summary refs log tree commit diff stats
Commit message (Collapse)AuthorAgeFilesLines
...
| * | target/alpha: Only build sys_helper.c on system emulationPhilippe Mathieu-Daudé2024-01-192-5/+4
| | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231207105426.49339-3-philmd@linaro.org>
| * | target/alpha: Extract clk_helper.c from sys_helper.cPhilippe Mathieu-Daudé2024-01-193-15/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Except helper_load_pcc(), all helpers from sys_helper.c are system-emulation specific. In preparation of restricting sys_helper.c to system emulation, extract helper_load_pcc() to clk_helper.c. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231207105426.49339-2-philmd@linaro.org>
| * | accel/tcg: Remove tb_invalidate_phys_page() from system emulationPhilippe Mathieu-Daudé2024-01-192-24/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since previous commit, tb_invalidate_phys_page() is not used anymore in system emulation. Make it static for user emulation and remove its public declaration in "exec/translate-all.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20231130205600.35727-1-philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
| * | accel/tcg: Remove unused tb_invalidate_phys_addr()Philippe Mathieu-Daudé2024-01-192-34/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit e3f7c801f1 introduced the TCGCPUOps::debug_check_breakpoint() handler, and commit 10c37828b2 "moved breakpoint recognition outside of translation", so "we no longer need to flush any TBs when changing BPs". The last target using tb_invalidate_phys_addr() was converted to the debug_check_breakpoint(), so this function is now unused. Remove it. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231130203241.31099-1-philmd@linaro.org>
| * | tests/tcg/xtensa: add icount/ibreak priority testMax Filippov2024-01-191-1/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When icount and ibreak exceptions are due to happen on the same address icount has higher precedence. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20231130171920.3798954-3-jcmvbkbc@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * | target/xtensa: use generic instruction breakpoint infrastructureMax Filippov2024-01-195-33/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't embed ibreak exception generation into TB and don't invalidate TB on ibreak address change. Add CPUBreakpoint pointers to xtensa CPUArchState, use cpu_breakpoint_insert/cpu_breakpoint_remove_by_ref to manage ibreak breakpoints and provide TCGCPUOps::debug_check_breakpoint callback that recognizes valid instruction breakpoints. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20231130171920.3798954-2-jcmvbkbc@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * | accel: Do not set CPUState::can_do_io in non-TCG accelsPhilippe Mathieu-Daudé2024-01-193-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'can_do_io' is specific to TCG. It was added to other accelerators in 626cf8f4c6 ("icount: set can_do_io outside TB execution"), then likely copy/pasted in commit c97d6d2cdf ("i386: hvf: add code base from Google's QEMU repository"). Having it set in non-TCG code is confusing, so remove it from QTest / HVF / KVM. Fixes: 626cf8f4c6 ("icount: set can_do_io outside TB execution") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231129205037.16849-1-philmd@linaro.org>
| * | accel: Do not set CPUState::tcg_cflags in non-TCG accelsPhilippe Mathieu-Daudé2024-01-192-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | 'tcg_cflags' is specific to TCG. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231130075958.21285-1-philmd@linaro.org>
| * | backends/cryptodev: Do not ignore throttle/backends ErrorsPhilippe Mathieu-Daudé2024-01-191-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Both cryptodev_backend_set_throttle() and CryptoDevBackendClass::init() can set their Error** argument. Do not ignore them, return early on failure. Without that, running into another failure trips error_setv()'s assertion. Use the ERRP_GUARD() macro as suggested in commit ae7c80a7bd ("error: New macro ERRP_GUARD()"). Cc: qemu-stable@nongnu.org Fixes: e7a775fd9f ("cryptodev: Account statistics") Fixes: 2580b452ff ("cryptodev: support QoS") Reviewed-by: zhenwei pi <pizhenwei@bytedance.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20231120150418.93443-1-philmd@linaro.org>
| * | hw/timer/hpet: Convert DPRINTF to trace eventsDaniel Hoffman2024-01-192-33/+37
| |/ | | | | | | | | | | | | | | | | | | | | This conversion is pretty straight-forward. Standardized some formatting so the +0 and +4 offset cases can recycle the same message. Signed-off-by: Daniel Hoffman <dhoff749@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20231118231129.2840388-1-dhoff749@gmail.com> [PMD: Fixed few string formats] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* | Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingPeter Maydell2024-01-1918-300/+433
