Commit Graph

95296 Commits

Author SHA1 Message Date
Richard Henderson
0cbc135917 target/i386: Suppress coverity warning on fsave/frstor
Coverity warns that 14 << data32 may overflow with respect
to the target_ulong to which it is subsequently added.
We know this wasn't true because data32 is in [1,2],
but the suggested fix is perfectly fine.

Fixes: Coverity CID 1487135, 1487256
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Damien Hedde <damien.hedde@greensocs.com>
Message-Id: <20220401184635.327423-1-richard.henderson@linaro.org>
2022-04-26 19:59:51 -07:00
Richard Henderson
21641ee5a9 target/s390x: Fix the accumulation of ccm in op_icm
Coverity rightly reports that 0xff << pos can overflow.
This would affect the ICMH instruction.

Fixes: Coverity CID 1487161
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20220401193659.332079-1-richard.henderson@linaro.org>
2022-04-26 19:58:43 -07:00
Richard Henderson
b826044fc0 accel/tcg: Assert mmu_idx in range before use in cputlb
Coverity reports out-of-bound accesses within cputlb.c.
This should be a false positive due to how the index is
decoded from MemOpIdx.  To be fair, nothing is checking
the correct bounds during encoding either.

Assert index in range before use, both to catch user errors
and to pacify static analysis.

Fixes: Coverity CID 1487120, 1487127, 1487170, 1487196, 1487215, 1487238
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20220401170813.318609-1-richard.henderson@linaro.org>
2022-04-26 19:57:56 -07:00
Richard Henderson
a72d900809 nbd patches for 2022-04-26
- Paolo Bonzini: thread-safety improvements to NBD client
 - Vladimir Sementsov-Ogievsky: finer-grained selection of bitmaps during
   nbd-export
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEccLMIrHEYCkn0vOqp6FrSiUnQ2oFAmJoUhAACgkQp6FrSiUn
 Q2qnpgf/YCuONdwAndjEo7he5c1BfB/F2sujQJJ00CebUqnz5OFKQ85RwLC8DCGB
 rXnxqC/NF4yyYM+6uYWDpggDd0bJVKbfG7NE/AZsEZrK+n9xMkvGLRwGqMugUii+
 Px4Ba98++0giqGoAI8pU/wQZNh1I6uGabv/DPRTpwzBjbfAcATqV09OzaGiK3SRC
 Zm/55zmXm1zM4XSUtUzN1gILPG09P+51m6NVkANZbzps9e2PtfFy8EsWc5+YhuBM
 5K7sN+5g8GpRhz6j8RkrhrbNpvg3bGvgRJRMcW7Bo8KVUdvT1Jng6xs8CIRv39AF
 jDJwGe+cq5p5PNuyqOrVSA/ynBZxBw==
 =I1yM
 -----END PGP SIGNATURE-----

Merge tag 'pull-nbd-2022-04-26' of https://repo.or.cz/qemu/ericb into staging

nbd patches for 2022-04-26

- Paolo Bonzini: thread-safety improvements to NBD client
- Vladimir Sementsov-Ogievsky: finer-grained selection of bitmaps during
  nbd-export

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCAAdFiEEccLMIrHEYCkn0vOqp6FrSiUnQ2oFAmJoUhAACgkQp6FrSiUn
# Q2qnpgf/YCuONdwAndjEo7he5c1BfB/F2sujQJJ00CebUqnz5OFKQ85RwLC8DCGB
# rXnxqC/NF4yyYM+6uYWDpggDd0bJVKbfG7NE/AZsEZrK+n9xMkvGLRwGqMugUii+
# Px4Ba98++0giqGoAI8pU/wQZNh1I6uGabv/DPRTpwzBjbfAcATqV09OzaGiK3SRC
# Zm/55zmXm1zM4XSUtUzN1gILPG09P+51m6NVkANZbzps9e2PtfFy8EsWc5+YhuBM
# 5K7sN+5g8GpRhz6j8RkrhrbNpvg3bGvgRJRMcW7Bo8KVUdvT1Jng6xs8CIRv39AF
# jDJwGe+cq5p5PNuyqOrVSA/ynBZxBw==
# =I1yM
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 26 Apr 2022 01:12:00 PM PDT
# gpg:                using RSA key 71C2CC22B1C4602927D2F3AAA7A16B4A2527436A
# gpg: Good signature from "Eric Blake <eblake@redhat.com>" [full]
# gpg:                 aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" [full]
# gpg:                 aka "[jpeg image of size 6874]" [full]

