]> git.proxmox.com Git - mirror_qemu.git/log
mirror_qemu.git
2 years agomigration: Report the error returned when save_live_iterate fails
David Edmondson [Wed, 15 Dec 2021 14:14:37 +0000 (14:14 +0000)]
migration: Report the error returned when save_live_iterate fails

Should qemu_savevm_state_iterate() encounter a failure when calling a
particular save_live_iterate function, report the error code returned
by the function.

Signed-off-by: David Edmondson <david.edmondson@oracle.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
2 years agomigration/migration.c: Remove the MIGRATION_STATUS_ACTIVE when migration finished
Zhang Chen [Fri, 31 Dec 2021 05:59:35 +0000 (13:59 +0800)]
migration/migration.c: Remove the MIGRATION_STATUS_ACTIVE when migration finished

The MIGRATION_STATUS_ACTIVE indicates that migration is running.
Remove it to be handled by the default operation,
It should be part of the unknown ending states.

Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
2 years agomigration/migration.c: Avoid COLO boot in postcopy migration
Zhang Chen [Fri, 31 Dec 2021 05:59:34 +0000 (13:59 +0800)]
migration/migration.c: Avoid COLO boot in postcopy migration

COLO dose not support postcopy migration and remove the Fixme.

Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
2 years agomigration/migration.c: Add missed default error handler for migration state
Zhang Chen [Fri, 31 Dec 2021 05:59:33 +0000 (13:59 +0800)]
migration/migration.c: Add missed default error handler for migration state

In the migration_completion() no other status is expected, for
example MIGRATION_STATUS_CANCELLING, MIGRATION_STATUS_CANCELLED, etc.

Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
2 years agoRemove unnecessary minimum_version_id_old fields
Peter Maydell [Tue, 18 Jan 2022 10:44:34 +0000 (10:44 +0000)]
Remove unnecessary minimum_version_id_old fields

The migration code will not look at a VMStateDescription's
minimum_version_id_old field unless that VMSD has set the
load_state_old field to something non-NULL.  (The purpose of
minimum_version_id_old is to specify what migration version is needed
for the code in the function pointed to by load_state_old to be able
to handle it on incoming migration.)

We have exactly one VMSD which still has a load_state_old,
in the PPC CPU; every other VMSD which sets minimum_version_id_old
is doing so unnecessarily. Delete all the unnecessary ones.

Commit created with:
  sed -i '/\.minimum_version_id_old/d' $(git grep -l '\.minimum_version_id_old')
with the one legitimate use then hand-edited back in.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---

It missed vmstate_ppc_cpu.

2 years agomultifd: Rename pages_used to normal_pages
Juan Quintela [Mon, 22 Nov 2021 13:13:51 +0000 (14:13 +0100)]
multifd: Rename pages_used to normal_pages

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2 years agomultifd: recv side only needs the RAMBlock host address
Juan Quintela [Mon, 22 Nov 2021 13:10:57 +0000 (14:10 +0100)]
multifd: recv side only needs the RAMBlock host address

So we can remove the MultiFDPages.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2 years agomultifd: Use normal pages array on the recv side
Juan Quintela [Mon, 22 Nov 2021 12:41:06 +0000 (13:41 +0100)]
multifd: Use normal pages array on the recv side

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
---

Rename num_normal_pages to total_normal_pages (peter)

2 years agomultifd: Use normal pages array on the send side
Juan Quintela [Mon, 22 Nov 2021 12:26:18 +0000 (13:26 +0100)]
multifd: Use normal pages array on the send side

We are only sending normal pages through multifd channels.
Later on this series, we are going to also send zero pages.
We are going to detect if a page is zero or non zero in the multifd
channel thread, not on the main thread.

So we receive an array of pages page->offset[N]

And we will end with:

p->normal[N - zero_pages]
p->zero[zero_pages].

In this patch, we just copy all the pages in offset to normal.

for (i = 0; i < pages->num; i++) {
    p->narmal[p->normal_num] = pages->offset[i];
    p->normal_num++:
}

Later in the series this becomes:

for (i = 0; i < pages->num; i++) {
    if (buffer_is_zero(page->offset[i])) {
        p->zerol[p->zero_num] = pages->offset[i];
        p->zero_num++:
    } else {
        p->narmal[p->normal_num] = pages->offset[i];
        p->normal_num++:
    }
}

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
---

Improving comment (dave)
Renaming num_normal_pages to total_normal_pages (peter)

2 years agomultifd: Unfold "used" variable by its value
Juan Quintela [Mon, 22 Nov 2021 12:01:29 +0000 (13:01 +0100)]
multifd: Unfold "used" variable by its value

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2 years agomultifd: Use a single writev on the send side
Juan Quintela [Fri, 19 Nov 2021 14:35:58 +0000 (15:35 +0100)]
multifd: Use a single writev on the send side

Until now, we wrote the packet header with write(), and the rest of the
pages with writev().  Just increase the size of the iovec and do a
single writev().

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2 years agomultifd: Remove send_write() method
Juan Quintela [Fri, 19 Nov 2021 14:08:16 +0000 (15:08 +0100)]
multifd: Remove send_write() method

Everything use now iov's.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2 years agomultifd: Make zstd use iov's
Juan Quintela [Fri, 19 Nov 2021 14:05:23 +0000 (15:05 +0100)]
multifd: Make zstd use iov's

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2 years agomultifd: Make zlib use iov's
Juan Quintela [Fri, 19 Nov 2021 14:03:02 +0000 (15:03 +0100)]
multifd: Make zlib use iov's

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2 years agomultifd: Move iov from pages to params
Juan Quintela [Fri, 19 Nov 2021 11:06:05 +0000 (12:06 +0100)]
multifd: Move iov from pages to params

This will allow us to reduce the number of system calls on the next patch.

