Skip to content
Snippets Groups Projects
  1. May 11, 2021
  2. May 10, 2021
    • Peter Maydell's avatar
      Merge remote-tracking branch 'remotes/kraxel/tags/usb-20210505-pull-request' into staging · e4f3ede9
      Peter Maydell authored
      
      usb: fix some memory allocation issues (CVE-2021-3527).
      usb: add stubs, allow building without usb subsystem.
      
      # gpg: Signature made Wed 05 May 2021 14:07:02 BST
      # gpg:                using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
      # Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138
      
      * remotes/kraxel/tags/usb-20210505-pull-request:
        usb: limit combined packets to 1 MiB (CVE-2021-3527)
        usb/mtp: avoid dynamic stack allocation
        usb/redir: avoid dynamic stack allocation (CVE-2021-3527)
        usb/hid: avoid dynamic stack allocation
        hw/usb: Do not build USB subsystem if not required
        hw/usb/host-stub: Remove unused header
      
      Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      e4f3ede9
    • Peter Maydell's avatar
      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210510-1' into staging · e58c7a3b
      Peter Maydell authored
      
      target-arm queue:
       * docs: fix link in sbsa description
       * linux-user/aarch64: Enable hwcap for RND, BTI, and MTE
       * target/arm: Fix tlbbits calculation in tlbi_aa64_vae2is_write()
       * target/arm: Split neon and vfp translation to their own
         compilation units
       * target/arm: Make WFI a NOP for userspace emulators
       * hw/sd/omap_mmc: Use device_cold_reset() instead of
         device_legacy_reset()
       * include: More fixes for 'extern "C"' block use
       * hw/arm/imx25_pdk: Fix error message for invalid RAM size
       * hw/arm/mps2-tz: Implement AN524 memory remapping via machine property
       * hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9
      
      # gpg: Signature made Mon 10 May 2021 17:26:55 BST
      # gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
      # gpg:                issuer "peter.maydell@linaro.org"
      # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
      # gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
      # gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
      # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE
      
      * remotes/pmaydell/tags/pull-target-arm-20210510-1: (26 commits)
        hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9
        hw/arm/mps2-tz: Implement AN524 memory remapping via machine property
        hw/misc/mps2-scc: Support using CFG0 bit 0 for remapping
        hw/misc/mps2-scc: Add "QEMU interface" comment
        hw/arm/imx25_pdk: Fix error message for invalid RAM size
        include/disas/dis-asm.h: Handle being included outside 'extern "C"'
        include/qemu/bswap.h: Handle being included outside extern "C" block
        osdep: Make os-win32.h and os-posix.h handle 'extern "C"' themselves
        hw/sd/omap_mmc: Use device_cold_reset() instead of device_legacy_reset()
        target/arm: Make WFI a NOP for userspace emulators
        target/arm: Make translate-neon.c.inc its own compilation unit
        target/arm: Make functions used by translate-neon global
        target/arm: Move NeonGenThreeOpEnvFn typedef to translate.h
        target/arm: Delete unused typedef
        target/arm: Move vfp_reg_ptr() to translate-neon.c.inc
        target/arm: Make translate-vfp.c.inc its own compilation unit
        target/arm: Make functions used by translate-vfp global
        target/arm: Move vfp_{load, store}_reg{32, 64} to translate-vfp.c.inc
        target/arm: Move gen_aa32 functions to translate-a32.h
        target/arm: Split m-nocp trans functions into their own file
        ...
      
      Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      e58c7a3b
    • Guenter Roeck's avatar
      hw/arm/xlnx: Fix PHY address for xilinx-zynq-a9 · c3080fbd
      Guenter Roeck authored
      
      Commit dfc38879 ("hw/arm: xlnx: Set all boards' GEM 'phy-addr'
      property value to 23") configured the PHY address for xilinx-zynq-a9
      to 23. When trying to boot xilinx-zynq-a9 with zynq-zc702.dtb or
      zynq-zc706.dtb, this results in the following error message when
      trying to use the Ethernet interface.
      
      macb e000b000.ethernet eth0: Could not attach PHY (-19)
      
      The devicetree files for ZC702 and ZC706 configure PHY address 7. The
      documentation for the ZC702 and ZC706 evaluation boards suggest that the
      PHY address is 7, not 23. Other boards use PHY address 0, 1, 3, or 7.
      I was unable to find a documentation or a devicetree file suggesting
      or using PHY address 23. The Ethernet interface starts working with
      zynq-zc702.dtb and zynq-zc706.dtb when setting the PHY address to 7,
      so let's use it.
      
