aboutsummaryrefslogtreecommitdiff
path: root/tests/qtest/meson.build
AgeCommit message (Collapse)AuthorFilesLines
2022-09-27tests/qtest: Build test-filter-{mirror, redirector} cases for posix onlyBin Meng1-20/+16
The test-filter-{mirror,redirector} cases use socketpair() API that is only available on POSIX and should only be built for POSIX. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220925113032.1949844-30-bmeng.cn@gmail.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-08-25tests/qtest: Build cases that use memory-backend-file for posix onlyBin Meng1-1/+2
As backends/meson.build tells us, hostmem-file.c is only supported on POSIX platforms, hence any test case that utilizes the memory backend file should be guarded by CONFIG_POSIX too. Signed-off-by: Bin Meng <bin.meng@windriver.com> Acked-by: Thomas Huth <thuth@redhat.com> Message-Id: <20220824094029.1634519-19-bmeng.cn@gmail.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-08-25tests/qtest: Build e1000e-test for posix onlyBin Meng1-1/+3
The whole e1000e-test test case relies on socketpair() which does not exist on win32. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20220824094029.1634519-17-bmeng.cn@gmail.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-08-08tests/qtest: add scenario for -readconfig handlingDaniel P. Berrangé1-0/+1
This test of -readconfig validates the last three regressions we have fixed with -readconfig: * Interpretation of memory size units as MiB not bytes * Allow use of [spice] * Allow use of [object] Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20220805115529.124544-2-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-07-18Align Raspberry Pi DMA interrupts with Linux DTSAndrey Makarov1-1/+2
There is nothing in the specs on DMA engine interrupt lines: it should have been in the "BCM2835 ARM Peripherals" datasheet but the appropriate "ARM peripherals interrupt table" (p.113) is nearly empty. All Raspberry Pi models 1-3 (based on bcm2835) have Linux device tree (arch/arm/boot/dts/bcm2835-common.dtsi +25): /* dma channel 11-14 share one irq */ This information is repeated in the driver code (drivers/dma/bcm2835-dma.c +1344): /* * in case of channel >= 11 * use the 11th interrupt and that is shared */ In this patch channels 0--10 and 11--14 are handled separately. Signed-off-by: Andrey Makarov <andrey.makarov@auriga.com> Message-id: 20220716113210.349153-1-andrey.makarov@auriga.com [PMM: fixed checkpatch nits] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-05-16Merge tag 'for_upstream' of git://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Richard Henderson1-0/+4
into staging virtio,pc,pci: fixes,cleanups,features most of CXL support fixes, cleanups all over the place Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmKCuLIPHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRpdDUH/12SmWaAo+0+SdIHgWFFxsmg3t/EdcO38fgi # MV+GpYdbp6TlU3jdQhrMZYmFdkVVydBdxk93ujCLbFS0ixTsKj31j0IbZMfdcGgv # SLqnV+E3JdHqnGP39q9a9rdwYWyqhkgHoldxilIFW76ngOSapaZVvnwnOMAMkf77 # 1LieL4/Xq7N9Ho86Zrs3IczQcf0czdJRDaFaSIu8GaHl8ELyuPhlSm6CSqqrEEWR # PA/COQsLDbLOMxbfCi5v88r5aaxmGNZcGbXQbiH9qVHw65nlHyLH9UkNTdJn1du1 # f2GYwwa7eekfw/LCvvVwxO1znJrj02sfFai7aAtQYbXPvjvQiqA= # =xdSk # -----END PGP SIGNATURE----- # gpg: Signature made Mon 16 May 2022 01:48:50 PM PDT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [undefined] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of git://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (86 commits) vhost-user-scsi: avoid unlink(NULL) with fd passing virtio-net: don't handle mq request in userspace handler for vhost-vdpa vhost-vdpa: change name and polarity for vhost_vdpa_one_time_request() vhost-vdpa: backend feature should set only once vhost-net: fix improper cleanup in vhost_net_start vhost-vdpa: fix improper cleanup in net_init_vhost_vdpa virtio-net: align ctrl_vq index for non-mq guest for vhost_vdpa virtio-net: setup vhost_dev and notifiers for cvq only when feature is negotiated hw/i386/amd_iommu: Fix IOMMU event log encoding errors hw/i386: Make pic a property of common x86 base machine type hw/i386: Make pit a property of common x86 base machine type include/hw/pci/pcie_host: Correct PCIE_MMCFG_SIZE_MAX include/hw/pci/pcie_host: Correct PCIE_MMCFG_BUS_MASK docs/vhost-user: Clarifications for VHOST_USER_ADD/REM_MEM_REG vhost-user: more master/slave things virtio: add vhost support for virtio devices virtio: drop name parameter for virtio_init() virtio/vhost-user: dynamically assign VhostUserHostNotifiers hw/virtio/vhost-user: don't suppress F_CONFIG when supported include/hw: start documenting the vhost API ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-05-16tests: add migration tests of TLS with x509 credentialsDaniel P. Berrangé1-0/+5