Signed-off-by: Juan Quintela <quintela@redhat.com>
2 years agomultifd: Use proper maximum compression values
Juan Quintela [Fri, 26 Nov 2021 09:30:32 +0000 (10:30 +0100)]
multifd: Use proper maximum compression values

It happens that there are functions to calculate the worst possible
compression size for a packet.  Use them.

Suggested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2 years agomigration: Move ram_release_pages() call to save_zero_page_to_file()
Juan Quintela [Thu, 16 Dec 2021 08:58:49 +0000 (09:58 +0100)]
migration: Move ram_release_pages() call to save_zero_page_to_file()

We always need to call it when we find a zero page, so put it in a
single place.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
2 years agomigration: simplify do_compress_ram_page
Juan Quintela [Thu, 16 Dec 2021 08:39:49 +0000 (09:39 +0100)]
migration: simplify do_compress_ram_page

The goto is not needed at all.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2 years agomigration: Remove masking for compression
Juan Quintela [Tue, 21 Dec 2021 09:28:16 +0000 (10:28 +0100)]
migration: Remove masking for compression

Remove the mask in the call to ram_release_pages().  Nothing else does
it, and if the offset has that bits set, we have a lot of trouble.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2 years agomigration: ram_release_pages() always receive 1 page as argument
Juan Quintela [Wed, 15 Dec 2021 19:34:47 +0000 (20:34 +0100)]
migration: ram_release_pages() always receive 1 page as argument

Remove the pages argument. And s/pages/page/

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
---

- Use 1LL instead of casts (philmd)
- Change the whole 1ULL for TARGET_PAGE_SIZE

2 years agomigration: We only need last_stage in two places
Juan Quintela [Wed, 15 Dec 2021 18:01:21 +0000 (19:01 +0100)]
migration: We only need last_stage in two places

We only need last_stage in two places and we are passing it all
around.  Just add a field to RAMState that passes it.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
---

Repeat subject (philmd suggestion)

2 years agomigration: All this fields are unsigned
Juan Quintela [Wed, 15 Dec 2021 13:20:48 +0000 (14:20 +0100)]
migration: All this fields are unsigned

So printing it as %d is wrong.  Notice that for the channel id, that
is an uint8_t, but I changed it anyways for consistency.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
2 years agoMerge remote-tracking branch 'remotes/aperard/tags/pull-xen-20220127' into staging
Peter Maydell [Fri, 28 Jan 2022 11:05:28 +0000 (11:05 +0000)]
Merge remote-tracking branch 'remotes/aperard/tags/pull-xen-20220127' into staging

Xen patches

- bug fixes for mapcache and ioreq handling

# gpg: Signature made Thu 27 Jan 2022 15:17:22 GMT
# gpg:                using RSA key F80C006308E22CFD8A92E7980CF5572FD7FB55AF
# gpg: Good signature from "Anthony PERARD <anthony.perard@gmail.com>" [unknown]
# gpg:                 aka "Anthony PERARD <anthony.perard@citrix.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 5379 2F71 024C 600F 778A  7161 D8D5 7199 DF83 42C8
#      Subkey fingerprint: F80C 0063 08E2 2CFD 8A92  E798 0CF5 572F D7FB 55AF

* remotes/aperard/tags/pull-xen-20220127:
  xen-mapcache: Avoid entry->lock overflow
  xen-hvm: Allow disabling buffer_io_timer

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2 years agoMerge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2022-01-27-v2' into staging
Peter Maydell [Thu, 27 Jan 2022 15:45:13 +0000 (15:45 +0000)]
Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2022-01-27-v2' into staging

QAPI patches patches for 2022-01-27

# gpg: Signature made Thu 27 Jan 2022 14:19:51 GMT
# gpg:                using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg:                issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full]
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>" [full]
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867  4E5F 3870 B400 EB91 8653

* remotes/armbru/tags/pull-qapi-2022-01-27-v2:
  qapi: generate trace events by default
  meson: document why we don't generate trace events for tests/ and qga/
  docs/qapi-code-gen: update to cover trace events code generation
  meson: generate trace events for qmp commands
  qapi/commands: Optionally generate trace for QMP commands
  qapi/commands: refactor error handling code
  qapi/gen: Add FOO.trace-events output module
  schemas: add missing vim modeline

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2 years agoxen-mapcache: Avoid entry->lock overflow
Ross Lagerwall [Mon, 24 Jan 2022 10:44:50 +0000 (10:44 +0000)]
xen-mapcache: Avoid entry->lock overflow

In some cases, a particular mapcache entry may be mapped 256 times
causing the lock field to wrap to 0. For example, this may happen when
using emulated NVME and the guest submits a large scatter-gather write.
At this point, the entry map be remapped causing QEMU to write the wrong
data or crash (since remap is not atomic).

Avoid this overflow by increasing the lock field to a uint32_t and also
detect it and abort rather than continuing regardless.

Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Reviewed-by: Paul Durrant <paul@xen.org>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Message-Id: <20220124104450.152481-1-ross.lagerwall@citrix.com>
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2 years agoxen-hvm: Allow disabling buffer_io_timer
Jason Andryuk [Fri, 10 Dec 2021 19:34:34 +0000 (14:34 -0500)]
xen-hvm: Allow disabling buffer_io_timer

commit f37f29d31488 "xen: slightly simplify bufioreq handling" hard
coded setting req.count = 1 during initial field setup before the main
loop.  This missed a subtlety that an early exit from the loop when
there are no ioreqs to process, would have req.count == 0 for the return
value.  handle_buffered_io() would then remove state->buffered_io_timer.
Instead handle_buffered_iopage() is basically always returning true and
handle_buffered_io() always re-setting the timer.

Restore the disabling of the timer by introducing a new handled_ioreq
boolean and use as the return value.  The named variable will more
clearly show the intent of the code.

Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
Reviewed-by: Paul Durrant <paul@xen.org>
Message-Id: <20211210193434.75566-1-jandryuk@gmail.com>
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2 years agoqapi: generate trace events by default
Vladimir Sementsov-Ogievskiy [Wed, 26 Jan 2022 16:11:30 +0000 (17:11 +0100)]
qapi: generate trace events by default

We don't generate trace events for tests/ and qga/ because that it is
not simple and not necessary. We have corresponding comments in both
tests/meson.build and qga/meson.build.

Still to not miss possible future qapi code generation call, and not to
forget to enable trace events generation, let's enable it by default.
So, turn option --gen-trace into opposite --no-trace-events and use new
option only in tests/ and qga/ where we already have good comments why
we don't generate trace events code.

Note that this commit enables trace-events generation for qapi-gen.py
call from tests/qapi-schema/meson.build and storage-daemon/meson.build.
Still, both are kind of noop: tests/qapi-schema/ doesn't seem to
generate any QMP command code and no .trace-events files anyway,
storage-daemon/ uses common QMP command implementations and just
generate empty .trace-events

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20220126161130.3240892-8-vsementsov@virtuozzo.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2 years agomeson: document why we don't generate trace events for tests/ and qga/
Vladimir Sementsov-Ogievskiy [Wed, 26 Jan 2022 16:11:29 +0000 (17:11 +0100)]
meson: document why we don't generate trace events for tests/ and qga/

Making trace generation work for tests/ and qga/ would involve some
Meson hackery to ensure we generate the trace-events files before
trace-tool uses them. Since we don't actually support tracing there
anyway, we bypass that problem.

Let's add corresponding comments.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20220126161130.3240892-7-vsementsov@virtuozzo.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Pasto fixed, commit message punctuation tidied up]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2 years agodocs/qapi-code-gen: update to cover trace events code generation
Vladimir Sementsov-Ogievskiy [Wed, 26 Jan 2022 16:11:28 +0000 (17:11 +0100)]
docs/qapi-code-gen: update to cover trace events code generation

Previous commits enabled trace events generation for most of QAPI
generated code (except for tests/ and qga/). Let's update documentation
to illustrate it.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20220126161130.3240892-6-vsementsov@virtuozzo.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2 years agomeson: generate trace events for qmp commands
Vladimir Sementsov-Ogievskiy [Wed, 26 Jan 2022 16:11:27 +0000 (17:11 +0100)]
meson: generate trace events for qmp commands

1. Use --gen-trace when generate qmp commands
2. Add corresponding .trace-events files as outputs in qapi_files
   custom target
3. Define global qapi_trace_events list of .trace-events file targets,
   to fill in trace/qapi.build and to use in trace/meson.build
4. In trace/meson.build use the new array as an additional source of
   .trace_events files to be processed

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20220126161130.3240892-5-vsementsov@virtuozzo.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2 years agoqapi/commands: Optionally generate trace for QMP commands
Vladimir Sementsov-Ogievskiy [Wed, 26 Jan 2022 16:11:26 +0000 (17:11 +0100)]
qapi/commands: Optionally generate trace for QMP commands

Add trace generation disabled by default and new option --gen-trace to
enable it.  The next commit will enable it for qapi/, but not for qga/
and tests/.  Making it work for the latter two would involve some Meson
hackery to ensure we generate the trace-events files before trace-tool
uses them.  Since we don't actually support tracing there, we'll bypass
that problem.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20220126161130.3240892-4-vsementsov@virtuozzo.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Superfluous #include dropped]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2 years agoqapi/commands: refactor error handling code
Vladimir Sementsov-Ogievskiy [Wed, 26 Jan 2022 16:11:25 +0000 (17:11 +0100)]
qapi/commands: refactor error handling code

Move error_propagate() to if (err) and make "if (err)" block mandatory.
This is to simplify further commit, which will bring trace events
generation for QMP commands.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20220126161130.3240892-3-vsementsov@virtuozzo.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2 years agoqapi/gen: Add FOO.trace-events output module
Vladimir Sementsov-Ogievskiy [Wed, 26 Jan 2022 16:11:24 +0000 (17:11 +0100)]
qapi/gen: Add FOO.trace-events output module

We are going to generate trace events for QMP commands. We should
generate both trace_*() function calls and trace-events files listing
events for trace generator.

So, add an output module FOO.trace-events for each FOO schema module.

Since we're going to add trace events only to command marshallers,
make the trace-events output optional, so we don't generate so many
useless empty files.