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * vga: implement odd/even and byte/word/doubleword modes more accurately * vga: implement horizontal pel panning * KVM: add class property to configure KVM device node to use * fix various bugs in x86 TCG PC-relative translation * properly align huge pages on LoongArch * cleanup patches # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmWo8wkUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroMhHAf+KiYvN/gxrYnpSS7IfbFqx6MtQrwW # Hj9QsfgRF2sThRu6BveLMG7REwEtwFh7lMhUbiyR/mzuYN9cMmHDw4OE62WRrL86 # 3PAtzAaJ/Lzd8Qp4K4un+ZrFZvq8a83HvGRRTaF9wO6/9EwpqmqMTbrNlSSA08Gy # mnfXGEt0oYitJ3JUH0MI8y6EOh1mkIhEfGPeyJaGDZVW/m4ob+QIauNOOozYN7r6 # QK+2OU0HeJC5CIzi2o5kq5U0AydVO1iAp7OBxtclYaaSvRyhlpEmbdTIKCzzPlUx # vZthxbU2PgzUbME8fraUcd7GzT64++QOLDxNyZNEL8PCCcd0lRQ0EEukgA== # =Uz0X # -----END PGP SIGNATURE----- # gpg: Signature made Thu 18 Jan 2024 09:44:41 GMT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: tests/tcg: Don't #include <inttypes.h> in aarch64/system/vtimer.c qemu/osdep: Add huge page aligned support on LoongArch platform remove unnecessary casts from uintptr_t target/i386: pcrel: store low bits of physical address in data[0] target/i386: fix incorrect EIP in PC-relative translation blocks target/i386: Do not re-compute new pc with CF_PCREL io_uring: move LuringState typedef to block/aio.h Add class property to configure KVM device node to use vga: sort-of implement word and double-word access modes vga: use latches in odd/even mode too vga: reindent memory access code vga: optimize horizontal pel panning in 256-color modes vga: implement horizontal pel panning in graphics modes vga: mask addresses in non-VESA modes to 256k vga: introduce VGADisplayParams vga: use common endian swap macros Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * tests/tcg: Don't #include <inttypes.h> in aarch64/system/vtimer.cIlya Leoshkevich2024-01-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | make check-tcg fails on Fedora with: vtimer.c:9:10: fatal error: inttypes.h: No such file or directory Fedora has a minimal aarch64 cross-compiler, which satisfies the configure checks, so it's chosen instead of the dockerized one. There is no cross-version of inttypes.h, however. Fix by using stdint.h instead. The test does not require anything from inttypes.h anyway. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-ID: <20240108125030.58569-1-iii@linux.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * qemu/osdep: Add huge page aligned support on LoongArch platformBibo Mao2024-01-181-0/+8
| | | | | | | | | | | | | | | | | | | | | | On LoongArch kvm mode if transparent huge page wants to be enabled, base address and size of memslot from both HVA and GPA view. And LoongArch supports both 4K and 16K page size with Linux kernel, so transparent huge page size is calculated from real page size rather than hardcoded size. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Message-ID: <20240115073244.174155-1-maobibo@loongson.cn> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * remove unnecessary casts from uintptr_tPaolo Bonzini2024-01-184-8/+8
| | | | | | | | | | | | | | | | | | uintptr_t, or unsigned long which is equivalent on Linux I32LP64 systems, is an unsigned type and there is no need to further cast to __u64 which is another unsigned integer type; widening casts from unsigned integers zero-extend the value. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * target/i386: pcrel: store low bits of physical address in data[0]Paolo Bonzini2024-01-182-5/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For PC-relative translation blocks, env->eip changes during the execution of a translation block, Therefore, QEMU must be able to recover an instruction's PC just from the TranslationBlock struct and the instruction data with. Because a TB will not span two pages, QEMU stores all the low bits of EIP in the instruction data and replaces them in x86_restore_state_to_opc. Bits 12 and higher (which may vary between executions of a PCREL TB, since these only use the physical address in the hash key) are kept unmodified from env->eip. The assumption is that these bits of EIP, unlike bits 0-11, will not change as the translation block executes. Unfortunately, this is incorrect when the CS base is not aligned to a page. Then the linear address of the instructions (i.e. the one with the CS base addred) indeed will never span two pages, but bits 12+ of EIP can actually change. For example, if CS base is 0x80262200 and EIP = 0x6FF4, the first instruction in the translation block will be at linear address 0x802691F4. Even a very small TB will cross to EIP = 0x7xxx, while the linear addresses will remain comfortably within a single page. The fix is simply to use the low bits of the linear address for data[0], since those don't change. Then x86_restore_state_to_opc uses tb->cs_base to compute a temporary linear address (referring to some unknown instruction in the TB, but with the correct values of bits 12 and higher); the low bits are replaced with data[0], and EIP is obtained by subtracting again the CS base. Huge thanks to Mark Cave-Ayland for the image and initial debugging, and to Gitlab user @kjliew for help with bisecting another occurrence of (hopefully!) the