summary refs log tree commit diff stats
path: root/python/qemu/utils/qemu_ga_client.py (unfollow)
Commit message (Collapse)AuthorFilesLines
2022-01-28target/ppc: 74xx: External interrupt cleanupFabiano Rosas1-38/+0
The 74xx don't have MSR_HV so all the LPES0 logic can be removed. Also remove the BookE IRQ code. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Message-Id: <20220127201116.1154733-5-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: 74xx: Machine Check exception cleanupFabiano Rosas1-24/+0
The 74xx don't have an MSR_HV. Also remove 40x and BookE code. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Message-Id: <20220127201116.1154733-4-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: Simplify powerpc_excp_74xxFabiano Rosas1-202/+9
Differences from the generic powerpc_excp code: - Not BookE, so some MSR bits are cleared at interrupt dispatch; - No MSR_HV; - No power saving states; - No Hypervisor Emulation Assistance; - Not 64 bits; - No System call vectored; - No Alternate Interrupt Location. Exceptions used: POWERPC_EXCP_ALIGN POWERPC_EXCP_DECR POWERPC_EXCP_DSI POWERPC_EXCP_EXTERNAL POWERPC_EXCP_FPU POWERPC_EXCP_IABR POWERPC_EXCP_ISI POWERPC_EXCP_MCHECK POWERPC_EXCP_PERFM POWERPC_EXCP_PROGRAM POWERPC_EXCP_RESET POWERPC_EXCP_SMI POWERPC_EXCP_SYSCALL POWERPC_EXCP_THERM POWERPC_EXCP_TRACE POWERPC_EXCP_VPU POWERPC_EXCP_VPUA Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Message-Id: <20220127201116.1154733-3-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: Introduce powerpc_excp_74xxFabiano Rosas1-0/+474
Introduce a new powerpc_excp function specific for PowerPC 74xx CPUs. This commit copies powerpc_excp_legacy verbatim so the next one has a clean diff. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Message-Id: <20220127201116.1154733-2-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: books: Program exception cleanupFabiano Rosas1-4/+0
Remove setting of BookE registers. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220124184605.999353-6-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: books: External interrupt cleanupFabiano Rosas1-23/+7
Since this is now BookS only, we can simplify the code a bit and check has_hv_mode instead of enumerating the exception models. LPES0 does not make sense if there is no MSR_HV. Note that QEMU does not support HV mode on 970 and POWER5+ so we don't set MSR_HV in msr_mask. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220124184605.999353-5-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: books: Machine Check exception cleanupFabiano Rosas1-17/+0
powerpc_excp_books is BookS only, so remove 40x and BookE code. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220124184605.999353-4-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: Simplify powerpc_excp_booksFabiano Rosas1-147/+14
Differences from the generic powerpc_excp code: - Not BookE, so some MSR bits are cleared at interrupt dispatch; - Always uses HV_EMU if the CPU has MSR_HV; - Exceptions always delivered in 64 bit. Exceptions used: POWERPC_EXCP_ALIGN POWERPC_EXCP_DECR POWERPC_EXCP_DSEG POWERPC_EXCP_DSI POWERPC_EXCP_EXTERNAL POWERPC_EXCP_FPU POWERPC_EXCP_FU POWERPC_EXCP_HDECR POWERPC_EXCP_HDSI POWERPC_EXCP_HISI POWERPC_EXCP_HVIRT POWERPC_EXCP_HV_EMU POWERPC_EXCP_HV_FU POWERPC_EXCP_ISEG POWERPC_EXCP_ISI POWERPC_EXCP_MAINT POWERPC_EXCP_MCHECK POWERPC_EXCP_PERFM POWERPC_EXCP_PROGRAM POWERPC_EXCP_RESET POWERPC_EXCP_SDOOR_HV POWERPC_EXCP_SYSCALL POWERPC_EXCP_SYSCALL_VECTORED POWERPC_EXCP_THERM POWERPC_EXCP_TRACE POWERPC_EXCP_VPU POWERPC_EXCP_VPUA POWERPC_EXCP_VSXU POWERPC_EXCP_HV_MAINT POWERPC_EXCP_SDOOR (I added the two above that were not being considered. They used to be "Invalid exception". Now they become "Unimplemented exception" which is more accurate.) Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220124184605.999353-3-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: Introduce powerpc_excp_booksFabiano Rosas1-0/+478
Introduce a new powerpc_excp function specific for BookS CPUs. This commit copies powerpc_excp_legacy verbatim so the next one has a clean diff. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220124184605.999353-2-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: 405: Watchdog timer exception cleanupFabiano Rosas1-9/+0