This validates that we correctly handle migration success and failure scenarios when using TLS with x509 certificates. There are quite a few different scenarios that matter in relation to hostname validation. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20220426160048.812266-5-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> dgilbert: Manual merge due to ifdef change in 3
2022-05-16tests: add migration tests of TLS with PSK credentialsDaniel P. Berrangé1-1/+6
This validates that we correctly handle migration success and failure scenarios when using TLS with pre shared keys. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20220426160048.812266-4-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2022-05-13qtest/cxl: Introduce initial test for pxb-cxl only.Jonathan Cameron1-0/+4
Initial test with just pxb-cxl. Other tests will be added alongside functionality. Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20220429144110.25167-16-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2022-05-07meson: use have_vhost_* variables to pick sourcesPaolo Bonzini1-1/+3
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-05-02hw/gpio/aspeed_gpio: Fix QOM pin propertyPeter Delevoryas1-1/+2
I was setting gpioV4-7 to "1110" using the QOM pin property handler and noticed that lowering gpioV7 was inadvertently lowering gpioV4-6 too. (qemu) qom-set /machine/soc/gpio gpioV4 true (qemu) qom-set /machine/soc/gpio gpioV5 true (qemu) qom-set /machine/soc/gpio gpioV6 true (qemu) qom-get /machine/soc/gpio gpioV4 true (qemu) qom-set /machine/soc/gpio gpioV7 false (qemu) qom-get /machine/soc/gpio gpioV4 false An expression in aspeed_gpio_set_pin_level was using a logical NOT operator instead of a bitwise NOT operator: value &= !pin_mask; The original author probably intended to make a bitwise NOT expression "~", but mistakenly used a logical NOT operator "!" instead. Some programming languages like Rust use "!" for both purposes. Fixes: 4b7f956862dc ("hw/gpio: Add basic Aspeed GPIO model for AST2400 and AST2500") Signed-off-by: Peter Delevoryas <pdel@fb.com> Message-Id: <20220502080827.244815-1-pdel@fb.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-04-28meson, configure: move libgio test to mesonPaolo Bonzini1-3/+2
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-04-20tests/qtest: Move the fuzz tests to x86 onlyThomas Huth1-7/+6
The fuzz tests are currently scheduled for all targets, but their setup code limits the run to "i386", so that these tests always show "SKIP" on other targets. Move it to the right x86 list in meson.build, then we can drop the architecture check during runtime, too. Message-Id: <20220414130127.719528-1-thuth@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-04-20tests/qtest: Enable more tests for the "mipsel" targetThomas Huth1-11/+3
Allow the same set of tests for all MIPS targets, so that "mipsel" now gets some additional test coverage, too. While we're at it, simplify the definitions for qtests_mips64 and qtests_mips64el. Message-Id: <20220414114655.604391-1-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-03-14qtest/meson.build: check CONFIG_TCG for boot-serial-test in qtests_ppcDaniel Henrique Barboza1-1/+2