same bug. It should be relatively easy to write a testcase that performs MMIO on an EIP with different bits 12+ than the first instruction of the translation block; any help is welcome. Fixes: e3a79e0e878 ("target/i386: Enable TARGET_TB_PCREL", 2022-10-11) Cc: qemu-stable@nongnu.org Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Cc: Richard Henderson <richard.henderson@linaro.org> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1759 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1964 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2012 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * target/i386: fix incorrect EIP in PC-relative translation blocksguoguangyao2024-01-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | The PCREL patches introduced a bug when updating EIP in the !CF_PCREL case. Using s->pc in func gen_update_eip_next() solves the problem. Cc: qemu-stable@nongnu.org Fixes: b5e0d5d22fbf ("target/i386: Fix 32-bit wrapping of pc/eip computation") Signed-off-by: guoguangyao <guoguangyao18@mails.ucas.ac.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240115020804.30272-1-guoguangyao18@mails.ucas.ac.cn> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * target/i386: Do not re-compute new pc with CF_PCRELRichard Henderson2024-01-181-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With PCREL, we have a page-relative view of EIP, and an approximation of PC = EIP+CSBASE that is good enough to detect page crossings. If we try to recompute PC after masking EIP, we will mess up that approximation and write a corrupt value to EIP. We already handled masking properly for PCREL, so the fix in b5e0d5d2 was only needed for the !PCREL path. Cc: qemu-stable@nongnu.org Fixes: b5e0d5d22fbf ("target/i386: Fix 32-bit wrapping of pc/eip computation") Reported-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240101230617.129349-1-richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * io_uring: move LuringState typedef to block/aio.hPaolo Bonzini2024-01-183-7/+6
| | | | | | | | | | | | | | | | | | The LuringState typedef is defined twice, in include/block/raw-aio.h and block/io_uring.c. Move it in include/block/aio.h, which is included everywhere the typedef is needed, since include/block/aio.h already has to define the forward reference to the struct. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * Add class property to configure KVM device node to useDaan De Meyer2024-01-183-2/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This allows passing the KVM device node to use as a file descriptor via /dev/fdset/XX. Passing the device node to use as a file descriptor allows running qemu unprivileged even when the user running qemu is not in the kvm group on distributions where access to /dev/kvm is gated behind membership of the kvm group (as long as the process invoking qemu is able to open /dev/kvm and passes the file descriptor to qemu). Signed-off-by: Daan De Meyer <daan.j.demeyer@gmail.com> Message-ID: <20231021134015.1119597-1-daan.j.demeyer@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * vga: sort-of implement word and double-word access modesPaolo Bonzini2024-01-182-24/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Jazz Jackrabbit has a very unusual VGA setup, where it uses odd/even mode with 256-color graphics. Probably, it wants to use fast VRAM-to-VRAM copies without having to store 4 copies of the sprites as needed in mode X, one for each mod-4 alignment; odd/even mode simplifies the code a lot if it's okay to place on a 160-pixels horizontal grid. At the same time, because it wants to use double buffering (a la "mode X") it uses byte mode, not word mode as is the case in text modes. In order to implement the combination of odd/even mode (plane number comes from bit 0 of the address) and byte mode (use all bytes of VRAM, whereas word mode only uses bytes 0, 2, 4,... on each of the four planes), we need to separate the effect on the plane number from the effect on the address. Implementing the modes properly is a mess in QEMU, because it would change the layout of VRAM and break migration. As an approximation, shift right when the CPU accesses memory instead of shifting left when the CRT controller reads it. A hack is needed in order to write font data properly (see comment in the code), but it works well enough for the game. Because doubleword and chain4 modes are now independent, chain4 does not assert anymore that the address is in range. Instead it just returns all ones and discards writes, like other modes. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * vga: use latches in odd/even mode tooPaolo Bonzini2024-01-181-26/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Jazz Jackrabbit uses odd/even mode with 256-color graphics. This is probably so that it can do very fast blitting with a decent resolution (two pixels, compared to four pixels for "regular" mode X). Accesses still use all planes (reads go to the latches and the game uses read mode 1 so that the CPU always gets 0xFF; writes use the plane mask register because the game sets bit 2 of the sequencer's memory mode register). For this to work, QEMU needs to use the code for latched memory accesses in odd/even mode. The only difference between odd/even mode and "regular" planar mode is how the plane is computed in read mode 0, and how the planes are masked if the aforementioned bit 2 is reset. It is almost enough to fix the game. You also need to honor byte/word mode selection, which is done in the next patch. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * vga: reindent memory access codePaolo Bonzini2024-01-181-96/+105
