Our code was already checking that we did not attempt to
allocate more clusters than what would fit in an INT64 (the
physical maximimum if we can access a full off_t's worth of
data). But this does not catch smaller limits enforced by
various spots in the qcow2 image description: L1 and normal
clusters of L2 are documented as having bits 63-56 reserved
for other purposes, capping our maximum offset at 64PB (bit
55 is the maximum bit set). And for compressed images with
2M clusters, the cap drops the maximum offset to bit 48, or
a maximum offset of 512TB. If we overflow that offset, we
would write compressed data into one place, but try to
decompress from another, which won't work.
It's actually possible to prove that overflow can cause image
corruption without this patch; I'll add the iotests separately
in the next commit.
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Although off_t permits up to 63 bits (8EB) of file offsets, in
practice, we're going to hit other limits first. Document some
of those limits in the qcow2 spec (some are inherent, others are
implementation choices of qemu), and how choice of cluster size
can influence some of the limits.
While we cannot map any uncompressed virtual cluster to any
address higher than 64 PB (56 bits) (due to the current L1/L2
field encoding stopping at bit 55), qemu's cap of 8M for the
refcount table can still access larger host addresses for some
combinations of large clusters and small refcount_order. For
comparison, ext4 with 4k blocks caps files at 16PB.
Another interesting limit: for compressed clusters, the L2 layout
requires an ever-smaller maximum host offset as cluster size gets
larger, down to a 512 TB maximum with 2M clusters. In particular,
note that with a cluster size of 8k or smaller, the L2 entry for
a compressed cluster could technically point beyond the 64PB mark,
but when you consider that with 8k clusters and refcount_order = 0,
you cannot access beyond 512T without exceeding qemu's limit of an
8M cap on the refcount table, it is unlikely that any image in the
wild has attempted to do so. To be safe, let's document that bits
beyond 55 in a compressed cluster must be 0.
Signed-off-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Don't leak 'cluster' in the mapping == NULL case. Found by Coverity
(CID 1055918).
Fixes: 8d9401c279
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Liam Merwick <liam.merwick@oracle.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Commit c8a35f1cf0 "fdc: use IsaDma interface instead of global DMA_*
functions" accidentally introduced a segfault in fdctrl_stop_transfer() for
non-DMA transfers.
If fdctrl->dma_chann has not been configured then the fdctrl->dma interface
reference isn't initialised during isabus_fdc_realize(). Unfortunately
fdctrl_stop_transfer() unconditionally references the DMA interface when
finishing the transfer causing a NULL pointer dereference.
Fix the issue by adding a check in fdctrl_stop_transfer() so that the DMA
interface reference and release method is only invoked if fdctrl->dma_chann
has been set.
(This issue was discovered by Martin testing a recent change in the NetBSD
installer under qemu-system-sparc)
Cc: qemu-stable@nongnu.org
Reported-by: Martin Husemann <martin@duskware.de>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Hervé Poussineau <hpoussin@reactos.org>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Currently, the nvme_cmb_ops mr doesn't check the addr and size.
This can lead an oob access issue. This is triggerable in the guest.
Add check to avoid this issue.
Fixes CVE-2018-16847.
Reported-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
The MAINTAINERS file is a bit sparse on information about what
the different designators are. Let's add some more information
to give contributors a better idea about what the different
roles are.