'boot-serial-test' does not work with a QEMU built with --disable-tcg in a IBM POWER9 host. The reason is that without TCG QEMU will default to KVM acceleration, but then the KVM module in IBM POWER hosts aren't able to handle other CPUs. The result is that the test will break with a KVM error when trying to ruin the ppce500 test: $ QTEST_QEMU_BINARY=./qemu-system-ppc64 ./tests/qtest/boot-serial-test /ppc64/boot-serial/ppce500: qemu-system-ppc64: -accel tcg: invalid accelerator tcg error: kvm run failed Invalid argument NIP 0000000000f00000 LR 0000000000000000 CTR 0000000000000000 XER 0000000000000000 CPU#0 MSR 0000000000000000 HID0 0000000000000000 HF 24020002 iidx 1 didx 1 TB 00000000 00000000 DECR 0 (...) ** (./tests/qtest/boot-serial-test:1935760): ERROR **: 07:44:03.010: Failed to find expected string. Please check '/tmp/qtest-boot-serial-sJ78sqg' Fix it by checking CONFIG_TCG before compiling boot-serial-test. Cc: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20220303153517.168943-3-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-03-14qtest/meson.build: check CONFIG_TCG for prom-env-test in qtests_ppcDaniel Henrique Barboza1-1/+2
'prom-env-test' is a TCG test that will fail if QEMU is compiled with --disable-tcg: $ QTEST_QEMU_BINARY=./qemu-system-ppc64 ./tests/qtest/prom-env-test /ppc64/prom-env/mac99: qemu-system-ppc64: -accel tcg: invalid accelerator tcg (... hangs indefinitely ...) Fix it by checking CONFIG_TCG before compiling prom-env-test. Cc: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20220303153517.168943-2-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-03-08hw/sensor: add Intersil ISL69260 device modelTitus Rwantare1-0/+1
Signed-off-by: Titus Rwantare <titusr@google.com> Reviewed-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Corey Minyard <cminyard@mvista.com> Message-Id: <20220307200605.4001451-8-titusr@google.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2022-03-02tests/qtest: add qtests for npcm7xx sdhciShengtan Mao1-0/+1
Reviewed-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Chris Rauer <crauer@google.com> Signed-off-by: Shengtan Mao <stmao@google.com> Signed-off-by: Patrick Venture <venture@google.com> Message-id: 20220225174451.192304-1-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-02-08hw/sensor: Add lsm303dlhc magnetometer deviceKevin Townsend1-0/+1
This commit adds emulation of the magnetometer on the LSM303DLHC. It allows the magnetometer's X, Y and Z outputs to be set via the mag-x, mag-y and mag-z properties, as well as the 12-bit temperature output via the temperature property. Sensor can be enabled with 'CONFIG_LSM303DLHC_MAG=y'. Signed-off-by: Kevin Townsend <kevin.townsend@linaro.org> Message-id: 20220130095032.35392-1-kevin.townsend@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-02-06ACPI ERST: qtest for ERSTEric DeVolder1-0/+2
This change provides a qtest that locates and then does a simple interrogation of the ERST feature within the guest. Signed-off-by: Eric DeVolder <eric.devolder@oracle.com> Reviewed-by: Ani Sinha <ani@anisinha.ca> Message-Id: <1643402289-22216-9-git-send-email-eric.devolder@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2022-01-27build-sys: fix a meson deprecation warningMarc-André Lureau1-1/+1
WARNING: Deprecated features used: * 0.56.0: {'meson.source_root'} Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reported-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20220113162148.3621818-1-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-01-12meson: build all modules by defaultPaolo Bonzini1-2/+1
With more recent versions of Meson, the build.ninja file is more selective as to what is built by default, and not building the modules results in test failures. Mark the modules as built-by-default and, to make the dependencies more precise, also require them to be up-to-date before running tests. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/801 Tested-by: Li Zhang <lizhang@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-12-22tests/qtest: Make the filter tests independent from a specific NICThomas Huth1-9/+31