* tag 'pull-nbd-2022-04-26' of https://repo.or.cz/qemu/ericb:
  nbd: document what is protected by the CoMutexes
  nbd: take receive_mutex when reading requests[].receiving
  nbd: move s->state under requests_lock
  nbd: code motion and function renaming
  nbd: use a QemuMutex to synchronize yanking, reconnection and coroutines
  nbd: keep send_mutex/free_sema handling outside nbd_co_do_establish_connection
  nbd: remove peppering of nbd_client_connected
  nbd: mark more coroutine_fns
  nbd: safeguard against waking up invalid coroutine
  iotests/223: check new possibility of exporting bitmaps by node/name
  qapi: nbd-export: allow select bitmaps by node/name pair
  qapi: rename BlockDirtyBitmapMergeSource to BlockDirtyBitmapOrStr

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-04-26 14:39:09 -07:00
Richard Henderson
88d5814e6b Fix nios2-linux-user syscalls.
Fix nios2-linux-user sigreturn.
 Enable tests for nios2-linux-user.
 Remove special handling of SIGSEGV.
 Check supervisor for eret, bret.
 Split special registers out of env->regs[].
 Clean up interrupt processing.
 Raise unaligned data and destination exceptions.
 Set TLBMISC fields correctly on exceptions.
 Prevent writes to read-only or reserved control fields.
 Use tcg_constant_tl().
 Implement shadow register sets.
 Implement external interrupt controller interface.
 Implement vectored interrupt controller.
 Enable semihosting tests for nios2-softmmu.
 -----BEGIN PGP SIGNATURE-----
 
 iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmJoNuQdHHJpY2hhcmQu
 aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV+a0ggAhawc3tod4OTHRlRq
 rvZrJK740bNMo8rtidDnh71+IGjBiz8pXahqkE78cADtMzNmQoScwWbjht3cuMN2
 TMV0sbNDeA2OB98QzX6JTbCRtEfQAB7pyjpFvg6oXhYYSfwwhWbTR9QsYTHjq157
 ZKOprafoSlmDlgWJhlAikLdvJb07/5jgmvsLbBzu8/G/HiJ4HhHyjZxL1wNz1t/+
 0KTAbnn3SWGDAhLGS/P6BMZKeU1EAExAwo7CtZeUbs+9QCfeM3cBAurG3WB1Vw14
 ERPoGPPrARtoNPtgQFMHu0am3HH5HtneuzJfWaLT96rrwNyTrYY0EYti1NtFDW8O
 CCz42Q==
 =MHar
 -----END PGP SIGNATURE-----

Merge tag 'pull-nios2-20220426' of https://gitlab.com/rth7680/qemu into staging

Fix nios2-linux-user syscalls.
Fix nios2-linux-user sigreturn.
Enable tests for nios2-linux-user.
Remove special handling of SIGSEGV.
Check supervisor for eret, bret.
Split special registers out of env->regs[].
Clean up interrupt processing.
Raise unaligned data and destination exceptions.
Set TLBMISC fields correctly on exceptions.
Prevent writes to read-only or reserved control fields.
Use tcg_constant_tl().
Implement shadow register sets.
Implement external interrupt controller interface.
Implement vectored interrupt controller.
Enable semihosting tests for nios2-softmmu.

# -----BEGIN PGP SIGNATURE-----
#
# iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmJoNuQdHHJpY2hhcmQu
# aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV+a0ggAhawc3tod4OTHRlRq
# rvZrJK740bNMo8rtidDnh71+IGjBiz8pXahqkE78cADtMzNmQoScwWbjht3cuMN2
# TMV0sbNDeA2OB98QzX6JTbCRtEfQAB7pyjpFvg6oXhYYSfwwhWbTR9QsYTHjq157
# ZKOprafoSlmDlgWJhlAikLdvJb07/5jgmvsLbBzu8/G/HiJ4HhHyjZxL1wNz1t/+
# 0KTAbnn3SWGDAhLGS/P6BMZKeU1EAExAwo7CtZeUbs+9QCfeM3cBAurG3WB1Vw14
# ERPoGPPrARtoNPtgQFMHu0am3HH5HtneuzJfWaLT96rrwNyTrYY0EYti1NtFDW8O
# CCz42Q==
# =MHar
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 26 Apr 2022 11:16:04 AM PDT
# gpg:                using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg:                issuer "richard.henderson@linaro.org"
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [ultimate]

