| 1 | Arm queue; bugfixes only. | 1 | The following changes since commit aa9e7fa4689d1becb2faf67f65aafcbcf664f1ce: |
|---|---|---|---|
| 2 | 2 | ||
| 3 | thanks | 3 | Merge tag 'edk2-stable202302-20230320-pull-request' of https://gitlab.com/kraxel/qemu into staging (2023-03-20 13:43:35 +0000) |
| 4 | -- PMM | ||
| 5 | |||
| 6 | The following changes since commit 48aa8f0ac536db3550a35c295ff7de94e4c33739: | ||
| 7 | |||
| 8 | Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2020-11-16' into staging (2020-11-17 11:07:00 +0000) | ||
| 9 | 4 | ||
| 10 | are available in the Git repository at: | 5 | are available in the Git repository at: |
| 11 | 6 | ||
| 12 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201117 | 7 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230321 |
| 13 | 8 | ||
| 14 | for you to fetch changes up to ab135622cf478585bdfcb68b85e4a817d74a0c42: | 9 | for you to fetch changes up to 5787d17a42f7af4bd117e5d6bfa54b1fdf93c255: |
| 15 | 10 | ||
| 16 | tmp105: Correct handling of temperature limit checks (2020-11-17 12:56:33 +0000) | 11 | target/arm: Don't advertise aarch64-pauth.xml to gdb (2023-03-21 13:19:08 +0000) |
| 17 | 12 | ||
| 18 | ---------------------------------------------------------------- | 13 | ---------------------------------------------------------------- |
| 19 | target-arm queue: | 14 | target-arm queue: |
| 20 | * hw/arm/virt: ARM_VIRT must select ARM_GIC | 15 | * contrib/elf2dmp: Support Windows Server 2022 |
| 21 | * exynos: Fix bad printf format specifiers | 16 | * hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings |
| 22 | * hw/input/ps2.c: Remove remnants of printf debug | 17 | * target/arm: Add Neoverse-N1 IMPDEF registers |
| 23 | * target/openrisc: Remove dead code attempting to check "is timer disabled" | 18 | * hw/usb/imx: Fix out of bounds access in imx_usbphy_read() |
| 24 | * register: Remove unnecessary NULL check | 19 | * docs/system/arm/cpu-features.rst: Fix formatting |
| 25 | * util/cutils: Fix Coverity array overrun in freq_to_str() | 20 | * target/arm: Don't advertise aarch64-pauth.xml to gdb |
| 26 | * configure: Make "does libgio work" test pull in some actual functions | ||
| 27 | * tmp105: reset the T_low and T_High registers | ||
| 28 | * tmp105: Correct handling of temperature limit checks | ||
| 29 | 21 | ||
| 30 | ---------------------------------------------------------------- | 22 | ---------------------------------------------------------------- |
| 31 | Alex Chen (1): | 23 | Chen Baozi (1): |
| 32 | exynos: Fix bad printf format specifiers | 24 | target/arm: Add Neoverse-N1 registers |
| 33 | 25 | ||
| 34 | Alistair Francis (1): | 26 | Guenter Roeck (1): |
| 35 | register: Remove unnecessary NULL check | 27 | hw/usb/imx: Fix out of bounds access in imx_usbphy_read() |
| 36 | 28 | ||
| 37 | Andrew Jones (1): | 29 | Peter Maydell (3): |
| 38 | hw/arm/virt: ARM_VIRT must select ARM_GIC | 30 | hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings |
| 31 | docs/system/arm/cpu-features.rst: Fix formatting | ||
| 32 | target/arm: Don't advertise aarch64-pauth.xml to gdb | ||
| 39 | 33 | ||
| 40 | Peter Maydell (5): | 34 | Viktor Prutyanov (3): |
| 41 | hw/input/ps2.c: Remove remnants of printf debug | 35 | contrib/elf2dmp: fix code style |
| 42 | target/openrisc: Remove dead code attempting to check "is timer disabled" | 36 | contrib/elf2dmp: move PE dir search to pe_get_data_dir_entry |
| 43 | configure: Make "does libgio work" test pull in some actual functions | 37 | contrib/elf2dmp: add PE name check and Windows Server 2022 support |
| 44 | hw/misc/tmp105: reset the T_low and T_High registers | ||
| 45 | tmp105: Correct handling of temperature limit checks | ||
| 46 | 38 | ||
| 47 | Philippe Mathieu-Daudé (1): | 39 | docs/system/arm/cpu-features.rst | 68 ++++++++++------------- |
| 48 | util/cutils: Fix Coverity array overrun in freq_to_str() | 40 | contrib/elf2dmp/pe.h | 115 ++++++++++++++++++++++----------------- |
| 49 | 41 | contrib/elf2dmp/addrspace.c | 1 + | |
| 50 | configure | 11 +++++-- | 42 | contrib/elf2dmp/main.c | 108 ++++++++++++++++++++++++------------ |
| 51 | hw/misc/tmp105.h | 7 +++++ | 43 | hw/char/cadence_uart.c | 6 +- |
| 52 | hw/core/register.c | 4 --- | 44 | hw/usb/imx-usb-phy.c | 19 ++++++- |
| 53 | hw/input/ps2.c | 9 ------ | 45 | target/arm/cpu64.c | 69 +++++++++++++++++++++++ |
| 54 | hw/misc/tmp105.c | 73 ++++++++++++++++++++++++++++++++++++++------ | 46 | target/arm/gdbstub.c | 7 +++ |
| 55 | hw/timer/exynos4210_mct.c | 4 +-- | 47 | 8 files changed, 267 insertions(+), 126 deletions(-) |
| 56 | hw/timer/exynos4210_pwm.c | 8 ++--- | ||
| 57 | target/openrisc/sys_helper.c | 3 -- | ||
| 58 | util/cutils.c | 3 +- | ||
| 59 | hw/arm/Kconfig | 1 + | ||
| 60 | 10 files changed, 89 insertions(+), 34 deletions(-) | ||
| 61 | diff view generated by jsdifflib |
Deleted patch | |||
|---|---|---|---|
| 1 | From: Andrew Jones <drjones@redhat.com> | ||
| 2 | 1 | ||
| 3 | The removal of the selection of A15MPCORE from ARM_VIRT also | ||
| 4 | removed what A15MPCORE selects, ARM_GIC. We still need ARM_GIC. | ||
| 5 | |||
| 6 | Fixes: bec3c97e0cf9 ("hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals") | ||
| 7 | Reported-by: Miroslav Rezanina <mrezanin@redhat.com> | ||
| 8 | Signed-off-by: Andrew Jones <drjones@redhat.com> | ||
| 9 | Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com> | ||
| 10 | Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
| 11 | Message-id: 20201111143440.112763-1-drjones@redhat.com | ||
| 12 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
| 13 | --- | ||
| 14 | hw/arm/Kconfig | 1 + | ||
| 15 | 1 file changed, 1 insertion(+) | ||
| 16 | |||
| 17 | diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig | ||
| 18 | index XXXXXXX..XXXXXXX 100644 | ||
| 19 | --- a/hw/arm/Kconfig | ||
| 20 | +++ b/hw/arm/Kconfig | ||
| 21 | @@ -XXX,XX +XXX,XX @@ config ARM_VIRT | ||
| 22 | imply VFIO_PLATFORM | ||
| 23 | imply VFIO_XGMAC | ||
| 24 | imply TPM_TIS_SYSBUS | ||
| 25 | + select ARM_GIC | ||
| 26 | select ACPI | ||
| 27 | select ARM_SMMUV3 | ||
| 28 | select GPIO_KEY | ||
| 29 | -- | ||
| 30 | 2.20.1 | ||
| 31 | |||
| 32 | diff view generated by jsdifflib |
| 1 | The TMP105 datasheet (https://www.ti.com/lit/gpn/tmp105) says that the | 1 | From: Chen Baozi <chenbaozi@phytium.com.cn> |
|---|---|---|---|
| 2 | power-up reset values for the T_low and T_high registers are 80 degrees C | ||
| 3 | and 75 degrees C, which are 0x500 and 0x4B0 hex according to table 5. These | ||
| 4 | values are then shifted right by four bits to give the register reset | ||
| 5 | values, since both registers store the 12 bits of temperature data in bits | ||
| 6 | [15..4] of a 16 bit register. | ||
| 7 | 2 | ||
| 8 | We were resetting these registers to zero, which is problematic for Linux | 3 | Add implementation defined registers for neoverse-n1 which |
| 9 | guests which enable the alert interrupt and then immediately take an | 4 | would be accessed by TF-A. Since there is no DSU in Qemu, |
| 10 | unexpected overtemperature alert because the current temperature is above | 5 | CPUCFR_EL1.SCU bit is set to 1 to avoid DSU registers definition. |
| 11 | freezing... | ||
| 12 | 6 | ||
| 7 | Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn> | ||
| 8 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | ||
| 9 | Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> | ||
| 10 | Message-id: 20230313033936.585669-1-chenbaozi@phytium.com.cn | ||
| 13 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 11 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
