Paolo Bonzini [Wed, 20 Apr 2022 15:33:45 +0000 (17:33 +0200)]
meson: remove CONFIG_XEN_PCI_PASSTHROUGH from config-target.h
CONFIG_XEN_PCI_PASSTHROUGH is just a global configuration option;
it is never used in the source files, so there is no need to put
CONFIG_XEN_PCI_PASSTHROUGH in config-target.h or even in config-host.h.
This inaccuracy was copied over from the configure script in commit 8a19980e3f ("configure: move accelerator logic to meson", 2020-10-03).
Paolo Bonzini [Wed, 20 Apr 2022 15:33:38 +0000 (17:33 +0200)]
configure: gcov should not exclude fortify-source
There is no reason other than history (dating back to commit 1d728c3946, "tests: add gcov
support", 2013-01-06) for this, remove this unnecessary conditional.
Paolo Bonzini [Wed, 20 Apr 2022 15:33:37 +0000 (17:33 +0200)]
configure: pc-bios/qemu-icon.bmp does not exist
The file has been removed in commit a8260d3876 ("ui: install logo icons to
$prefix/share/icons", 2019-01-21), do not try to symlink it in the build tree.
Paolo Bonzini [Wed, 20 Apr 2022 15:33:34 +0000 (17:33 +0200)]
meson: show final set of compiler flags
The actual set of compiler flags can grow beyond what is found by the configure
script, for example if gprof is used. Show the full set in the summary.
Paul Brook [Sun, 24 Apr 2022 22:01:23 +0000 (00:01 +0200)]
i386: pcmpestr 64-bit sign extension bug
The abs1 function in ops_sse.h only works sorrectly when the result fits
in a signed int. This is fine most of the time because we're only dealing
with byte sized values.
However pcmp_elen helper function uses abs1 to calculate the absolute value
of a cpu register. This incorrectly truncates to 32 bits, and will give
the wrong anser for the most negative value.
Fix by open coding the saturation check before taking the absolute value.
Paolo Bonzini [Thu, 14 Apr 2022 14:57:21 +0000 (10:57 -0400)]
remove -writeconfig
Like -set and -readconfig, it would not really be too hard to
extend -writeconfig to parsing mechanisms other than QemuOpts.
However, the uses of -writeconfig are substantially more
limited, as it is generally easier to write the configuration
by hand in the first place. In addition, -writeconfig does
not even try to detect cases where it prints incorrect
syntax (for example if values have a quote in them, since
qemu_config_parse does not support any kind of escaping.
Just remove it.
Michael Tokarev [Fri, 22 Apr 2022 10:08:25 +0000 (13:08 +0300)]
configure: make fortify_source=yes by default
Commit c87ea1163111917 "configure: add --without-default-feature"
changed fortify_source from "yes" to "$default_feature". But there's
no option to turn it on, we only turn it off for debug build. I think
this should always be initialized to "yes" in the first place.
Haiyue Wang [Sun, 24 Apr 2022 10:50:35 +0000 (18:50 +0800)]
error-report: fix g_date_time_format assertion
The 'g_get_real_time' returns the number of microseconds since January
1, 1970 UTC, but 'g_date_time_new_from_unix_utc' needs the number of
seconds, so it will cause the invalid time input:
Merge tag 'kraxel-20220427-pull-request' of git://git.kraxel.org/qemu into staging
vnc: add display-update monitor command.
screendump: add png support.
vmsvga: screen update fix.