* tag 'pull-nios2-20220426' of https://gitlab.com/rth7680/qemu: (68 commits)
  tests/tcg/nios2: Add test-shadow-1
  tests/tcg/nios2: Add semihosting multiarch tests
  hw/nios2: Machine with a Vectored Interrupt Controller
  hw/nios2: Move memory regions into Nios2Machine
  hw/nios2: Introduce Nios2MachineState
  hw/intc: Vectored Interrupt Controller (VIC)
  linux-user/nios2: Handle various SIGILL exceptions
  target/nios2: Advance pc when raising exceptions
  target/nios2: Implement EIC interrupt processing
  target/nios2: Update helper_eret for shadow registers
  target/nios2: Implement rdprs, wrprs
  target/nios2: Introduce shadow register sets
  target/nios2: Implement Misaligned destination exception
  target/nios2: Use tcg_gen_lookup_and_goto_ptr
  target/nios2: Use gen_goto_tb for DISAS_TOO_MANY
  target/nios2: Hoist set of is_jmp into gen_goto_tb
  target/nios2: Create gen_jumpr
  target/nios2: Enable unaligned traps for system mode
  target/nios2: Drop CR_STATUS_EH from tb->flags
  target/nios2: Introduce dest_gpr
  ...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-04-26 13:12:37 -07:00
Paolo Bonzini
620c5cb5da nbd: document what is protected by the CoMutexes
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20220414175756.671165-10-pbonzini@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Lukas Straub <lukasstraub2@web.de>
Signed-off-by: Eric Blake <eblake@redhat.com>
2022-04-26 13:16:42 -05:00
Paolo Bonzini
a80a9a1c73 nbd: take receive_mutex when reading requests[].receiving
requests[].receiving is set by nbd_receive_replies() under the receive_mutex;
Read it under the same mutex as well.  Waking up receivers on errors happens
after each reply finishes processing, in nbd_co_receive_one_chunk().
If there is no currently-active reply, there are two cases:

* either there is no active request at all, in which case no
element of request[] can have .receiving = true

* or nbd_receive_replies() must be running and owns receive_mutex;
in that case it will get back to nbd_co_receive_one_chunk() because
the socket has been shutdown, and all waiting coroutines will wake up
in turn.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20220414175756.671165-9-pbonzini@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@openvz.org>
Reviewed-by: Lukas Straub <lukasstraub2@web.de>
Signed-off-by: Eric Blake <eblake@redhat.com>
2022-04-26 13:16:41 -05:00
Paolo Bonzini
dba5156c0e nbd: move s->state under requests_lock
Remove the confusing, and most likely wrong, atomics.  The only function
that used to be somewhat in a hot path was nbd_client_connected(),
but it is not anymore after the previous patches.

The same logic is used both to check if a request had to be reissued
and also in nbd_reconnecting_attempt().  The former cases are outside
requests_lock, while nbd_reconnecting_attempt() does have the lock,
therefore the two have been separated in the previous commit.
nbd_client_will_reconnect() can simply take s->requests_lock, while
nbd_reconnecting_attempt() can inline the access now that no
complicated atomics are involved.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20220414175756.671165-8-pbonzini@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@openvz.org>
Reviewed-by: Lukas Straub <lukasstraub2@web.de>
Signed-off-by: Eric Blake <eblake@redhat.com>
2022-04-26 13:16:39 -05:00
Paolo Bonzini
8d45185cb7 nbd: code motion and function renaming
Prepare for the next patch, so that the diff is less confusing.

nbd_client_connecting is moved closer to the definition point.

nbd_client_connecting_wait() is kept only for the reconnection
logic; when it is used to check if a request has to be reissued,
use the renamed function nbd_client_will_reconnect().  In the
next patch, the two cases will have different locking requirements.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20220414175756.671165-7-pbonzini@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@openvz.org>
Reviewed-by: Lukas Straub <lukasstraub2@web.de>
Signed-off-by: Eric Blake <eblake@redhat.com>
2022-04-26 13:16:38 -05:00
Paolo Bonzini
ee19d953ec nbd: use a QemuMutex to synchronize yanking, reconnection and coroutines
The condition for waiting on the s->free_sema queue depends on
both s->in_flight and s->state.  The latter is currently using
atomics, but this is quite dubious and probably wrong.