| | | | | | | | | | | | | | | | | | The next patch will reuse latched memory access in text modes. Start with a patch that moves the latched access code out of the "if". Best reviewed with "git diff -b". Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * vga: optimize horizontal pel panning in 256-color modesPaolo Bonzini2024-01-181-0/+12
| | | | | | | | | | | | | | Do not go through the panning buffer unless the address wraps in the middle of the line. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * vga: implement horizontal pel panning in graphics modesPaolo Bonzini2024-01-184-32/+111
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This implements smooth scrolling, as used for example by Commander Keen and Second Reality. Unfortunately, this is not enough to avoid tearing in Commander Keen, because sometimes the wrong start address is used for a frame. On real EGA, the panning register is sampled on every line, while the display start is latched for the next frame at the start of the vertical retrace. On real VGA, the panning register is also latched, but at the end of the vertical retrace. It looks like Keen exploits this by only waiting for horizontal retrace when setting the display start, but implementing it breaks the 256-color Keen games... Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * vga: mask addresses in non-VESA modes to 256kPaolo Bonzini2024-01-182-4/+8
| | | | | | | | | | | | | | | | This allows setting the start address to a high value, and reading the bottom of the screen from the beginning of VRAM. Commander Keen 4 ("Goodbye, Galaxy!") relies on this behavior. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * vga: introduce VGADisplayParamsPaolo Bonzini2024-01-183-69/+52
| | | | | | | | | | | | | | | | The next patches will introduce more parameters that cause a full refresh. Instead of adding arguments to get_offsets and lines to update_basic_params, do everything through a struct. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * vga: use common endian swap macrosPaolo Bonzini2024-01-181-48/+17
| | | | | | | | | | | | | | | | The constant-expression bswap is provided by const_le32(), and GET_PLANE() can also be implemented using cpu_to_le32(). Remove the custom macros in vga.c. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | Merge tag 'pull-target-arm-20240118' of ↵Peter Maydell2024-01-1826-29/+1719
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * docs/devel/docs: Document .hx file syntax * arm_pamax() no longer needs to do feature propagation * docs/system/arm/virt.rst: Improve 'highmem' option docs * STM32L4x5 Implement SYSCFG and EXTI devices * hw/timer: fix systick trace message * hw/arm/virt: Consolidate valid CPU types * load_elf: fix iterator's type for elf file processing # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmWpHM4ZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3pZxD/sGIXvTeoOCsum7OFpArKoQ # J+wcy74pO526IDzjudgtwP8kFW09oVblMPgrt/68F9LY4Oa7sDNAZX/Xqlhs/hdJ # SVbOXArRmyLvgLpn8KVii9xk9iI/olMGt0S6KcXAErdgFud+JcCevbS0D5fAF4Ua # /G/4ldnwr+WcYUA5IIoi02ymSBm5VNeH2bKu0MPS3xpizjzgOFxWTBYwq3zkZYWD # w5GjH9+F+IC67CiAlCLvuQBqpGLdRwFBttU05hLtGXuSlnvS+FtJTooI7gGD17CR # 2wTa7qF716qDN1lNSIvxA6t8/dWNMIYCZYdlxJml476WzP3jECpth2WFWqE0G3yg # Orr7sFVB8X6JmtlR34srW6e3CZA3t+4FIWqcdELFLi5IQtJeer90jqQ9xwx4SttJ # nsHdy5M8txWSa61yAaDTXMID/smVlC7sWTKJrR9kV7v5+b9OPQ/R8k0mCODl5Aer # mzAVuCvUQVYK3j7fzprGrlldla57s3v78OAhqACLgKflK0+aJSJjglulPrSMK1z5 # bRPS5jLZjFwEi2VaLVg3LPJiBMDj1s/wAl0ycfCQSv2oEzvmpkw+Ar1HDc2NFe+d # 9dunbdhAZJMwh+ABIg7iMj+l0ncOXDa4DS+6BnjRxfECCa172u3viq1HATkLLAFI # GTkcJ5hIQzNEeg9ob0MDIg== # =Rfpe # -----END PGP SIGNATURE----- # gpg: Signature made Thu 18 Jan 2024 12:42:54 GMT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20240118' of https://git.linaro.org/people/pmaydell/qemu-arm: load_elf: fix iterator's type for elf file processing hw/arm/virt: Consolidate valid CPU types hw/timer: fix systick trace message tests/qtest: Add STM32L4x5 SYSCFG QTest testcase hw/arm: Connect STM32L4x5 SYSCFG to STM32L4x5 SoC hw/misc: Implement STM32L4x5 SYSCFG tests/qtest: Add STM32L4x5 EXTI QTest testcase hw/arm: Connect STM32L4x5 EXTI to STM32L4x5 SoC hw/misc: Implement STM32L4x5 EXTI docs/system/arm/virt.rst: Improve 'highmem' option docs target/arm: arm_pamax() no longer needs to do feature propagation docs/devel/docs: Document .hx file syntax Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | load_elf: fix iterator's type for elf file processingAnastasia Belova2024-01-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | j is used while loading an ELF file to