Remove references to BookE. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220118184448.852996-15-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: 405: Program exception cleanupFabiano Rosas1-15/+4
The 405 Program Interrupt does not set SRR1 with any diagnostic bits, just a clean copy of the MSR. We're using the BookE Exception Syndrome Register which is different from the 405. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> [ clg: restored SPR_40x_ESR settings ] Message-Id: <20220118184448.852996-14-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: 405: Instruction storage interrupt cleanupFabiano Rosas1-1/+0
The 405 ISI does not set SRR1 with any exception syndrome bits, only a clean copy of the MSR. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> [ clg : Fixed removal which was done in the wrong routine ] Message-Id: <20220118184448.852996-13-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: 405: Data Storage exception cleanupFabiano Rosas1-1/+1
The 405 has no DSISR or DAR, so convert the trace entry to use ESR and DEAR instead. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> [ clg : - changed registers to ESR and DEAR. - updated commit log ] Message-Id: <20220118184448.852996-12-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: 405: Debug exception cleanupFabiano Rosas1-14/+4
The current Debug exception dispatch is the BookE one, so it is different from the 405. We effectively don't support the 405 Debug exception. This patch removes the BookE code and moves the DEBUG into the "not implemented" block. Note that there is in theory a functional change here since we now abort when a Debug exception happens. However, given how it was never implemented, I don't believe this to have ever been dispatched for the 405. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20220118184448.852996-11-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: 405: Alignment exception cleanupFabiano Rosas1-7/+0
There is no DSISR in the 405. It uses DEAR which we already set earlier at ppc_cpu_do_unaligned_access. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au Message-Id: <20220118184448.852996-10-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: 405: System call exception cleanupFabiano Rosas1-19/+2
There's no sc 1. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220118184448.852996-9-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: 405: External exception cleanupFabiano Rosas1-37/+0
405 has no MSR_HV and EPR is BookE only so we can remove it all. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20220118184448.852996-8-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: 405: Machine check exception cleanupFabiano Rosas1-24/+2
powerpc_excp_40x applies only to the 405, so remove HV code and references to BookE. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20220118184448.852996-7-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: 405: Critical exceptions cleanupFabiano Rosas1-15/+2
In powerpc_excp_40x the Critical exception is now for 405 only, so we can remove the BookE and G2 blocks. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220118184448.852996-6-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: Simplify powerpc_excp_40xFabiano Rosas1-195/+10
Differences from the generic powerpc_excp code: - Not BookE, so some MSR bits are cleared at interrupt dispatch; - No MSR_HV or MSR_LE; - No power saving states; - No Hypervisor Emulation Assistance; - Not 64 bits; - No System call vectored; - No Interrupts Little Endian; - No Alternate Interrupt Location. Exceptions used: POWERPC_EXCP_ALIGN POWERPC_EXCP_CRITICAL POWERPC_EXCP_DEBUG POWERPC_EXCP_DSI POWERPC_EXCP_DTLB POWERPC_EXCP_EXTERNAL POWERPC_EXCP_FIT POWERPC_EXCP_ISI POWERPC_EXCP_ITLB POWERPC_EXCP_MCHECK POWERPC_EXCP_PIT POWERPC_EXCP_PROGRAM POWERPC_EXCP_SYSCALL POWERPC_EXCP_WDT Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20220118184448.852996-5-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: Introduce powerpc_excp_40xFabiano Rosas1-0/+474
Introduce a new powerpc_excp function specific for 40x CPUs. This commit copies powerpc_excp_legacy verbatim so the next one has a clean diff. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220118184448.852996-4-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: 405: Add missing MSR_ME bitFabiano Rosas1-0/+1