Because s->state is written in the main thread too, for example by
the yank callback, it cannot be protected by a CoMutex.  Introduce a
separate lock that can be used by nbd_co_send_request(); later on this
lock will also be used for s->state.  There will not be any contention
on the lock unless there is a yank or reconnect, so this is not
performance sensitive.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20220414175756.671165-6-pbonzini@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Lukas Straub <lukasstraub2@web.de>
Signed-off-by: Eric Blake <eblake@redhat.com>
2022-04-26 13:16:37 -05:00
Paolo Bonzini
8610b4491f nbd: keep send_mutex/free_sema handling outside nbd_co_do_establish_connection
Elevate s->in_flight early so that other incoming requests will wait
on the CoQueue in nbd_co_send_request; restart them after getting back
from nbd_reconnect_attempt.  This could be after the reconnect timer or
nbd_cancel_in_flight have cancelled the attempt, so there is no
need anymore to cancel the requests there.

nbd_co_send_request now handles both stopping and restarting pending
requests after a successful connection, and there is no need to
hold send_mutex in nbd_co_do_establish_connection.  The current setup
is confusing because nbd_co_do_establish_connection is called both with
send_mutex taken and without it.  Before the patch it uses free_sema which
(at least in theory...) is protected by send_mutex, after the patch it
does not anymore.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20220414175756.671165-5-pbonzini@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: wrap long line]
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@openvz.org>
Reviewed-by: Lukas Straub <lukasstraub2@web.de>
Signed-off-by: Eric Blake <eblake@redhat.com>
2022-04-26 13:16:36 -05:00
Paolo Bonzini
172f5f1a40 nbd: remove peppering of nbd_client_connected
It is unnecessary to check nbd_client_connected() because every time
s->state is moved out of NBD_CLIENT_CONNECTED the socket is shut down
and all coroutines are resumed.

The only case where it was actually needed is when the NBD
server disconnects and there is no reconnect-delay.  In that
case, nbd_receive_replies() does not set s->reply.handle and
nbd_co_do_receive_one_chunk() cannot continue.  For that one case,
check the return value of nbd_receive_replies().

As to the others:

* nbd_receive_replies() can put the current coroutine to sleep if another
reply is ongoing; then it will be woken by nbd_channel_error(), called
by the ongoing reply.  Or it can try itself to read a reply header and
fail, thus calling nbd_channel_error() itself.

* nbd_co_send_request() will write the body of the request and fail

* nbd_reply_chunk_iter_receive() will call nbd_co_receive_one_chunk()
and then nbd_co_do_receive_one_chunk(), which will handle the failure as
above; or it will just detect a previous call to nbd_iter_channel_error()
via iter->ret < 0.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20220414175756.671165-4-pbonzini@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@openvz.org>
Reviewed-by: Lukas Straub <lukasstraub2@web.de>
Signed-off-by: Eric Blake <eblake@redhat.com>
2022-04-26 13:16:36 -05:00
Paolo Bonzini
0c43c6fc89 nbd: mark more coroutine_fns
Several coroutine functions in block/nbd.c are not marked as such.  This
patch adds a few more markers; it is not exhaustive, but it focuses
especially on:

- places that wake other coroutines, because aio_co_wake() has very
different semantics inside a coroutine (queuing after yield vs. entering
immediately);