byteswap segments' data. If data is larger than 2GB an overflow may happen. So j should be elf_word. This commit fixes a minor bug: it's unlikely anybody is trying to load ELF files with 2GB+ segments for wrong-endianness targets, but if they did, it wouldn't work correctly. Found by Linux Verification Center (linuxtesting.org) with SVACE. Cc: qemu-stable@nongnu.org Fixes: 7ef295ea5b ("loader: Add data swap option to load-elf") Signed-off-by: Anastasia Belova <abelova@astralinux.ru> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/arm/virt: Consolidate valid CPU typesGavin Shan2024-01-181-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's found that some of the CPU type names in the array of valid CPU types are invalid because their corresponding classes aren't registered, as reported by Peter Maydell. [gshan@gshan build]$ ./qemu-system-arm -machine virt -cpu cortex-a9 qemu-system-arm: Invalid CPU model: cortex-a9 The valid models are: cortex-a7, cortex-a15, (null), (null), (null), (null), (null), (null), (null), (null), (null), (null), (null), max Fix it by consolidating the array of valid CPU types. After it's applied, we have the following output when TCG is enabled. [gshan@gshan build]$ ./qemu-system-arm -machine virt -cpu cortex-a9 qemu-system-arm: Invalid CPU model: cortex-a9 The valid models are: cortex-a7, cortex-a15, max [gshan@gshan build]$ ./qemu-system-aarch64 -machine virt -cpu cortex-a9 qemu-system-aarch64: Invalid CPU model: cortex-a9 The valid models are: cortex-a7, cortex-a15, cortex-a35, cortex-a55, cortex-a72, cortex-a76, cortex-a710, a64fx, neoverse-n1, neoverse-v1, neoverse-n2, cortex-a53, cortex-a57, max Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2084 Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-id: 20240111051054.83304-1-gshan@redhat.com Fixes: fa8c617791 ("hw/arm/virt: Check CPU type in machine_run_board_init()") Signed-off-by: Gavin Shan <gshan@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/timer: fix systick trace messageSamuel Tardieu2024-01-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Samuel Tardieu <sam@rfc1149.net> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-id: 20240109184508.3189599-1-sam@rfc1149.net Fixes: ff68dacbc786 ("armv7m: Split systick out from NVIC") Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | tests/qtest: Add STM32L4x5 SYSCFG QTest testcaseInès Varhol2024-01-152-1/+333
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Message-id: 20240109194438.70934-4-ines.varhol@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/arm: Connect STM32L4x5 SYSCFG to STM32L4x5 SoCInès Varhol2024-01-153-1/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The SYSCFG input GPIOs aren't connected yet. When the STM32L4x5 GPIO device will be implemented, its output GPIOs will be connected to the SYSCFG input GPIOs. Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20240109194438.70934-3-ines.varhol@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/misc: Implement STM32L4x5 SYSCFGInès Varhol2024-01-156-1/+331
| | | | | | | | | | | | | | | | | | | | | | | | | | | Acked-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Message-id: 20240109194438.70934-2-ines.varhol@telecom-paris.fr Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | tests/qtest: Add STM32L4x5 EXTI QTest testcaseInès Varhol2024-01-152-0/+529
| | | | | | | | | | | | | | | | | | | | | | | | | | | Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Message-id: 20240109160658.311932-4-ines.varhol@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/arm: Connect STM32L4x5 EXTI to STM32L4x5 SoCInès Varhol2024-01-153-1/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Message-id: 20240109160658.311932-3-ines.varhol@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/misc: Implement STM32L4x5 EXTIInès Varhol2024-01-156-3/+352
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Although very similar to the STM32F4xx EXTI, STM32L4x5 EXTI generates more than 32 event/interrupt requests and thus uses more registers than STM32F4xx EXTI which generates 23 event/interrupt requests. Acked-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240109160658.311932-2-ines.varhol@telecom-paris.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | docs/system/arm/virt.rst: Improve 'highmem' option docsPeter Maydell2024-01-151-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Improve the 'highmem' option docs to note that by default we assume that a 32-bit kernel on an LPAE-capable CPU has LPAE enabled, and what the consequences are. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-id: 20240109170834.1387457-1-peter.maydell@linaro.org
