summary refs log tree commit diff stats
path: root/hw/usb/dev-storage.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2023-03-21contrib/elf2dmp: move PE dir search to pe_get_data_dir_entryViktor Prutyanov1-29/+42
Move out PE directory search functionality to be reused not only for Debug Directory processing but for arbitrary PE directory. Signed-off-by: Viktor Prutyanov <viktor@daynix.com> Reviewed-by: Annie Li <annie.li@oracle.com> Message-id: 20230222211246.883679-3-viktor@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-21contrib/elf2dmp: fix code styleViktor Prutyanov3-53/+57
Originally elf2dmp were added with some code style issues, especially in pe.h header, and some were introduced by 2d0fc797faaa73fbc1d30f5f9e90407bf3dd93f0. Fix them now. Signed-off-by: Viktor Prutyanov <viktor@daynix.com> Reviewed-by: Annie Li <annie.li@oracle.com> Message-id: 20230222211246.883679-2-viktor@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-21hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settingsPeter Maydell1-2/+4
The cadence UART attempts to avoid allowing the guest to set invalid baud rate register values in the uart_write() function. However it does the "mask to the size of the register field" and "check for invalid values" in the wrong order, which means that a malicious guest can get a bogus value into the register by setting also some high bits in the value, and cause QEMU to crash by division-by-zero. Do the mask before the bounds check instead of afterwards. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com> Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Qiang Liu <cyruscyliu@gmail.com> Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org
2023-03-21target/arm: Add Neoverse-N1 registersChen Baozi1-0/+69
Add implementation defined registers for neoverse-n1 which would be accessed by TF-A. Since there is no DSU in Qemu, CPUCFR_EL1.SCU bit is set to 1 to avoid DSU registers definition. Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> Message-id: 20230313033936.585669-1-chenbaozi@phytium.com.cn Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-20replace TABs with spacesYeqi Fu32-2084/+2084
Bring the files in line with the QEMU coding style, with spaces for indentation. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/378 Signed-off-by: Yeqi Fu <fufuyqqqqqq@gmail.com> Message-Id: <20230315032649.57568-1-fufuyqqqqqq@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20qemu/osdep: Switch position of "extern" and "G_NORETURN"Bernhard Beschow1-1/+1
Fixes the Windows build under msys2 using GCC 12 which fails with the following error: [184/579] Compiling C++ object qga/vss-win32/qga-vss.dll.p/install.cpp.obj FAILED: qga/vss-win32/qga-vss.dll.p/install.cpp.obj "c++" "-m64" "-mcx16" "-Iqga/vss-win32/qga-vss.dll.p" "-Iqga/vss-win32" "-I../src/qga/vss-win32" "-I." "-Iqapi" "-Itrace" "-Iui" "-Iui/shader" "-IC:/msys64/mingw64/include/glib-2.0" "-IC:/msys64/mingw64/lib/glib-2.0/include" "-fdiagnostics-color=auto" "-Wall" "-Winvalid-pch" "-Wnon-virtual-dtor" "-Werror" "-std=gnu++11" "-g" "-iquote" "." "-iquote" "C:/msys64/home/shentey/Projects/qemu/src" "-iquote" "C:/msys64/home/shentey/Projects/qemu/src/include" "-iquote" "C:/msys64/home/shentey/Projects/qemu/src/tcg/i386" "-D__STDC_LIMIT_MACROS" "-D__STDC_CONSTANT_MACROS" "-D__STDC_FORMAT_MACROS" "-fno-pie" "-no-pie" "-D_GNU_SOURCE" "-D_FILE_OFFSET_BITS=64" "-D_LARGEFILE_SOURCE" "-fno-strict-aliasing" "-fno-common" "-fwrapv" "-Wundef" "-Wwrite-strings" "-Wtype-limits" "-Wformat-security" "-Wformat-y2k" "-Winit-self" "-Wignored-qualifiers" "-Wempty-body" "-Wendif-labels" "-Wexpansion-to-defined" "-Wimplicit-fallthrough=2" "-Wmissing-format-attribute" "-Wno-missing-include-dirs" "-Wno-shift-negative-value" "-Wno-psabi" "-fstack-protector-strong" "-Wno-unknown-pragmas" "-Wno-delete-non-virtual-dtor" "-Wno-non-virtual-dtor" -MD -MQ qga/vss-win32/qga-vss.dll.p/install.cpp.obj -MF "qga/vss-win32/qga-vss.dll.p/install.cpp.obj.d" -o qga/vss-win32/qga-vss.dll.p/install.cpp.obj "-c" ../src/qga/vss-win32/install.cpp In file included from