- functions with _co_ in their names, to avoid confusion

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20220414175756.671165-3-pbonzini@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@openvz.org>
Reviewed-by: Lukas Straub <lukasstraub2@web.de>
Signed-off-by: Eric Blake <eblake@redhat.com>
2022-04-26 13:16:35 -05:00
Paolo Bonzini
8846b7d1c1 nbd: safeguard against waking up invalid coroutine
The .reply_possible field of s->requests is never set to false.  This is
not a problem as it is only a safeguard to detect protocol errors,
but it's sloppy.  In fact, the field is actually not necessary at all,
because .coroutine is set to NULL in NBD_FOREACH_REPLY_CHUNK after
receiving the last chunk.  Thus, replace .reply_possible with .coroutine
and move the check before deciding the fate of this request.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20220414175756.671165-2-pbonzini@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@openvz.org>
Reviewed-by: Lukas Straub <lukasstraub2@web.de>
Signed-off-by: Eric Blake <eblake@redhat.com>
2022-04-26 13:16:24 -05:00
Vladimir Sementsov-Ogievskiy
c08c220be7 iotests/223: check new possibility of exporting bitmaps by node/name
Add simple test that new interface introduced in previous commit works.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@openvz.org>
Message-Id: <20220314213226.362217-4-v.sementsov-og@mail.ru>
[eblake: Adjust S-o-b to Vladimir's new email, with permission]
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
2022-04-26 13:15:56 -05:00
Vladimir Sementsov-Ogievskiy
e5fb29d5d0 qapi: nbd-export: allow select bitmaps by node/name pair
Hi all! Current logic of relying on search through backing chain is not
safe neither convenient.

Sometimes it leads to necessity of extra bitmap copying. Also, we are
going to add "snapshot-access" driver, to access some snapshot state
through NBD. And this driver is not formally a filter, and of course
it's not a COW format driver. So, searching through backing chain will
not work. Instead of widening the workaround of bitmap searching, let's
extend the interface so that user can select bitmap precisely.

Note, that checking for bitmap active status is not copied to the new
API, I don't see a reason for it, user should understand the risks. And
anyway, bitmap from other node is unrelated to this export being
read-only or read-write.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@openvz.org>
Message-Id: <20220314213226.362217-3-v.sementsov-og@mail.ru>
[eblake: Adjust S-o-b to Vladimir's new email, with permission]
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
2022-04-26 13:15:19 -05:00
Vladimir Sementsov-Ogievskiy
1466ef6cbe qapi: rename BlockDirtyBitmapMergeSource to BlockDirtyBitmapOrStr
Rename the type to be reused. Old name is "what is it for". To be
natively reused for other needs, let's name it exactly "what is it".

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@openvz.org>
Message-Id: <20220314213226.362217-2-v.sementsov-og@mail.ru>
[eblake: Adjust S-o-b to Vladimir's new email, with permission]
Reviewed-by: Eric Blake <eblake@redhat.com>
Acked-by: John Snow <jsnow@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
2022-04-26 13:13:50 -05:00
Richard Henderson
eab18e4021 Misc patch queue
* Removes depecated --enable-fips QEMU system emulator option
 * Fixes array bounds check in keycode conversion for ESCC device
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE2vOm/bJrYpEtDo4/vobrtBUQT98FAmJoDAoACgkQvobrtBUQ
 T99iOg/+LeLLLKtjVx2HFzDgXWy9F5gGBzUNv4tqlkqDHMSdKWrMJAZfQXNMIeIN
 NsIc7cJW9usZj9kPrLIMjXQziVaqFzuwGrD0A9ESJOEI/quPFuQ6clUL+Qs7leRz
 SaoGHjprDy9TRe+e9B418LDIL29a2e5KUDa/HgpZJfXQRuSx93lutaNqm5MwGs8+
 WllO0fIi/6N2IJlaBwoYWZJ1VdV3DbokS/We9p2BAMCaxk16w/2o+W+drBkaxjaS
 hihicW50JJgn4B7uUKqpHKRLkdmYatBcdqUc2aIuKZ6URx/cS6A0Oxt2coKhhOHV
 vIDsUhqK03sfIPmQhr5HWeKpCs5lANgu0tmKIYZac5qIZFN/1ATpoKOZD8IZ1K25
 GOC7p7wDDTB6KaAqpCXDBZc7Kp4CbCYR79VciI1XNxFXiKgkqfaXRwr9JPM0oseo
 QKLdb5Xn3c0HvjDKnEmO3BR5jx9E0QabK8WwplodCJJfpu349eUflNRdiH74iDFk
 +AO4hShIr56Ksuj/GSWwIk4YeE0Ct2viZqjjIEGGWAKCQT1aultIH1pZcvCrTUVe
 qyWSHx1lmqgOwGOF15xHo8yBZAa/o/SAv8V4FDVwXAzLU1eg144fJupkMMEMd3Og
 PLnuR14Bii8K1pSkZbGSXqMxEybSmjnLlEh4xJxX0t/q4clzE0U=
 =NiU1
 -----END PGP SIGNATURE-----