| * | target/arm: arm_pamax() no longer needs to do feature propagationPeter Maydell2024-01-151-8/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In arm_pamax(), we need to cope with the virt board calling this function on a CPU object which has been inited but not realize. We used to do propagation of feature-flag implications (such as "V7VE implies LPAE") at realize, so we have some code in arm_pamax() which manually checks for both V7VE and LPAE feature flags. In commit b8f7959f28c4f36 we moved the feature propagation for almost all features from realize to post-init. That means that now when the virt board calls arm_pamax(), the feature propagation has been done. So we can drop the manual propagation handling and check only for the feature we actually care about, which is ARM_FEATURE_LPAE. Retain the comment that the virt board is calling this function with a not completely realized CPU object, because that is a potential beartrap for later changes which is worth calling out. (Note that b8f7959f28c4f36 actually fixed a bug in the arm_pamax() handling: arm_pamax() was missing a check for ARM_FEATURE_V8, so it incorrectly thought that the qemu-system-arm 'max' CPU did not have LPAE and turned off 'highmem' support in the virt board. Following b8f7959f28c4f36 qemu-system-arm 'max' is treated the same as 'cortex-a15' and other v7 LPAE CPUs, because the generic feature propagation code does correctly propagate V8 -> V7VE -> LPAE.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240109143804.1118307-1-peter.maydell@linaro.org
| * | docs/devel/docs: Document .hx file syntaxPeter Maydell2024-01-157-10/+76
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We don't currently document the syntax of .hx files anywhere except in a few comments at the top of individual .hx files. We don't even have somewhere in the developer docs where we could do this. Add a new files docs/devel/docs.rst which can be a place to document how our docs build process works. For the moment, put in only a brief introductory paragraph and the documentation of the .hx files. We could later add to this file by for example describing how the QAPI-schema-to-docs process works, or anything else that developers might need to know about how to add documentation. Make the .hx files refer to this doc file, and clean up their header comments to be more accurate for the usage in each file and less cut-n-pasted. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Luc Michel <luc.michel@amd.com> Reviewed-by: David Woodhouse <dwmw@amazon.co.uk> Message-id: 20231212162313.1742462-1-peter.maydell@linaro.org
* | Merge tag 'pull-request-2024-01-16' of https://gitlab.com/thuth/qemu into ↵Peter Maydell2024-01-183-3/+21
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging * Improve the timeouts for some problematic qtests * Enable some ROP mitigation compiler switches # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmWmNDURHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbVM0w/+Nafbtnw9Q1gp633CIYQRsNDGiKiCND5H # epLfd3DFAG2jATZm/hIIrV3dlEkGRQh916XKik572eUm2yyu3i3EqVNooTcLr0k/ # 4MI1ZzG0rnAnAr15zVdUaDCiaGdlpcSGTwLDAlQjIR4n0MdugQ/bkrfkDRU0YD/6 # mv/yDck5fHOUDm88LA7Gxep0G7U8Wi8oiQXx+WlbQpmDHfBJM7ERQSPhXobtVtFO # 8wpceUcMwlGBecxEsRggrRhdn09CJUyuirP8UHG4rT8xMjkXpqHJVqZ+gVDyV65J # y9y6snCk+oFyCTDSstQxVbzHg/1C4xE2gVUMaXv4Wu1TcCgBpF1WDQymXb35Buuh # pbgAaF1ZsBGwE7rUUJIF3NBTpjmedP4NbCR2EPsiL06w08mG7IRuU/b8JStuAHef # qUqxiHfpEwAxXY8O83XOvBb+zJ625OQHGi/MGDnaYczBfqBJAx2AKiuSmMWBAWo2 # gO4kQX25sPzov6xsLcjEwh0HcJ9W5mkGRJ/x8GSjWnvDlGBDBYWPUShJlohDKGU0 # 4+JGk4+8RKMoKE97bO8DItOp9ahh87up/qHDFkJJo+VKuDaBPdzlS6PURzc8wv0T # QquWUkfdE6qYIPr8ShVYT00NNThIKLyn0qaN4s1mQ+2h8p8nXc4aYsWgcr2wxJFm # sOoVvwOXzDE= # =Yuwq # -----END PGP SIGNATURE----- # gpg: Signature made Tue 16 Jan 2024 07:45:57 GMT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2024-01-16' of https://gitlab.com/thuth/qemu: meson: mitigate against use of uninitialize stack for exploits meson: mitigate against ROP exploits with -fzero-call-used-regs qtest: Bump npcm7xx_watchdog_timer-test timeout to 2 minutes tests/qtest/npcm7xx_watchdog_timer: Only test the corner cases by default tests/qtest/meson.build: Bump the boot-serial-test timeout to 4 minutes Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | meson: mitigate against use of uninitialize stack for exploitsDaniel P. Berrangé2024-01-161-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When variables are used without being initialized, there is potential to take advantage of data that was pre-existing on the stack from an earlier call, to drive an exploit. It is good practice to always initialize variables, and the compiler can warn about flaws when -Wuninitialized is present. This warning, however, is by no means foolproof with its output varying depending on compiler version and which optimizations are enabled. The -ftrivial-auto-var-init option can be used to tell the compiler to always initialize all variables. This increases the security and predictability of the program, closing off certain attack vectors, reducing the risk of unsafe memory disclosure. While the option takes several possible values, using 'zero' is considered to be the option that is likely to lead to semantically correct or safe behaviour[1]. eg sizes/indexes are not likely to lead to out-of-bounds accesses when initialized to zero. Pointers are less likely to point something useful if initialized to zero. Even with -ftrivial-auto-var-init=zero set, GCC will still issue warnings with -Wuninitialized if it discovers a problem, so we are not loosing diagnostics for developers, just hardening runtime behaviour and making QEMU behave more predictably in case of hitting bad codepaths. [1] https://lists.llvm.org/pipermail/cfe-dev/2020-April/065221.html Signed-off-by: "Daniel P. Berrangé" <berrange@redhat.com> Message-ID: <20240103123414.2401208-3-berrange@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