| 14 | Reviewed-by: Cédric Le Goater <clg@kaod.org> | ||
| 15 | Message-id: 20201110150023.25533-2-peter.maydell@linaro.org | ||
| 16 | --- | 12 | --- |
| 17 | hw/misc/tmp105.c | 3 +++ | 13 | target/arm/cpu64.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++ |
| 18 | 1 file changed, 3 insertions(+) | 14 | 1 file changed, 69 insertions(+) |
| 19 | 15 | ||
| 20 | diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c | 16 | diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c |
| 21 | index XXXXXXX..XXXXXXX 100644 | 17 | index XXXXXXX..XXXXXXX 100644 |
| 22 | --- a/hw/misc/tmp105.c | 18 | --- a/target/arm/cpu64.c |
| 23 | +++ b/hw/misc/tmp105.c | 19 | +++ b/target/arm/cpu64.c |
| 24 | @@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c) | 20 | @@ -XXX,XX +XXX,XX @@ |
| 25 | s->faults = tmp105_faultq[(s->config >> 3) & 3]; | 21 | #include "qemu/osdep.h" |
| 26 | s->alarm = 0; | 22 | #include "qapi/error.h" |
| 27 | 23 | #include "cpu.h" | |
| 28 | + s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */ | 24 | +#include "cpregs.h" |
| 29 | + s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */ | 25 | #include "qemu/module.h" |
| 26 | #include "sysemu/kvm.h" | ||
| 27 | #include "sysemu/hvf.h" | ||
| 28 | @@ -XXX,XX +XXX,XX @@ static void aarch64_a64fx_initfn(Object *obj) | ||
| 29 | /* TODO: Add A64FX specific HPC extension registers */ | ||
| 30 | } | ||
| 31 | |||
| 32 | +static const ARMCPRegInfo neoverse_n1_cp_reginfo[] = { | ||
| 33 | + { .name = "ATCR_EL1", .state = ARM_CP_STATE_AA64, | ||
| 34 | + .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 7, .opc2 = 0, | ||
| 35 | + .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 36 | + { .name = "ATCR_EL2", .state = ARM_CP_STATE_AA64, | ||
| 37 | + .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 0, | ||
| 38 | + .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 39 | + { .name = "ATCR_EL3", .state = ARM_CP_STATE_AA64, | ||
| 40 | + .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 7, .opc2 = 0, | ||
| 41 | + .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 42 | + { .name = "ATCR_EL12", .state = ARM_CP_STATE_AA64, | ||
| 43 | + .opc0 = 3, .opc1 = 5, .crn = 15, .crm = 7, .opc2 = 0, | ||
| 44 | + .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 45 | + { .name = "AVTCR_EL2", .state = ARM_CP_STATE_AA64, | ||
| 46 | + .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 1, | ||
| 47 | + .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 48 | + { .name = "CPUACTLR_EL1", .state = ARM_CP_STATE_AA64, | ||
| 49 | + .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 0, | ||
| 50 | + .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 51 | + { .name = "CPUACTLR2_EL1", .state = ARM_CP_STATE_AA64, | ||
| 52 | + .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 1, | ||
| 53 | + .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 54 | + { .name = "CPUACTLR3_EL1", .state = ARM_CP_STATE_AA64, | ||
| 55 | + .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 2, | ||
| 56 | + .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 57 | + /* | ||
| 58 | + * Report CPUCFR_EL1.SCU as 1, as we do not implement the DSU | ||
| 59 | + * (and in particular its system registers). | ||
| 60 | + */ | ||
| 61 | + { .name = "CPUCFR_EL1", .state = ARM_CP_STATE_AA64, | ||
| 62 | + .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 0, .opc2 = 0, | ||
| 63 | + .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 4 }, | ||
| 64 | + { .name = "CPUECTLR_EL1", .state = ARM_CP_STATE_AA64, | ||
| 65 | + .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 4, | ||
| 66 | + .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0x961563010 }, | ||
| 67 | + { .name = "CPUPCR_EL3", .state = ARM_CP_STATE_AA64, | ||
| 68 | + .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 1, | ||
| 69 | + .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 70 | + { .name = "CPUPMR_EL3", .state = ARM_CP_STATE_AA64, | ||
| 71 | + .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 3, | ||
| 72 | + .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 73 | + { .name = "CPUPOR_EL3", .state = ARM_CP_STATE_AA64, | ||
| 74 | + .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 2, | ||
| 75 | + .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 76 | + { .name = "CPUPSELR_EL3", .state = ARM_CP_STATE_AA64, | ||
| 77 | + .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 0, | ||
| 78 | + .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 79 | + { .name = "CPUPWRCTLR_EL1", .state = ARM_CP_STATE_AA64, | ||
| 80 | + .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 7, | ||
| 81 | + .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 82 | + { .name = "ERXPFGCDN_EL1", .state = ARM_CP_STATE_AA64, | ||
| 83 | + .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 2, | ||
| 84 | + .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 85 | + { .name = "ERXPFGCTL_EL1", .state = ARM_CP_STATE_AA64, | ||
| 86 | + .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 1, | ||
| 87 | + .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 88 | + { .name = "ERXPFGF_EL1", .state = ARM_CP_STATE_AA64, | ||
| 89 | + .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 0, | ||
| 90 | + .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, | ||
| 91 | +}; | ||
| 30 | + | 92 | + |
| 31 | tmp105_interrupt_update(s); | 93 | +static void define_neoverse_n1_cp_reginfo(ARMCPU *cpu) |
| 94 | +{ | ||
| 95 | + define_arm_cp_regs(cpu, neoverse_n1_cp_reginfo); | ||
| 96 | +} | ||
| 97 | + | ||
| 98 | static void aarch64_neoverse_n1_initfn(Object *obj) | ||
| 99 | { | ||
| 100 | ARMCPU *cpu = ARM_CPU(obj); | ||
| 101 | @@ -XXX,XX +XXX,XX @@ static void aarch64_neoverse_n1_initfn(Object *obj) | ||
| 102 | |||
| 103 | /* From D5.1 AArch64 PMU register summary */ | ||
| 104 | cpu->isar.reset_pmcr_el0 = 0x410c3000; | ||
| 105 | + | ||
| 106 | + define_neoverse_n1_cp_reginfo(cpu); | ||
| 32 | } | 107 | } |
| 33 | 108 | ||
| 109 | static void aarch64_host_initfn(Object *obj) | ||
| 34 | -- | 110 | -- |
| 35 | 2.20.1 | 111 | 2.34.1 |
| 36 | |||
| 37 | diff view generated by jsdifflib |
| 1 | In commit 76346b6264a9b01979 we tried to add a configure check that | 1 | The cadence UART attempts to avoid allowing the guest to set invalid |
|---|---|---|---|
| 2 | the libgio pkg-config data was correct, which builds an executable | 2 | baud rate register values in the uart_write() function. However it |
| 3 | linked against it. Unfortunately this doesn't catch the problem | 3 | does the "mask to the size of the register field" and "check for |
| 4 | (missing static library dependency info), because a "do nothing" test | 4 | invalid values" in the wrong order, which means that a malicious |
| 5 | source file doesn't have any symbol references that cause the linker | 5 | guest can get a bogus value into the register by setting also some |
| 6 | to pull in .o files from libgio.a, and so we don't see the "missing | 6 | high bits in the value, and cause QEMU to crash by division-by-zero. |
| 7 | symbols from libmount" error that a full QEMU link triggers. | ||
| 8 | 7 | ||
| 9 | (The ineffective test went unnoticed because of a typo that | 8 | Do the mask before the bounds check instead of afterwards. |
| 10 | effectively disabled libgio unconditionally, but after commit | ||
| 11 | 3569a5dfc11f2 fixed that, a static link of the system emulator on | ||
| 12 | Ubuntu stopped working again.) | ||
| 13 | 9 | ||
| 14 | Improve the gio test by having the test source fragment reference a | 10 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493 |