i386: sev setup for -bios loaded firmware
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmJpfYUACgkQTLbY7tPo
# cTg6ChAAn5EWtNwmVbfbVzRTu0kqdx7QXyK6FFgTgXrsrmBCWzJhHDraYa9cMOZU
# wBlU/Rutuv9ETvtRTRic3t0qcdRmvZjpHuA/3agBMJY7xpEQbQ8NwVdSRZTOZo0i
# hXzWEAnxviEv8F/W1TXwB5d2Q9sWlJ2yO8SvcxTfAEK7hOSFrWypp3XRKr5WBHjO
# DFTtwqTk9MRNsgsfnpEHNGDb30JPTqKZKRbDal15NDR9fQz+iCq3FIv/FpBaUfys
# v9GA2zNT324MvhR64xNblaujCn2XFOsFvDY4nGDrfbKGJch8ltAg5t4G1CCZqOn7
# NIiwodC0508sAv9xUm+qvh+oHyf11EFdcAMWYimrExY2I51XOEDnJip/SAdogo5u
# h7LyLkZTEG5tyc+a4PGIcC216ecDDNytMnJM9nh9YK3p5UiBOgcHV2wWDdzJbsdS
# GRoP0fzF/MBQd985HBCF2vtQVk4AbQA7atZ8FKp1ZsHr3sFfs+vd0xyItsDMinBP
# k/eKOOKbHRgXcdIocw4PK16yURrMo5IUGCGGiG9waqYz+VDyHhtikBAzQvYYdnqN
# NaZttCcEieIk4XNd+wCfI0GQLtOY/AP1k8TV0rCaDTnO6nOxJ/uP64IaCzxzCT10
# b8VRdCfYDGjd2C14XYKmTzBRPM4hVrf9bo7FtXVtmSksTG+eIao=
# =yaxh
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 27 Apr 2022 10:29:41 AM PDT
# gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <[email protected]>" [undefined]
# gpg: aka "Gerd Hoffmann <[email protected]>" [undefined]
# gpg: aka "Gerd Hoffmann (private) <[email protected]>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138
* tag 'kraxel-20220427-pull-request' of git://git.kraxel.org/qemu:
i386: firmware parsing and sev setup for -bios loaded firmware
i386: factor out x86_firmware_configure()
i386: move bios load error message
avocado/vnc: add test_change_listen
qapi/ui: add 'display-update' command for changing listen address
ui/vnc: refactor arrays of addresses to SocketAddressList
Added parameter to take screenshot with screendump as PNG
Replacing CONFIG_VNC_PNG with CONFIG_PNG
hw/display/vmware_vga: do not discard screen updates
qapi/ui: add 'display-update' command for changing listen address
Add possibility to change addresses where VNC server listens for new
connections. Prior to 6.0 this functionality was available through
'change' qmp command which was deleted.
ui/vnc: refactor arrays of addresses to SocketAddressList
Let's use SocketAddressList instead of dynamic arrays.
Benefits:
- Automatic cleanup: don't need specific freeing function and drop
some gotos.
- Less indirection: no triple asterix anymore!
- Prepare for the following commit, which will reuse new interface of
vnc_display_listen().
Kshitij Suri [Fri, 8 Apr 2022 07:13:35 +0000 (07:13 +0000)]
Added parameter to take screenshot with screendump as PNG
Currently screendump only supports PPM format, which is un-compressed. Added
a "format" parameter to QMP and HMP screendump command to support PNG image
capture using libpng.
Kshitij Suri [Fri, 8 Apr 2022 07:13:34 +0000 (07:13 +0000)]
Replacing CONFIG_VNC_PNG with CONFIG_PNG
Libpng is only detected if VNC is enabled currently. This patch adds a
generalised png option in the meson build which is aimed to replace use of
CONFIG_VNC_PNG with CONFIG_PNG.
* tag 'pull-tcg-20220426' of https://gitlab.com/rth7680/qemu:
softfloat: Use FloatRelation for fracN_cmp
softfloat: Use FloatRelation within partsN_compare
softfloat: Fix declaration of partsN_compare
target/i386: Suppress coverity warning on fsave/frstor
target/s390x: Fix the accumulation of ccm in op_icm
accel/tcg: Assert mmu_idx in range before use in cputlb
target/i386: Suppress coverity warning on fsave/frstor
Coverity warns that 14 << data32 may overflow with respect
to the target_ulong to which it is subsequently added.
We know this wasn't true because data32 is in [1,2],
but the suggested fix is perfectly fine.
accel/tcg: Assert mmu_idx in range before use in cputlb
Coverity reports out-of-bound accesses within cputlb.c.
This should be a false positive due to how the index is
decoded from MemOpIdx. To be fair, nothing is checking
the correct bounds during encoding either.
Assert index in range before use, both to catch user errors
and to pacify static analysis.
* tag 'pull-nbd-2022-04-26' of https://repo.or.cz/qemu/ericb:
nbd: document what is protected by the CoMutexes
nbd: take receive_mutex when reading requests[].receiving
nbd: move s->state under requests_lock
nbd: code motion and function renaming
nbd: use a QemuMutex to synchronize yanking, reconnection and coroutines
nbd: keep send_mutex/free_sema handling outside nbd_co_do_establish_connection
nbd: remove peppering of nbd_client_connected
nbd: mark more coroutine_fns
nbd: safeguard against waking up invalid coroutine
iotests/223: check new possibility of exporting bitmaps by node/name
qapi: nbd-export: allow select bitmaps by node/name pair
qapi: rename BlockDirtyBitmapMergeSource to BlockDirtyBitmapOrStr
Merge tag 'pull-nios2-20220426' of https://gitlab.com/rth7680/qemu into staging
Fix nios2-linux-user syscalls.