C:/msys64/mingw64/lib/glib-2.0/include/glibconfig.h:9, from C:/msys64/mingw64/include/glib-2.0/glib/gtypes.h:34, from C:/msys64/mingw64/include/glib-2.0/glib/galloca.h:34, from C:/msys64/mingw64/include/glib-2.0/glib.h:32, from C:/msys64/home/shentey/Projects/qemu/src/include/glib-compat.h:32, from C:/msys64/home/shentey/Projects/qemu/src/include/qemu/osdep.h:144, from ../src/qga/vss-win32/install.cpp:13: C:/msys64/mingw64/include/glib-2.0/glib/gmacros.h:1075:21: error: standard attributes in middle of decl-specifiers 1075 | # define G_NORETURN [[noreturn]] | ^ C:/msys64/home/shentey/Projects/qemu/src/include/qemu/osdep.h:240:8: note: in expansion of macro 'G_NORETURN' 240 | extern G_NORETURN | ^~~~~~~~~~ C:/msys64/mingw64/include/glib-2.0/glib/gmacros.h:1075:21: note: standard attributes must precede the decl-specifiers to apply to the declaration, or follow them to apply to the type 1075 | # define G_NORETURN [[noreturn]] | ^ C:/msys64/home/shentey/Projects/qemu/src/include/qemu/osdep.h:240:8: note: in expansion of macro 'G_NORETURN' 240 | extern G_NORETURN | ^~~~~~~~~~ C:/msys64/mingw64/include/glib-2.0/glib/gmacros.h:1075:21: error: attribute ignored [-Werror=attributes] 1075 | # define G_NORETURN [[noreturn]] | ^ C:/msys64/home/shentey/Projects/qemu/src/include/qemu/osdep.h:240:8: note: in expansion of macro 'G_NORETURN' 240 | extern G_NORETURN | ^~~~~~~~~~ C:/msys64/mingw64/include/glib-2.0/glib/gmacros.h:1075:21: note: an attribute that appertains to a type-specifier is ignored 1075 | # define G_NORETURN [[noreturn]] | ^ C:/msys64/home/shentey/Projects/qemu/src/include/qemu/osdep.h:240:8: note: in expansion of macro 'G_NORETURN' 240 | extern G_NORETURN | ^~~~~~~~~~ cc1plus.exe: all warnings being treated as errors Apparently it also fixes the compilation with Clang 15 (see https://gitlab.com/qemu-project/qemu/-/issues/1541 ). Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1541 Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-Id: <20230318185931.181659-1-shentey@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20tests/unit/test-blockjob: Disable complete_in_standby testPeter Maydell1-1/+8
The blockjob/complete_in_standby test is flaky and fails intermittently in CI: 172/621 qemu:unit / test-blockjob ERROR 0.26s killed by signal 6 SIGABRT 11:03:46 MALLOC_PERTURB_=176 G_TEST_SRCDIR=/Users/pm215/src/qemu-for-merges/tests/unit G_TEST_BUILDDIR=/Users/pm215/src/qemu-for-merges/build/all/tests/unit /Users/pm215/src/qemu-for-merges/build/all/tests/unit/test-blockjob --tap -k ----------------------------------- output ----------------------------------- stdout: # random seed: R02S8c79d6e1c01ce0b25475b2210a253242 1..9 # Start of blockjob tests ok 1 /blockjob/ids stderr: Assertion failed: (job->status == JOB_STATUS_STANDBY), function test_complete_in_standby, file ../../tests/unit/test-blockjob.c, line 499. Seen on macOS/x86_64, FreeBSD 13/x86_64, msys2-64bit, eg: https://gitlab.com/qemu-project/qemu/-/jobs/3872508803 https://gitlab.com/qemu-project/qemu/-/jobs/3950667240 Disable this subtest until somebody has time to investigate. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20230317143534.1481947-1-peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x/tcg/mem_helper: Remove bad assert() statementThomas Huth1-1/+0
The "assert(!nonfault)" statement can be triggered by running the "mvpg" s390x kvm-unit-test with TCG. According to Richard: "... the assert looks backward. We should only arrive there if nonfault was true for the probe (otherwise the probe would have raised the exception directly). I would think we could just remove the assert." Fixes: 4049431478 ("target/s390x: Fix s390_probe_access for user-only") Suggested-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230317135737.597570-1-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20edk2: update firmware binariesGerd Hoffmann8-0/+0
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2023-03-20edk2: replace build scriptsGerd Hoffmann6-528/+511