| * | meson: mitigate against ROP exploits with -fzero-call-used-regsDaniel P. Berrangé2024-01-161-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To quote wikipedia: "Return-oriented programming (ROP) is a computer security exploit technique that allows an attacker to execute code in the presence of security defenses such as executable space protection and code signing. In this technique, an attacker gains control of the call stack to hijack program control flow and then executes carefully chosen machine instruction sequences that are already present in the machine's memory, called "gadgets". Each gadget typically ends in a return instruction and is located in a subroutine within the existing program and/or shared library code. Chained together, these gadgets allow an attacker to perform arbitrary operations on a machine employing defenses that thwart simpler attacks." QEMU is by no means perfect with an ever growing set of CVEs from flawed hardware device emulation, which could potentially be exploited using ROP techniques. Since GCC 11 there has been a compiler option that can mitigate against this exploit technique: -fzero-call-user-regs To understand it refer to these two resources: https://www.jerkeby.se/newsletter/posts/rop-reduction-zero-call-user-regs/ https://gcc.gnu.org/pipermail/gcc-patches/2020-August/552262.html I used two programs to scan qemu-system-x86_64 for ROP gadgets: https://github.com/0vercl0k/rp https://github.com/JonathanSalwan/ROPgadget When asked to find 8 byte gadgets, the 'rp' tool reports: A total of 440278 gadgets found. You decided to keep only the unique ones, 156143 unique gadgets found. While the ROPgadget tool reports: Unique gadgets found: 353122 With the --ropchain argument, the latter attempts to use the found gadgets to product a chain that can execute arbitrary syscalls. With current QEMU it succeeds in this task, which is an undesirable situation. With QEMU modified to use -fzero-call-user-regs=used-gpr the 'rp' tool reports A total of 528991 gadgets found. You decided to keep only the unique ones, 121128 unique gadgets found. This is 22% fewer unique gadgets While the ROPgadget tool reports: Unique gadgets found: 328605 This is 7% fewer unique gadgets. Crucially though, despite this more modest reduction, the ROPgadget tool is no longer able to identify a chain of gadgets for executing arbitrary syscalls. It fails at the very first step, unable to find gadgets for populating registers for a future syscall. Having said that, more advanced tools do still manage to put together a viable ROP chain. Also this only takes into account QEMU code. QEMU links to many 3rd party shared libraries and ideally all of them would be compiled with this same hardening. That becomes a distro policy question though. In terms of performance impact, TCG was used as an evaluation test case. We're not interested in protecting TCG since it isn't designed to provide a security barrier, but it is performance sensitive code, so useful as a guide to how other areas of QEMU might be impacted. With the -fzero-call-user-regs=used-gpr argument present, using the real world test of booting a linux kernel and having init immediately poweroff, there is a ~1% slow down in performance under TCG. The QEMU binary size also grows by approximately 1%. By comparison, using the more aggressive -fzero-call-user-regs=all, results in a slowdown of over 25% in TCG, which is clearly not an acceptable impact, and a binary size increase of 5%. Considering that 'used-gpr' successfully stopped ROPgadget assembling a chain, this more targeted protection is a justifiable hardening / performance tradeoff. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: "Daniel P. Berrangé" <berrange@redhat.com> Message-ID: <20240103123414.2401208-2-berrange@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
| * | qtest: Bump npcm7xx_watchdog_timer-test timeout to 2 minutesThomas Huth2024-01-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The npcm7xx_watchdog_timer-test can take more than 60 seconds in SPEED=slow mode on a loaded host system. Bumping to 2 minutes will give more headroom. Message-ID: <20240112164717.1063954-1-thuth@redhat.com> Reviewed-by: "Daniel P. Berrangé" <berrange@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
| * | tests/qtest/npcm7xx_watchdog_timer: Only test the corner cases by defaultThomas Huth2024-01-161-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The test_prescaler() part in the npcm7xx_watchdog_timer test is quite repetitive, testing all possible combinations of the WTCLK and WTIS bitfields. Since each test spins up a new instance of QEMU, this is rather an expensive test, especially on loaded host systems. For the normal quick test mode, it should be sufficient to test the corner settings of these fields (i.e. 0 and 3), so we can speed up this test in the default mode quite a bit. Message-ID: <20240115070223.30178-1-thuth@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