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20181026105711.29605-1-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJb8F5WAAoJENSXKoln91plAtoH/1aBwQbI8BhiKDxD1KZOSQMD
Sefn15AuRECfM2Helfzr/3rHPhXa7OWCjI10Z7pNMxAy3wpAjPec6eeVzfRx0xDJ
3vIkUuFQCzjHl5BloKdlsRPJC2/mTrwtvpLUF8g3D/pUpZoLyMF5f1mo4tVn9yz3
TRRajkLIRaPJQ3aA/q4BJYYYebVD7treLi+HGMhvRYQmdcaVZAXvGsYnAHIHqU6u
jNJm6w15SkoqR7u8/7rVrLLdR8jyB7XfBK7uih9O5kYcdkH5oa8QEE2khYtRfPw0
g2MmYmGSnZKQzCWK0aGzNhnP5QPgjy733WmbnLKqnelKvYnV74B1ZCuoA1J6bX0=
=2r8m
-----END PGP SIGNATURE-----
Merge remote-tracking branch 'remotes/amarkovic/tags/mips-queue-november-2018-v2' into staging
MIPS queue for QEMU 3.1-rc2 - v2
# gpg: Signature made Sat 17 Nov 2018 18:30:46 GMT
# gpg: using RSA key D4972A8967F75A65
# gpg: Good signature from "Aleksandar Markovic <amarkovic@wavecomp.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 8526 FBF1 5DA3 811F 4A01 DD75 D497 2A89 67F7 5A65
* remotes/amarkovic/tags/mips-queue-november-2018-v2:
MAINTAINERS: Add Stefan Markovic as a MIPS reviewer
target/mips: Disable R5900 support
target/mips: Rename MMI-related functions
target/mips: Rename MMI-related opcodes
target/mips: Rename MMI-related masks
target/mips: Guard check_insn with INSN_R5900 check
target/mips: Guard check_insn_opc_user_only with INSN_R5900 check
target/mips: Fix decoding mechanism of special R5900 opcodes
target/mips: Fix decoding mechanism of R5900 DIV1 and DIVU1
target/mips: Fix decoding mechanism of R5900 MFLO1, MFHI1, MTLO1 and MTHI1
linux-user: Update MIPS specific prctl() implementation
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This pull request contains four patches that aren't really related to
each other aside from all being bug fixes that I think should go in for
3.1.0:
* The second half of Alistair's memory leak patch set that I missed last
week.
* A fix to make fclass.d availiable only on RV64IFD systems (without
this it's availiable on RV32IFD systems, truncating the result).
* A fix to make sfence.vm availiable only in priv-1.9.1, and sfence.vma
only availiable in priv-1.10.
* A change to respect fences in user-mode emulators, which were
previously treated as NOPs.
As usual, this builds and boot Linux for me. I don't think I have
anything else planned for 3.1.0, but I may be wrong as things are a bit
hectic this week.
-----BEGIN PGP SIGNATURE-----
iQJHBAABCAAxFiEEAM520YNJYN/OiG3470yhUCzLq0EFAlvrYtYTHHBhbG1lckBk
YWJiZWx0LmNvbQAKCRDvTKFQLMurQdF+EACA9fVWBbXmJfsOeWq1887zGXt+Txdf
KKxWc9JNf6Zo/QLziGinSDAt8UNTtHzckVePdlSAJIiNuvDLf4AtQT8wSjPGeVzS
IMauZnXe/gz15iqPGLOUmaz9B/UrkV4T5wmFwnNv7T00dBFWIKESez7QJgjPih/e
zmDgUw+FG6A/SGHBkL60xxhv2+2ZkXhtwaB9tzqeKmqebaJDOgEGT6roQDffbW0C
jKiRXmBQVFWfmmi1HXfs8NFGmMDgV1vBAr/3dd7F2tZU7lZBhFp/KUkY5VhMC+2y
CNU7Ug1OyIE6haoPgui2FqlQV95CL7zkqkwEZqdaqzgXAQAxtWsJjMwZl4vCuumu
DmTEhunvt7/aMqsB2iQgVAXDgKX79qI5xLzc04en0I/BppT1991BWJfyQSyucQyb
vBF5iLBudsxzAWAB6TSWu7lsBECTYci+QJ/z7ZvvOpTaT8mm0Rc0aEfm0PVpVLIk
hxZAMdbbPKl3q2e69//w/nw5jHfWk2cAPWcfpFvGWyweD3xLiy60S+++nzWjwJy3
9mXW7MjW6iFGYTGDUWOQ5207NJ/tISxBsmck81+aPHfb6bPxpIJicZnchfzoWdop
ahw9XbOsnBZdY18csgeNBQh5UVKZcVGvxeCfjtO/XlIw+kUB3wPbu+bQ+3vUSeV+
Ubfw/T0n/GerUg==
=Y5YG
-----END PGP SIGNATURE-----
Merge remote-tracking branch 'remotes/riscv/tags/riscv-for-master-3.1-rc2' into staging
RISC-V Patches for 3.1-rc2
This pull request contains four patches that aren't really related to
each other aside from all being bug fixes that I think should go in for
3.1.0:
* The second half of Alistair's memory leak patch set that I missed last
week.
* A fix to make fclass.d availiable only on RV64IFD systems (without
this it's availiable on RV32IFD systems, truncating the result).