Remove Makefile.edk2 and the edk2*.sh scripts and replace them with a python script (which already handles fedora rpm builds) and a config file for it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2023-03-20edk2: update submodule to edk2-stable202302Gerd Hoffmann2-2/+2
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-03-20acpi: disable tests/data/acpi updatesGerd Hoffmann1-1/+0
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2023-03-20bios-tables-test: use 128M numa nodes on aarch64Gerd Hoffmann3-3/+3
Recent edk2 versions don't boot with very small numa nodes. Bump the size from 64M to 128M. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2023-03-20acpi: enable tests/data/acpi updatesGerd Hoffmann1-0/+1
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2023-03-20tests/tcg/s390x: Test unaligned accessesIlya Leoshkevich17-3/+311
Add a number of small test that check whether accessing unaligned addresses in various ways leads to a specification exception. Run these test both in softmmu and user configurations; expect a PGM in one case and SIGILL in the other. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230316164428.275147-13-iii@linux.ibm.com> [thuth: Added -Wl,--build-id=none to LDFLAGS] Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Update do_unaligned_access() commentIlya Leoshkevich1-2/+2
Relative long instructions now depend on do_unaligned_access() too. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-12-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle STGRL to non-aligned addressesIlya Leoshkevich2-5/+6
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-11-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle STRL to non-aligned addressesIlya Leoshkevich2-7/+8
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-10-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle CLRL and CLGFRL with non-aligned addressesIlya Leoshkevich1-1/+2
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-9-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle CGRL and CLGRL with non-aligned addressesIlya Leoshkevich1-1/+2
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-8-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle CRL and CGFRL with non-aligned addressesIlya Leoshkevich1-1/+2
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-7-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle LLGFRL from non-aligned addressesIlya Leoshkevich2-4/+5
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-6-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle LRL and LGFRL from non-aligned addressesIlya Leoshkevich2-8/+9
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-5-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle LGRL from non-aligned addressesIlya Leoshkevich2-4/+5
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-4-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle EXECUTE of odd addressesIlya Leoshkevich1-2/+10
Generate a specification exception in the helper before trying to fetch the instruction. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-3-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle branching to odd addressesIlya Leoshkevich1-0/+9
Let branching happen and try to generate a new translation block with an odd address. Generate a specification exception in cpu_get_tb_cpu_state(). Reported-by: Harold Grovesteen <h.grovsteen@tx.rr.com> Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20tests/tcg/s390x: Add ex-relative-long.cIlya Leoshkevich2-0/+157
Test EXECUTE and EXECUTE RELATIVE LONG with relative long instructions as targets. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Message-Id: <20230316210751.302423-3-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Fix EXECUTE of relative long instructionsIlya Leoshkevich3-1/+14
The code uses the wrong base for relative addressing: it should use the target instruction address and not the EXECUTE's address. Fix by storing the target instruction address in the new CPUS390XState member and loading it from the code generated by gen_ri2(). Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20230316210751.302423-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20tests/tcg/s390x: Add rxsbg.cIlya Leoshkevich2-0/+49
