summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-03-15lan9118: switch to use qemu_receive_packet() for loopbackAlexander Bulekov
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15cadence_gem: switch to use qemu_receive_packet() for loopbackAlexander Bulekov
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15pcnet: switch to use qemu_receive_packet() for loopbackAlexander Bulekov
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Buglink: https://bugs.launchpad.net/qemu/+bug/1917085 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15rtl8139: switch to use qemu_receive_packet() for loopbackAlexander Bulekov
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Buglink: https://bugs.launchpad.net/qemu/+bug/1910826 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15tx_pkt: switch to use qemu_receive_packet_iov() for loopbackJason Wang
This patch switches to use qemu_receive_receive_iov() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15sungem: switch to use qemu_receive_packet() for loopbackJason Wang
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15msf2-mac: switch to use qemu_receive_packet() for loopbackJason Wang
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15dp8393x: switch to use qemu_receive_packet() for loopback packetJason Wang
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15e1000: switch to use qemu_receive_packet() for loopbackJason Wang
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15net: introduce qemu_receive_packet()Jason Wang
Some NIC supports loopback mode and this is done by calling nc->info->receive() directly which in fact suppresses the effort of reentrancy check that is done in qemu_net_queue_send(). Unfortunately we can't use qemu_net_queue_send() here since for loopback there's no sender as peer, so this patch introduce a qemu_receive_packet() which is used for implementing loopback mode for a NIC with this check. NIC that supports loopback mode will be converted to this helper. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15e1000: fail early for evil descriptorJason Wang
During procss_tx_desc(), driver can try to chain data descriptor with legacy descriptor, when will lead underflow for the following calculation in process_tx_desc() for bytes: if (tp->size + bytes > msh) bytes = msh - tp->size; This will lead a infinite loop. So check and fail early if tp->size if greater or equal to msh. Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> Reported-by: Ruhr-University Bochum <bugs-syssec@rub.de> Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15net: validate that ids are well formedPaolo Bonzini
When a network or network device is created from the command line or HMP, QemuOpts ensures that the id passes the id_wellformed check. However, QMP skips this: $ qemu-system-x86_64 -qmp stdio -S -nic user,id=123/456 qemu-system-x86_64: -nic user,id=123/456: Parameter id expects an identifier Identifiers consist of letters, digits, -, ., _, starting with a letter. $ qemu-system-x86_64 -qmp stdio -S {"execute":"qmp_capabilities"} {"return": {}} {"execute":"netdev_add", "arguments": {"type": "user", "id": "123/456"}} {"return": {}} After: $ qemu-system-x86_64 -qmp stdio -S {"execute":"qmp_capabilities"} {"return": {}} {"execute":"netdev_add", "arguments": {"type": "user", "id": "123/456"}} {"error": {"class": "GenericError", "desc": "Parameter "id" expects an identifier"}} Validity checks should be performed always at the bottom of the call chain, because QMP skips all the steps above. At the same time we know that every call chain should go through either QMP or (for legacy) through QemuOpts. Because the id for -net and -nic is automatically generated and not well-formed by design, just add the check to QMP. Cc: Jason Wang <jasowang@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15net: Fix build error when DEBUG_NET is onBin Meng
"qemu-common.h" should be included to provide the forward declaration of qemu_hexdump() when DEBUG_NET is on. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15virtio-net: calculating proper msix vectors on initJason Wang
Currently, the default msix vectors for virtio-net-pci is 3 which is obvious not suitable for multiqueue guest, so we depends on the user or management tools to pass a correct vectors parameter. In fact, we can simplifying this by calculating the number of vectors on realize. Consider we have N queues, the number of vectors needed is 2*N + 2 (#queue pairs + plus one config interrupt and control vq). We didn't check whether or not host support control vq because it was added unconditionally by qemu to avoid breaking legacy guests such as Minix. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-14Merge remote-tracking branch ↵Peter Maydell