| 15 | g_dbus function (which is what is indirectly causing us to end up | 11 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
| 16 | wanting functions from libmount). | 12 | Reviewed-by: Thomas Huth <thuth@redhat.com> |
| 13 | Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com> | ||
| 14 | Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> | ||
| 15 | Reviewed-by: Alistair Francis <alistair.francis@wdc.com> | ||
| 16 | Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> | ||
| 17 | Tested-by: Qiang Liu <cyruscyliu@gmail.com> | ||
| 18 | Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org | ||
| 19 | --- | ||
| 20 | hw/char/cadence_uart.c | 6 ++++-- | ||
| 21 | 1 file changed, 4 insertions(+), 2 deletions(-) | ||
| 17 | 22 | ||
| 18 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 23 | diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c |
| 19 | Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> | 24 | index XXXXXXX..XXXXXXX 100644 |
| 20 | Message-id: 20201116104617.18333-1-peter.maydell@linaro.org | 25 | --- a/hw/char/cadence_uart.c |
| 21 | --- | 26 | +++ b/hw/char/cadence_uart.c |
| 22 | configure | 11 +++++++++-- | 27 | @@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset, |
| 23 | 1 file changed, 9 insertions(+), 2 deletions(-) | 28 | } |
| 24 | 29 | break; | |
| 25 | diff --git a/configure b/configure | 30 | case R_BRGR: /* Baud rate generator */ |
| 26 | index XXXXXXX..XXXXXXX 100755 | 31 | + value &= 0xffff; |
| 27 | --- a/configure | 32 | if (value >= 0x01) { |
| 28 | +++ b/configure | 33 | - s->r[offset] = value & 0xFFFF; |
| 29 | @@ -XXX,XX +XXX,XX @@ if $pkg_config --atleast-version=$glib_req_ver gio-2.0; then | 34 | + s->r[offset] = value; |
| 30 | # Check that the libraries actually work -- Ubuntu 18.04 ships | 35 | } |
| 31 | # with pkg-config --static --libs data for gio-2.0 that is missing | 36 | break; |
| 32 | # -lblkid and will give a link error. | 37 | case R_BDIV: /* Baud rate divider */ |
| 33 | - write_c_skeleton | 38 | + value &= 0xff; |
| 34 | - if compile_prog "" "$gio_libs" ; then | 39 | if (value >= 0x04) { |
| 35 | + cat > $TMPC <<EOF | 40 | - s->r[offset] = value & 0xFF; |
| 36 | +#include <gio/gio.h> | 41 | + s->r[offset] = value; |
| 37 | +int main(void) | 42 | } |
| 38 | +{ | 43 | break; |
| 39 | + g_dbus_proxy_new_sync(0, 0, 0, 0, 0, 0, 0, 0); | 44 | default: |
| 40 | + return 0; | ||
| 41 | +} | ||
| 42 | +EOF | ||
| 43 | + if compile_prog "$gio_cflags" "$gio_libs" ; then | ||
| 44 | gio=yes | ||
| 45 | else | ||
| 46 | gio=no | ||
| 47 | -- | 45 | -- |
| 48 | 2.20.1 | 46 | 2.34.1 |
| 49 | 47 | ||
| 50 | 48 | diff view generated by jsdifflib |
| 1 | From: Philippe Mathieu-Daudé <f4bug@amsat.org> | 1 | From: Viktor Prutyanov <viktor@daynix.com> |
|---|---|---|---|
| 2 | 2 | ||
| 3 | Fix Coverity CID 1435957: Memory - illegal accesses (OVERRUN): | 3 | Originally elf2dmp were added with some code style issues, |
| 4 | especially in pe.h header, and some were introduced by | ||
| 5 | 2d0fc797faaa73fbc1d30f5f9e90407bf3dd93f0. Fix them now. | ||
| 4 | 6 | ||
| 5 | >>> Overrunning array "suffixes" of 7 8-byte elements at element | 7 | Signed-off-by: Viktor Prutyanov <viktor@daynix.com> |
| 6 | index 7 (byte offset 63) using index "idx" (which evaluates to 7). | 8 | Reviewed-by: Annie Li <annie.li@oracle.com> |
| 7 | 9 | Message-id: 20230222211246.883679-2-viktor@daynix.com | |
| 8 | Note, the biggest input value freq_to_str() can accept is UINT64_MAX, | ||
| 9 | which is ~18.446 EHz, less than 1000 EHz. | ||
| 10 | |||
| 11 | Reported-by: Eduardo Habkost <ehabkost@redhat.com> | ||
| 12 | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> | ||
| 13 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | ||
| 14 | Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> | ||
| 15 | Reviewed-by: Luc Michel <luc@lmichel.fr> | ||
| 16 | Message-id: 20201101215755.2021421-1-f4bug@amsat.org | ||
| 17 | Suggested-by: Peter Maydell <peter.maydell@linaro.org> | ||
| 18 | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> | ||
| 19 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 10 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
| 20 | --- | 11 | --- |
| 21 | util/cutils.c | 3 ++- | 12 | contrib/elf2dmp/pe.h | 100 ++++++++++++++++++------------------ |
| 22 | 1 file changed, 2 insertions(+), 1 deletion(-) | 13 | contrib/elf2dmp/addrspace.c | 1 + |
| 14 | contrib/elf2dmp/main.c | 9 ++-- | ||
| 15 | 3 files changed, 57 insertions(+), 53 deletions(-) | ||
| 23 | 16 | ||
| 24 | diff --git a/util/cutils.c b/util/cutils.c | 17 | diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h |
| 25 | index XXXXXXX..XXXXXXX 100644 | 18 | index XXXXXXX..XXXXXXX 100644 |
| 26 | --- a/util/cutils.c | 19 | --- a/contrib/elf2dmp/pe.h |
| 27 | +++ b/util/cutils.c | 20 | +++ b/contrib/elf2dmp/pe.h |
| 28 | @@ -XXX,XX +XXX,XX @@ char *freq_to_str(uint64_t freq_hz) | 21 | @@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DOS_HEADER { |
| 29 | double freq = freq_hz; | 22 | } __attribute__ ((packed)) IMAGE_DOS_HEADER; |
| 30 | size_t idx = 0; | 23 | |
| 31 | 24 | typedef struct IMAGE_FILE_HEADER { | |
| 32 | - while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) { | 25 | - uint16_t Machine; |
| 33 | + while (freq >= 1000.0) { | 26 | - uint16_t NumberOfSections; |
| 34 | freq /= 1000.0; | 27 | - uint32_t TimeDateStamp; |
| 35 | idx++; | 28 | - uint32_t PointerToSymbolTable; |
| 29 | - uint32_t NumberOfSymbols; | ||
| 30 | - uint16_t SizeOfOptionalHeader; | ||
| 31 | - uint16_t Characteristics; | ||
| 32 | + uint16_t Machine; | ||
| 33 | + uint16_t NumberOfSections; | ||
| 34 | + uint32_t TimeDateStamp; | ||
| 35 | + uint32_t PointerToSymbolTable; | ||
| 36 | + uint32_t NumberOfSymbols; | ||
| 37 | + uint16_t SizeOfOptionalHeader; | ||
| 38 | + uint16_t Characteristics; | ||
| 39 | } __attribute__ ((packed)) IMAGE_FILE_HEADER; | ||
| 40 | |||
| 41 | typedef struct IMAGE_DATA_DIRECTORY { | ||
| 42 | - uint32_t VirtualAddress; | ||
| 43 | - uint32_t Size; | ||
| 44 | + uint32_t VirtualAddress; | ||
| 45 | + uint32_t Size; | ||
| 46 | } __attribute__ ((packed)) IMAGE_DATA_DIRECTORY; | ||
| 47 | |||
| 48 | #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 | ||
| 49 | |||
| 50 | typedef struct IMAGE_OPTIONAL_HEADER64 { | ||
| 51 | - uint16_t Magic; /* 0x20b */ | ||
| 52 | - uint8_t MajorLinkerVersion; | ||
| 53 | - uint8_t MinorLinkerVersion; | ||
| 54 | - uint32_t SizeOfCode; | ||
| 55 | - uint32_t SizeOfInitializedData; | ||
| 56 | - uint32_t SizeOfUninitializedData; | ||
| 57 | - uint32_t AddressOfEntryPoint; | ||
| 58 | - uint32_t BaseOfCode; | ||
| 59 | - uint64_t ImageBase; | ||
| 60 | - uint32_t SectionAlignment; | ||
| 61 | - uint32_t FileAlignment; | ||
| 62 | - uint16_t MajorOperatingSystemVersion; | ||
| 63 | - uint16_t MinorOperatingSystemVersion; | ||
| 64 | - uint16_t MajorImageVersion; | ||
| 65 | - uint16_t MinorImageVersion; | ||
| 66 | - uint16_t MajorSubsystemVersion; | ||
| 67 | - uint16_t MinorSubsystemVersion; | ||
| 68 | - uint32_t Win32VersionValue; | ||
| 69 | - uint32_t SizeOfImage; | ||
| 70 | - uint32_t SizeOfHeaders; | ||
| 71 | - uint32_t CheckSum; | ||
| 72 | - uint16_t Subsystem; | ||
| 73 | - uint16_t DllCharacteristics; | ||
| 74 | - uint64_t SizeOfStackReserve; | ||
| 75 | - uint64_t SizeOfStackCommit; | ||
| 76 | - uint64_t SizeOfHeapReserve; | ||
| 77 | - uint64_t SizeOfHeapCommit; | ||
| 78 | - uint32_t LoaderFlags; | ||
| 79 | - uint32_t NumberOfRvaAndSizes; | ||
| 80 | - IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; | ||