Add a small test for RXSBG with T=1 to prevent regressions. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-Id: <20230316172205.281369-3-iii@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Fix R[NOX]SBG with T=1Ilya Leoshkevich1-0/+4
RXSBG usage in the "filetests" test from the wasmtime testsuite makes tcg_reg_alloc_op() attempt to temp_load() a TEMP_VAL_DEAD temporary, causing an assertion failure: 0x01000a70: ec14 b040 3057 rxsbg %r1, %r4, 0xb0, 0x40, 0x30 OP after optimization and liveness analysis: ---- 0000000001000a70 0000000000000004 0000000000000006 rotl_i64 tmp2,r4,$0x30 dead: 1 2 pref=0xffff and_i64 tmp2,tmp2,$0x800000000000ffff dead: 1 pref=0xffff [xor_i64 tmp3,tmp3,tmp2 dead: 1 2 pref=0xffff] and_i64 cc_dst,tmp3,$0x800000000000ffff sync: 0 dead: 0 1 2 pref=0xffff mov_i64 psw_addr,$0x1000a76 sync: 0 dead: 0 1 pref=0xffff mov_i32 cc_op,$0x6 sync: 0 dead: 0 1 pref=0xffff call lookup_tb_ptr,$0x6,$1,tmp8,env dead: 1 pref=none goto_ptr tmp8 dead: 0 set_label $L0 exit_tb $0x7fffe809d183 ../tcg/tcg.c:3865: tcg fatal error The reason is that tmp3 does not have an initial value, which confuses the register allocator. This also affects the correctness of the results. Fix by assigning R1 to it. Exposed by commit e2e641fa3d5 ("tcg: Change default temp lifetime to TEMP_TB"). Fixes: d6c6372e186e ("target-s390: Implement R[NOX]SBG") Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20230316172205.281369-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20tests/tcg/s390x: Add PSW modification testsIlya Leoshkevich6-0/+204
Add several small tests that check the PSW modification instructions: * lpsw.S checks whether LPSW works correctly in the "happy" case. * lpswe-early.S checks whether early exceptions are recognized and whether the correct ILC and old PSW are stored when they happen. * ssm-early.S, stosm-early.S and exrl-ssm-early.S check the special handling of SSM and STOSM with respect to early exceptions. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-Id: <20230315020408.384766-4-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Implement Early Exception RecognitionIlya Leoshkevich4-1/+45
Generate a specification exception if a reserved bit is set in the PSW mask or if the PSW address is out of bounds dictated by the addressing mode. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20230315020408.384766-3-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Fix LPSWIlya Leoshkevich1-10/+12
Currently LPSW does not invert the mask bit 12 and incorrectly copies the BA bit into the address. Fix by generating code similar to what s390_cpu_load_normal() does. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Co-developed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20230315020408.384766-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20MAINTAINERS: Mark the Nios II CPU as orphanThomas Huth1-3/+3
Marek and Chris haven't been active for Nios II since years (the last time seems to have been in 2017), and we've got unhandled severe Nios II bug tickets in the bug tracker since a long time, so to avoid wrong expectations of people who are looking at the MAINTAINERS file, it's maybe best to mark the Nios II entry as orphan nowadays. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230313183352.274744-1-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-16migration: fix populate_vfio_infoSteve Sistare1-1/+1
Include CONFIG_DEVICES so that populate_vfio_info is instantiated for CONFIG_VFIO. Without it, the 'info migrate' command never returns info about vfio. Fixes: 43bd0bf30f ("migration: Move populate_vfio_info() into a separate file") Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2023-03-16migration/multifd: correct multifd_send_thread to trace the flagsWei Wang1-1/+2