The 405 MSR has the Machine Check Enable bit. We're making use of it when dispatching Machine Check, so add the bit to the msr_mask. Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220118184448.852996-3-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: 405: Rename MSR_POW to MSR_WEFabiano Rosas2-1/+2
Bit 13 is the Wait State Enable bit. Give it its proper name. As far as I can see we don't do anything with MSR_POW for the 405, so this change has no effect. Suggested-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220118184448.852996-2-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28ppc/ppc405: Fix TLB flushingCédric Le Goater3-2/+13
Commit cd0c6f473532 did not take into account 405 CPUs when adding support to batching of TCG tlb flushes. Set the TLB_NEED_LOCAL_FLUSH flag when the SPR_40x_PID is set or a TLB updated. Cc: Thomas Huth <thuth@redhat.com> Cc: Christophe Leroy <christophe.leroy@csgroup.eu> Cc: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Fabiano Rosas <farosas@linux.ibm.com> Fixes: cd0c6f473532 ("ppc: Do some batching of TCG tlb flushes") Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220113180352.1234512-1-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28hw/ppc/vof: Add missing includesPhilippe Mathieu-Daudé2-1/+5
vof.h requires "qom/object.h" for DECLARE_CLASS_CHECKERS(), "exec/memory.h" for address_space_read/write(), "exec/address-spaces.h" for address_space_memory and more importantly "cpu.h" for target_ulong. vof.c doesn't need "exec/ram_addr.h". Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220122003104.84391-1-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: Put do_rfi under a TCG-only blockFabiano Rosas1-2/+0
The --disable-tcg build broke when do_rfi stopped being inlined. Fixes: 62e79ef914 ("target/ppc: Remove static inline") Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20220124191547.1008391-1-farosas@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: Fix test on mmu_model in hreg_compute_hflags_value()Cédric Le Goater1-2/+4
POWERPC_MMU_BOOKE is not a mask and should not be tested with a bitwise AND operator. It went unnoticed because it only impacts the 601 CPU implementation for which we don't have a known firmware image. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20220124081609.3672341-1-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28spapr.c: check bus != NULL in spapr_get_fw_dev_path()Daniel Henrique Barboza1-1/+1
spapr_get_fw_dev_path() is an impl of FWPathProviderClass::get_dev_path(). This interface is used by hw/core/qdev-fw.c via fw_path_provider_try_get_dev_path() in two functions: - static char *qdev_get_fw_dev_path_from_handler(), which is used only in qdev_get_fw_dev_path_helper() and it's guarded by "if (dev && dev->parent_bus)"; - char *qdev_get_own_fw_dev_path_from_handler(), which is used in softmmu/bootdevice.c in get_boot_device_path() like this: if (dev) { d = qdev_get_own_fw_dev_path_from_handler(dev->parent_bus, dev); This means that, when called via softmmu/bootdevice.c, there's no check of 'dev->parent_bus' being not NULL. The result is that the "BusState *bus" arg of spapr_get_fw_dev_path() can potentially be NULL and if, at the same time, "SCSIDevice *d" is not NULL, we'll hit this line: void *spapr = CAST(void, bus->parent, "spapr-vscsi"); And we'll SIGINT because 'bus' is NULL and we're accessing bus->parent. Adding a simple 'bus != NULL' check to guard the instances where we access 'bus->parent' can avoid this altogether. Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220121213852.30243-1-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: fix 'skip KVM' cond in cpu_interrupt_exittb()Daniel Henrique Barboza1-1/+5