Fix nios2-linux-user sigreturn.
Enable tests for nios2-linux-user.
Remove special handling of SIGSEGV.
Check supervisor for eret, bret.
Split special registers out of env->regs[].
Clean up interrupt processing.
Raise unaligned data and destination exceptions.
Set TLBMISC fields correctly on exceptions.
Prevent writes to read-only or reserved control fields.
Use tcg_constant_tl().
Implement shadow register sets.
Implement external interrupt controller interface.
Implement vectored interrupt controller.
Enable semihosting tests for nios2-softmmu.
Paolo Bonzini [Thu, 14 Apr 2022 17:57:55 +0000 (19:57 +0200)]
nbd: take receive_mutex when reading requests[].receiving
requests[].receiving is set by nbd_receive_replies() under the receive_mutex;
Read it under the same mutex as well. Waking up receivers on errors happens
after each reply finishes processing, in nbd_co_receive_one_chunk().
If there is no currently-active reply, there are two cases:
* either there is no active request at all, in which case no
element of request[] can have .receiving = true
* or nbd_receive_replies() must be running and owns receive_mutex;
in that case it will get back to nbd_co_receive_one_chunk() because
the socket has been shutdown, and all waiting coroutines will wake up
in turn.
Paolo Bonzini [Thu, 14 Apr 2022 17:57:54 +0000 (19:57 +0200)]
nbd: move s->state under requests_lock
Remove the confusing, and most likely wrong, atomics. The only function
that used to be somewhat in a hot path was nbd_client_connected(),
but it is not anymore after the previous patches.
The same logic is used both to check if a request had to be reissued
and also in nbd_reconnecting_attempt(). The former cases are outside
requests_lock, while nbd_reconnecting_attempt() does have the lock,
therefore the two have been separated in the previous commit.
nbd_client_will_reconnect() can simply take s->requests_lock, while
nbd_reconnecting_attempt() can inline the access now that no
complicated atomics are involved.
Paolo Bonzini [Thu, 14 Apr 2022 17:57:53 +0000 (19:57 +0200)]
nbd: code motion and function renaming
Prepare for the next patch, so that the diff is less confusing.
nbd_client_connecting is moved closer to the definition point.
nbd_client_connecting_wait() is kept only for the reconnection
logic; when it is used to check if a request has to be reissued,
use the renamed function nbd_client_will_reconnect(). In the
next patch, the two cases will have different locking requirements.
Paolo Bonzini [Thu, 14 Apr 2022 17:57:52 +0000 (19:57 +0200)]
nbd: use a QemuMutex to synchronize yanking, reconnection and coroutines
The condition for waiting on the s->free_sema queue depends on
both s->in_flight and s->state. The latter is currently using
atomics, but this is quite dubious and probably wrong.
Because s->state is written in the main thread too, for example by
the yank callback, it cannot be protected by a CoMutex. Introduce a
separate lock that can be used by nbd_co_send_request(); later on this
lock will also be used for s->state. There will not be any contention
on the lock unless there is a yank or reconnect, so this is not
performance sensitive.
Elevate s->in_flight early so that other incoming requests will wait
on the CoQueue in nbd_co_send_request; restart them after getting back
from nbd_reconnect_attempt. This could be after the reconnect timer or
nbd_cancel_in_flight have cancelled the attempt, so there is no
need anymore to cancel the requests there.
nbd_co_send_request now handles both stopping and restarting pending
requests after a successful connection, and there is no need to
hold send_mutex in nbd_co_do_establish_connection. The current setup
is confusing because nbd_co_do_establish_connection is called both with
send_mutex taken and without it. Before the patch it uses free_sema which
(at least in theory...) is protected by send_mutex, after the patch it
does not anymore.
Paolo Bonzini [Thu, 14 Apr 2022 17:57:50 +0000 (19:57 +0200)]
nbd: remove peppering of nbd_client_connected
It is unnecessary to check nbd_client_connected() because every time
s->state is moved out of NBD_CLIENT_CONNECTED the socket is shut down
and all coroutines are resumed.
The only case where it was actually needed is when the NBD
server disconnects and there is no reconnect-delay. In that
case, nbd_receive_replies() does not set s->reply.handle and
nbd_co_do_receive_one_chunk() cannot continue. For that one case,
check the return value of nbd_receive_replies().