'remotes/vivier2/tags/linux-user-for-6.0-pull-request' into staging linux-user pull request 20210313 - fix elfload - fix executable page of /proc/self/maps - add preserve-arg[0] support for binfmt_misc # gpg: Signature made Sat 13 Mar 2021 09:47:23 GMT # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/linux-user-for-6.0-pull-request: linux-user/elfload: fix address calculation in fallback scenario linux-user/elfload: do not assume MAP_FIXED_NOREPLACE kernel support linux-user/elfload: munmap proper address in pgd_find_hole_fallback linux-user: manage binfmt-misc preserve-arg[0] flag linux-user: Fix executable page of /proc/self/maps Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-14Merge remote-tracking branch ↵Peter Maydell
'remotes/thuth-gitlab/tags/pull-request-2021-03-12' into staging * Move unit and bench tests into separate directories * Clean-up and improve gitlab-ci jobs * Drop the non-working "check-speed" makefile target * Minor documentation updates # gpg: Signature made Fri 12 Mar 2021 17:18:45 GMT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * remotes/thuth-gitlab/tags/pull-request-2021-03-12: README: Add Documentation blurb MAINTAINERS: Merge the Gitlab-CI section into the generic CI section tests: remove "make check-speed" in favor of "make bench" gitlab-ci.yml: Merge check-crypto-old jobs into the build-crypto-old jobs gitlab-ci.yml: Merge one of the coroutine jobs with the tcg-disabled job gitlab-ci.yml: Add some missing dependencies to the jobs gitlab-ci.yml: Move build-tools-and-docs-debian to a better place tests: Move benchmarks into a separate folder tests: Move unit tests into a separate directory Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-14Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20210314' into staging target-arm queue: * versal: Support XRAMs and XRAM controller * smmu: Various minor bug fixes * SVE emulation: fix bugs handling odd vector lengths * allwinner-sun8i-emac: traverse transmit queue using TX_CUR_DESC register value * tests/acceptance: fix orangepi-pc acceptance tests * hw/timer/sse-timer: Propagate eventual error in sse_timer_realize() * hw/arm/virt: KVM: The IPA lower bound is 32 * npcm7xx: support MFT module * pl110, pxa2xx_lcd: tidy up template headers # gpg: Signature made Sun 14 Mar 2021 13:17:43 GMT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210314: (39 commits) hw/display/pxa2xx: Inline template header hw/display/pxa2xx: Apply whitespace-only coding style fixes to template header hw/display/pxa2xx: Apply brace-related coding style fixes to template header hw/display/pxa2xx: Remove use of BITS in pxa2xx_template.h hw/display/pxa2xx_lcd: Remove dest_width state field hw/display/pxa2xx_lcd: Remove dead code for non-32-bpp surfaces hw/display/pl110: Remove use of BITS from pl110_template.h hw/display/pl110: Pull included-once parts of template header into pl110.c hw/display/pl110: Remove dead code for non-32-bpp surfaces tests/qtest: Test PWM fan RPM using MFT in PWM test hw/arm: Connect PWM fans in NPCM7XX boards hw/arm: Add MFT device to NPCM7xx Soc hw/misc: Add NPCM7XX MFT Module hw/misc: Add GPIOs for duty in NPCM7xx PWM hw/arm/virt: KVM: The IPA lower bound is 32 accel: kvm: Fix kvm_type invocation hw/timer/sse-timer: Propagate eventual error in sse_timer_realize() tests/acceptance: drop ARMBIAN_ARTIFACTS_CACHED condition for orangepi-pc, cubieboard tests tests/acceptance: update sunxi kernel from armbian to 5.10.16 tests/acceptance/boot_linux_console: change URL for test_arm_orangepi_bionic_20_08 ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-14hw/display/pxa2xx: Inline template headerPeter Maydell
The template header is now included only once; just inline its contents in hw/display/pxa2xx_lcd.c. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-10-peter.maydell@linaro.org
2021-03-14hw/display/pxa2xx: Apply whitespace-only coding style fixes to template headerPeter Maydell
We're about to move code from the template header into pxa2xx_lcd.c. Before doing that, make coding style fixes so checkpatch doesn't complain about the patch which moves the code. This commit is whitespace changes only: * avoid hard-coded tabs * fix ident on function prototypes * no newline before open brace on array definitions Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-9-peter.maydell@linaro.org
2021-03-14hw/display/pxa2xx: Apply brace-related coding style fixes to template headerPeter Maydell
We're about to move code from the template header into pxa2xx_lcd.c. Before doing that, make coding style fixes so checkpatch doesn't complain about the patch which moves the code. This commit fixes missing braces in the SKIP_PIXEL() macro definition and in if() statements. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-8-peter.maydell@linaro.org