cpu_interrupt_exittb() was introduced by commit 044897ef4a22 ("target/ppc: Fix system lockups caused by interrupt_request state corruption") as a way to wrap cpu_interrupt() helper in BQL. After that, commit 6d38666a8931 ("ppc: Ignore the CPU_INTERRUPT_EXITTB interrupt with KVM") added a condition to skip this interrupt if we're running with KVM. Problem is that the change made by the above commit, testing for !kvm_enabled() at the start of cpu_interrupt_exittb(): static inline void cpu_interrupt_exittb(CPUState *cs) { if (!kvm_enabled()) { return; } (... do cpu_interrupt(cs, CPU_INTERRUPT_EXITTB) ...) is doing the opposite of what it intended to do. This will return immediately if not kvm_enabled(), i.e. it's a emulated CPU, and if kvm_enabled() it will proceed to fire CPU_INTERRUPT_EXITTB. Fix the 'skip KVM' condition so the function is a no-op when kvm_enabled(). CC: Greg Kurz <groug@kaod.org> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/809 Fixes: 6d38666a8931 ("ppc: Ignore the CPU_INTERRUPT_EXITTB interrupt with KVM") Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <20220121160841.9102-1-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28ppc/xive: check return value of ldq_be_dma()Cédric Le Goater1-4/+18
The ldq_be_dma() routine was recently changed to return a result of the transaction. Use it when loading the virtual structure descriptors in the XIVE PowerNV model. Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220124081635.3672439-1-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28ppc/pnv: use a do-while() loop in pnv_phb4_translate_tve()Daniel Henrique Barboza1-2/+4
pnv_phb4_translate_tve() is quite similar to pnv_phb3_translate_tve(), and that includes the fact that 'taddr' can be considered uninitialized when throwing the "TCE access fault" error because, in theory, the loop that sets 'taddr' can be skippable due to 'lev' being an signed int. No one complained about this specific case yet, but since we took the time to handle the same situtation in pnv_phb3_translate_tve(), let's replicate it here as well. Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Matheus Ferst <matheus.ferst@eldorado.org.br> Message-Id: <20220127122234.842145-3-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28ppc/pnv: use a do-while() loop in pnv_phb3_translate_tve()Daniel Henrique Barboza1-2/+4
The 'taddr' variable is left unintialized, being set only inside the "while ((lev--) >= 0)" loop where we get the TCE address. The 'lev' var is an int32_t that is being initiliazed by the GETFIELD() macro, which returns an uint64_t. For a human reader this means that 'lev' will always be positive or zero. But some compilers may beg to differ. 'lev' being an int32_t can in theory be set as negative, and the "while ((lev--) >= 0)" loop might never be reached, and 'taddr' will be left unitialized. This can cause phb3_error() to use 'taddr' uninitialized down below: if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) { phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr); A quick way of fixing it is to use a do/while() loop. This will keep the same semanting as the existing while() loop does and the compiler will understand that 'taddr' will be initialized at least once. Suggested-by: Matheus K. Ferst <matheus.ferst@eldorado.org.br> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/573 Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20220127122234.842145-2-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28ppc/pnv: Fail DMA access if page permissions are not correctFrederic Barrat2-10/+12
If an iommu page has wrong permissions, an error message is displayed, but the access is allowed, which is odd. This patch fixes it. Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20220121152350.381685-1-fbarrat@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc/mmu_common: Fix SRR1/MSR error code on Book-EVitaly Cheptsov1-3/+15
Book-E architecture does not set the error code in 31:27 bits of SRR1, but instead uses these bits for custom fields such as GS (Guest Supervisor). Wrongly setting these fields will result in QEMU crashes when attempting to execute not executable code due to the attempts to use Guest Supervisor mode. Cc: "Cédric Le Goater" <clg@kaod.org> Cc: Daniel Henrique Barboza <danielhb413@gmail.com> Cc: David Gibson <david@gibson.dropbear.id.au> Cc: Greg Kurz <groug@kaod.org> Cc: qemu-ppc@nongnu.org Cc: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org Signed-off-by: Vitaly Cheptsov <cheptsov@ispras.ru> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220121093107.15478-1-cheptsov@ispras.ru> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28target/ppc: 603: fix restore of GPRs 0-3 on rfiChristophe Leroy1-0/+4