Merge tag 'misc-next-pull-request' of https://gitlab.com/berrange/qemu into staging

Misc patch queue

* Removes depecated --enable-fips QEMU system emulator option
* Fixes array bounds check in keycode conversion for ESCC device

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE2vOm/bJrYpEtDo4/vobrtBUQT98FAmJoDAoACgkQvobrtBUQ
# T99iOg/+LeLLLKtjVx2HFzDgXWy9F5gGBzUNv4tqlkqDHMSdKWrMJAZfQXNMIeIN
# NsIc7cJW9usZj9kPrLIMjXQziVaqFzuwGrD0A9ESJOEI/quPFuQ6clUL+Qs7leRz
# SaoGHjprDy9TRe+e9B418LDIL29a2e5KUDa/HgpZJfXQRuSx93lutaNqm5MwGs8+
# WllO0fIi/6N2IJlaBwoYWZJ1VdV3DbokS/We9p2BAMCaxk16w/2o+W+drBkaxjaS
# hihicW50JJgn4B7uUKqpHKRLkdmYatBcdqUc2aIuKZ6URx/cS6A0Oxt2coKhhOHV
# vIDsUhqK03sfIPmQhr5HWeKpCs5lANgu0tmKIYZac5qIZFN/1ATpoKOZD8IZ1K25
# GOC7p7wDDTB6KaAqpCXDBZc7Kp4CbCYR79VciI1XNxFXiKgkqfaXRwr9JPM0oseo
# QKLdb5Xn3c0HvjDKnEmO3BR5jx9E0QabK8WwplodCJJfpu349eUflNRdiH74iDFk
# +AO4hShIr56Ksuj/GSWwIk4YeE0Ct2viZqjjIEGGWAKCQT1aultIH1pZcvCrTUVe
# qyWSHx1lmqgOwGOF15xHo8yBZAa/o/SAv8V4FDVwXAzLU1eg144fJupkMMEMd3Og
# PLnuR14Bii8K1pSkZbGSXqMxEybSmjnLlEh4xJxX0t/q4clzE0U=
# =NiU1
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 26 Apr 2022 08:13:14 AM PDT
# gpg:                using RSA key DAF3A6FDB26B62912D0E8E3FBE86EBB415104FDF
# gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>" [full]
# gpg:                 aka "Daniel P. Berrange <berrange@redhat.com>" [full]

* tag 'misc-next-pull-request' of https://gitlab.com/berrange/qemu:
  github: fix config mistake preventing repo lockdown commenting
  hw/char: fix qcode array bounds check in ESCC impl
  softmmu: remove deprecated --enable-fips option

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-04-26 10:36:35 -07:00
Richard Henderson
7f176c5a0b tests/tcg/nios2: Add test-shadow-1
Add a regression test for tcg indirect global lowering.

This appeared with nios2, with cps != 0, so that we use
indirection into the shadow register set.  An indirect
call verifies alignment of rA.  The use of rA was live
across the brcond leading to a tcg_debug_assert failure.

Cc: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20220421151735.31996-65-richard.henderson@linaro.org>
2022-04-26 08:17:10 -07:00
Richard Henderson
ccbaa553a1 tests/tcg/nios2: Add semihosting multiarch tests
Add runtime supporting the nios2-semi.c interface.
Execute the hello and memory multiarch tests.

Cc: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-64-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Amir Gonnen
28a3c1b5f1 hw/nios2: Machine with a Vectored Interrupt Controller
Demonstrate how to use nios2 VIC on a machine.
Introduce a new machine property to attach a VIC.

When VIC is present, let the CPU know that it should use the
External Interrupt Interface instead of the Internal Interrupt Interface.
The devices on the machine are attached to the VIC and not directly to cpu.
To allow VIC update EIC fields, we set the "cpu" property of the VIC
with a reference to the nios2 cpu.