Currently nobody set add_trace_events to True, so new functionality is
disabled. It will be enabled for QAPISchemaGenCommandVisitor
in a further commit.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20220126161130.3240892-2-vsementsov@virtuozzo.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2 years agoschemas: add missing vim modeline
Victor Toso [Mon, 20 Dec 2021 14:56:24 +0000 (15:56 +0100)]
schemas: add missing vim modeline

Similar to f7160f3218 "schemas: Add vim modeline"

Signed-off-by: Victor Toso <victortoso@redhat.com>
Message-Id: <20211220145624.52801-1-victortoso@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2 years agoMerge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-virtiofs-20220126...
Peter Maydell [Wed, 26 Jan 2022 10:59:50 +0000 (10:59 +0000)]
Merge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-virtiofs-20220126' into staging

virtiofsd: Security fix

Fixes: CVE-2022-0358
# gpg: Signature made Wed 26 Jan 2022 10:46:44 GMT
# gpg:                using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7
# gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full]
# Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A  9FA9 0516 331E BC5B FDE7

* remotes/dgilbert-gitlab/tags/pull-virtiofs-20220126:
  virtiofsd: Drop membership of all supplementary groups (CVE-2022-0358)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2 years agovirtiofsd: Drop membership of all supplementary groups (CVE-2022-0358)
Vivek Goyal [Tue, 25 Jan 2022 18:51:14 +0000 (13:51 -0500)]
virtiofsd: Drop membership of all supplementary groups (CVE-2022-0358)

At the start, drop membership of all supplementary groups. This is
not required.

If we have membership of "root" supplementary group and when we switch
uid/gid using setresuid/setsgid, we still retain membership of existing
supplemntary groups. And that can allow some operations which are not
normally allowed.

For example, if root in guest creates a dir as follows.

$ mkdir -m 03777 test_dir

This sets SGID on dir as well as allows unprivileged users to write into
this dir.

And now as unprivileged user open file as follows.

$ su test
$ fd = open("test_dir/priviledge_id", O_RDWR|O_CREAT|O_EXCL, 02755);

This will create SGID set executable in test_dir/.

And that's a problem because now an unpriviliged user can execute it,
get egid=0 and get access to resources owned by "root" group. This is
privilege escalation.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2044863
Fixes: CVE-2022-0358
Reported-by: JIETAO XIAO <shawtao1125@gmail.com>
Suggested-by: Miklos Szeredi <mszeredi@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Message-Id: <YfBGoriS38eBQrAb@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
  dgilbert: Fixed missing {}'s style nit

2 years agoMerge remote-tracking branch 'remotes/jsnow-gitlab/tags/python-pull-request' into...
Peter Maydell [Sat, 22 Jan 2022 12:03:22 +0000 (12:03 +0000)]
Merge remote-tracking branch 'remotes/jsnow-gitlab/tags/python-pull-request' into staging

Python patches

A few fixes to the Python CI tests, a few fixes to the (async) QMP
library, and a set of patches that begin to shift us towards using the
new qmp lib.

# gpg: Signature made Sat 22 Jan 2022 00:07:58 GMT
# gpg:                using RSA key F9B7ABDBBCACDF95BE76CBD07DEF8106AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" [full]
# Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
#      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

* remotes/jsnow-gitlab/tags/python-pull-request:
  scripts/render-block-graph: switch to AQMP
  scripts/cpu-x86-uarch-abi: switch to AQMP
  scripts/cpu-x86-uarch-abi: fix CLI parsing
  python: move qmp-shell under the AQMP package
  python: move qmp utilities to python/qemu/utils
  python/qmp: switch qmp-shell to AQMP
  python/qmp: switch qom tools to AQMP
  python/qmp: switch qemu-ga-client to AQMP
  python/qemu-ga-client: don't use deprecated CLI syntax in usage comment
  python/aqmp: rename AQMPError to QMPError
  python/aqmp: add SocketAddrT to package root
  python/aqmp: copy type definitions from qmp
  python/aqmp: handle asyncio.TimeoutError on execute()
  python/aqmp: add __del__ method to legacy interface
  python/aqmp: fix docstring typo
  python: use avocado's "new" runner
  python: pin setuptools below v60.0.0

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2 years agoscripts/render-block-graph: switch to AQMP
John Snow [Mon, 10 Jan 2022 23:28:59 +0000 (18:28 -0500)]
scripts/render-block-graph: switch to AQMP

Creating an instance of qemu.aqmp.ExecuteError is too involved here, so
just drop the specificity down to a generic QMPError.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Beraldo Leal <bleal@redhat.com>
2 years agoscripts/cpu-x86-uarch-abi: switch to AQMP
John Snow [Mon, 10 Jan 2022 23:28:58 +0000 (18:28 -0500)]
scripts/cpu-x86-uarch-abi: switch to AQMP

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Beraldo Leal <bleal@redhat.com>
2 years agoscripts/cpu-x86-uarch-abi: fix CLI parsing
John Snow [Mon, 10 Jan 2022 23:28:57 +0000 (18:28 -0500)]
scripts/cpu-x86-uarch-abi: fix CLI parsing

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2 years agopython: move qmp-shell under the AQMP package
John Snow [Mon, 10 Jan 2022 23:28:55 +0000 (18:28 -0500)]
python: move qmp-shell under the AQMP package

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Beraldo Leal <bleal@redhat.com>
2 years agopython: move qmp utilities to python/qemu/utils
John Snow [Mon, 10 Jan 2022 23:28:54 +0000 (18:28 -0500)]
python: move qmp utilities to python/qemu/utils

In order to upload a QMP package to PyPI, I want to remove any scripts
that I am not 100% confident I want to support upstream, beyond our
castle walls.