2021-03-14hw/display/pxa2xx: Remove use of BITS in pxa2xx_template.hPeter Maydell
Now that BITS is always 32, expand out all its uses in the template header, including removing now-useless uses of the glue() macro. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-7-peter.maydell@linaro.org
2021-03-14hw/display/pxa2xx_lcd: Remove dest_width state fieldPeter Maydell
Since the dest_width is now always 4 because the output surface is 32bpp, we can replace the dest_width state field with a constant. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-6-peter.maydell@linaro.org
2021-03-14hw/display/pxa2xx_lcd: Remove dead code for non-32-bpp surfacesPeter Maydell
For a long time now the UI layer has guaranteed that the console surface is always 32 bits per pixel. Remove the legacy dead code from the pxa2xx_lcd display device which was handling the possibility that the console surface was some other format. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-5-peter.maydell@linaro.org
2021-03-14hw/display/pl110: Remove use of BITS from pl110_template.hPeter Maydell
BITS is always 32, so remove all uses of it from the template header, by dropping the trailing '32' from the draw function names and not constructing the name of rgb_to_pixel32() via the glue() macro. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-4-peter.maydell@linaro.org
2021-03-14hw/display/pl110: Pull included-once parts of template header into pl110.cPeter Maydell
The pl110_template.h header has a doubly-nested multiple-include pattern: * pl110.c includes it once for each host bit depth (now always 32) * every time it is included, it includes itself 6 times, to account for multiple guest device pixel and byte orders Now we only have to deal with 32-bit host bit depths, we can move the code corresponding to the outer layer of this double-nesting to be directly in pl110.c and reduce the template header to a single layer of nesting. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-3-peter.maydell@linaro.org
2021-03-14hw/display/pl110: Remove dead code for non-32-bpp surfacesPeter Maydell
For a long time now the UI layer has guaranteed that the console surface is always 32 bits per pixel. Remove the legacy dead code from the pl110 display device which was handling the possibility that the console surface was some other format. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210211141515.8755-2-peter.maydell@linaro.org
2021-03-13linux-user/elfload: fix address calculation in fallback scenarioVincent Fazio
Previously, guest_loaddr was not taken into account when returning an address from pgb_find_hole when /proc/self/maps was unavailable which caused an improper guest_base address to be calculated. This could cause a SIGSEGV later in load_elf_image -> target_mmap for ET_EXEC type images since the mmap MAP_FIXED flag is specified which could clobber existing mappings at the address returnd by g2h(). mmap(0xd87000, 16846912, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_NORESERVE|0x100000, -1, 0) = 0xd87000 munmap(0xd87000, 16846912) = 0 write(2, "Locating guest address space @ 0"..., 40Locating guest address space @ 0xd87000) = 40 mmap(0x1187000, 16850944, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_NORESERVE, -1, 0) = 0x1187000 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2188310} --- +++ killed by SIGSEGV +++ Now, pgd_find_hole accounts for guest_loaddr in this scenario. Fixes: ad592e37dfcc ("linux-user: provide fallback pgd_find_hole for bare chroots") Signed-off-by: Vincent Fazio <vfazio@gmail.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210131061948.15990-1-vfazio@xes-inc.com> [lv: updated it to check if ret == -1] Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-03-13linux-user/elfload: do not assume MAP_FIXED_NOREPLACE kernel supportVincent Fazio
Previously, pgd_find_hole_fallback assumed that if the build host's libc had MAP_FIXED_NOREPLACE defined that the address returned by mmap would match the requested address. This is not a safe assumption for Linux kernels prior to 4.17 Now, we always compare mmap's resultant address with the requested address and no longer short-circuit based on MAP_FIXED_NOREPLACE. Fixes: 2667e069e7b5 ("linux-user: don't use MAP_FIXED in pgd_find_hole_fallback") Signed-off-by: Vincent Fazio <vfazio@gmail.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210131061930.14554-1-vfazio@xes-inc.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-03-13linux-user/elfload: munmap proper address in pgd_find_hole_fallbackVincent Fazio