[rth: Put a property on the 10m50-ghrd machine, rather than
      create a new machine class.]

Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Amir Gonnen <amir.gonnen@neuroblade.ai>
Message-Id: <20220303153906.2024748-6-amir.gonnen@neuroblade.ai>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-63-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
e734cedf11 hw/nios2: Move memory regions into Nios2Machine
Convert to contiguous allocation, as much as possible so far.
The two timer objects are not exposed for subobject allocation.

Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-62-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
6fc834d5fe hw/nios2: Introduce Nios2MachineState
We want to move data from the heap into Nios2MachineState,
which is not possible with DEFINE_MACHINE.

Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-61-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Amir Gonnen
c46cabd4a9 hw/intc: Vectored Interrupt Controller (VIC)
Implement nios2 Vectored Interrupt Controller (VIC).
VIC is connected to EIC. It needs to update rha, ril, rrs and rnmi
fields on Nios2CPU before raising an IRQ.
For that purpose, VIC has a "cpu" property which should refer to the
nios2 cpu and set by the board that connects VIC.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Amir Gonnen <amir.gonnen@neuroblade.ai>
Message-Id: <20220303153906.2024748-5-amir.gonnen@neuroblade.ai>
[rth: Split out nios2_vic.h]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-60-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
3747727aad linux-user/nios2: Handle various SIGILL exceptions
We missed out on a couple of exception types that may
legitimately be raised by a userland program.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-59-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
e84f176844 target/nios2: Advance pc when raising exceptions
The exception return address for nios2 is the instruction
after the one that was executing at the time of the exception.

We have so far implemented this by advancing the pc during the
process of raising the exception.  It is perhaps a little less
confusing to do this advance in the translator (and helpers)
when raising the exception in the first place, so that we may
more closely match kernel sources.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20220421151735.31996-58-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
a25c4eff32 target/nios2: Implement EIC interrupt processing
This is the cpu side of the operation.  Register one irq line,
called EIC.  Split out the rather different processing to a
separate function.

Delay initialization of gpio irqs until realize.  We need to
provide a window after init in which the board can set eic_present.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20220421151735.31996-57-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
6bcc59cafa target/nios2: Update helper_eret for shadow registers
When CRS = 0, we restore from estatus; otherwise from sstatus.
Update for the new CRS.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-56-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
3a03087019 target/nios2: Implement rdprs, wrprs
Implement these out of line, so that tcg global temps
(aka the architectural registers) are synced back to
tcg storage as required.  This makes sure that we get
the proper results when status.PRS == status.CRS.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-55-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
945a5bd3f8 target/nios2: Introduce shadow register sets
Do not actually enable them so far, in terms of being able
to change the current register set, but add all of the
plumbing to address them.  Do not enable them for user-only.

Add an env->regs pointer that handles the indirection to
the current register set.  The naming of the pointer hides
the difference between old and new, user-only and sysemu.

From the notes on wrprs, which states that r0 must be initialized
before use in shadow register sets, infer that R_ZERO is *not*
hardwired to zero in shadow register sets, but that it is still
read-only.  Introduce tbflags bit R0_0 to track that it has been
properly set to zero.  Adjust load_gpr to reflect this.

At the same time we might as well special case crs == 0 to avoid
the indirection through env->regs during translation as well; this
is intended to be the most common case for non-interrupt handlers.

Init env->regs at reset.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20220421151735.31996-54-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
410c6aaa3b target/nios2: Implement Misaligned destination exception
Indirect branches, plus eret and bret optionally raise
an exception when branching to a misaligned address.
The exception is required when an mmu is enabled, but
enable it always because the fallback behaviour is not
documented (though presumably it discards low bits).

For the purposes of the linux-user cpu loop, if EXCP_UNALIGN
(misaligned data) were to arrive, it would be treated the
same as EXCP_UNALIGND (misaligned destination).  See the
!defined(CONFIG_NIOS2_ALIGNMENT_TRAP) block in kernel/traps.c.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-53-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
0e6f22c561 target/nios2: Use tcg_gen_lookup_and_goto_ptr
Use lookup_and_goto_ptr for indirect chaining between TBs.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-52-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
5b843284d8 target/nios2: Use gen_goto_tb for DISAS_TOO_MANY
Depending on the reason for ending the TB, we can chain
to the next TB because the PC is constant.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-51-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
3ad5935c58 target/nios2: Hoist set of is_jmp into gen_goto_tb
Rather than force all callers to set this, do it
within the subroutine.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-50-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
bd9154aa2b target/nios2: Create gen_jumpr
Split out a function to perform an indirect branch.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-49-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
0706ac0f86 target/nios2: Enable unaligned traps for system mode
Unaligned traps are optional, but required with an mmu.
Turn them on always, because the fallback behaviour undefined.