These filter tests need a NIC, no matter which one, so they use a common NIC by default. However, these common NIC models might not always have been compiled into the QEMU target binary, so assuming that a certain NIC is available is a bad idea. Since the exact type of NIC does not really matter for these tests, let's switch to "-nic" instead of "-netdev" so that QEMU can simply pick a default NIC for us. This way we can now run the tests on other targets that have a default machine with an on-board/default NIC, too. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20211220103025.311759-1-thuth@redhat.com> Reviewed-by: Zhang Chen <chen.zhang@intel.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-12-21tests: start dbus-display-testMarc-André Lureau1-0/+8
Cover basic display interface usage. More cases to be added to cover disconnections, multiple connections, corner cases. At this point, they would be better written in Rust or Python though. The proxy also covers reading the properties, since they are automatically loaded at creation. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com>
2021-12-21backends: move dbus-vmstate1.xml to backends/Marc-André Lureau1-1/+1
Although not used by the backend itself, use a common location for documentation and sharing purposes. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com>
2021-12-16Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson1-0/+1
* improve compatibility for macOS scripts/entitlement.sh (Evan) * add support for KVM_GUESTDBG_BLOCKIRQ (Maxim) * update linux-headers to Linux 5.16 (myself) * configure cleanups (myself) * lsi53c895a assertion failure fix (Philippe) * fix incorrect description for die-id (Yanan) * support for NUMA in SGX enclave memory (Yang Zhong) # gpg: Signature made Wed 15 Dec 2021 02:49:44 AM PST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [unknown] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: configure: remove dead variables doc: Add the SGX numa description numa: Support SGX numa in the monitor and Libvirt interfaces numa: Enable numa for SGX EPC sections kvm: add support for KVM_GUESTDBG_BLOCKIRQ gdbstub, kvm: let KVM report supported singlestep flags gdbstub: reject unsupported flags in handle_set_qemu_sstep linux-headers: update to 5.16-rc1 virtio-gpu: do not byteswap padding scripts/entitlement.sh: Use backward-compatible cp flags qapi/machine.json: Fix incorrect description for die-id tests/qtest: Add fuzz-lsi53c895a-test hw/scsi/lsi53c895a: Do not abort when DMA requested and no data queued Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-12-15tests: qtest: Add virtio-iommu testEric Auger1-0/+1
Add the framework to test the virtio-iommu-pci device and tests exercising the attach/detach, map/unmap API. Signed-off-by: Eric Auger <eric.auger@redhat.com> Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Acked-by: Thomas Huth <thuth@redhat.com> Message-Id: <20211127072910.1261824-5-eric.auger@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-12-15tests/qtest: Fence the tests that need xlnx-zcu102 with CONFIG_XLNX_ZYNQMP_ARMThomas Huth1-2/+1
The 'xlnx-can-test' and the 'fuzz-xlnx-dp-test' need the "xlnx-zcu102" machine and thus should only be built and run if CONFIG_XLNX_ZYNQMP_ARM is enabled. Message-Id: <20211201104347.51922-3-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-12-15tests/qtest: Run the PPC 32-bit tests with the 64-bit target binary, tooThomas Huth1-0/+1
The ppc64 target is a superset of the 32-bit target, so we should include the tests here, too. This used to be done in the past already, but it got lost during the conversion to meson. Fixes: a2ce7dbd91 ("meson: convert tests/qtest to meson") Message-Id: <20211201104347.51922-2-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-12-15tests/qtest: add some tests for virtio-net failoverLaurent Vivier1-0/+4
Add test cases to test several error cases that must be generated by invalid failover configuration. Add a combination of coldplug and hotplug test cases to be sure the primary is correctly managed according the presence or not of the STANDBY feature. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20211208130350.10178-3-lvivier@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-11-30tests/qtest: Add fuzz-lsi53c895a-testPhilippe Mathieu-Daudé1-0/+1