| 81 | + uint16_t Magic; /* 0x20b */ | ||
| 82 | + uint8_t MajorLinkerVersion; | ||
| 83 | + uint8_t MinorLinkerVersion; | ||
| 84 | + uint32_t SizeOfCode; | ||
| 85 | + uint32_t SizeOfInitializedData; | ||
| 86 | + uint32_t SizeOfUninitializedData; | ||
| 87 | + uint32_t AddressOfEntryPoint; | ||
| 88 | + uint32_t BaseOfCode; | ||
| 89 | + uint64_t ImageBase; | ||
| 90 | + uint32_t SectionAlignment; | ||
| 91 | + uint32_t FileAlignment; | ||
| 92 | + uint16_t MajorOperatingSystemVersion; | ||
| 93 | + uint16_t MinorOperatingSystemVersion; | ||
| 94 | + uint16_t MajorImageVersion; | ||
| 95 | + uint16_t MinorImageVersion; | ||
| 96 | + uint16_t MajorSubsystemVersion; | ||
| 97 | + uint16_t MinorSubsystemVersion; | ||
| 98 | + uint32_t Win32VersionValue; | ||
| 99 | + uint32_t SizeOfImage; | ||
| 100 | + uint32_t SizeOfHeaders; | ||
| 101 | + uint32_t CheckSum; | ||
| 102 | + uint16_t Subsystem; | ||
| 103 | + uint16_t DllCharacteristics; | ||
| 104 | + uint64_t SizeOfStackReserve; | ||
| 105 | + uint64_t SizeOfStackCommit; | ||
| 106 | + uint64_t SizeOfHeapReserve; | ||
| 107 | + uint64_t SizeOfHeapCommit; | ||
| 108 | + uint32_t LoaderFlags; | ||
| 109 | + uint32_t NumberOfRvaAndSizes; | ||
| 110 | + IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; | ||
| 111 | } __attribute__ ((packed)) IMAGE_OPTIONAL_HEADER64; | ||
| 112 | |||
| 113 | typedef struct IMAGE_NT_HEADERS64 { | ||
| 114 | - uint32_t Signature; | ||
| 115 | - IMAGE_FILE_HEADER FileHeader; | ||
| 116 | - IMAGE_OPTIONAL_HEADER64 OptionalHeader; | ||
| 117 | + uint32_t Signature; | ||
| 118 | + IMAGE_FILE_HEADER FileHeader; | ||
| 119 | + IMAGE_OPTIONAL_HEADER64 OptionalHeader; | ||
| 120 | } __attribute__ ((packed)) IMAGE_NT_HEADERS64; | ||
| 121 | |||
| 122 | typedef struct IMAGE_DEBUG_DIRECTORY { | ||
| 123 | - uint32_t Characteristics; | ||
| 124 | - uint32_t TimeDateStamp; | ||
| 125 | - uint16_t MajorVersion; | ||
| 126 | - uint16_t MinorVersion; | ||
| 127 | - uint32_t Type; | ||
| 128 | - uint32_t SizeOfData; | ||
| 129 | - uint32_t AddressOfRawData; | ||
| 130 | - uint32_t PointerToRawData; | ||
| 131 | + uint32_t Characteristics; | ||
| 132 | + uint32_t TimeDateStamp; | ||
| 133 | + uint16_t MajorVersion; | ||
| 134 | + uint16_t MinorVersion; | ||
| 135 | + uint32_t Type; | ||
| 136 | + uint32_t SizeOfData; | ||
| 137 | + uint32_t AddressOfRawData; | ||
| 138 | + uint32_t PointerToRawData; | ||
| 139 | } __attribute__ ((packed)) IMAGE_DEBUG_DIRECTORY; | ||
| 140 | |||
| 141 | #define IMAGE_DEBUG_TYPE_CODEVIEW 2 | ||
| 142 | diff --git a/contrib/elf2dmp/addrspace.c b/contrib/elf2dmp/addrspace.c | ||
| 143 | index XXXXXXX..XXXXXXX 100644 | ||
| 144 | --- a/contrib/elf2dmp/addrspace.c | ||
| 145 | +++ b/contrib/elf2dmp/addrspace.c | ||
| 146 | @@ -XXX,XX +XXX,XX @@ | ||
| 147 | static struct pa_block *pa_space_find_block(struct pa_space *ps, uint64_t pa) | ||
| 148 | { | ||
| 149 | size_t i; | ||
| 150 | + | ||
| 151 | for (i = 0; i < ps->block_nr; i++) { | ||
| 152 | if (ps->block[i].paddr <= pa && | ||
| 153 | pa <= ps->block[i].paddr + ps->block[i].size) { | ||
| 154 | diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c | ||
| 155 | index XXXXXXX..XXXXXXX 100644 | ||
| 156 | --- a/contrib/elf2dmp/main.c | ||
| 157 | +++ b/contrib/elf2dmp/main.c | ||
| 158 | @@ -XXX,XX +XXX,XX @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps, | ||
| 159 | }; | ||
| 160 | |||
| 161 | for (i = 0; i < ps->block_nr; i++) { | ||
| 162 | - h.PhysicalMemoryBlock.NumberOfPages += ps->block[i].size / ELF2DMP_PAGE_SIZE; | ||
| 163 | + h.PhysicalMemoryBlock.NumberOfPages += | ||
| 164 | + ps->block[i].size / ELF2DMP_PAGE_SIZE; | ||
| 165 | h.PhysicalMemoryBlock.Run[i] = (WinDumpPhyMemRun64) { | ||
| 166 | .BasePage = ps->block[i].paddr / ELF2DMP_PAGE_SIZE, | ||
| 167 | .PageCount = ps->block[i].size / ELF2DMP_PAGE_SIZE, | ||
| 168 | }; | ||
| 36 | } | 169 | } |
| 37 | + assert(idx < ARRAY_SIZE(suffixes)); | 170 | |
| 38 | 171 | - h.RequiredDumpSpace += h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS; | |
| 39 | return g_strdup_printf("%0.3g %sHz", freq, suffixes[idx]); | 172 | + h.RequiredDumpSpace += |
| 40 | } | 173 | + h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS; |
| 174 | |||
| 175 | *hdr = h; | ||
| 176 | |||
| 177 | @@ -XXX,XX +XXX,XX @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps, | ||
| 178 | static int fill_context(KDDEBUGGER_DATA64 *kdbg, | ||
| 179 | struct va_space *vs, QEMU_Elf *qe) | ||
| 180 | { | ||
| 181 | - int i; | ||
| 182 | + int i; | ||
| 183 | + | ||
| 184 | for (i = 0; i < qe->state_nr; i++) { | ||
| 185 | uint64_t Prcb; | ||
| 186 | uint64_t Context; | ||
| 41 | -- | 187 | -- |
| 42 | 2.20.1 | 188 | 2.34.1 |
| 43 | |||
| 44 | diff view generated by jsdifflib |
| 1 | From: Alistair Francis <alistair.francis@wdc.com> | 1 | From: Viktor Prutyanov <viktor@daynix.com> |
|---|---|---|---|
| 2 | 2 | ||
| 3 | This patch fixes CID 1432800 by removing an unnecessary check. | 3 | Move out PE directory search functionality to be reused not only |
| 4 | for Debug Directory processing but for arbitrary PE directory. | ||
| 4 | 5 | ||
| 5 | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> | 6 | Signed-off-by: Viktor Prutyanov <viktor@daynix.com> |
| 6 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 7 | Reviewed-by: Annie Li <annie.li@oracle.com> |
| 8 | Message-id: 20230222211246.883679-3-viktor@daynix.com | ||
| 7 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
| 8 | --- | 10 | --- |
| 9 | hw/core/register.c | 4 ---- | 11 | contrib/elf2dmp/main.c | 71 +++++++++++++++++++++++++----------------- |
| 10 | 1 file changed, 4 deletions(-) | 12 | 1 file changed, 42 insertions(+), 29 deletions(-) |
| 11 | 13 | ||
| 12 | diff --git a/hw/core/register.c b/hw/core/register.c | 14 | diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c |
| 13 | index XXXXXXX..XXXXXXX 100644 | 15 | index XXXXXXX..XXXXXXX 100644 |
| 14 | --- a/hw/core/register.c | 16 | --- a/contrib/elf2dmp/main.c |
| 15 | +++ b/hw/core/register.c | 17 | +++ b/contrib/elf2dmp/main.c |
| 16 | @@ -XXX,XX +XXX,XX @@ static RegisterInfoArray *register_init_block(DeviceState *owner, | 18 | @@ -XXX,XX +XXX,XX @@ static int fill_context(KDDEBUGGER_DATA64 *kdbg, |
| 17 | int index = rae[i].addr / data_size; | 19 | return 0; |
| 18 | RegisterInfo *r = &ri[index]; | 20 | } |
| 19 | 21 | ||
| 20 | - if (data + data_size * index == 0 || !&rae[i]) { | 22 | +static int pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx, |
| 21 | - continue; | 23 | + void *entry, size_t size, struct va_space *vs) |
| 22 | - } | 24 | +{ |
| 25 | + const char e_magic[2] = "MZ"; | ||
| 26 | + const char Signature[4] = "PE\0\0"; | ||
| 27 | + IMAGE_DOS_HEADER *dos_hdr = start_addr; | ||
| 28 | + IMAGE_NT_HEADERS64 nt_hdrs; | ||
| 29 | + IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader; | ||
| 30 | + IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader; | ||
| 31 | + IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory; | ||
| 32 | + | ||
| 33 | + QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE); | ||
| 34 | + | ||
| 35 | + if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) { | ||
| 36 | + return 1; | ||
| 37 | + } | ||
| 38 | + | ||
| 39 | + if (va_space_rw(vs, base + dos_hdr->e_lfanew, | ||
| 40 | + &nt_hdrs, sizeof(nt_hdrs), 0)) { | ||
| 41 | + return 1; | ||
| 42 | + } | ||
| 43 | + | ||
| 44 | + if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) || | ||
| 45 | + file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) { | ||
| 46 | + return 1; | ||
| 47 | + } | ||
| 48 | + | ||