Move most of our QMP utilities into the utils package so we can split
them out from the PyPI upload.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Beraldo Leal <bleal@redhat.com>
2 years agopython/qmp: switch qmp-shell to AQMP
John Snow [Mon, 10 Jan 2022 23:28:53 +0000 (18:28 -0500)]
python/qmp: switch qmp-shell to AQMP

We have a replacement for async QMP, but it doesn't have feature parity
yet. For now, then, port the old tool onto the new backend.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2 years agopython/qmp: switch qom tools to AQMP
John Snow [Mon, 10 Jan 2022 23:28:52 +0000 (18:28 -0500)]
python/qmp: switch qom tools to AQMP

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Beraldo Leal <bleal@redhat.com>
2 years agopython/qmp: switch qemu-ga-client to AQMP
John Snow [Mon, 10 Jan 2022 23:28:51 +0000 (18:28 -0500)]
python/qmp: switch qemu-ga-client to AQMP

Async QMP always raises a "ConnectError" on any connection error which
houses the cause in a second exception. We can check if this root cause
was python's ConnectionError to determine a fairly similar condition to
the original error check here.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Beraldo Leal <bleal@redhat.com>
2 years agopython/qemu-ga-client: don't use deprecated CLI syntax in usage comment
John Snow [Mon, 10 Jan 2022 23:28:50 +0000 (18:28 -0500)]
python/qemu-ga-client: don't use deprecated CLI syntax in usage comment

Cleanup related to commit ccd3b3b8112b670f, "qemu-option: warn for
short-form boolean options".

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2 years agopython/aqmp: rename AQMPError to QMPError
John Snow [Mon, 10 Jan 2022 23:28:49 +0000 (18:28 -0500)]
python/aqmp: rename AQMPError to QMPError

This is in preparation for renaming qemu.aqmp to qemu.qmp. I should have
done this from this from the very beginning, but it's a convenient time
to make sure this churn is taken care of.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2 years agopython/aqmp: add SocketAddrT to package root
John Snow [Mon, 10 Jan 2022 23:28:48 +0000 (18:28 -0500)]
python/aqmp: add SocketAddrT to package root

It's a commonly needed definition, it can be re-exported by the root.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Beraldo Leal <bleal@redhat.com>
2 years agopython/aqmp: copy type definitions from qmp
John Snow [Mon, 10 Jan 2022 23:28:47 +0000 (18:28 -0500)]
python/aqmp: copy type definitions from qmp

Copy the remaining type definitions from QMP into the qemu.aqmp.legacy
module. Now, users that require the legacy interface don't need to
import anything else but qemu.aqmp.legacy wrapper.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Beraldo Leal <bleal@redhat.com>
2 years agopython/aqmp: handle asyncio.TimeoutError on execute()
John Snow [Mon, 10 Jan 2022 23:28:46 +0000 (18:28 -0500)]
python/aqmp: handle asyncio.TimeoutError on execute()

This exception can be injected into any await statement. If we are
canceled via timeout, we want to clear the pending execution record on
our way out.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Beraldo Leal <bleal@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2 years agopython/aqmp: add __del__ method to legacy interface
John Snow [Mon, 10 Jan 2022 23:28:45 +0000 (18:28 -0500)]
python/aqmp: add __del__ method to legacy interface

asyncio can complain *very* loudly if you forget to back out of things
gracefully before the garbage collector starts destroying objects that
contain live references to asyncio Tasks.

The usual fix is just to remember to call aqmp.disconnect(), but for the
sake of the legacy wrapper and quick, one-off scripts where a graceful
shutdown is not necessarily of paramount imporance, add a courtesy
cleanup that will trigger prior to seeing screenfuls of confusing
asyncio tracebacks.

Note that we can't *always* save you from yourself; depending on when
the GC runs, you might just seriously be out of luck. The best we can do
in this case is to gently remind you to clean up after yourself.

(Still much better than multiple pages of incomprehensible python
warnings for the crime of forgetting to put your toys away.)

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Beraldo Leal <bleal@redhat.com>
2 years agopython/aqmp: fix docstring typo
John Snow [Mon, 10 Jan 2022 23:28:44 +0000 (18:28 -0500)]
python/aqmp: fix docstring typo

Reported-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Beraldo Leal <bleal@redhat.com>
2 years agopython: use avocado's "new" runner
John Snow [Wed, 19 Jan 2022 19:39:13 +0000 (14:39 -0500)]
python: use avocado's "new" runner

The old legacy runner no longer seems to work with output logging, so we
can't see failure logs when a test case fails. The new runner doesn't
(seem to) support Coverage.py yet, but seeing error output is a more
important feature.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Beraldo Leal <bleal@redhat.com>
Message-id: 20220119193916.4138217-3-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
2 years agopython: pin setuptools below v60.0.0
John Snow [Fri, 21 Jan 2022 00:52:21 +0000 (19:52 -0500)]
python: pin setuptools below v60.0.0

setuptools is a package that replaces the python stdlib 'distutils'. It
is generally installed by all venv-creating tools "by default". It isn't
actually needed at runtime for the qemu package, so our own setup.cfg
does not mention it as a dependency.

However, tox will create virtual environments that include it, and will
upgrade it to the very latest version. the 'venv' tool will also include
whichever version your host system happens to have.

