-send-email-chenhc@lemote.com>
2020-05-30hw/m68k/mcf52xx: Replace hw_error() by qemu_log_mask()Philippe Mathieu-Daudé4-15/+30
hw_error() calls exit(). This a bit overkill when we can log the accesses as unimplemented or guest error. When fuzzing the devices, we don't want the whole process to exit. Replace some hw_error() calls by qemu_log_mask(). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200526094052.1723-3-f4bug@amsat.org> Reviewed-by: Thomas Huth <huth@tuxfamily.org> Signed-off-by: Thomas Huth <huth@tuxfamily.org>
2020-05-30hw/m68k/mcf5206: Reduce m5206_mbar_read/write() offset arg to 16-bitPhilippe Mathieu-Daudé1-4/+4
All calls to m5206_mbar_read/m5206_mbar_write are used with 'offset = hwaddr & 0x3ff', so we are sure the offset fits in 16-bit. Suggested-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200526094052.1723-2-f4bug@amsat.org> Signed-off-by: Thomas Huth <huth@tuxfamily.org>
2020-05-28Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200528-pull-request' ↵Peter Maydell10-281/+299
into staging hw/dispaly/sm501: bugfixes, add sanity checks. hw/display: use tracepoints, misc cleanups. # gpg: Signature made Thu 28 May 2020 13:35:32 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20200528-pull-request: (21 commits) sm501: Remove obsolete changelog and todo comment sm501: Optimize small overlapping blits sm501: Replace hand written implementation with pixman where possible sm501: Clean up local variables in sm501_2d_operation sm501: Use BIT(x) macro to shorten constant sm501: Shorten long variable names in sm501_2d_operation sm501: Convert printf + abort to qemu_log_mask hw/display/pxa2xx_lcd: Replace printf() call by qemu_log_mask() hw/display/omap_dss: Replace fprintf() call by qemu_log_mask(LOG_UNIMP) hw/display/exynos4210_fimd: Use qemu_log_mask(GUEST_ERROR) hw/display/vmware_vga: Let the PCI device own its I/O MemoryRegion hw/display/vmware_vga: Replace printf() calls by qemu_log_mask(ERROR) hw/display/xlnx_dp: Replace disabled DPRINTF() by error_report() hw/display/dpcd: Convert debug printf()s to trace events hw/display/dpcd: Fix memory region size hw/display/cirrus_vga: Convert debug printf() to trace event hw/display/cirrus_vga: Use qemu_log_mask(ERROR) instead of debug printf hw/display/cirrus_vga: Use qemu_log_mask(UNIMP) instead of debug printf hw/display/cirrus_vga: Convert debug printf() to trace event hw/display/cg3: Convert debug printf()s to trace events ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-28Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2020-05-27' ↵Peter Maydell8-44/+32
into staging Error reporting patches for 2020-05-27 # gpg: Signature made Wed 27 May 2020 06:48:02 BST # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-error-2020-05-27: i386: Fix x86_cpu_load_model() error API violation arm/sabrelite: Consistently use &error_fatal in sabrelite_init() mips/boston: Plug memory leak in boston_mach_init() mips/boston: Fix boston_mach_init() error handling mips/malta: Fix create_cps() error handling error: Use error_reportf_err() where appropriate tests/migration: Tighten error checking s390x/cpumodel: Fix harmless misuse of visit_check_struct() xen: Fix and improve handling of device_add usb-host errors nvdimm: Plug memory leak in uuid property setter Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-28sm501: Remove obsolete changelog and todo commentBALATON Zoltan1-18/+1
Also update copyright year for latest changes Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 1392cad2ad1315a5a50409970e0af061821462e6.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28sm501: Optimize small overlapping blitsBALATON Zoltan1-4/+11
AmigaOS tends to do a lot of small blits (even 1 pixel). Avoid malloc overhead by keeping around a buffer for this and only alloc when blitting larger areas. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 7946852258d528497e85f465327fc90b5c3b59fb.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28sm501: Replace hand written implementation with pixman where possibleBALATON Zoltan1-88/+119
Besides being faster this should also prevent malicious guests to abuse 2D engine to overwrite data or cause a crash. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 58666389b6cae256e4e972a32c05cf8aa51bffc0.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.1 at 2024-11-20 13:31:20 +0000