| 49 | + if (va_space_rw(vs, | ||
| 50 | + base + data_dir[idx].VirtualAddress, | ||
| 51 | + entry, size, 0)) { | ||
| 52 | + return 1; | ||
| 53 | + } | ||
| 54 | + | ||
| 55 | + printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx, | ||
| 56 | + (uint32_t)data_dir[idx].VirtualAddress); | ||
| 57 | + | ||
| 58 | + return 0; | ||
| 59 | +} | ||
| 60 | + | ||
| 61 | static int write_dump(struct pa_space *ps, | ||
| 62 | WinDumpHeader64 *hdr, const char *name) | ||
| 63 | { | ||
| 64 | @@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps, | ||
| 65 | static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr, | ||
| 66 | char *hash, struct va_space *vs) | ||
| 67 | { | ||
| 68 | - const char e_magic[2] = "MZ"; | ||
| 69 | - const char Signature[4] = "PE\0\0"; | ||
| 70 | const char sign_rsds[4] = "RSDS"; | ||
| 71 | - IMAGE_DOS_HEADER *dos_hdr = start_addr; | ||
| 72 | - IMAGE_NT_HEADERS64 nt_hdrs; | ||
| 73 | - IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader; | ||
| 74 | - IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader; | ||
| 75 | - IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory; | ||
| 76 | IMAGE_DEBUG_DIRECTORY debug_dir; | ||
| 77 | OMFSignatureRSDS rsds; | ||
| 78 | char *pdb_name; | ||
| 79 | size_t pdb_name_sz; | ||
| 80 | size_t i; | ||
| 81 | |||
| 82 | - QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE); | ||
| 23 | - | 83 | - |
| 24 | /* Init the register, this will zero it. */ | 84 | - if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) { |
| 25 | object_initialize((void *)r, sizeof(*r), TYPE_REGISTER); | 85 | - return 1; |
| 86 | - } | ||
| 87 | - | ||
| 88 | - if (va_space_rw(vs, base + dos_hdr->e_lfanew, | ||
| 89 | - &nt_hdrs, sizeof(nt_hdrs), 0)) { | ||
| 90 | - return 1; | ||
| 91 | - } | ||
| 92 | - | ||
| 93 | - if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) || | ||
| 94 | - file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) { | ||
| 95 | - return 1; | ||
| 96 | - } | ||
| 97 | - | ||
| 98 | - printf("Debug Directory RVA = 0x%08"PRIx32"\n", | ||
| 99 | - (uint32_t)data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress); | ||
| 100 | - | ||
| 101 | - if (va_space_rw(vs, | ||
| 102 | - base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress, | ||
| 103 | - &debug_dir, sizeof(debug_dir), 0)) { | ||
| 104 | + if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY, | ||
| 105 | + &debug_dir, sizeof(debug_dir), vs)) { | ||
| 106 | + eprintf("Failed to get Debug Directory\n"); | ||
| 107 | return 1; | ||
| 108 | } | ||
| 26 | 109 | ||
| 27 | -- | 110 | -- |
| 28 | 2.20.1 | 111 | 2.34.1 |
| 29 | |||
| 30 | diff view generated by jsdifflib |
| 1 | The TMP105 datasheet says that in Interrupt Mode (when TM==1) the device | 1 | From: Viktor Prutyanov <viktor@daynix.com> |
|---|---|---|---|
| 2 | signals an alert when the temperature equals or exceeds the T_high value and | ||
| 3 | then remains high until a device register is read or the device responds to | ||
| 4 | the SMBUS Alert Response address, or the device is put into Shutdown Mode. | ||
| 5 | Thereafter the Alert pin will only be re-signalled when temperature falls | ||
| 6 | below T_low; alert can then be cleared in the same set of ways, and the | ||
| 7 | device returns to its initial "alert when temperature goes above T_high" | ||
| 8 | mode. (If this textual description is confusing, see figure 3 in the | ||
| 9 | TI datasheet at https://www.ti.com/lit/gpn/tmp105 .) | ||
| 10 | 2 | ||
| 11 | We were misimplementing this as a simple "always alert if temperature is | 3 | Since its inception elf2dmp has checked MZ signatures within an |
| 12 | above T_high or below T_low" condition, which gives a spurious alert on | 4 | address space above IDT[0] interrupt vector and took first PE image |
| 13 | startup if using the "T_high = 80 degrees C, T_low = 75 degrees C" reset | 5 | found as Windows Kernel. |
| 14 | limit values. | 6 | But in Windows Server 2022 memory dump this address space range is |
| 7 | full of invalid PE fragments and the tool must check that PE image | ||
| 8 | is 'ntoskrnl.exe' actually. | ||
| 9 | So, introduce additional validation by checking image name from | ||
| 10 | Export Directory against 'ntoskrnl.exe'. | ||
| 15 | 11 | ||
| 16 | Implement the correct (hysteresis) behaviour by tracking whether we | 12 | Signed-off-by: Viktor Prutyanov <viktor@daynix.com> |
| 17 | are currently looking for the temperature to rise over T_high or | 13 | Tested-by: Yuri Benditovich <yuri.benditovich@daynix.com> |
| 18 | for it to fall below T_low. Our implementation of the comparator | 14 | Reviewed-by: Annie Li <annie.li@oracle.com> |
| 19 | mode (TM==0) wasn't wrong, but rephrase it to match the way that | 15 | Message-id: 20230222211246.883679-4-viktor@daynix.com |
| 20 | interrupt mode is now handled for clarity. | 16 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
| 17 | --- | ||
| 18 | contrib/elf2dmp/pe.h | 15 +++++++++++++++ | ||
| 19 | contrib/elf2dmp/main.c | 28 ++++++++++++++++++++++++++-- | ||
| 20 | 2 files changed, 41 insertions(+), 2 deletions(-) | ||
| 21 | 21 | ||
| 22 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 22 | diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h |
| 23 | Reviewed-by: Cédric Le Goater <clg@kaod.org> | ||
| 24 | Message-id: 20201110150023.25533-3-peter.maydell@linaro.org | ||
| 25 | --- | ||
| 26 | hw/misc/tmp105.h | 7 +++++ | ||
| 27 | hw/misc/tmp105.c | 70 +++++++++++++++++++++++++++++++++++++++++------- | ||
| 28 | 2 files changed, 68 insertions(+), 9 deletions(-) | ||
| 29 | |||
| 30 | diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h | ||
| 31 | index XXXXXXX..XXXXXXX 100644 | 23 | index XXXXXXX..XXXXXXX 100644 |
| 32 | --- a/hw/misc/tmp105.h | 24 | --- a/contrib/elf2dmp/pe.h |
| 33 | +++ b/hw/misc/tmp105.h | 25 | +++ b/contrib/elf2dmp/pe.h |
| 34 | @@ -XXX,XX +XXX,XX @@ struct TMP105State { | 26 | @@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_NT_HEADERS64 { |
| 35 | int16_t limit[2]; | 27 | IMAGE_OPTIONAL_HEADER64 OptionalHeader; |
| 36 | int faults; | 28 | } __attribute__ ((packed)) IMAGE_NT_HEADERS64; |
| 37 | uint8_t alarm; | 29 | |
| 38 | + /* | 30 | +typedef struct IMAGE_EXPORT_DIRECTORY { |
| 39 | + * The TMP105 initially looks for a temperature rising above T_high; | 31 | + uint32_t Characteristics; |
| 40 | + * once this is detected, the condition it looks for next is the | 32 | + uint32_t TimeDateStamp; |
| 41 | + * temperature falling below T_low. This flag is false when initially | 33 | + uint16_t MajorVersion; |
| 42 | + * looking for T_high, true when looking for T_low. | 34 | + uint16_t MinorVersion; |
| 43 | + */ | 35 | + uint32_t Name; |
| 44 | + bool detect_falling; | 36 | + uint32_t Base; |
| 45 | }; | 37 | + uint32_t NumberOfFunctions; |
| 46 | 38 | + uint32_t NumberOfNames; | |
| 39 | + uint32_t AddressOfFunctions; | ||
| 40 | + uint32_t AddressOfNames; | ||
| 41 | + uint32_t AddressOfNameOrdinals; | ||
| 42 | +} __attribute__ ((packed)) IMAGE_EXPORT_DIRECTORY; | ||
| 43 | + | ||
| 44 | typedef struct IMAGE_DEBUG_DIRECTORY { | ||
| 45 | uint32_t Characteristics; | ||
| 46 | uint32_t TimeDateStamp; | ||
| 47 | @@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DEBUG_DIRECTORY { | ||
| 48 | #define IMAGE_DEBUG_TYPE_CODEVIEW 2 | ||
| 47 | #endif | 49 | #endif |
| 48 | diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c | 50 | |
| 51 | +#define IMAGE_FILE_EXPORT_DIRECTORY 0 | ||
| 52 | #define IMAGE_FILE_DEBUG_DIRECTORY 6 | ||
| 53 | |||
| 54 | typedef struct guid_t { | ||
| 55 | diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c | ||