Unfortunately, setuptools version 60.0.0 and above include a hack to
forcibly overwrite python's built-in distutils. The pylint tool that we
use to run code analysis checks on this package relies on distutils and
suffers regressions when setuptools >= 60.0.0 is present at all, see
https://github.com/PyCQA/pylint/issues/5704

Instruct tox and the 'check-dev' targets to avoid setuptools packages
that are too new, for now. Pipenv is unaffected, because setuptools 60
does not offer Python 3.6 support, and our pipenv config is pinned
against Python 3.6.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Beraldo Leal <bleal@redhat.com>
Reviewed-by: Cleber Rosa <crosa@redhat.com>
Tested-by: Cleber Rosa <crosa@redhat.com>
Message-id: 20220121005221.142236-1-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
2 years agoMerge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20220121...
Peter Maydell [Fri, 21 Jan 2022 10:31:25 +0000 (10:31 +0000)]
Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20220121-1' into staging

Third RISC-V PR for QEMU 7.0

 * Fixes for OpenTitan timer
 * Correction of OpenTitan PLIC stride length
 * RISC-V KVM support
 * Device tree code cleanup
 * Support for the Zve64f and Zve32f extensions
 * OpenSBI binary loading support for the Spike machine
 * Removal of OpenSBI ELFs
 * Support for the UXL field in xstatus

# gpg: Signature made Fri 21 Jan 2022 05:57:09 GMT
# gpg:                using RSA key F6C4AC46D4934868D3B8CE8F21E10D29DF977054
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [full]
# Primary key fingerprint: F6C4 AC46 D493 4868 D3B8  CE8F 21E1 0D29 DF97 7054

* remotes/alistair/tags/pull-riscv-to-apply-20220121-1: (61 commits)
  target/riscv: Relax UXL field for debugging
  target/riscv: Enable uxl field write
  target/riscv: Set default XLEN for hypervisor
  target/riscv: Adjust scalar reg in vector with XLEN
  target/riscv: Adjust vector address with mask
  target/riscv: Fix check range for first fault only
  target/riscv: Remove VILL field in VTYPE
  target/riscv: Adjust vsetvl according to XLEN
  target/riscv: Split out the vill from vtype
  target/riscv: Split pm_enabled into mask and base
  target/riscv: Calculate address according to XLEN
  target/riscv: Alloc tcg global for cur_pm[mask|base]
  target/riscv: Create current pm fields in env
  target/riscv: Adjust csr write mask with XLEN
  target/riscv: Relax debug check for pm write
  target/riscv: Use gdb xml according to max mxlen
  target/riscv: Extend pc for runtime pc write
  target/riscv: Ignore the pc bits above XLEN
  target/riscv: Create xl field in env
  target/riscv: Sign extend pc for different XLEN
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2 years agotarget/riscv: Relax UXL field for debugging
LIU Zhiwei [Thu, 20 Jan 2022 12:20:50 +0000 (20:20 +0800)]
target/riscv: Relax UXL field for debugging

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-24-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Enable uxl field write
LIU Zhiwei [Thu, 20 Jan 2022 12:20:49 +0000 (20:20 +0800)]
target/riscv: Enable uxl field write

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-23-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Set default XLEN for hypervisor
LIU Zhiwei [Thu, 20 Jan 2022 12:20:48 +0000 (20:20 +0800)]
target/riscv: Set default XLEN for hypervisor

When swap regs for hypervisor, the value of vsstatus or mstatus_hs
should have the right XLEN. Otherwise, it will propagate to mstatus.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-22-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Adjust scalar reg in vector with XLEN
LIU Zhiwei [Thu, 20 Jan 2022 12:20:47 +0000 (20:20 +0800)]
target/riscv: Adjust scalar reg in vector with XLEN

When sew <= 32bits, not need to extend scalar reg.
When sew > 32bits, if xlen is less that sew, we should sign extend
the scalar register, except explicitly specified by the spec.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-21-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Adjust vector address with mask
LIU Zhiwei [Thu, 20 Jan 2022 12:20:46 +0000 (20:20 +0800)]
target/riscv: Adjust vector address with mask

The mask comes from the pointer masking extension, or the max value
corresponding to XLEN bits.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220120122050.41546-20-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Fix check range for first fault only
LIU Zhiwei [Thu, 20 Jan 2022 12:20:45 +0000 (20:20 +0800)]
target/riscv: Fix check range for first fault only

Only check the range that has passed the address translation.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-19-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Remove VILL field in VTYPE
LIU Zhiwei [Thu, 20 Jan 2022 12:20:44 +0000 (20:20 +0800)]
target/riscv: Remove VILL field in VTYPE

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-18-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Adjust vsetvl according to XLEN
LIU Zhiwei [Thu, 20 Jan 2022 12:20:43 +0000 (20:20 +0800)]
target/riscv: Adjust vsetvl according to XLEN

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-17-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Split out the vill from vtype
LIU Zhiwei [Thu, 20 Jan 2022 12:20:42 +0000 (20:20 +0800)]
target/riscv: Split out the vill from vtype

We need not specially process vtype when XLEN changes.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-16-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Split pm_enabled into mask and base
LIU Zhiwei [Thu, 20 Jan 2022 12:20:41 +0000 (20:20 +0800)]
target/riscv: Split pm_enabled into mask and base

Use cached cur_pmmask and cur_pmbase to infer the
current PM mode.