After a TLB miss exception, GPRs 0-3 must be restored on rfi. This is managed by hreg_store_msr() which is called by do_rfi() However, hreg_store_msr() does it if MSR[TGPR] is unset in the passed MSR value. The problem is that do_rfi() is given the content of SRR1 as the value to be set in MSR, but TGPR bit is not part of SRR1 and that bit is used for something else and is sometimes set to 1, leading to hreg_store_msr() not restoring GPRs. So, do the same way as for POW bit, force clearing it. Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu> Cc: Cedric Le Goater <clg@kaod.org> Cc: Fabiano Rosas <farosas@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220120103824.239573-1-christophe.leroy@csgroup.eu> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-28spapr: Force 32bit when resetting a coreAlexey Kardashevskiy2-2/+5
"PowerPC Processor binding to IEEE 1275" says in "8.2.1. Initial Register Values" that the initial state is defined as 32bit so do it for both SLOF and VOF. This should not cause behavioral change as SLOF switches to 64bit very early anyway. As nothing enforces LE anywhere, this drops it for VOF. The goal is to make VOF work with TCG as otherwise it barfs with qemu: fatal: TCG hflags mismatch (current:0x6c000004 rebuilt:0x6c000000) Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220107072423.2278113-1-aik@ozlabs.ru> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-01-27qapi: generate trace events by defaultVladimir Sementsov-Ogievskiy4-7/+9
We don't generate trace events for tests/ and qga/ because that it is not simple and not necessary. We have corresponding comments in both tests/meson.build and qga/meson.build. Still to not miss possible future qapi code generation call, and not to forget to enable trace events generation, let's enable it by default. So, turn option --gen-trace into opposite --no-trace-events and use new option only in tests/ and qga/ where we already have good comments why we don't generate trace events code. Note that this commit enables trace-events generation for qapi-gen.py call from tests/qapi-schema/meson.build and storage-daemon/meson.build. Still, both are kind of noop: tests/qapi-schema/ doesn't seem to generate any QMP command code and no .trace-events files anyway, storage-daemon/ uses common QMP command implementations and just generate empty .trace-events Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20220126161130.3240892-8-vsementsov@virtuozzo.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-01-27meson: document why we don't generate trace events for tests/ and qga/Vladimir Sementsov-Ogievskiy2-0/+14
Making trace generation work for tests/ and qga/ would involve some Meson hackery to ensure we generate the trace-events files before trace-tool uses them. Since we don't actually support tracing there anyway, we bypass that problem. Let's add corresponding comments. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20220126161130.3240892-7-vsementsov@virtuozzo.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Pasto fixed, commit message punctuation tidied up] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-01-27docs/qapi-code-gen: update to cover trace events code generationVladimir Sementsov-Ogievskiy2-0/+25
Previous commits enabled trace events generation for most of QAPI generated code (except for tests/ and qga/). Let's update documentation to illustrate it. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20220126161130.3240892-6-vsementsov@virtuozzo.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-01-27meson: generate trace events for qmp commandsVladimir Sementsov-Ogievskiy3-4/+19
1. Use --gen-trace when generate qmp commands 2. Add corresponding .trace-events files as outputs in qapi_files custom target 3. Define global qapi_trace_events list of .trace-events file targets, to fill in trace/qapi.build and to use in trace/meson.build 4. In trace/meson.build use the new array as an additional source of .trace_events files to be processed Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20220126161130.3240892-5-vsementsov@virtuozzo.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-01-27qapi/commands: Optionally generate trace for QMP commandsVladimir Sementsov-Ogievskiy2-14/+90