Without the previous commit, this test triggers: $ make check-qtest-x86_64 [...] Running test qtest-x86_64/fuzz-lsi53c895a-test qemu-system-x86_64: hw/scsi/lsi53c895a.c:624: lsi_do_dma: Assertion `s->current' failed. ERROR qtest-x86_64/fuzz-lsi53c895a-test - too few tests run (expected 1, got 0) Suggested-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20211123111732.83137-3-philmd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-10-05meson: switch minimum meson version to 0.58.2, minimum recommended to 0.59.2Paolo Bonzini1-1/+1
Meson 0.58.2 does not need b_staticpic=$pie anymore, and has stabilized the keyval module. Remove the workaround and use a few replacements for features deprecated in the 0.57.0 release cycle. One feature that we would like to use is passing dependencies to summary. However, that was broken in 0.59.0 and 0.59.1. Therefore, use the embedded Meson if the host has anything older than 0.59.2, but allow --meson= to use 0.58.2. Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-09-30tests: qtest: bios-tables-test depends on the unpacked edk2 ROMsPaolo Bonzini1-3/+3
Skip the test if bzip2 is not available, and run it after they are uncompressed. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20210923105529.3845741-2-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-08-31hw/display/xlnx_dp: fix an out-of-bounds read in xlnx_dp_readQiang Liu1-0/+1
xlnx_dp_read allows an out-of-bounds read at its default branch because of an improper index. According to https://www.xilinx.com/html_docs/registers/ug1087/ug1087-zynq-ultrascale-registers.html (DP Module), registers 0x3A4/0x3A4/0x3AC are allowed. DP_INT_MASK 0x000003A4 32 mixed 0xFFFFF03F Interrupt Mask Register for intrN. DP_INT_EN 0x000003A8 32 mixed 0x00000000 Interrupt Enable Register. DP_INT_DS 0x000003AC 32 mixed 0x00000000 Interrupt Disable Register. In xlnx_dp_write, when the offset is 0x3A8 and 0x3AC, the virtual device will write s->core_registers[0x3A4 >> 2]. That is to say, the maxize of s->core_registers could be ((0x3A4 >> 2) + 1). However, the current size of s->core_registers is (0x3AF >> >> 2), that is ((0x3A4 >> 2) + 2), which is out of the range. In xlxn_dp_read, the access to offset 0x3A8 or 0x3AC will be directed to the offset 0x3A8 (incorrect functionality) or 0x3AC (out-of-bounds read) rather than 0x3A4. This patch enforces the read access to offset 0x3A8 and 0x3AC to 0x3A4, but does not adjust the size of s->core_registers to avoid breaking migration. Fixes: 58ac482a66de ("introduce xlnx-dp") Signed-off-by: Qiang Liu <cyruscyliu@gmail.com> Acked-by: Thomas Huth <thuth@redhat.com> Acked-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <1628059910-12060-1-git-send-email-cyruscyliu@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-08-11storage-daemon: Add missing build dependency to the vhost-user-blk-testThomas Huth1-2/+5
vhost-user-blk-test needs the qemu-storage-daemon, otherwise it currently hangs. So make sure that we build the daemon before running the tests. Message-Id: <20210811094705.131314-1-thuth@redhat.com> Tested-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-07-12hw/sd/sdcard: Check for valid address range in SEND_WRITE_PROT (CMD30)Philippe Mathieu-Daudé1-0/+1
OSS-Fuzz found sending illegal addresses when querying the write protection bits triggers an assertion: qemu-fuzz-i386: hw/sd/sd.c:824: uint32_t sd_wpbits(SDState *, uint64_t): Assertion `wpnum < sd->wpgrps_size' failed. ==11578== ERROR: libFuzzer: deadly signal #8 0x7ffff628e091 in __assert_fail #9 0x5555588f1a3c in sd_wpbits hw/sd/sd.c:824:9 #10 0x5555588dd271 in sd_normal_command hw/sd/sd.c:1383:38 #11 0x5555588d777c in sd_do_command hw/sd/sd.c #12 0x555558cb25a0 in sdbus_do_command hw/sd/core.c:100:16 #13 0x555558e02a9a in sdhci_send_command hw/sd/sdhci.c:337:12 #14 0x555558dffa46 in sdhci_write hw/sd/sdhci.c:1187:9 #15 0x5555598b9d76 in memory_region_write_accessor softmmu/memory.c:489:5 Similarly to commit 8573378e62d ("hw/sd: fix out-of-bounds check for multi block reads"), check the address range before sending the status of the write protection bits. Include the qtest reproducer provided by Alexander Bulekov: $ make check-qtest-i386 ... Running test qtest-i386/fuzz-sdcard-test qemu-system-i386: ../hw/sd/sd.c:824: sd_wpbits: Assertion `wpnum < sd->wpgrps_size' failed. Reported-by: OSS-Fuzz (Issue 29225) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/450 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210702155900.148665-4-f4bug@amsat.org>