This may decrease the TCG IR by one when pm_enabled
is true and pm_base_enabled is false.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-15-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Calculate address according to XLEN
LIU Zhiwei [Thu, 20 Jan 2022 12:20:40 +0000 (20:20 +0800)]
target/riscv: Calculate address according to XLEN

Define one common function to compute a canonical address from a register
plus offset. Merge gen_pm_adjust_address into this function.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-14-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Alloc tcg global for cur_pm[mask|base]
LIU Zhiwei [Thu, 20 Jan 2022 12:20:39 +0000 (20:20 +0800)]
target/riscv: Alloc tcg global for cur_pm[mask|base]

Replace the array of pm_mask/pm_base with scalar variables.
Remove the cached array value in DisasContext.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-13-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Create current pm fields in env
LIU Zhiwei [Thu, 20 Jan 2022 12:20:38 +0000 (20:20 +0800)]
target/riscv: Create current pm fields in env

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220120122050.41546-12-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Adjust csr write mask with XLEN
LIU Zhiwei [Thu, 20 Jan 2022 12:20:37 +0000 (20:20 +0800)]
target/riscv: Adjust csr write mask with XLEN

Write mask is representing the bits we care about.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-11-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Relax debug check for pm write
LIU Zhiwei [Thu, 20 Jan 2022 12:20:36 +0000 (20:20 +0800)]
target/riscv: Relax debug check for pm write

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-10-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Use gdb xml according to max mxlen
LIU Zhiwei [Thu, 20 Jan 2022 12:20:35 +0000 (20:20 +0800)]
target/riscv: Use gdb xml according to max mxlen

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-9-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Extend pc for runtime pc write
LIU Zhiwei [Thu, 20 Jan 2022 12:20:34 +0000 (20:20 +0800)]
target/riscv: Extend pc for runtime pc write

In some cases, we must restore the guest PC to the address of the start of
the TB, such as when the instruction counter hits zero. So extend pc register
according to current xlen for these cases.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-8-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Ignore the pc bits above XLEN
LIU Zhiwei [Thu, 20 Jan 2022 12:20:33 +0000 (20:20 +0800)]
target/riscv: Ignore the pc bits above XLEN

The read from PC for translation is in cpu_get_tb_cpu_state, before translation.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-7-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Create xl field in env
LIU Zhiwei [Thu, 20 Jan 2022 12:20:32 +0000 (20:20 +0800)]
target/riscv: Create xl field in env

Current xlen has been used in helper functions and many other places.
The computation of current xlen is not so trivial, so that we should
recompute it as little as possible.

Fortunately, xlen only changes in very seldom cases, such as exception,
misa write, mstatus write, cpu reset, migration load. So that we can only
recompute xlen in this places and cache it into CPURISCVState.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-6-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Sign extend pc for different XLEN
LIU Zhiwei [Thu, 20 Jan 2022 12:20:31 +0000 (20:20 +0800)]
target/riscv: Sign extend pc for different XLEN

When pc is written, it is sign-extended to fill the widest supported XLEN.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-5-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Sign extend link reg for jal and jalr
LIU Zhiwei [Thu, 20 Jan 2022 12:20:30 +0000 (20:20 +0800)]
target/riscv: Sign extend link reg for jal and jalr

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-4-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Don't save pc when exception return
LIU Zhiwei [Thu, 20 Jan 2022 12:20:29 +0000 (20:20 +0800)]
target/riscv: Don't save pc when exception return

As pc will be written by the xepc in exception return, just ignore
pc in translation.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-3-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: Adjust pmpcfg access with mxl
LIU Zhiwei [Thu, 20 Jan 2022 12:20:28 +0000 (20:20 +0800)]
target/riscv: Adjust pmpcfg access with mxl

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-2-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agoroms/opensbi: Remove ELF images
Anup Patel [Tue, 18 Jan 2022 08:30:35 +0000 (14:00 +0530)]
roms/opensbi: Remove ELF images

Now that all RISC-V machines can use OpenSBI BIN images, we remove
OpenSBI ELF images and also exclude these images from BIOS build.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agohw/riscv: Remove macros for ELF BIOS image names
Anup Patel [Tue, 18 Jan 2022 08:08:56 +0000 (13:38 +0530)]
hw/riscv: Remove macros for ELF BIOS image names

Now that RISC-V Spike machine can use BIN BIOS images, we remove
the macros used for ELF BIOS image names.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agohw/riscv: spike: Allow using binary firmware as bios
Anup Patel [Thu, 13 Jan 2022 14:50:39 +0000 (20:20 +0530)]
hw/riscv: spike: Allow using binary firmware as bios

Currently, we have to use OpenSBI firmware ELF as bios for the spike
machine because the HTIF console requires ELF for parsing "fromhost"
and "tohost" symbols.