| 49 | index XXXXXXX..XXXXXXX 100644 | 56 | index XXXXXXX..XXXXXXX 100644 |
| 50 | --- a/hw/misc/tmp105.c | 57 | --- a/contrib/elf2dmp/main.c |
| 51 | +++ b/hw/misc/tmp105.c | 58 | +++ b/contrib/elf2dmp/main.c |
| 52 | @@ -XXX,XX +XXX,XX @@ static void tmp105_alarm_update(TMP105State *s) | 59 | @@ -XXX,XX +XXX,XX @@ |
| 53 | return; | 60 | |
| 54 | } | 61 | #define SYM_URL_BASE "https://msdl.microsoft.com/download/symbols/" |
| 55 | 62 | #define PDB_NAME "ntkrnlmp.pdb" | |
| 56 | - if ((s->config >> 1) & 1) { /* TM */ | 63 | +#define PE_NAME "ntoskrnl.exe" |
| 57 | - if (s->temperature >= s->limit[1]) | 64 | |
| 58 | - s->alarm = 1; | 65 | #define INITIAL_MXCSR 0x1f80 |
| 59 | - else if (s->temperature < s->limit[0]) | 66 | |
| 60 | - s->alarm = 1; | 67 | @@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps, |
| 61 | + if (s->config >> 1 & 1) { | 68 | return fclose(dmp_file); |
| 62 | + /* | ||
| 63 | + * TM == 1 : Interrupt mode. We signal Alert when the | ||
| 64 | + * temperature rises above T_high, and expect the guest to clear | ||
| 65 | + * it (eg by reading a device register). | ||
| 66 | + */ | ||
| 67 | + if (s->detect_falling) { | ||
| 68 | + if (s->temperature < s->limit[0]) { | ||
| 69 | + s->alarm = 1; | ||
| 70 | + s->detect_falling = false; | ||
| 71 | + } | ||
| 72 | + } else { | ||
| 73 | + if (s->temperature >= s->limit[1]) { | ||
| 74 | + s->alarm = 1; | ||
| 75 | + s->detect_falling = true; | ||
| 76 | + } | ||
| 77 | + } | ||
| 78 | } else { | ||
| 79 | - if (s->temperature >= s->limit[1]) | ||
| 80 | - s->alarm = 1; | ||
| 81 | - else if (s->temperature < s->limit[0]) | ||
| 82 | - s->alarm = 0; | ||
| 83 | + /* | ||
| 84 | + * TM == 0 : Comparator mode. We signal Alert when the temperature | ||
| 85 | + * rises above T_high, and stop signalling it when the temperature | ||
| 86 | + * falls below T_low. | ||
| 87 | + */ | ||
| 88 | + if (s->detect_falling) { | ||
| 89 | + if (s->temperature < s->limit[0]) { | ||
| 90 | + s->alarm = 0; | ||
| 91 | + s->detect_falling = false; | ||
| 92 | + } | ||
| 93 | + } else { | ||
| 94 | + if (s->temperature >= s->limit[1]) { | ||
| 95 | + s->alarm = 1; | ||
| 96 | + s->detect_falling = true; | ||
| 97 | + } | ||
| 98 | + } | ||
| 99 | } | ||
| 100 | |||
| 101 | tmp105_interrupt_update(s); | ||
| 102 | @@ -XXX,XX +XXX,XX @@ static int tmp105_post_load(void *opaque, int version_id) | ||
| 103 | return 0; | ||
| 104 | } | 69 | } |
| 105 | 70 | ||
| 106 | +static bool detect_falling_needed(void *opaque) | 71 | +static bool pe_check_export_name(uint64_t base, void *start_addr, |
| 72 | + struct va_space *vs) | ||
| 107 | +{ | 73 | +{ |
| 108 | + TMP105State *s = opaque; | 74 | + IMAGE_EXPORT_DIRECTORY export_dir; |
| 75 | + const char *pe_name; | ||
| 109 | + | 76 | + |
| 110 | + /* | 77 | + if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_EXPORT_DIRECTORY, |
| 111 | + * We only need to migrate the detect_falling bool if it's set; | 78 | + &export_dir, sizeof(export_dir), vs)) { |
| 112 | + * for migration from older machines we assume that it is false | 79 | + return false; |
| 113 | + * (ie temperature is not out of range). | 80 | + } |
| 114 | + */ | 81 | + |
| 115 | + return s->detect_falling; | 82 | + pe_name = va_space_resolve(vs, base + export_dir.Name); |
| 83 | + if (!pe_name) { | ||
| 84 | + return false; | ||
| 85 | + } | ||
| 86 | + | ||
| 87 | + return !strcmp(pe_name, PE_NAME); | ||
| 116 | +} | 88 | +} |
| 117 | + | 89 | + |
| 118 | +static const VMStateDescription vmstate_tmp105_detect_falling = { | 90 | static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr, |
| 119 | + .name = "TMP105/detect-falling", | 91 | char *hash, struct va_space *vs) |
| 120 | + .version_id = 1, | 92 | { |
| 121 | + .minimum_version_id = 1, | 93 | @@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[]) |
| 122 | + .needed = detect_falling_needed, | 94 | uint64_t KdDebuggerDataBlock; |
| 123 | + .fields = (VMStateField[]) { | 95 | KDDEBUGGER_DATA64 *kdbg; |
| 124 | + VMSTATE_BOOL(detect_falling, TMP105State), | 96 | uint64_t KdVersionBlock; |
| 125 | + VMSTATE_END_OF_LIST() | 97 | + bool kernel_found = false; |
| 126 | + } | 98 | |
| 127 | +}; | 99 | if (argc != 3) { |
| 128 | + | 100 | eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]); |
| 129 | static const VMStateDescription vmstate_tmp105 = { | 101 | @@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[]) |
| 130 | .name = "TMP105", | 102 | } |
| 131 | .version_id = 0, | 103 | |
| 132 | @@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tmp105 = { | 104 | if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */ |
| 133 | VMSTATE_UINT8(alarm, TMP105State), | 105 | - break; |
| 134 | VMSTATE_I2C_SLAVE(i2c, TMP105State), | 106 | + if (pe_check_export_name(KernBase, nt_start_addr, &vs)) { |
| 135 | VMSTATE_END_OF_LIST() | 107 | + kernel_found = true; |
| 136 | + }, | 108 | + break; |
| 137 | + .subsections = (const VMStateDescription*[]) { | 109 | + } |
| 138 | + &vmstate_tmp105_detect_falling, | 110 | } |
| 139 | + NULL | ||
| 140 | } | 111 | } |
| 141 | }; | 112 | |
| 142 | 113 | - if (!nt_start_addr) { | |
| 143 | @@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c) | 114 | + if (!kernel_found) { |
| 144 | s->config = 0; | 115 | eprintf("Failed to find NT kernel image\n"); |
| 145 | s->faults = tmp105_faultq[(s->config >> 3) & 3]; | 116 | err = 1; |
| 146 | s->alarm = 0; | 117 | goto out_ps; |
| 147 | + s->detect_falling = false; | ||
| 148 | |||
| 149 | s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */ | ||
| 150 | s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */ | ||
| 151 | -- | 118 | -- |
| 152 | 2.20.1 | 119 | 2.34.1 |
| 153 | |||
| 154 | diff view generated by jsdifflib |
| 1 | From: Alex Chen <alex.chen@huawei.com> | 1 | From: Guenter Roeck <linux@roeck-us.net> |
|---|---|---|---|
| 2 | 2 | ||
| 3 | We should use printf format specifier "%u" instead of "%d" for | 3 | The i.MX USB Phy driver does not check register ranges, resulting in out of |
| 4 | argument of type "unsigned int". | 4 | bounds accesses if an attempt is made to access non-existing PHY registers. |
| 5 | Add range check and conditionally report bad accesses to fix the problem. | ||
| 5 | 6 | ||
| 6 | Reported-by: Euler Robot <euler.robot@huawei.com> | 7 | While at it, also conditionally log attempted writes to non-existing or |
| 7 | Signed-off-by: Alex Chen <alex.chen@huawei.com> | 8 | read-only registers. |
| 8 | Message-id: 20201111073651.72804-1-alex.chen@huawei.com | 9 | |
| 10 | Reported-by: Qiang Liu <cyruscyliu@gmail.com> | ||
| 11 | Signed-off-by: Guenter Roeck <linux@roeck-us.net> | ||
| 12 | Tested-by: Qiang Liu <cyruscyliu@gmail.com> | ||
| 13 | Message-id: 20230316234926.208874-1-linux@roeck-us.net | ||
| 14 | Link: https://gitlab.com/qemu-project/qemu/-/issues/1408 | ||
| 15 | Fixes: 0701a5efa015 ("hw/usb: Add basic i.MX USB Phy support") | ||
| 16 | Signed-off-by: Guenter Roeck <linux@roeck-us.net> | ||
| 9 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 17 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> |
| 10 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 18 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
| 11 | --- | 19 | --- |
| 12 | hw/timer/exynos4210_mct.c | 4 ++-- | 20 | hw/usb/imx-usb-phy.c | 19 +++++++++++++++++-- |
| 13 | hw/timer/exynos4210_pwm.c | 8 ++++---- | 21 | 1 file changed, 17 insertions(+), 2 deletions(-) |
| 14 | 2 files changed, 6 insertions(+), 6 deletions(-) | ||
| 15 | 22 | ||