Previously, if the build host's libc did not define MAP_FIXED_NOREPLACE or if the running kernel didn't support that flag, it was possible for pgd_find_hole_fallback to munmap an incorrect address which could lead to SIGSEGV if the range happened to overlap with the mapped address of the QEMU binary. mmap(0x1000, 22261224, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_NORESERVE, -1, 0) = 0x7f889d331000 munmap(0x1000, 22261224) = 0 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x84b817} --- ++ killed by SIGSEGV +++ Now, always munmap the address returned by mmap. Fixes: 2667e069e7b5 ("linux-user: don't use MAP_FIXED in pgd_find_hole_fallback") Signed-off-by: Vincent Fazio <vfazio@gmail.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210131061849.12615-1-vfazio@xes-inc.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-03-13linux-user: manage binfmt-misc preserve-arg[0] flagLaurent Vivier
Add --preserve-argv0 in qemu-binfmt-conf.sh to configure the preserve-argv0 flag. This patch allows to use new flag in AT_FLAGS to detect if preserve-argv0 is configured for this interpreter: argv[0] (the full pathname provided by binfmt-misc) is removed and replaced by argv[1] (the original argv[0] provided by binfmt-misc when 'P'/preserve-arg[0] is set) For instance with this patch and kernel support for AT_FLAGS: $ sudo chroot m68k-chroot sh -c 'echo $0' sh without this patch: $ sudo chroot m68k-chroot sh -c 'echo $0' /usr/bin/sh The new flag is available in kernel (v5.12) since: 2347961b11d4 ("binfmt_misc: pass binfmt_misc flags to the interpreter") This can be tested with something like: # cp ..../qemu-ppc /chroot/powerpc/jessie # qemu-binfmt-conf.sh --qemu-path / --systemd ppc --credential yes \ --persistent no --preserve-argv0 yes # systemctl restart systemd-binfmt.service # cat /proc/sys/fs/binfmt_misc/qemu-ppc enabled interpreter //qemu-ppc flags: POC offset 0 magic 7f454c4601020100000000000000000000020014 mask ffffffffffffff00fffffffffffffffffffeffff # chroot /chroot/powerpc/jessie sh -c 'echo $0' sh # qemu-binfmt-conf.sh --qemu-path / --systemd ppc --credential yes \ --persistent no --preserve-argv0 no # systemctl restart systemd-binfmt.service # cat /proc/sys/fs/binfmt_misc/qemu-ppc enabled interpreter //qemu-ppc flags: OC offset 0 magic 7f454c4601020100000000000000000000020014 mask ffffffffffffff00fffffffffffffffffffeffff # chroot /chroot/powerpc/jessie sh -c 'echo $0' /bin/sh Signed-off-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210222105004.1642234-1-laurent@vivier.eu>
2021-03-13linux-user: Fix executable page of /proc/self/mapsNicolas Surbayrole
The guest binary and libraries are not always map with the executable bit in the host process. The guest may read a /proc/self/maps with no executable address range. The perm fields should be based on the guest permission inside Qemu. Signed-off-by: Nicolas Surbayrole <nsurbayrole@quarkslab.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210308091959.986540-1-nsurbayrole@quarkslab.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-03-12Merge remote-tracking branch 'remotes/vivier/tags/m68k-for-6.0-pull-request' ↵Peter Maydell
into staging Prepare MacOS ROM support: - add RTR instruction - fix unaligned access requirement - fix ATC bit (68040 MMU) # gpg: Signature made Thu 11 Mar 2021 22:18:11 GMT # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier/tags/m68k-for-6.0-pull-request: target/m68k: add M68K_FEATURE_UNALIGNED_DATA feature target/m68k: reformat m68k_features enum target/m68k: don't set SSW ATC bit for physical bus errors target/m68k: implement rtr instruction Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12README: Add Documentation blurbJohn Snow
Add it in a prominent place: Right after figuring out what QEMU is, users may wish to know how to use it more than they want to know how to build their own version of it. Signed-off-by: John Snow <jsnow@redhat.com> Message-Id: <20201104193032.1319248-1-jsnow@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-03-12MAINTAINERS: Merge the Gitlab-CI section into the generic CI sectionThomas Huth
The status of the gitlab-CI files is currently somewhat confusing, and it is often not quite clear whether a patch should go via my tree or via the testing tree of Alex. That situation has grown historically... Initially, I was the only one using the gitlab-CI, just for my private repository there. But in the course of time, the gitlab-CI switched to use the containers from tests/docker/ (which is not part of the gitlab-CI section in the MAINTAINERS file), and QEMU now even switched to gitlab.com completely for the repository and will soon use it as its gating CI, too, so it makes way more sense if the gitlab-ci.yml files belong to the people who are owning the qemu-project on gitlab.com and take care of the gitlab CI there. Thus let's merge the gitlab-ci section into the common "test and build automation" section. And while we're at it, I'm also removing the line with Fam there for now, since he was hardly active during the last years in this area anymore. If he ever gets more