Enable alignment checks in the config file.
Unwind the guest pc properly from do_unaligned_access.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-48-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
d2293ebb04 target/nios2: Drop CR_STATUS_EH from tb->flags
There's nothing about EH that affects translation,
so there's no need to include it in tb->flags.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-47-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
7eed8e4003 target/nios2: Introduce dest_gpr
Constrain all references to cpu_R[] to load_gpr and dest_gpr.
This will be required for supporting shadow register sets.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-46-richard.henderson@linaro.org>
2022-04-26 08:17:05 -07:00
Richard Henderson
541cb627da target/nios2: Split out helpers for gen_rr_shift
Do as little work as possible within the macro.
Split out helper functions and pass in arguments instead.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-04-26 08:17:02 -07:00
Richard Henderson
3099c41bee target/nios2: Split out helpers for gen_rr_mul_high
Rename the macro from gen_r_mul, because these are the multiply
variants that produce a high-part result.  Do as little work as
possible within the macro; split out helper functions and pass
in arguments instead.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-04-26 08:16:58 -07:00
Richard Henderson
7c849046af target/nios2: Split out helpers for gen_r_math_logic
Split the macro in two, one for reg/imm and one for reg/reg.
Do as little work as possible within the macros; split out
helper functions and pass in arguments instead.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-04-26 08:16:55 -07:00
Richard Henderson
cd419bc63d target/nios2: Split out helpers for gen_i_math_logic
Do as little work as possible within the macro.
Split out helper functions and pass in arguments instead.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-04-26 08:16:52 -07:00
Richard Henderson
3d1f63d019 target/nios2: Split out helpers for gen_i_cmpxx
Do as little work as possible within the macro.
Split out helper functions and pass in arguments instead.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-04-26 08:16:41 -07:00
Richard Henderson
1746338ed6 target/nios2: Split out named structs for [IRJ]_TYPE
Currently the structures are anonymous within the macro.
Pull them out to standalone types.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20220421151735.31996-44-richard.henderson@linaro.org>
2022-04-26 08:16:41 -07:00
Richard Henderson
718db07714 target/nios2: Use tcg_constant_tl
Replace current uses of tcg_const_tl, and remove the frees.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-43-richard.henderson@linaro.org>
2022-04-26 08:16:41 -07:00
Richard Henderson
345b7a8757 target/nios2: Support division error exception
Division may (optionally) raise a division exception.
Since the linux kernel has been prepared for this for
some time, enable it by default.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-42-richard.henderson@linaro.org>
2022-04-26 08:16:41 -07:00
Richard Henderson
e8d12542ee target/nios2: Remove CPU_INTERRUPT_NMI
This interrupt bit is never set, so testing it in
nios2_cpu_has_work is pointless.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-41-richard.henderson@linaro.org>
2022-04-26 08:16:41 -07:00
Richard Henderson
2de70d2d96 target/nios2: Implement CR_STATUS.RSIE
Without EIC, this bit is RES1.  So set the bit at reset,
and add it to the readonly fields of CR_STATUS.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-40-richard.henderson@linaro.org>
2022-04-26 08:16:41 -07:00
Richard Henderson
b05550af11 target/nios2: Implement cpuid
Copy the existing cpu_index into the space reserved for CR_CPUID.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220421151735.31996-39-richard.henderson@linaro.org>
2022-04-26 08:16:41 -07:00
Richard Henderson
796945d596 target/nios2: Prevent writes to read-only or reserved control fields
Create an array of masks which detail the writable and readonly
bits for each control register.  Apply them when writing to
control registers, including the write to status during eret.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20220421151735.31996-38-richard.henderson@linaro.org>
2022-04-26 08:16:41 -07:00