The latest OpenSBI can now optionally pick-up HTIF register address
from HTIF DT node so using this feature spike machine can now use
OpenSBI firmware BIN as bios.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Allow Zve32f extension to be turned on
Frank Chang [Tue, 18 Jan 2022 01:45:20 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Allow Zve32f extension to be turned on

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-18-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve32f support for narrowing type-convert insns
Frank Chang [Tue, 18 Jan 2022 01:45:19 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve32f support for narrowing type-convert insns

Vector narrowing conversion instructions are provided to and from all
supported integer EEWs for Zve32f extension.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-17-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve32f support for widening type-convert insns
Frank Chang [Tue, 18 Jan 2022 01:45:18 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve32f support for widening type-convert insns

Vector widening conversion instructions are provided to and from all
supported integer EEWs for Zve32f extension.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-16-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve32f support for single-width fp reduction insns
Frank Chang [Tue, 18 Jan 2022 01:45:17 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve32f support for single-width fp reduction insns

Vector single-width floating-point reduction operations for EEW=32 are
supported for Zve32f extension.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-15-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve32f support for scalar fp insns
Frank Chang [Tue, 18 Jan 2022 01:45:16 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve32f support for scalar fp insns

Zve32f extension requires the scalar processor to implement the F
extension and implement all vector floating-point instructions for
floating-point operands with EEW=32 (i.e., no widening floating-point
operations).

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-14-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve32f support for configuration insns
Frank Chang [Tue, 18 Jan 2022 01:45:15 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve32f support for configuration insns

All Zve* extensions support the vector configuration instructions.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-13-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve32f extension into RISC-V
Frank Chang [Tue, 18 Jan 2022 01:45:14 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve32f extension into RISC-V

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-12-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Allow Zve64f extension to be turned on
Frank Chang [Tue, 18 Jan 2022 01:45:13 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Allow Zve64f extension to be turned on

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-11-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve64f support for narrowing type-convert insns
Frank Chang [Tue, 18 Jan 2022 01:45:12 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve64f support for narrowing type-convert insns

Vector narrowing conversion instructions are provided to and from all
supported integer EEWs for Zve64f extension.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-10-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve64f support for widening type-convert insns
Frank Chang [Tue, 18 Jan 2022 01:45:11 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve64f support for widening type-convert insns

Vector widening conversion instructions are provided to and from all
supported integer EEWs for Zve64f extension.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-9-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve64f support for single-width fp reduction insns
Frank Chang [Tue, 18 Jan 2022 01:45:10 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve64f support for single-width fp reduction insns

Vector single-width floating-point reduction operations for EEW=32 are
supported for Zve64f extension.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-8-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve64f support for scalar fp insns
Frank Chang [Tue, 18 Jan 2022 01:45:09 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve64f support for scalar fp insns

Zve64f extension requires the scalar processor to implement the F
extension and implement all vector floating-point instructions for
floating-point operands with EEW=32 (i.e., no widening floating-point
operations).

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-7-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve64f support for vsmul.vv and vsmul.vx insns
Frank Chang [Tue, 18 Jan 2022 01:45:08 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve64f support for vsmul.vv and vsmul.vx insns

All Zve* extensions support all vector fixed-point arithmetic
instructions, except that vsmul.vv and vsmul.vx are not supported
for EEW=64 in Zve64*.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-6-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve64f support for vmulh variant insns
Frank Chang [Tue, 18 Jan 2022 01:45:07 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve64f support for vmulh variant insns

All Zve* extensions support all vector integer instructions,
except that the vmulh integer multiply variants that return the
high word of the product (vmulh.vv, vmulh.vx, vmulhu.vv, vmulhu.vx,
vmulhsu.vv, vmulhsu.vx) are not included for EEW=64 in Zve64*.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-5-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve64f support for load and store insns
Frank Chang [Tue, 18 Jan 2022 01:45:06 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve64f support for load and store insns

All Zve* extensions support all vector load and store instructions,
except Zve64* extensions do not support EEW=64 for index values when
XLEN=32.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-4-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve64f support for configuration insns
Frank Chang [Tue, 18 Jan 2022 01:45:05 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve64f support for configuration insns

All Zve* extensions support the vector configuration instructions.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-3-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agotarget/riscv: rvv-1.0: Add Zve64f extension into RISC-V
Frank Chang [Tue, 18 Jan 2022 01:45:04 +0000 (09:45 +0800)]
target/riscv: rvv-1.0: Add Zve64f extension into RISC-V

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-2-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agosoftmmu/device_tree: Remove redundant pointer assignment
Yanan Wang [Tue, 11 Jan 2022 03:27:58 +0000 (11:27 +0800)]
softmmu/device_tree: Remove redundant pointer assignment

The pointer assignment "const char *p = path;" in function
qemu_fdt_add_path is unnecessary. Let's remove it and just
use the "path" passed in. No functional change.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Yanan Wang <wangyanan55@huawei.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20220111032758.27804-1-wangyanan55@huawei.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2 years agosoftmmu/device_tree: Silence compiler warning with --enable-sanitizers
Thomas Huth [Fri, 7 Jan 2022 13:38:44 +0000 (14:38 +0100)]
softmmu/device_tree: Silence compiler warning with --enable-sanitizers

If I configure my build with --enable-sanitizers, my GCC (v8.5.0)
complains:

.../softmmu/device_tree.c: In function ‘qemu_fdt_add_path’:
.../softmmu/device_tree.c:560:18: error: ‘retval’ may be used uninitialized
 in this function [-Werror=maybe-uninitialized]
     int namelen, retval;
                  ^~~~~~

It's a false warning since the while loop is always executed at least
once (p has to be non-NULL, otherwise the derefence in the if-statement
earlier will crash). Thus let's switch to a do-while loop here instead
to make the compiler happy in all cases.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Yanan Wang <wangyanan55@huawei.com>
Message-id: 20220107133844.145039-1-thuth@redhat.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>