* A fix to make sfence.vm availiable only in priv-1.9.1, and sfence.vma
only availiable in priv-1.10.
* A change to respect fences in user-mode emulators, which were
previously treated as NOPs.
As usual, this builds and boot Linux for me. I don't think I have
anything else planned for 3.1.0, but I may be wrong as things are a bit
hectic this week.
# gpg: Signature made Tue 13 Nov 2018 23:48:38 GMT
# gpg: using RSA key EF4CA1502CCBAB41
# gpg: Good signature from "Palmer Dabbelt <palmer@dabbelt.com>"
# gpg: aka "Palmer Dabbelt <palmer@sifive.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 00CE 76D1 8349 60DF CE88 6DF8 EF4C A150 2CCB AB41
* remotes/riscv/tags/riscv-for-master-3.1-rc2:
RISC-V: Respect fences for user-only emulators
target/riscv: Fix sfence.vm/a both available in any priv version
target/riscv: Fix FCLASS_D being treated as RV64 only
hw/riscv/virt: Free the test device tree node name
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Add Stefan Markovic as a MIPS reviewer. He had several key
contributions to QEMU for MIPS this year. He is a meticulous
person with the ability to think and act on many levels.
Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Disable R5900 support. There are some outstanding issues related
to ABI support and emulation accuracy, that were not understood
well during review process. Disable to avoid backward compatibility
issues.
Reverts commit ed4f49ba9b.
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Rename MMI-related functions.
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Rename MMI-related opcodes.
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Rename MMI-related masks.
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Explicitely mark handling of PREF instruction for R5900 as
treating the same as NOP.
Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Fredrik Noring <noring@nocrew.org>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Avoid using check_opc_user_only() as a decision making code wrt
various architectures. Use ctx->insn_flags checks instead.
Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Fredrik Noring <noring@nocrew.org>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
MOVN, MOVZ, MFHI, MFLO, MTHI, MTLO, MULT, MULTU, DIV, DIVU, DMULT,
DMULTU, DDIV, DDIVU and JR are decoded in decode_opc_special_tx79
instead of the generic decode_opc_special_legacy.
Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Fredrik Noring <noring@nocrew.org>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
DIV1 and DIVU1 are generated in gen_div1_tx79 instead of the generic
gen_muldiv.
Signed-off-by: Fredrik Noring <noring@nocrew.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
MFLO1, MFHI1, MTLO1 and MTHI1 are generated in gen_HILO1_tx79 instead of
the generic gen_HILO.
Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Fredrik Noring <noring@nocrew.org>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Perform needed checks before actual prctl() PR_SET_FP_MODE and
PR_GET_FP_MODE work based on kernel implementation. Also, update
necessary hflags.
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
EGL headless has been missing from QEMU's help or man page, we should
mention that such a thing exists, especially since projects like libvirt
might rely on that. This patch also adds the newly introduced option for
egl-headless 'rendernode'.
Signed-off-by: Erik Skultety <eskultet@redhat.com>
Message-id: 87ef678b0934d3abba66c46c9e65b57119d29295.1542362949.git.eskultet@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Unlike SPICE, egl-headless doesn't offer a way of specifying the DRM
node used for OpenGL, hence QEMU always selecting the first one that is
available. Thus, add the 'rendernode' option for egl-headless to QAPI.
Signed-off-by: Erik Skultety <eskultet@redhat.com>
Message-id: 7658e15eca72d520e7a5fb1c2e724702d83d4f7f.1542362949.git.eskultet@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Version: GnuPG v1
iQEcBAABAgAGBQJb7jvSAAoJEO8Ells5jWIRizgH/0rSNEVWis7Cvf1BxXcuAbkY
S3LYgBxVJUhvsjB5Mx7/FRYWSUB/D7Q35cZMFNU66G5ZOAm7YlF7Q7XHDuCWd+mH
U+HhRKFZLe6YFVgsukLBui+8GRxD+H0Olpd2i3W7+pYC+oNTeVDhAio/K3d4yv4G
oVM+Lpo3O+NE3nPIcnpKFHOwRcPYnX2bNR+QinKhpUYFwzcKDOggqvI/62S58zgk
Kh6uYixxtcGfMXx5utNmOzF2m25AfcsC6oRbSDUnQCeRQgIz82OA1haqFhrw+sFK
YoBJEGHw1ua9C3CuaU60EENEdAs5VvNauBdpuX7jj3BrgP9u06exbxwVRFprLKY=
=c83S
-----END PGP SIGNATURE-----
Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging
# gpg: Signature made Fri 16 Nov 2018 03:38:58 GMT
# gpg: using RSA key EF04965B398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg: It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211
* remotes/jasowang/tags/net-pull-request:
net/filter-rewriter.c: Fix coverity static analysis issue
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
The original code just follow the TCP state diagram,
but in this case, we can skip the TCPS_TIME_WAIT state to simplify
the implementation.