| 16 | diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c | 23 | diff --git a/hw/usb/imx-usb-phy.c b/hw/usb/imx-usb-phy.c |
| 17 | index XXXXXXX..XXXXXXX 100644 | 24 | index XXXXXXX..XXXXXXX 100644 |
| 18 | --- a/hw/timer/exynos4210_mct.c | 25 | --- a/hw/usb/imx-usb-phy.c |
| 19 | +++ b/hw/timer/exynos4210_mct.c | 26 | +++ b/hw/usb/imx-usb-phy.c |
| 20 | @@ -XXX,XX +XXX,XX @@ static void exynos4210_gcomp_raise_irq(void *opaque, uint32_t id) | 27 | @@ -XXX,XX +XXX,XX @@ |
| 21 | /* If CSTAT is pending and IRQ is enabled */ | 28 | #include "qemu/osdep.h" |
| 22 | if ((s->reg.int_cstat & G_INT_CSTAT_COMP(id)) && | 29 | #include "hw/usb/imx-usb-phy.h" |
| 23 | (s->reg.int_enb & G_INT_ENABLE(id))) { | 30 | #include "migration/vmstate.h" |
| 24 | - DPRINTF("gcmp timer[%d] IRQ\n", id); | 31 | +#include "qemu/log.h" |
| 25 | + DPRINTF("gcmp timer[%u] IRQ\n", id); | 32 | #include "qemu/module.h" |
| 26 | qemu_irq_raise(s->irq[id]); | 33 | |
| 34 | static const VMStateDescription vmstate_imx_usbphy = { | ||
| 35 | @@ -XXX,XX +XXX,XX @@ static uint64_t imx_usbphy_read(void *opaque, hwaddr offset, unsigned size) | ||
| 36 | value = s->usbphy[index - 3]; | ||
| 37 | break; | ||
| 38 | default: | ||
| 39 | - value = s->usbphy[index]; | ||
| 40 | + if (index < USBPHY_MAX) { | ||
| 41 | + value = s->usbphy[index]; | ||
| 42 | + } else { | ||
| 43 | + qemu_log_mask(LOG_GUEST_ERROR, | ||
| 44 | + "%s: Read from non-existing USB PHY register 0x%" | ||
| 45 | + HWADDR_PRIx "\n", | ||
| 46 | + __func__, offset); | ||
| 47 | + value = 0; | ||
| 48 | + } | ||
| 49 | break; | ||
| 50 | } | ||
| 51 | return (uint64_t)value; | ||
| 52 | @@ -XXX,XX +XXX,XX @@ static void imx_usbphy_write(void *opaque, hwaddr offset, uint64_t value, | ||
| 53 | s->usbphy[index - 3] ^= value; | ||
| 54 | break; | ||
| 55 | default: | ||
| 56 | - /* Other registers are read-only */ | ||
| 57 | + /* Other registers are read-only or do not exist */ | ||
| 58 | + qemu_log_mask(LOG_GUEST_ERROR, | ||
| 59 | + "%s: Write to %s USB PHY register 0x%" | ||
| 60 | + HWADDR_PRIx "\n", | ||
| 61 | + __func__, | ||
| 62 | + index >= USBPHY_MAX ? "non-existing" : "read-only", | ||
| 63 | + offset); | ||
| 64 | break; | ||
| 27 | } | 65 | } |
| 28 | } | 66 | } |
| 29 | @@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s) | ||
| 30 | MCT_CFG_GET_DIVIDER(s->reg_mct_cfg)); | ||
| 31 | |||
| 32 | if (freq != s->freq) { | ||
| 33 | - DPRINTF("freq=%dHz\n", s->freq); | ||
| 34 | + DPRINTF("freq=%uHz\n", s->freq); | ||
| 35 | |||
| 36 | /* global timer */ | ||
| 37 | tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq); | ||
| 38 | diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c | ||
| 39 | index XXXXXXX..XXXXXXX 100644 | ||
| 40 | --- a/hw/timer/exynos4210_pwm.c | ||
| 41 | +++ b/hw/timer/exynos4210_pwm.c | ||
| 42 | @@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id) | ||
| 43 | |||
| 44 | if (freq != s->timer[id].freq) { | ||
| 45 | ptimer_set_freq(s->timer[id].ptimer, s->timer[id].freq); | ||
| 46 | - DPRINTF("freq=%dHz\n", s->timer[id].freq); | ||
| 47 | + DPRINTF("freq=%uHz\n", s->timer[id].freq); | ||
| 48 | } | ||
| 49 | } | ||
| 50 | |||
| 51 | @@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque) | ||
| 52 | uint32_t id = s->id; | ||
| 53 | bool cmp; | ||
| 54 | |||
| 55 | - DPRINTF("timer %d tick\n", id); | ||
| 56 | + DPRINTF("timer %u tick\n", id); | ||
| 57 | |||
| 58 | /* set irq status */ | ||
| 59 | p->reg_tint_cstat |= TINT_CSTAT_STATUS(id); | ||
| 60 | |||
| 61 | /* raise IRQ */ | ||
| 62 | if (p->reg_tint_cstat & TINT_CSTAT_ENABLE(id)) { | ||
| 63 | - DPRINTF("timer %d IRQ\n", id); | ||
| 64 | + DPRINTF("timer %u IRQ\n", id); | ||
| 65 | qemu_irq_raise(p->timer[id].irq); | ||
| 66 | } | ||
| 67 | |||
| 68 | @@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque) | ||
| 69 | } | ||
| 70 | |||
| 71 | if (cmp) { | ||
| 72 | - DPRINTF("auto reload timer %d count to %x\n", id, | ||
| 73 | + DPRINTF("auto reload timer %u count to %x\n", id, | ||
| 74 | p->timer[id].reg_tcntb); | ||
| 75 | ptimer_set_count(p->timer[id].ptimer, p->timer[id].reg_tcntb); | ||
| 76 | ptimer_run(p->timer[id].ptimer, 1); | ||
| 77 | -- | 67 | -- |
| 78 | 2.20.1 | 68 | 2.34.1 |
| 79 | |||
| 80 | diff view generated by jsdifflib |
| 1 | In the mtspr helper we attempt to check for "is the timer disabled" | 1 | The markup for the Arm CPU feature documentation is incorrect, |
|---|---|---|---|
| 2 | with "if (env->ttmr & TIMER_NONE)". This is wrong because TIMER_NONE | 2 | and results in the HTML not rendering correctly -- the first |
| 3 | is zero and the condition is always false (Coverity complains about | 3 | line of each description is rendered in boldface as if it |
| 4 | the dead code.) | 4 | were part of the option name. |
| 5 | 5 | ||
| 6 | The correct check would be to test whether the TTMR_M field in the | 6 | Reformat to match the styling used in cpu-models-x86.rst.inc. |
| 7 | register is equal to TIMER_NONE instead. However, the | ||
| 8 | cpu_openrisc_timer_update() function checks whether the timer is | ||
| 9 | enabled (it looks at cpu->env.is_counting, which is set to 0 via | ||
| 10 | cpu_openrisc_count_stop() when the TTMR_M field is set to | ||
| 11 | TIMER_NONE), so there's no need to check for "timer disabled" in the | ||
| 12 | target/openrisc code. Instead, simply remove the dead code. | ||
| 13 | 7 | ||
| 14 | Fixes: Coverity CID 1005812 | 8 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1479 |
| 15 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
| 16 | Acked-by: Stafford Horne <shorne@gmail.com> | 10 | Message-id: 20230316105808.1414003-1-peter.maydell@linaro.org |
| 17 | Message-id: 20201103114654.18540-1-peter.maydell@linaro.org | 11 | Reviewed-by: Cornelia Huck <cohuck@redhat.com> |
| 18 | --- | 12 | --- |
| 19 | target/openrisc/sys_helper.c | 3 --- | 13 | docs/system/arm/cpu-features.rst | 68 ++++++++++++++------------------ |
| 20 | 1 file changed, 3 deletions(-) | 14 | 1 file changed, 30 insertions(+), 38 deletions(-) |
| 21 | 15 | ||
| 22 | diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c | 16 | diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst |
| 23 | index XXXXXXX..XXXXXXX 100644 | 17 | index XXXXXXX..XXXXXXX 100644 |
| 24 | --- a/target/openrisc/sys_helper.c | 18 | --- a/docs/system/arm/cpu-features.rst |
| 25 | +++ b/target/openrisc/sys_helper.c | 19 | +++ b/docs/system/arm/cpu-features.rst |
| 26 | @@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb) | 20 | @@ -XXX,XX +XXX,XX @@ are named with the prefix "kvm-". KVM VCPU features may be probed, |
| 27 | 21 | enabled, and disabled in the same way as other CPU features. Below is | |
| 28 | case TO_SPR(10, 1): /* TTCR */ | 22 | the list of KVM VCPU features and their descriptions. |
| 29 | cpu_openrisc_count_set(cpu, rb); | 23 | |
| 30 | - if (env->ttmr & TIMER_NONE) { | 24 | - kvm-no-adjvtime By default kvm-no-adjvtime is disabled. This |
| 31 | - return; | 25 | - means that by default the virtual time |
| 32 | - } | 26 | - adjustment is enabled (vtime is not *not* |
| 33 | cpu_openrisc_timer_update(cpu); | 27 | - adjusted). |
| 34 | break; | 28 | +``kvm-no-adjvtime`` |
| 35 | #endif | 29 | + By default kvm-no-adjvtime is disabled. This means that by default |
| 30 | + the virtual time adjustment is enabled (vtime is not *not* adjusted). | ||
| 31 | |||
| 32 | - When virtual time adjustment is enabled each | ||
| 33 | - time the VM transitions back to running state | ||
| 34 | - the VCPU's virtual counter is updated to ensure | ||
| 35 | - stopped time is not counted. This avoids time | ||
| 36 | - jumps surprising guest OSes and applications, | ||