The p->flags could be updated via the send_prepare callback, e.g. OR-ed with MULTIFD_FLAG_ZLIB via zlib_send_prepare. Assign p->flags to the local "flags" before the send_prepare callback could only get partial of p->flags. Fix it by moving the assignment of p->flags to the local flags after the callback, so that the correct flags can be traced. Fixes: ab7cbb0b9a3b ("multifd: Make no compression operations into its own structure") Signed-off-by: Wei Wang <wei.w.wang@intel.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2023-03-16migration/rdma: Remove deprecated variable rdma_return_pathLi Zhijian1-2/+1
It's no longer needed since commit 44bcfd45e98 ("migration/rdma: destination: create the return patch after the first accept") Signed-off-by: Li Zhijian <lizhijian@fujitsu.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2023-03-16migration/xbzrle: fix out-of-bounds write with axv512Matheus Tavares Bernardino1-4/+3
xbzrle_encode_buffer_avx512() checks for overflows too scarcely in its outer loop, causing out-of-bounds writes: $ ../configure --target-list=aarch64-softmmu --enable-sanitizers --enable-avx512bw $ make tests/unit/test-xbzrle && ./tests/unit/test-xbzrle ==5518==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62100000b100 at pc 0x561109a7714d bp 0x7ffed712a440 sp 0x7ffed712a430 WRITE of size 1 at 0x62100000b100 thread T0 #0 0x561109a7714c in uleb128_encode_small ../util/cutils.c:831 #1 0x561109b67f6a in xbzrle_encode_buffer_avx512 ../migration/xbzrle.c:275 #2 0x5611099a7428 in test_encode_decode_overflow ../tests/unit/test-xbzrle.c:153 #3 0x7fb2fb65a58d (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x7a58d) #4 0x7fb2fb65a333 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x7a333) #5 0x7fb2fb65aa79 in g_test_run_suite (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x7aa79) #6 0x7fb2fb65aa94 in g_test_run (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x7aa94) #7 0x5611099a3a23 in main ../tests/unit/test-xbzrle.c:218 #8 0x7fb2fa78c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #9 0x5611099a608d in _start (/qemu/build/tests/unit/test-xbzrle+0x28408d) 0x62100000b100 is located 0 bytes to the right of 4096-byte region [0x62100000a100,0x62100000b100) allocated by thread T0 here: #0 0x7fb2fb823a06 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:153 #1 0x7fb2fb637ef0 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ef0) Fix that by performing the overflow check in the inner loop, instead. Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2023-03-16migration/xbzrle: use ctz64 to avoid undefined resultMatheus Tavares Bernardino1-2/+3
__builtin_ctzll() produces undefined results when the argument is 0. This can be seen through test-xbzrle, which produces the following warning: ../migration/xbzrle.c:265: runtime error: passing zero to ctz(), which is not a valid argument Replace __builtin_ctzll() with our ctz64() wrapper which properly handles 0. Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2023-03-16migration/rdma: Fix return-path caseDr. David Alan Gilbert1-3/+5
The RDMA code has return-path handling code, but it's only enabled if postcopy is enabled; if the 'return-path' migration capability is enabled, the return path is NOT setup but the core migration code still tries to use it and breaks. Enable the RDMA return path if either postcopy or the return-path capability is enabled. bz: https://bugzilla.redhat.com/show_bug.cgi?id=2063615 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Li Zhijian <lizhijian@fujitsu.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2023-03-16migration: Wait on preempt channel in preempt threadPeter Xu1-5/+6
QEMU main thread will wait until dest preempt channel established during processing the LISTEN command (within the whole postcopy PACKAGED data), by waiting on the semaphore postcopy_qemufile_dst_done. That's racy, because it's possible that the dest QEMU main thread hasn't yet accept()ed the new connection when processing the LISTEN event. The sem_wait() will yield the main thread without being able to run anything else including the accept() of the new socket, which can cause deadlock within the main thread. To avoid the race, move the "wait channel" from main thread to the preempt thread right at the start. Reported-by: Peter Maydell <peter.maydell@linaro.org> Fixes: 5655aab079 ("migration: Postpone postcopy preempt channel to be after main") Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2023-03-16docs/sphinx/kerneldoc.py: Honour --enable-werrorPeter Maydell2-1/+6