2021-07-11Merge remote-tracking branch 'remotes/cminyard/tags/for-qemu-6.1-2' into stagingPeter Maydell1-0/+2
Some qemu updates for IPMI and I2C Move some ADC file to where they belong and move some sensors to a sensor directory, since with new BMCs coming in lots of different sensors should be coming in. Keep from cluttering things up. Add support for I2C PMBus devices. Replace the confusing and error-prone i2c_send_recv and i2c_transfer with specific send and receive functions. Several errors have already been made with these, avoid any new errors. Fix the watchdog_expired field in the IPMI watchdog, it's not a bool, it's a u8. After a vmstate transfer, the new value could be wrong. # gpg: Signature made Fri 09 Jul 2021 17:25:04 BST # gpg: using RSA key FD0D5CE67CE0F59A6688268661F38C90919BFF81 # gpg: Good signature from "Corey Minyard <cminyard@mvista.com>" [unknown] # gpg: aka "Corey Minyard <minyard@acm.org>" [unknown] # gpg: aka "Corey Minyard <corey@minyard.net>" [unknown] # gpg: aka "Corey Minyard <minyard@mvista.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: FD0D 5CE6 7CE0 F59A 6688 2686 61F3 8C90 919B FF81 * remotes/cminyard/tags/for-qemu-6.1-2: (24 commits) tests/qtest: add tests for MAX34451 device model hw/misc: add MAX34451 device tests/qtest: add tests for ADM1272 device model hw/misc: add ADM1272 device hw/i2c: add support for PMBus ipmi/sim: fix watchdog_expired data type error in IPMIBmcSim struct hw/i2c: Introduce i2c_start_recv() and i2c_start_send() hw/i2c: Extract i2c_do_start_transfer() from i2c_start_transfer() hw/i2c: Make i2c_start_transfer() direction argument a boolean hw/i2c: Rename i2c_set_slave_address() -> i2c_slave_set_address() hw/i2c: Remove confusing i2c_send_recv() hw/misc/auxbus: Replace i2c_send_recv() by i2c_recv() & i2c_send() hw/misc/auxbus: Replace 'is_write' boolean by its value hw/misc/auxbus: Explode READ_I2C / WRITE_I2C_MOT cases hw/misc/auxbus: Fix MOT/classic I2C mode hw/i2c/ppc4xx_i2c: Replace i2c_send_recv() by i2c_recv() & i2c_send() hw/i2c/ppc4xx_i2c: Add reference to datasheet hw/display/sm501: Replace i2c_send_recv() by i2c_recv() & i2c_send() hw/display/sm501: Simplify sm501_i2c_write() logic hw/input/lm832x: Define TYPE_LM8323 in public header ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-08tests/qtest: add tests for MAX34451 device modelTitus Rwantare1-0/+1
Signed-off-by: Titus Rwantare <titusr@google.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-Id: <20210708172556.1868139-6-titusr@google.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-07-08tests/qtest: add tests for ADM1272 device modelTitus Rwantare1-0/+1
Signed-off-by: Titus Rwantare <titusr@google.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-Id: <20210708172556.1868139-4-titusr@google.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-06-17hw/audio/sb16: Avoid assertion by restricting I/O sampling rate rangePhilippe Mathieu-Daudé1-0/+1
While the SB16 seems to work up to 48000 Hz, the "Sound Blaster Series Hardware Programming Guide" limit the sampling range from 4000 Hz to 44100 Hz (Section 3-9, 3-10: Digitized Sound I/O Programming, tables 3-2 and 3-3). Later, section 6-15 (DSP Commands) is more specific regarding the 41h / 42h registers (Set digitized sound output sampling rate): Valid sampling rates range from 5000 to 45000 Hz inclusive. There is no comment regarding error handling if the register is filled with an out-of-range value. (See also section 3-28 "8-bit or 16-bit Auto-initialize Transfer"). Assume limits are enforced in hardware. This fixes triggering an assertion in audio_calloc(): #1 abort #2 audio_bug audio/audio.c:119:9 #3 audio_calloc audio/audio.c:154:9 #4 audio_pcm_sw_alloc_resources_out audio/audio_template.h:116:15 #5 audio_pcm_sw_init_out audio/audio_template.h:175:11 #6 audio_pcm_create_voice_pair_out audio/audio_template.h:410:9 #7 AUD_open_out audio/audio_template.h:503:14 #8 continue_dma8 hw/audio/sb16.c:216:20 #9 dma_cmd8 hw/audio/sb16.c:276:5 #10 command hw/audio/sb16.c:0 #11 dsp_write