As to the others:
* nbd_receive_replies() can put the current coroutine to sleep if another
reply is ongoing; then it will be woken by nbd_channel_error(), called
by the ongoing reply. Or it can try itself to read a reply header and
fail, thus calling nbd_channel_error() itself.
* nbd_co_send_request() will write the body of the request and fail
* nbd_reply_chunk_iter_receive() will call nbd_co_receive_one_chunk()
and then nbd_co_do_receive_one_chunk(), which will handle the failure as
above; or it will just detect a previous call to nbd_iter_channel_error()
via iter->ret < 0.
Paolo Bonzini [Thu, 14 Apr 2022 17:57:49 +0000 (19:57 +0200)]
nbd: mark more coroutine_fns
Several coroutine functions in block/nbd.c are not marked as such. This
patch adds a few more markers; it is not exhaustive, but it focuses
especially on:
- places that wake other coroutines, because aio_co_wake() has very
different semantics inside a coroutine (queuing after yield vs. entering
immediately);
- functions with _co_ in their names, to avoid confusion
Paolo Bonzini [Thu, 14 Apr 2022 17:57:48 +0000 (19:57 +0200)]
nbd: safeguard against waking up invalid coroutine
The .reply_possible field of s->requests is never set to false. This is
not a problem as it is only a safeguard to detect protocol errors,
but it's sloppy. In fact, the field is actually not necessary at all,
because .coroutine is set to NULL in NBD_FOREACH_REPLY_CHUNK after
receiving the last chunk. Thus, replace .reply_possible with .coroutine
and move the check before deciding the fate of this request.
qapi: nbd-export: allow select bitmaps by node/name pair
Hi all! Current logic of relying on search through backing chain is not
safe neither convenient.
Sometimes it leads to necessity of extra bitmap copying. Also, we are
going to add "snapshot-access" driver, to access some snapshot state
through NBD. And this driver is not formally a filter, and of course
it's not a COW format driver. So, searching through backing chain will
not work. Instead of widening the workaround of bitmap searching, let's
extend the interface so that user can select bitmap precisely.
Note, that checking for bitmap active status is not copied to the new
API, I don't see a reason for it, user should understand the risks. And
anyway, bitmap from other node is unrelated to this export being
read-only or read-write.
Add a regression test for tcg indirect global lowering.
This appeared with nios2, with cps != 0, so that we use
indirection into the shadow register set. An indirect
call verifies alignment of rA. The use of rA was live
across the brcond leading to a tcg_debug_assert failure.
Amir Gonnen [Thu, 21 Apr 2022 15:17:33 +0000 (08:17 -0700)]
hw/nios2: Machine with a Vectored Interrupt Controller
Demonstrate how to use nios2 VIC on a machine.
Introduce a new machine property to attach a VIC.
When VIC is present, let the CPU know that it should use the
External Interrupt Interface instead of the Internal Interrupt Interface.
The devices on the machine are attached to the VIC and not directly to cpu.
To allow VIC update EIC fields, we set the "cpu" property of the VIC
with a reference to the nios2 cpu.
[rth: Put a property on the 10m50-ghrd machine, rather than
create a new machine class.]
Amir Gonnen [Thu, 21 Apr 2022 15:17:30 +0000 (08:17 -0700)]
hw/intc: Vectored Interrupt Controller (VIC)
Implement nios2 Vectored Interrupt Controller (VIC).
VIC is connected to EIC. It needs to update rha, ril, rrs and rnmi
fields on Nios2CPU before raising an IRQ.
For that purpose, VIC has a "cpu" property which should refer to the
nios2 cpu and set by the board that connects VIC.
The exception return address for nios2 is the instruction
after the one that was executing at the time of the exception.
We have so far implemented this by advancing the pc during the
process of raising the exception. It is perhaps a little less
confusing to do this advance in the translator (and helpers)
when raising the exception in the first place, so that we may
more closely match kernel sources.
Implement these out of line, so that tcg global temps
(aka the architectural registers) are synced back to
tcg storage as required. This makes sure that we get
the proper results when status.PRS == status.CRS.
Do not actually enable them so far, in terms of being able
to change the current register set, but add all of the
plumbing to address them. Do not enable them for user-only.
Add an env->regs pointer that handles the indirection to
the current register set. The naming of the pointer hides
the difference between old and new, user-only and sysemu.
From the notes on wrprs, which states that r0 must be initialized
before use in shadow register sets, infer that R_ZERO is *not*
hardwired to zero in shadow register sets, but that it is still
read-only. Introduce tbflags bit R0_0 to track that it has been
properly set to zero. Adjust load_gpr to reflect this.