Currently, the kerneldoc Sphinx plugin doesn't honour the --enable-werror configure option, so its warnings are never fatal. This is because although we do pass sphinx-build the -W switch, the warnings from kerneldoc are produced by the scripts/kernel-doc script directly and don't go through Sphinx's "emit a warning" function. When --enable-werror is in effect, pass sphinx-build an extra argument -Dkerneldoc_werror=1. The kerneldoc plugin can then use this to determine whether it should be passing the kernel-doc script -Werror. We do this because there is no documented mechanism for a Sphinx plugin to determine whether sphinx-build was passed -W or not; if one is provided then we can switch to that at a later date: https://github.com/sphinx-doc/sphinx/issues/11239 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230314114431.1096972-1-peter.maydell@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2023-03-16update seabios binaries to 1.16.2Gerd Hoffmann12-0/+0
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2023-03-16update seabios submodule to 1.16.2Gerd Hoffmann1-0/+0
git shortlog rel-1.16.1..rel-1.16.2 ----------------------------------- David Woodhouse (1): xen: require Xen info structure at 0x1000 to detect Xen Qi Zhou (1): usb: fix wrong init of keyboard/mouse's if first interface is not boot protocol Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2023-03-16target/sh4: Honor QEMU_LOG_FILENAME with QEMU_LOG=cpuIlya Leoshkevich1-7/+7
When using QEMU_LOG=cpu on sh4, QEMU_LOG_FILENAME is partially ignored. Fix by using qemu_fprintf() instead of qemu_printf() in the respective places. Fixes: 90c84c560067 ("qom/cpu: Simplify how CPUClass:cpu_dump_state() prints") Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230316003411.129462-1-iii@linux.ibm.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2023-03-16exec/memory: Fix kernel-doc warningBernhard Beschow2-5/+5
During build the kernel-doc script complains about the following issue: src/docs/../include/exec/memory.h:1741: warning: Function parameter or member 'n' not described in 'memory_region_unmap_iommu_notifier_range' src/docs/../include/exec/memory.h:1741: warning: Excess function parameter 'notifier' description in 'memory_region_unmap_iommu_notifier_range' Settle on "notifier" for consistency with other memory functions. Fixes: 7caebbf9ea53 ("memory: introduce memory_region_unmap_iommu_notifier_range()") Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230315072552.47117-1-shentey@gmail.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2023-03-15tests/tcg/xtensa: allow testing big-endian coresMax Filippov3-2/+8
Don't disable all big-endian tests, instead check whether $(CORE) is supported by the configured $(QEMU) and enable tests if it is. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2023-03-15tests/tcg/xtensa: add linker.ld to CLEANFILESMax Filippov1-0/+1
Linker script for xtensa tests must be preprocessed for a specific target, remove it as a part of make clean. Fixes: be5cac175a ("tests/tcg/xtensa: enable system tests") Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-03-15vl: defuse PID file path resolve errorFiona Ebner1-4/+5
Commit 85c4bf8aa6 ("vl: Unlink absolute PID file path") introduced a critical error when the PID file path cannot be resolved. Before this commit, it was possible to invoke QEMU when the PID file was a file created with mkstemp that was already unlinked at the time of the invocation. There might be other similar scenarios. It should not be a critical error when the PID file unlink notifier can't be registered, because the path can't be resolved. If the file is already gone from QEMU's perspective, silently ignore the error. Otherwise, only print a warning. Fixes: 85c4bf8aa6 ("vl: Unlink absolute PID file path") Reported-by: Dominik Csapak <d.csapak@proxmox.com> Suggested-by: Thomas Lamprecht <t.lamprecht@proxmox.com> Signed-off-by: Fiona Ebner <f.ebner@proxmox.com> Reviewed-by: Hanna Reitz <hreitz@redhat.com> Message-Id: <20221031094716.39786-1-f.ebner@proxmox.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-03-15hw/intc/ioapic: Update KVM routes before redelivering IRQ, on RTE updateDavid Woodhouse1-2/+1