hw/audio/sb16.c:949:13 #12 portio_write softmmu/ioport.c:205:13 #13 memory_region_write_accessor softmmu/memory.c:491:5 #14 access_with_adjusted_size softmmu/memory.c:552:18 #15 memory_region_dispatch_write softmmu/memory.c:0:13 #16 flatview_write_continue softmmu/physmem.c:2759:23 #17 flatview_write softmmu/physmem.c:2799:14 #18 address_space_write softmmu/physmem.c:2891:18 #19 cpu_outw softmmu/ioport.c:70:5 [*] http://www.baudline.com/solutions/full_duplex/sb16_pci/index.html OSS-Fuzz Report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29174 Fixes: 85571bc7415 ("audio merge (malc)") Buglink: https://bugs.launchpad.net/bugs/1910603 Tested-by: Qiang Liu <cyruscyliu@gmail.com> Reviewed-by: Qiang Liu <cyruscyliu@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210616104349.2398060-1-f4bug@amsat.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-05-18test: new qTest case to test the vhost-user-blk-serverCoiby Xu1-0/+4
This test case has the same tests as tests/virtio-blk-test.c except for tests have block_resize. Since the vhost-user-blk export only serves one client one time, two exports are started by qemu-storage-daemon for the hotplug test. Suggested-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Coiby Xu <coiby.xu@gmail.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210309094106.196911-3-stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20210322092327.150720-2-stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-05-12Remove the deprecated moxie targetThomas Huth1-2/+0
There are no known users of this CPU anymore, and there are no binaries available online which could be used for regression tests, so the code has likely completely bit-rotten already. It's been marked as deprecated since two releases now and nobody spoke up that there is still a need to keep it, thus let's remove it now. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210430160355.698194-1-thuth@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [Commit message typos fixed, trivial conflicts resolved] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2021-05-01tests/qtest: Rename m25p80 test in aspeed_smc testCédric Le Goater1-2/+2
The m25p80 test depends on the Aspeed SMC controller to test our SPI-NOR flash support. Reflect this dependency by changing the name. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-Id: <20210407171637.777743-17-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-05-01tests/qtest: Add test for Aspeed HACEJoel Stanley1-0/+3
This adds a test for the Aspeed Hash and Crypto (HACE) engine. It tests the currently implemented behavior of the hash functionality. The tests are similar, but are cut/pasted instead of broken out into a common function so the assert machinery produces useful output when a test fails. Co-developed-by: Cédric Le Goater <clg@kaod.org> Co-developed-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com> Acked-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Joel Stanley <joel@jms.id.au> Message-Id: <20210409000253.1475587-4-joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-04-12tests/qtest: add tests for am53c974 deviceMark Cave-Ayland1-0/+1
Use the autogenerated fuzzer test cases as the basis for a set of am53c974 regression tests. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-13-mark.cave-ayland@ilande.co.uk>
2021-04-08Revert "tests: Add tests for query-netdev command"Jason Wang1-3/+0
Several issues has been reported for query-netdev series. Consider it's late in the rc, this reverts commit 3c3b656885473ef0d699290ba966177f17839aa5. Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-22net/eth: Read ip6_ext_hdr_routing buffer before accessing itPhilippe Mathieu-Daudé1-0/+1