Signed-off-by: Zhang Chen <zhangckid@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQEcBAABAgAGBQJb7XzBAAoJEHWtZYAqC0IR3EsIAM6zSEaYlo5fh/VX4KCorYDT
4nb8agEgVdEP4qdRG2PGPeSvN3D63IEgAhR8dugUs8bGey1MU9SEctb5BR5XdJ3c
WEh6x7kNazN7Gsu1R5j0ApBnKh7jfObBVgKMc0c3i2TmAQMypwiZY6GJuLcvgAhV
NJHf8ldu6ephOwForYqerItTD3Cf2Pe0rmggRTEL5LFLgfGW2oem+fwSWLHbyjoC
qKoQDNZ1d+DatJIz92iygUeF1TDhhOa9+QCW3HujAw5v2DFSbSDtlsU7yf5AKJ11
/g91DQOK37vEd9Bhu9Z4bEeeoV2DHGCY18WpV4KESG1GYix14kVhd5goxF3A0II=
=Sw53
-----END PGP SIGNATURE-----
Merge remote-tracking branch 'remotes/stefanberger/tags/pull-tpm-2018-11-15-1' into staging
Merge tpm 2018/11/15 v1
# gpg: Signature made Thu 15 Nov 2018 14:03:45 GMT
# gpg: using RSA key 75AD65802A0B4211
# gpg: Good signature from "Stefan Berger <stefanb@linux.vnet.ibm.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B818 B9CA DF90 89C2 D5CE C66B 75AD 6580 2A0B 4211
* remotes/stefanberger/tags/pull-tpm-2018-11-15-1:
tests: tpm: Use g_test_message rather than fprintf
tpm: use loop iterator to set sts data field
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Coverity complains (CID 1390847) about some dead code in
do_sigreturn(). This is an if (err) clause that can never be
true, copied from the kernel (where __get_user returns an error).
The one code path that could report an error is in the
currently commented-out pseudocode for handling FPU register
restoring, so move the if into that comment (and fix the
broken indent in the comment in the process).
(The new position for the error check is also the semantically
correct one -- we should not restore the signal mask from
the signal frame if we get an error here, so the check must
be done before set_sigmask(), not after.)
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-id: 20181115114616.26265-1-peter.maydell@linaro.org
This is needed to build skiboot from tarball-distributed sources
since the git data the make_release.sh script relies on to generate
it is not available.
Cc: qemu-stable@nongnu.org
Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20181109161352.29873-1-mdroth@linux.vnet.ibm.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Display a message during the test using g_test_message rather
than fprintf.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
When TIS request is done, set 'sts' data field across all localities.
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Fix:
TEST linux-test on i386
.../tests/tcg/multiarch/linux-test.c:201: readdir
readdir() calls getdents64() to have the list of the entries in a
directory, and getdents64() can return 64bit d_off values (with ext4,
for instance) that will not fit in the 32bit d_off field of the
readdir() dirent structure.
To avoid that, use readdir64() to use a 64bit d_off field too.
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
We have reached the point where the MacOSX build was regularly timing
out. So as before I've reduced the target list to "major"
architectures to try and bring the build time down. I've added an
additional MacOSX build with the latest XCode with a minimal list of
"most likely" targets on MacOS.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Our current fence implementation ignores fences for the user-only
configurations. This is incorrect but unlikely to manifest: it requires
multi-threaded user-only code that takes advantage of the weakness in
the host's memory model and can be inlined by TCG.
This patch simply treats fences the same way for all our emulators.
I've given it to testing as I don't want to construct a test that would
actually trigger the failure.