At the same time we might as well special case crs == 0 to avoid
the indirection through env->regs during translation as well; this
is intended to be the most common case for non-interrupt handlers.
Indirect branches, plus eret and bret optionally raise
an exception when branching to a misaligned address.
The exception is required when an mmu is enabled, but
enable it always because the fallback behaviour is not
documented (though presumably it discards low bits).
For the purposes of the linux-user cpu loop, if EXCP_UNALIGN
(misaligned data) were to arrive, it would be treated the
same as EXCP_UNALIGND (misaligned destination). See the
!defined(CONFIG_NIOS2_ALIGNMENT_TRAP) block in kernel/traps.c.
target/nios2: Split out helpers for gen_rr_mul_high
Rename the macro from gen_r_mul, because these are the multiply
variants that produce a high-part result. Do as little work as
possible within the macro; split out helper functions and pass
in arguments instead.
target/nios2: Split out helpers for gen_r_math_logic
Split the macro in two, one for reg/imm and one for reg/reg.
Do as little work as possible within the macros; split out
helper functions and pass in arguments instead.
target/nios2: Prevent writes to read-only or reserved control fields
Create an array of masks which detail the writable and readonly
bits for each control register. Apply them when writing to
control registers, including the write to status during eret.
target/nios2: Clean up handling of tlbmisc in do_exception
The 4 lower bits, D, PERM, BAD, DBL, are unconditionally set on any
exception with EH=0, or so says Table 42 (Processor Status After
Taking Exception).
We currently do not set PERM or BAD at all, and only set/clear
DBL for tlb miss, and do not clear DBL for any other exception.
It is a bit confusing to set D in tlb_fill and the rest during
do_interrupt, so move the setting of D to do_interrupt as well.
To do this, split EXP_TLBD into two cases, EXCP_TLB_X and EXCP_TLB_D,
which allows us to distinguish them during do_interrupt. Choose
a value for EXCP_TLB_D such that when truncated it produces the
correct value for exception.CAUSE.
Rename EXCP_TLB[RWX] to EXCP_PERM_[RWX], to emphasize that the
exception is permissions related. Rename EXCP_SUPER[AD] to
EXCP_SUPERA_[DX] to emphasize that they are both "supervisor
address" exceptions, data and execute.
Retain the setting of tlbmisc.WE for the fast-tlb-miss path, as it
is being relied upon, but remove it from the permission path.
target/nios2: Cleanup set of CR_EXCEPTION for do_interrupt
The register is entirely read-only for software, and we do not
implement ECC, so we need not deposit the cause into an existing
value; just create a new value from scratch.
Furthermore, exception.CAUSE is not written for break exceptions.
target/nios2: Handle EXCP_UNALIGN and EXCP_UNALIGND
While some of the plumbing for misaligned data is present, in the form
of nios2_cpu_do_unaligned_access, the hook will not be called because
TARGET_ALIGNED_ONLY is not set in configs/targets/nios2-softmmu.mak.
Split out do_exception and do_iic_irq to handle bulk of the interrupt and
exception processing. Parameterize the changes required to cpu state.
The status.EH bit, which protects some data against double-faults,
is only present with the MMU. Several exception cases did not check
for status.EH being set, as required.
The status.IH bit, which had been set by EXCP_IRQ, is exclusive to
the external interrupt controller, which we do not yet implement.
The internal interrupt controller, when the MMU is also present,
sets the status.EH bit.
target/nios2: Use hw/registerfields.h for CR_TLBACC fields
Retain the helper macros for single bit fields as aliases to
the longer R_*_MASK names. Use FIELD_EX32 and FIELD_DP32
instead of manually manipulating the fields.
Since we're rewriting the references to CR_TLBACC_IGN_* anyway,
we correct the name of this field to IG, which is its name in
the official CPU documentation.
linux-user/nios2: Only initialize SP and PC in target_cpu_copy_regs
Drop the set of estatus in init_thread; it was clearly intended
to be setting the value of CR_STATUS for the application, but we
never actually performed that copy. However, the proper value is
set in nios2_cpu_reset so we don't need to do anything here.
We only initialize SP and EA in init_thread, there's no value in
copying other uninitialized data into ENV.
We had failed to copy BSTATUS back to STATUS, and diagnose
supervisor-only. The spec is light on the specifics of the
implementation of bret, but it is an easy assumption that
the restore into STATUS should work the same as eret.
projects / qemu.git / log