| * | tests/qtest/meson.build: Bump the boot-serial-test timeout to 4 minutesThomas Huth2024-01-161-1/+1
| |/ | | | | | | | | | | | | | | | | | | | | | | When running with TCI, the boot-serial-test can take longer than 3 minutes: https://gitlab.com/qemu-project/qemu/-/jobs/5890481086#L4774 Bump the timeout to 4 minutes to avoid CI failures here. Message-ID: <20240115071146.31213-1-thuth@redhat.com> Reviewed-by: "Daniel P. Berrangé" <berrange@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* | acpi/tests/avocado/bits: wait for 200 seconds for SHUTDOWN event from bits VMAni Sinha2024-01-181-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By default, the timeout to receive any specified event from the QEMU VM is 60 seconds set by the python avocado test framework. Please see event_wait() and events_wait() in python/qemu/machine/machine.py. If the matching event is not triggered within that interval, an asyncio.TimeoutError is generated. Since the timeout for the bits avocado test is 200 secs, we need to make event_wait() timeout of the same value as well so that an early timeout is not triggered by the avocado framework. CC: peter.maydell@linaro.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2077 Signed-off-by: Ani Sinha <anisinha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-id: 20240117042556.3360190-1-anisinha@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | Merge tag 'hppa-fixes-8.2-pull-request' of ↵Peter Maydell2024-01-168-38/+64
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://github.com/hdeller/qemu-hppa into staging target/hppa qemu v8.2 regression fixes There were some regressions introduced with Qemu v8.2 on the hppa/hppa64 target, e.g.: - 32-bit HP-UX crashes on B160L (32-bit) machine - NetBSD boot failure due to power button in page zero - NetBSD FPU detection failure - OpenBSD 7.4 boot failure This patch series fixes those known regressions and additionally: - allows usage of the max. 3840MB of memory (instead of 3GB), - adds support for the qemu --nodefaults option (to debug other devices) This patch set will not fix those known (non-regression) bugs: - HP-UX and NetBSD still fail to boot on the new 64-bit C3700 machine - Linux kernel will still fail to boot on C3700 as long as kernel modules are used. Changes v2->v3: - Added comment about Figures H-10 and H-11 in the parisc2.0 spec in patch which calculate PDC address translation if PSW.W=0 - Introduce and use hppa_set_ior_and_isr() - Use drive_get_max_bus(IF_SCSI), nd_table[] and serial_hd() to check if default devices should be created - Added Tested-by and Reviewed-by tags Changes v1->v2: - fix OpenBSD boot with SeaBIOS v15 instead of v14 - commit message enhancements suggested by BALATON Zoltan - use uint64_t for ram_max in patch #1 # -----BEGIN PGP SIGNATURE----- # # iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCZaImPQAKCRD3ErUQojoP # X2C5AP9fbIkCni45JU6KC6OmFsCbAReRQCPwLO+MzR8/us2ywgD+PsGxSBk8ASxM # nqtv3J9JC3i+XSnbtwLV+qChnO+IXwc= # =FAMY # -----END PGP SIGNATURE----- # gpg: Signature made Sat 13 Jan 2024 05:57:17 GMT # gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F # gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown] # gpg: aka "Helge Deller <deller@kernel.org>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603 # Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F * tag 'hppa-fixes-8.2-pull-request' of https://github.com/hdeller/qemu-hppa: target/hppa: Update SeaBIOS-hppa to version 15 target/hppa: Fix IOR and ISR on error in probe target/hppa: Fix IOR and ISR on unaligned access trap target/hppa: Export function hppa_set_ior_and_isr() target/hppa: Avoid accessing %gr0 when raising exception hw/hppa: Move software power button address back into PDC target/hppa: Fix PDC address translation on PA2.0 with PSW.W=0 hw/pci-host/astro: Add missing astro & elroy registers for NetBSD hw/hppa/machine: Disable default devices with --nodefaults option hw/hppa/machine: Allow up to 3840 MB total memory Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | target/hppa: Update SeaBIOS-hppa to version 15Helge Deller2024-01-131-0/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SeaBIOS-hppa version 15: - Fix OpenBSD 7.4 boot (PDC_MEM_MAP call returned wrong values) SeaBIOS-hppa version 14 comes with those fixes: - Fix 32-bit HP-UX crash (fix in PDC_FIND_MODULE call) - Fix NetBSD boot (power button fix and add option to disable it) - Fix FPU detection on NetBSD - Add MEMORY_HPA module on B160L - Fix detection of mptsas and esp scsi controllers - Fix terminate DMA transfer in esp driver (Mark Cave-Ayland) - Allow booting from esp controller Signed-off-by: Helge Deller <deller@gmx.de>
| * | target/hppa: Fix IOR and ISR on error in probeHelge Deller2024-01-131-5/+1
| | | | | | | | | | | | | | | | | | | | | Put correct values (depending on CPU arch) into IOR and ISR on fault. Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>