| 37 | - as long as they use the virtual counter for | ||
| 38 | - timekeeping. However it has the side effect of | ||
| 39 | - the virtual and physical counters diverging. | ||
| 40 | - All timekeeping based on the virtual counter | ||
| 41 | - will appear to lag behind any timekeeping that | ||
| 42 | - does not subtract VM stopped time. The guest | ||
| 43 | - may resynchronize its virtual counter with | ||
| 44 | - other time sources as needed. | ||
| 45 | + When virtual time adjustment is enabled each time the VM transitions | ||
| 46 | + back to running state the VCPU's virtual counter is updated to | ||
| 47 | + ensure stopped time is not counted. This avoids time jumps | ||
| 48 | + surprising guest OSes and applications, as long as they use the | ||
| 49 | + virtual counter for timekeeping. However it has the side effect of | ||
| 50 | + the virtual and physical counters diverging. All timekeeping based | ||
| 51 | + on the virtual counter will appear to lag behind any timekeeping | ||
| 52 | + that does not subtract VM stopped time. The guest may resynchronize | ||
| 53 | + its virtual counter with other time sources as needed. | ||
| 54 | |||
| 55 | - Enable kvm-no-adjvtime to disable virtual time | ||
| 56 | - adjustment, also restoring the legacy (pre-5.0) | ||
| 57 | - behavior. | ||
| 58 | + Enable kvm-no-adjvtime to disable virtual time adjustment, also | ||
| 59 | + restoring the legacy (pre-5.0) behavior. | ||
| 60 | |||
| 61 | - kvm-steal-time Since v5.2, kvm-steal-time is enabled by | ||
| 62 | - default when KVM is enabled, the feature is | ||
| 63 | - supported, and the guest is 64-bit. | ||
| 64 | +``kvm-steal-time`` | ||
| 65 | + Since v5.2, kvm-steal-time is enabled by default when KVM is | ||
| 66 | + enabled, the feature is supported, and the guest is 64-bit. | ||
| 67 | |||
| 68 | - When kvm-steal-time is enabled a 64-bit guest | ||
| 69 | - can account for time its CPUs were not running | ||
| 70 | - due to the host not scheduling the corresponding | ||
| 71 | - VCPU threads. The accounting statistics may | ||
| 72 | - influence the guest scheduler behavior and/or be | ||
| 73 | - exposed to the guest userspace. | ||
| 74 | + When kvm-steal-time is enabled a 64-bit guest can account for time | ||
| 75 | + its CPUs were not running due to the host not scheduling the | ||
| 76 | + corresponding VCPU threads. The accounting statistics may influence | ||
| 77 | + the guest scheduler behavior and/or be exposed to the guest | ||
| 78 | + userspace. | ||
| 79 | |||
| 80 | TCG VCPU Features | ||
| 81 | ================= | ||
| 82 | @@ -XXX,XX +XXX,XX @@ TCG VCPU Features | ||
| 83 | TCG VCPU features are CPU features that are specific to TCG. | ||
| 84 | Below is the list of TCG VCPU features and their descriptions. | ||
| 85 | |||
| 86 | - pauth-impdef When ``FEAT_Pauth`` is enabled, either the | ||
| 87 | - *impdef* (Implementation Defined) algorithm | ||
| 88 | - is enabled or the *architected* QARMA algorithm | ||
| 89 | - is enabled. By default the impdef algorithm | ||
| 90 | - is disabled, and QARMA is enabled. | ||
| 91 | +``pauth-impdef`` | ||
| 92 | + When ``FEAT_Pauth`` is enabled, either the *impdef* (Implementation | ||
| 93 | + Defined) algorithm is enabled or the *architected* QARMA algorithm | ||
| 94 | + is enabled. By default the impdef algorithm is disabled, and QARMA | ||
| 95 | + is enabled. | ||
| 96 | |||
| 97 | - The architected QARMA algorithm has good | ||
| 98 | - cryptographic properties, but can be quite slow | ||
| 99 | - to emulate. The impdef algorithm used by QEMU | ||
| 100 | - is non-cryptographic but significantly faster. | ||
| 101 | + The architected QARMA algorithm has good cryptographic properties, | ||
| 102 | + but can be quite slow to emulate. The impdef algorithm used by QEMU | ||
| 103 | + is non-cryptographic but significantly faster. | ||
| 104 | |||
| 105 | SVE CPU Properties | ||
| 106 | ================== | ||
| 36 | -- | 107 | -- |
| 37 | 2.20.1 | 108 | 2.34.1 |
| 38 | |||
| 39 | diff view generated by jsdifflib |
| 1 | In commit 5edab03d4040 we added tracepoints to the ps2 keyboard | 1 | Unfortunately a bug in older versions of gdb means that they will |
|---|---|---|---|
| 2 | and mouse emulation. However we didn't remove all the debug-by-printf | 2 | crash if QEMU sends them the aarch64-pauth.xml. This bug is fixed in |
| 3 | support. In fact there is only one printf() remaining, and it is | 3 | gdb commit 1ba3a3222039eb25, and there are plans to backport that to |
| 4 | redundant with the trace_ps2_write_mouse() event next to it. | 4 | affected gdb release branches, but since the bug affects gdb 9 |
| 5 | Remove the printf() and the now-unused DEBUG* macros. | 5 | through 12 it is very widely deployed (for instance by distros). |
| 6 | |||
| 7 | It is not currently clear what the best way to deal with this is; it | ||
| 8 | has been proposed to define a new XML feature name that old gdb will | ||
| 9 | ignore but newer gdb can handle. Since QEMU's 8.0 release is | ||
| 10 | imminent and at least one of our CI runners is now falling over this, | ||
| 11 | disable the pauth XML for the moment. We can follow up with a more | ||
| 12 | considered fix either in time for 8.0 or else for the 8.1 release. | ||
| 6 | 13 | ||
| 7 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 14 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
| 8 | Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
| 9 | Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> | ||
| 10 | Message-id: 20201101133258.4240-1-peter.maydell@linaro.org | ||
| 11 | --- | 15 | --- |
| 12 | hw/input/ps2.c | 9 --------- | 16 | target/arm/gdbstub.c | 7 +++++++ |
| 13 | 1 file changed, 9 deletions(-) | 17 | 1 file changed, 7 insertions(+) |
| 14 | 18 | ||
| 15 | diff --git a/hw/input/ps2.c b/hw/input/ps2.c | 19 | diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c |
| 16 | index XXXXXXX..XXXXXXX 100644 | 20 | index XXXXXXX..XXXXXXX 100644 |
| 17 | --- a/hw/input/ps2.c | 21 | --- a/target/arm/gdbstub.c |
| 18 | +++ b/hw/input/ps2.c | 22 | +++ b/target/arm/gdbstub.c |
| 19 | @@ -XXX,XX +XXX,XX @@ | 23 | @@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu) |
| 20 | 24 | aarch64_gdb_set_fpu_reg, | |
| 21 | #include "trace.h" | 25 | 34, "aarch64-fpu.xml", 0); |
| 22 | 26 | } | |
| 23 | -/* debug PC keyboard */ | 27 | +#if 0 |
| 24 | -//#define DEBUG_KBD | 28 | + /* |
| 25 | - | 29 | + * GDB versions 9 through 12 have a bug which means they will |
| 26 | -/* debug PC keyboard : only mouse */ | 30 | + * crash if they see this XML from QEMU; disable it for the 8.0 |
| 27 | -//#define DEBUG_MOUSE | 31 | + * release, pending a better solution. |
| 28 | - | 32 | + */ |
| 29 | /* Keyboard Commands */ | 33 | if (isar_feature_aa64_pauth(&cpu->isar)) { |
| 30 | #define KBD_CMD_SET_LEDS 0xED /* Set keyboard leds */ | 34 | gdb_register_coprocessor(cs, aarch64_gdb_get_pauth_reg, |
| 31 | #define KBD_CMD_ECHO 0xEE | 35 | aarch64_gdb_set_pauth_reg, |
| 32 | @@ -XXX,XX +XXX,XX @@ void ps2_write_mouse(void *opaque, int val) | 36 | 4, "aarch64-pauth.xml", 0); |
| 33 | PS2MouseState *s = (PS2MouseState *)opaque; | 37 | } |
| 34 | 38 | +#endif | |
| 35 | trace_ps2_write_mouse(opaque, val); | 39 | #endif |
| 36 | -#ifdef DEBUG_MOUSE | 40 | } else { |
| 37 | - printf("kbd: write mouse 0x%02x\n", val); | 41 | if (arm_feature(env, ARM_FEATURE_NEON)) { |
| 38 | -#endif | ||
| 39 | switch(s->common.write_cmd) { | ||
| 40 | default: | ||
| 41 | case -1: | ||
| 42 | -- | 42 | -- |
| 43 | 2.20.1 | 43 | 2.34.1 |
| 44 | |||
| 45 | diff view generated by jsdifflib |