time for this part again in the future, we surely can add the line back again. I'm also removing the Patchew URL from this section now since Patchew's files are not tracked in the main QEMU repo and it is also not maintained by Alex, Philippe and myself. The maintainers of Patchew are still listed more accurately in the wiki on https://wiki.qemu.org/AdminContacts & https://wiki.qemu.org/Testing/CI/Patchew instead. Now to avoid that Alex is listed here in this section alone, Philippe and I agreed to help as backup maintainers here, too. And Willian volunteered to be an additional reviewer. Message-Id: <20210309112356.737266-1-thuth@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Acked-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Acked-by: Fam Zheng <fam@euphon.net> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-03-12tests: remove "make check-speed" in favor of "make bench"Paolo Bonzini
"make check-speed" has been broken since the removal of ninja2make last October. It was just a backwards-compatibility alias for "make bench-speed", which in turn is in principle a subset of "make bench". Advertise the latter and drop "make check-speed" completely since no one has noticed. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20210310164612.285362-1-pbonzini@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-03-12gitlab-ci.yml: Merge check-crypto-old jobs into the build-crypto-old jobsThomas Huth
Both, the build-crypto-old and the check-crypto-old jobs finish reasonably fast, and the build artifacts are only used for the single corresponding check jobs, so there is no reason for doing the check step in a separate job here. Thus let's stop wasting artifacts space and job scheduler over- head by simply merging the test step into the build jobs. Message-Id: <20210311142211.1547864-5-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-03-12gitlab-ci.yml: Merge one of the coroutine jobs with the tcg-disabled jobThomas Huth
Our gitlab-ci got quite slow in the past weeks, due to the immense amount of jobs that we have, so we should try to reduce the number of jobs. Since we already have a job that builds without TCG, we can merge one of the "build-coroutine" jobs with it to get rid of at least one job. Message-Id: <20210311142211.1547864-4-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-03-12gitlab-ci.yml: Add some missing dependencies to the jobsThomas Huth
Let's make sure that all jobs have proper "needs:" statements so that they can start as soon as possible, without having to wait for the previous pipeline stage to finish. Message-Id: <20210311142211.1547864-3-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-03-12gitlab-ci.yml: Move build-tools-and-docs-debian to a better placeThomas Huth
The "build-tools-and-docs-debian" job had been added in between the "check-system-debian" and the "accepance-system-debian" jobs and thus separates the jobs that belong together. Move it away, to the end of the file, next to the "pages" job that depends on it. And while we're at it, also add a proper "needs:" line to the job so that it can be started as soon as possible instead of always waiting for the previous stage to finish. Message-Id: <20210311142211.1547864-2-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-03-12tests: Move benchmarks into a separate folderThomas Huth
Make it clear that these files are related to benchmarks by moving them into a new folder called "bench". Message-Id: <20210312092238.79509-1-thuth@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-03-12tests: Move unit tests into a separate directoryThomas Huth
The main tests directory still looks very crowded, and it's not clear which files are part of a unit tests and which belong to a different test subsystem. Let's clean up the mess and move the unit tests to a separate directory. Message-Id: <20210310063314.1049838-1-thuth@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-03-12Merge remote-tracking branch 'remotes/kraxel/tags/ui-20210311-pull-request' ↵Peter Maydell
into staging ui: mostly cocoa fixes # gpg: Signature made Thu 11 Mar 2021 12:33:51 GMT # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/ui-20210311-pull-request: ui/cocoa: Fix mouse association state ui/cocoa: Mark variables static ui/cocoa: Clear modifiers whenever possible ui/cocoa: Do not rely on the first argument ui/cocoa: Show QEMU icon in the about window docs: Fix removal text of -show-cursor ui/cocoa: Use kCGColorSpaceSRGB ui/gtk: Remove NULL checks in gd_switch Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12tests/qtest: Test PWM fan RPM using MFT in PWM testHao Wu