Our fence implementation has an additional deficiency where we map all
RISC-V fences to full fences. Now that we have a formal memory model
for RISC-V we can start to take advantage of the strength bits on our
fence instructions. This requires a bit more though, so I'm going to
split it out because the implementation is still correct without taking
advantage of these weaker fences.
Thanks to Richard Henderson for pointing out both of the issues.
Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
sfence.vm has been replaced in priv v1.10 spec by sfence.vma.
Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
Right now, errors during realize()/pre_plug/plug of the zPCI device
would result in QEMU crashing instead of failing nicely when creating
a zPCI device for a PCI device.
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Collin Walling <walling@linux.ibm.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20181113121710.18490-1-david@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* Remove no-longer-needed workaround for small SAU regions for v8M
* Remove antique TODO comment
* MAINTAINERS: Add an entry for the 'collie' machine
* hw/arm/sysbus-fdt: Only call match_fn callback if the type matches
* Fix infinite recursion in tlbi_aa64_vmalle1_write()
* ARM KVM: fix various bugs in handling of guest debugging
* Correctly implement handling of HCR_EL2.{VI, VF}
* Hyp mode R14 is shared with User and System
* Give Cortex-A15 and -A7 the EL2 feature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABCAAGBQJb6qzJAAoJEDwlJe0UNgzexa0P/0uZSNl/j4ZU86uSGka6sCpW
tNikzvJDMTvbBhHU0GbBIVDMs4d4NQJ8lPYAKbvfyAsGkw3RMsVoJOHph4zDNezx
r61U6Zmn4jF6CLRwRzyRvHS+NwiThdzMJZOdSFDmYI6hxASNbzxAgoIDvVBvCemZ
fNbtFT3pukc0/aN4I4236lm28A20+oDJrxvAlLp/RAwCHLjYbWUfRX81VRAseG67
wuY9gWBeY4S+xS0eE64vpR82bvHs8eZvQ3QLFrZBjhGsGu2vI8WQjraPGyoEFbvm
j61hdhrcH8nkTEQZXsUHkDBJo/FS0lDH13RRP3yQeBDiTTXDLMF+6ICPHvDAUo2b
s0wtI2aTVe+eag1yvWf0o+d8bShscjLtR/61PCJK4zX1KL3onyBs0OCKeyxKzB5E
DIChGFUIsTDRjwzprBCzox/+cPWpnUZNRyMPTJfvBs741JLaT9+yLVVHJeRJfBz0
duxEwLYKcR0M2lukZQUtKtaGXkYAI980v5+8PujXsPhMo4rAviebZQkiv2yZ0JZx
4xsQ3yJ+EIeIbEVigW2k+JyAwW3cmCNeWxYurAeOBcpHU0kXZ+OHUjVQWhNpYBhO
olhX6IzYmqtL9L4Vjm+jstoc8kbip8FmkHzFAI85VCMfKMgS+oEDKhuq8n39LyIl
kplZEjcCn16TRdDvIhOp
=wGuK
-----END PGP SIGNATURE-----
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20181113' into staging
target/arm queue:
* Remove no-longer-needed workaround for small SAU regions for v8M
* Remove antique TODO comment
* MAINTAINERS: Add an entry for the 'collie' machine
* hw/arm/sysbus-fdt: Only call match_fn callback if the type matches
* Fix infinite recursion in tlbi_aa64_vmalle1_write()
* ARM KVM: fix various bugs in handling of guest debugging
* Correctly implement handling of HCR_EL2.{VI, VF}
* Hyp mode R14 is shared with User and System
* Give Cortex-A15 and -A7 the EL2 feature
# gpg: Signature made Tue 13 Nov 2018 10:51:53 GMT
# gpg: using RSA key 3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg: aka "Peter Maydell <pmaydell@gmail.com>"
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE
* remotes/pmaydell/tags/pull-target-arm-20181113:
target/arm/cpu: Give Cortex-A15 and -A7 the EL2 feature
target/arm: Hyp mode R14 is shared with User and System
target/arm: Correctly implement handling of HCR_EL2.{VI, VF}
target/arm: Track the state of our irq lines from the GIC explicitly
Revert "target/arm: Implement HCR.VI and VF"
arm: fix aa64_generate_debug_exceptions to work with EL2
arm: use symbolic MDCR_TDE in arm_debug_target_el
tests/guest-debug: fix scoping of failcount
target/arm64: kvm debug set target_el when passing exception to guest
target/arm64: hold BQL when calling do_interrupt()
target/arm64: properly handle DBGVR RESS bits
target/arm: Fix typo in tlbi_aa64_vmalle1_write
hw/arm/sysbus-fdt: Only call match_fn callback if the type matches
MAINTAINERS: Add an entry for the 'collie' machine
target/arm: Remove antique TODO comment
target/arm: Remove workaround for small SAU regions
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
The Cortex-A15 and Cortex-A7 both have EL2; now we've implemented
it properly we can enable the feature bit.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20181109173553.22341-3-peter.maydell@linaro.org
Hyp mode is an exception to the general rule that each AArch32
mode has its own r13, r14 and SPSR -- it has a banked r13 and
SPSR but shares its r14 with User and System mode. We were
incorrectly implementing it as banked, which meant that on
entry to Hyp mode r14 was 0 rather than the USR/SYS r14.