We can't know the caller read enough data in the memory pointed by ext_hdr to cast it as a ip6_ext_hdr_routing. Declare rt_hdr on the stack and fill it again from the iovec. Since we already checked there is enough data in the iovec buffer, simply add an assert() call to consume the bytes_read variable. This fix a 2 bytes buffer overrun in eth_parse_ipv6_hdr() reported by QEMU fuzzer: $ cat << EOF | ./qemu-system-i386 -M pc-q35-5.0 \ -accel qtest -monitor none \ -serial none -nographic -qtest stdio outl 0xcf8 0x80001010 outl 0xcfc 0xe1020000 outl 0xcf8 0x80001004 outw 0xcfc 0x7 write 0x25 0x1 0x86 write 0x26 0x1 0xdd write 0x4f 0x1 0x2b write 0xe1020030 0x4 0x190002e1 write 0xe102003a 0x2 0x0807 write 0xe1020048 0x4 0x12077cdd write 0xe1020400 0x4 0xba077cdd write 0xe1020420 0x4 0x190002e1 write 0xe1020428 0x4 0x3509d807 write 0xe1020438 0x1 0xe2 EOF ================================================================= ==2859770==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdef904902 at pc 0x561ceefa78de bp 0x7ffdef904820 sp 0x7ffdef904818 READ of size 1 at 0x7ffdef904902 thread T0 #0 0x561ceefa78dd in _eth_get_rss_ex_dst_addr net/eth.c:410:17 #1 0x561ceefa41fb in eth_parse_ipv6_hdr net/eth.c:532:17 #2 0x561cef7de639 in net_tx_pkt_parse_headers hw/net/net_tx_pkt.c:228:14 #3 0x561cef7dbef4 in net_tx_pkt_parse hw/net/net_tx_pkt.c:273:9 #4 0x561ceec29f22 in e1000e_process_tx_desc hw/net/e1000e_core.c:730:29 #5 0x561ceec28eac in e1000e_start_xmit hw/net/e1000e_core.c:927:9 #6 0x561ceec1baab in e1000e_set_tdt hw/net/e1000e_core.c:2444:9 #7 0x561ceebf300e in e1000e_core_write hw/net/e1000e_core.c:3256:9 #8 0x561cef3cd4cd in e1000e_mmio_write hw/net/e1000e.c:110:5 Address 0x7ffdef904902 is located in stack of thread T0 at offset 34 in frame #0 0x561ceefa320f in eth_parse_ipv6_hdr net/eth.c:486 This frame has 1 object(s): [32, 34) 'ext_hdr' (line 487) <== Memory access at offset 34 overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow net/eth.c:410:17 in _eth_get_rss_ex_dst_addr Shadow bytes around the buggy address: 0x10003df188d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10003df188e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10003df188f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10003df18900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10003df18910: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 =>0x10003df18920:[02]f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 0x10003df18930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10003df18940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10003df18950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10003df18960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10003df18970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Stack left redzone: f1 Stack right redzone: f3 ==2859770==ABORTING Add the corresponding qtest case with the fuzzer reproducer. FWIW GCC 11 similarly reported: net/eth.c: In function 'eth_parse_ipv6_hdr': net/eth.c:410:15: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds] 410 | if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) { | ~~~~~^~~~~~~ net/eth.c:485:24: note: while referencing 'ext_hdr' 485 | struct ip6_ext_hdr ext_hdr; | ^~~~~~~ net/eth.c:410:38: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds] 410 | if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) { | ~~~~~^~~~~~~~~ net/eth.c:485:24: note: while referencing 'ext_hdr' 485 | struct ip6_ext_hdr ext_hdr; | ^~~~~~~ Cc: qemu-stable@nongnu.org Buglink: https://bugs.launchpad.net/qemu/+bug/1879531 Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Miroslav Rezanina <mrezanin@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com> Fixes: eb700029c78 ("net_pkt: Extend packet abstraction as required by e1000e functionality") Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-19tests/qtest: cleanup the testcase for bug 1878642Paolo Bonzini1-1/+1
Clean up the writes to the configuration space and the PM region, and rename the test to lpc-ich9-test. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-16tests/qtest: Only run fuzz-virtio-scsi when virtio-scsi is availablePhilippe Mathieu-Daudé1-0/+1
This test fails when QEMU is built without the virtio-scsi device, restrict it to its availability. Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-16tests/qtest: Only run fuzz-megasas-test if megasas device is availablePhilippe Mathieu-Daudé1-1/+3
This test fails when QEMU is built without the megasas device, restrict it to its availability. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.1 at 2025-01-24 14:07:44 +0000