This patch adds testing of PWM fan RPMs in the existing npcm7xx pwm test. It tests whether the MFT module can measure correct fan values for a PWM fan in NPCM7XX boards. Reviewed-by: Doug Evans <dje@google.com> Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Signed-off-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210311180855.149764-6-wuhaotsh@google.com [PMM: fixed format strings for printing uint64_t] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/arm: Connect PWM fans in NPCM7XX boardsHao Wu
This patch adds fan_splitters (split IRQs) in NPCM7XX boards. Each fan splitter corresponds to 1 PWM output and can connect to multiple fan inputs (MFT devices). In NPCM7XX boards(NPCM750 EVB and Quanta GSJ boards), we initializes these splitters and connect them to their corresponding modules according their specific device trees. Reviewed-by: Doug Evans <dje@google.com> Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Signed-off-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210311180855.149764-5-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/arm: Add MFT device to NPCM7xx SocHao Wu
This patch adds the recently implemented MFT device to the NPCM7XX SoC file. Reviewed-by: Doug Evans <dje@google.com> Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Signed-off-by: Hao Wu <wuhaotsh@google.com> Message-id: 20210311180855.149764-4-wuhaotsh@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/misc: Add NPCM7XX MFT ModuleHao Wu
This patch implements Multi Function Timer (MFT) module for NPCM7XX. This module is mainly used to configure PWM fans. It has just enough functionality to make the PWM fan kernel module work. The module takes two input, the max_rpm of a fan (modifiable via QMP) and duty cycle (a GPIO from the PWM module.) The actual measured RPM is equal to max_rpm * duty_cycle / NPCM7XX_PWM_MAX_DUTY. The RPM is measured as a counter compared to a prescaled input clock. The kernel driver reads this counter and report to user space. Refs: https://github.com/torvalds/linux/blob/master/drivers/hwmon/npcm750-pwm-fan.c Reviewed-by: Doug Evans <dje@google.com> Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Signed-off-by: Hao Wu <wuhaotsh@google.com> Message-id: 20210311180855.149764-3-wuhaotsh@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/misc: Add GPIOs for duty in NPCM7xx PWMHao Wu
This patch adds GPIOs in NPCM7xx PWM module for its duty values. The purpose of this is to connect it to the MFT module to provide an input for measuring a PWM fan's RPM. Each PWM module has NPCM7XX_PWM_PER_MODULE of GPIOs, each one corresponds to one PWM instance and can connect to multiple fan instances in MFT. Reviewed-by: Doug Evans <dje@google.com> Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Signed-off-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210311180855.149764-2-wuhaotsh@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/arm/virt: KVM: The IPA lower bound is 32Andrew Jones
The virt machine already checks KVM_CAP_ARM_VM_IPA_SIZE to get the upper bound of the IPA size. If that bound is lower than the highest possible GPA for the machine, then QEMU will error out. However, the IPA is set to 40 when the highest GPA is less than or equal to 40, even when KVM may support an IPA limit as low as 32. This means KVM may fail the VM creation unnecessarily. Additionally, 40 is selected with the value 0, which means use the default, and that gets around a check in some versions of KVM, causing a difficult to debug fail. Always use the IPA size that corresponds to the highest possible GPA, unless it's lower than 32, in which case use 32. Also, we must still use 0 when KVM only supports the legacy fixed 40 bit IPA. Suggested-by: Marc Zyngier <maz@kernel.org> Signed-off-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Message-id: 20210310135218.255205-3-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12accel: kvm: Fix kvm_type invocationAndrew Jones
Prior to commit f2ce39b4f067 a MachineClass kvm_type method only needed to be registered to ensure it would be executed. With commit f2ce39b4f067 a kvm-type machine property must also be specified. hw/arm/virt relies on the kvm_type method to pass its selected IPA limit to KVM, but this is not exposed as a machine property. Restore the previous functionality of invoking kvm_type when it's present. Fixes: f2ce39b4f067 ("vl: make qemu_get_machine_opts static") Signed-off-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-id: 20210310135218.255205-2-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-12hw/timer/sse-timer: Propagate eventual error in sse_timer_realize()Philippe Mathieu-Daudé
If the SSECounter link is absent, we set an error message in sse_timer_realize() but forgot to propagate this error. Add the missing 'return'. Fixes: CID 1450755 (Null pointer dereferences) Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210312001845.1562670-1-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>