A Linux guest will perform IRQ migration after the IRQ has happened, updating the RTE to point to the new destination CPU and then unmasking the interrupt. However, when the guest updates the RTE, ioapic_mem_write() calls ioapic_service(), which redelivers the pending level interrupt via kvm_set_irq(), *before* calling ioapic_update_kvm_routes() which sets the new target CPU. Thus, the IRQ which is supposed to go to the new target CPU is instead misdelivered to the previous target. An example where the guest kernel is attempting to migrate from CPU#2 to CPU#0 shows: xenstore_read tx 0 path control/platform-feature-xs_reset_watches ioapic_set_irq vector: 11 level: 1 ioapic_set_remote_irr set remote irr for pin 11 ioapic_service: trigger KVM IRQ 11 [ 0.523627] The affinity mask was 0-3 and the handler is on 2 ioapic_mem_write ioapic mem write addr 0x0 regsel: 0x27 size 0x4 val 0x26 ioapic_update_kvm_routes: update KVM route for IRQ 11: fee02000 8021 ioapic_mem_write ioapic mem write addr 0x10 regsel: 0x26 size 0x4 val 0x18021 xenstore_reset_watches ioapic_set_irq vector: 11 level: 1 ioapic_mem_read ioapic mem read addr 0x10 regsel: 0x26 size 0x4 retval 0x1c021 [ 0.524569] ioapic_ack_level IRQ 11 moveit = 1 ioapic_eoi_broadcast EOI broadcast for vector 33 ioapic_clear_remote_irr clear remote irr for pin 11 vector 33 ioapic_mem_write ioapic mem write addr 0x0 regsel: 0x26 size 0x4 val 0x26 ioapic_mem_read ioapic mem read addr 0x10 regsel: 0x26 size 0x4 retval 0x18021 [ 0.525235] ioapic_finish_move IRQ 11 calls irq_move_masked_irq() [ 0.526147] irq_do_set_affinity for IRQ 11, 0 [ 0.526732] ioapic_set_affinity for IRQ 11, 0 [ 0.527330] ioapic_setup_msg_from_msi for IRQ11 target 0 ioapic_mem_write ioapic mem write addr 0x0 regsel: 0x26 size 0x4 val 0x27 ioapic_mem_write ioapic mem write addr 0x10 regsel: 0x27 size 0x4 val 0x0 ioapic_mem_write ioapic mem write addr 0x0 regsel: 0x27 size 0x4 val 0x26 ioapic_mem_write ioapic mem write addr 0x10 regsel: 0x26 size 0x4 val 0x18021 [ 0.527623] ioapic_set_affinity returns 0 [ 0.527623] ioapic_finish_move IRQ 11 calls unmask_ioapic_irq() ioapic_mem_write ioapic mem write addr 0x0 regsel: 0x26 size 0x4 val 0x26 ioapic_mem_write ioapic mem write addr 0x10 regsel: 0x26 size 0x4 val 0x8021 ioapic_set_remote_irr set remote irr for pin 11 ioapic_service: trigger KVM IRQ 11 ioapic_update_kvm_routes: update KVM route for IRQ 11: fee00000 8021 [ 0.529571] The affinity mask was 0 and the handler is on 2 [ xenstore_watch path memory/target token FFFFFFFF92847D40 There are no other code paths in ioapic_mem_write() which need the KVM IRQ routing table to be updated, so just shift the call from the end of the function to happen right before the call to ioapic_service() and thus deliver the re-enabled IRQ to the right place. Alternative fixes might have been just to remove the part in ioapic_service() which delivers the IRQ via kvm_set_irq() because surely delivering as MSI ought to work just fine anyway in all cases? That code lacks a comment justifying its existence. Or maybe in the specific case shown in the above log, it would have sufficed for ioapic_update_kvm_routes() to update the route *even* when the IRQ is masked. It's not like it's actually going to get triggered unless QEMU deliberately does so, anyway? But that only works because the target CPU happens to be in the high word of the RTE; if something in the *low* word (vector, perhaps) was changed at the same time as the unmask, we'd still trigger with stale data. Fixes: 15eafc2e602f "kvm: x86: add support for KVM_CAP_SPLIT_IRQCHIP" Signed-off-by: David Woodhouse <dwmw2@infradead.org> Reviewed-by: Peter Xu <peterx@redhat.com> Message-Id: <20230308111952.2728440-2-dwmw2@infradead.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>