We provide a new function r14_bank_number() which is like
the existing bank_number() but provides the index into
env->banked_r14[]; bank_number() provides the index to use
for env->banked_r13[] and env->banked_cpsr[].
All the points in the code that were using bank_number()
to index into env->banked_r14[] are updated for consintency:
* switch_mode() -- this is the only place where we fix
an actual bug
* aarch64_sync_32_to_64() and aarch64_sync_64_to_32():
no behavioural change as we already special-cased Hyp R14
* kvm32.c: no behavioural change since the guest can't ever
be in Hyp mode, but conceptually the right thing to do
* msr_banked()/mrs_banked(): we can never get to the case
that accesses banked_r14[] with tgtmode == ARM_CPU_MODE_HYP,
so no behavioural change
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20181109173553.22341-2-peter.maydell@linaro.org
In commit 8a0fc3a29f we tried to implement HCR_EL2.{VI,VF},
but we got it wrong and had to revert it.
In that commit we implemented them as simply tracking whether there
is a pending virtual IRQ or virtual FIQ. This is not correct -- these
bits cause a software-generated VIRQ/VFIQ, which is distinct from
whether there is a hardware-generated VIRQ/VFIQ caused by the
external interrupt controller. So we need to track separately
the HCR_EL2 bit state and the external virq/vfiq line state, and
OR the two together to get the actual pending VIRQ/VFIQ state.
Fixes: 8a0fc3a29f
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20181109134731.11605-4-peter.maydell@linaro.org
Currently we track the state of the four irq lines from the GIC
only via the cs->interrupt_request or KVM irq state. That means
that we assume that an interrupt is asserted if and only if the
external line is set. This assumption is incorrect for VIRQ
and VFIQ, because the HCR_EL2.{VI,VF} bits allow assertion
of VIRQ and VFIQ separately from the state of the external line.
To handle this, start tracking the state of the external lines
explicitly in a CPU state struct field, as is common practice
for devices.
The complicated part of this is dealing with inbound migration
from an older QEMU which didn't have this state. We assume in
that case that the older QEMU did not implement the HCR_EL2.{VI,VF}
bits as generating interrupts, and so the line state matches
the current state in cs->interrupt_request. (This is not quite
true between commit 8a0fc3a29f and its revert, but
that commit is broken and never made it into any released QEMU
version.)
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20181109134731.11605-3-peter.maydell@linaro.org
This reverts commit 8a0fc3a29f.
The implementation of HCR.VI and VF in that commit is not
correct -- they do not track the overall "is there a pending
VIRQ or VFIQ" status, but whether there is a pending interrupt
due to "this mechanism", ie the hypervisor having set the VI/VF
bits. The overall pending state for VIRQ and VFIQ is effectively
the logical OR of the inbound lines from the GIC with the
VI and VF bits. Commit 8a0fc3a29f would result in pending
VIRQ/VFIQ possibly being lost when the hypervisor wrote to HCR.
As a preliminary to implementing the HCR.VI/VF feature properly,
revert the broken one entirely.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20181109134731.11605-2-peter.maydell@linaro.org
The test was incomplete and incorrectly caused debug exceptions to be
generated when returning to EL2 after a failed attempt to single-step
an EL1 instruction. Fix this while cleaning up the function a little.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181109152119.9242-8-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
We already have this symbol defined so lets use it.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181109152119.9242-7-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