Add trace generation disabled by default and new option --gen-trace to enable it. The next commit will enable it for qapi/, but not for qga/ and tests/. Making it work for the latter two would involve some Meson hackery to ensure we generate the trace-events files before trace-tool uses them. Since we don't actually support tracing there, we'll bypass that problem. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20220126161130.3240892-4-vsementsov@virtuozzo.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Superfluous #include dropped] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-01-27qapi/commands: refactor error handling codeVladimir Sementsov-Ogievskiy2-4/+8
Move error_propagate() to if (err) and make "if (err)" block mandatory. This is to simplify further commit, which will bring trace events generation for QMP commands. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20220126161130.3240892-3-vsementsov@virtuozzo.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-01-27qapi/gen: Add FOO.trace-events output moduleVladimir Sementsov-Ogievskiy1-4/+27
We are going to generate trace events for QMP commands. We should generate both trace_*() function calls and trace-events files listing events for trace generator. So, add an output module FOO.trace-events for each FOO schema module. Since we're going to add trace events only to command marshallers, make the trace-events output optional, so we don't generate so many useless empty files. Currently nobody set add_trace_events to True, so new functionality is disabled. It will be enabled for QAPISchemaGenCommandVisitor in a further commit. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20220126161130.3240892-2-vsementsov@virtuozzo.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-01-27schemas: add missing vim modelineVictor Toso4-0/+4
Similar to f7160f3218 "schemas: Add vim modeline" Signed-off-by: Victor Toso <victortoso@redhat.com> Message-Id: <20211220145624.52801-1-victortoso@redhat.com> Acked-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-01-26virtiofsd: Drop membership of all supplementary groups (CVE-2022-0358)Vivek Goyal1-0/+27
At the start, drop membership of all supplementary groups. This is not required. If we have membership of "root" supplementary group and when we switch uid/gid using setresuid/setsgid, we still retain membership of existing supplemntary groups. And that can allow some operations which are not normally allowed. For example, if root in guest creates a dir as follows. $ mkdir -m 03777 test_dir This sets SGID on dir as well as allows unprivileged users to write into this dir. And now as unprivileged user open file as follows. $ su test $ fd = open("test_dir/priviledge_id", O_RDWR|O_CREAT|O_EXCL, 02755); This will create SGID set executable in test_dir/. And that's a problem because now an unpriviliged user can execute it, get egid=0 and get access to resources owned by "root" group. This is privilege escalation. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2044863 Fixes: CVE-2022-0358 Reported-by: JIETAO XIAO <shawtao1125@gmail.com> Suggested-by: Miklos Szeredi <mszeredi@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Message-Id: <YfBGoriS38eBQrAb@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> dgilbert: Fixed missing {}'s style nit
2022-01-21scripts/render-block-graph: switch to AQMPJohn Snow1-5/+3
Creating an instance of qemu.aqmp.ExecuteError is too involved here, so just drop the specificity down to a generic QMPError. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Beraldo Leal <bleal@redhat.com>
2022-01-21scripts/cpu-x86-uarch-abi: switch to AQMPJohn Snow1-2/+2
Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Beraldo Leal <bleal@redhat.com>
2022-01-21scripts/cpu-x86-uarch-abi: fix CLI parsingJohn Snow1-2/+1
Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2022-01-21python: move qmp-shell under the AQMP packageJohn Snow4-3/+3
Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Beraldo Leal <bleal@redhat.com>
2022-01-21python: move qmp utilities to python/qemu/utilsJohn Snow11-14/+14
In order to upload a QMP package to PyPI, I want to remove any scripts that I am not 100% confident I want to support upstream, beyond our castle walls. Move most of our QMP utilities into the utils package so we can split them out from the PyPI upload. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Beraldo Leal <bleal@redhat.com>