      Cc: Bin Meng <bin.meng@windriver.com>
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Reviewed-by: default avatarBin Meng <bmeng.cn@gmail.com>
      Acked-by: default avatarEdgar E. Iglesias <edgar.iglesias@xilinx.com>
      Message-id: 20210504124140.1100346-1-linux@roeck-us.net
      Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      c3080fbd
    • Peter Maydell's avatar
      hw/arm/mps2-tz: Implement AN524 memory remapping via machine property · f1dfab0d
      Peter Maydell authored
      
      The AN524 FPGA image supports two memory maps, which differ in where
      the QSPI and BRAM are.  In the default map, the BRAM is at
      0x0000_0000, and the QSPI at 0x2800_0000.  In the second map, they
      are the other way around.
      
      In hardware, the initial mapping can be selected by the user by
      writing either "REMAP: BRAM" (the default) or "REMAP: QSPI" in the
      board configuration file.  The board config file is acted on by the
      "Motherboard Configuration Controller", which is an entirely separate
      microcontroller on the dev board but outside the FPGA.
      
      The guest can also dynamically change the mapping via the SCC
      CFG_REG0 register.
      
      Implement this functionality for QEMU, using a machine property
      "remap" with valid values "BRAM" and "QSPI" to allow the user to set
      the initial mapping, in the same way they can on the FPGA, and
      wiring up the bit from the SCC register to also switch the mapping.
      
      Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      Reviewed-by: default avatarRichard Henderson <richard.henderson@linaro.org>
      Reviewed-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
      Message-id: 20210504120912.23094-4-peter.maydell@linaro.org
      f1dfab0d
    • Peter Maydell's avatar
      hw/misc/mps2-scc: Support using CFG0 bit 0 for remapping · 5bddf92e
      Peter Maydell authored
      
      On some boards, SCC config register CFG0 bit 0 controls whether
      parts of the board memory map are remapped. Support this with:
       * a device property scc-cfg0 so the board can specify the
         initial value of the CFG0 register
       * an outbound GPIO line which tracks bit 0 and which the board
         can wire up to provide the remapping
      
      Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      Reviewed-by: default avatarRichard Henderson <richard.henderson@linaro.org>
      Reviewed-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
      Message-id: 20210504120912.23094-3-peter.maydell@linaro.org
      5bddf92e
    • Peter Maydell's avatar
      hw/misc/mps2-scc: Add "QEMU interface" comment · c52c266d
      Peter Maydell authored
      
      The MPS2 SCC device doesn't have any documentation of its properties;
      add a "QEMU interface" format comment describing them.
      
      Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      Reviewed-by: default avatarRichard Henderson <richard.henderson@linaro.org>
      Message-id: 20210504120912.23094-2-peter.maydell@linaro.org
      c52c266d
    • Philippe Mathieu-Daudé's avatar
      hw/arm/imx25_pdk: Fix error message for invalid RAM size · f463684f
      Philippe Mathieu-Daudé authored
      
      The i.MX25 PDK board has 2 banks for SDRAM, each can
      address up to 256 MiB. So the total RAM usable for this
      board is 512M. When we ask for more we get a misleading
      error message:
      
        $ qemu-system-arm -M imx25-pdk -m 513M
        qemu-system-arm: Invalid RAM size, should be 128 MiB
      
      Update the error message to better match the reality:
      
        $ qemu-system-arm -M imx25-pdk -m 513M
        qemu-system-arm: RAM size more than 512 MiB is not supported
      
      Fixes: bf350daa ("arm/imx25_pdk: drop RAM size fixup")
      Signed-off-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
      Reviewed-by: default avatarRichard Henderson <richard.henderson@linaro.org>
      Reviewed-by: default avatarIgor Mammedov <imammedo@redhat.com>
      Message-id: 20210407225608.1882855-1-f4bug@amsat.org
      Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      f463684f
    • Peter Maydell's avatar
      include/disas/dis-asm.h: Handle being included outside 'extern "C"' · 2c316f9a
      Peter Maydell authored
      
      Make dis-asm.h handle being included outside an 'extern "C"' block;
      this allows us to remove the 'extern "C"' blocks that our two C++
      files that include it are using.
      
      Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      Reviewed-by: default avatarRichard Henderson <richard.henderson@linaro.org>
      2c316f9a
    • Peter Maydell's avatar
      include/qemu/bswap.h: Handle being included outside extern "C" block · b30a8c24
      Peter Maydell authored
      
      Make bswap.h handle being included outside an 'extern "C"' block:
      all system headers are included first, then all declarations are
      put inside an 'extern "C"' block.
      
      This requires a little rearrangement as currently we have an ifdef
      ladder that has some system includes and some local declarations
      or definitions, and we need to separate those out.
      
      We want to do this because dis-asm.h includes bswap.h, dis-asm.h
      may need to be included from C++ files, and system headers should
      not be included within 'extern "C"' blocks.
      
      Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      Reviewed-by: default avatarRichard Henderson <richard.henderson@linaro.org>
      b30a8c24
    • Peter Maydell's avatar
      osdep: Make os-win32.h and os-posix.h handle 'extern "C"' themselves · 415a9fb8
      Peter Maydell authored
      
      Both os-win32.h and os-posix.h include system header files. Instead
      of having osdep.h include them inside its 'extern "C"' block, make
      these headers handle that themselves, so that we don't include the
      system headers inside 'extern "C"'.
      
      This doesn't fix any current problems, but it's conceptually the
      right way to handle system headers.
      
      Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      Reviewed-by: default avatarRichard Henderson <richard.henderson@linaro.org>
      415a9fb8
    • Peter Maydell's avatar
      hw/sd/omap_mmc: Use device_cold_reset() instead of device_legacy_reset() · f16a3bf8
      Peter Maydell authored
      
      The omap_mmc_reset() function resets its SD card via
      device_legacy_reset().  We know that the SD card does not have a qbus
      of its own, so the new device_cold_reset() function (which resets
      both the device and its child buses) is equivalent here to
      device_legacy_reset() and we can just switch to the new API.
      
      Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      Reviewed-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
      Message-id: 20210430222348.8514-1-peter.maydell@linaro.org
      f16a3bf8
    • Peter Maydell's avatar
      target/arm: Make WFI a NOP for userspace emulators · 5b2c8af8
      Peter Maydell authored
      The WFI insn is not system-mode only, though it doesn't usually make
      a huge amount of sense for userspace code to execute it.  Currently
      if you try it in qemu-arm then the helper function will raise an
      EXCP_HLT exception, which is not covered by the switch in cpu_loop()
      and results in an abort:
      
      qemu: unhandled CPU exception 0x10001 - aborting
      R00=00000001 R01=408003e4 R02=408003ec R03=000102ec
      R04=00010a28 R05=00010158 R06=00087460 R07=00010158
      R08=00000000 R09=00000000 R10=00085b7c R11=408002a4
      R12=408002b8 R13=408002a0 R14=0001057c R15=000102f8
      PSR=60000010 -ZC- A usr32
      qemu:handle_cpu_signal received signal outside vCPU context @ pc=0x7fcbfa4f0a12
      
      Make the WFI helper function return immediately in the usermode
      emulator. This turns WFI into a NOP, which is OK because:
       * architecturally "WFI is a NOP" is a permitted implementation
       * aarch64 Linux kernels use the SCTLR_EL1.nTWI bit to trap
         userspace WFI and NOP it (though aarch32 kernels currently
         just let WFI do whatever it would do)
      
      We could in theory make the translate.c code special case user-mode
      emulation and NOP the insn entirely rather than making the helper
      do nothing, but because no real world code will be trying to
      execute WFI we don't care about efficiency and the helper provides
      a single place where we can make the change rather than having
      to touch multiple places in translate.c and translate-a64.c.
      
      Fixes: https://bugs.launchpad.net/qemu/+bug/1926759
      
      
      Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      Reviewed-by: default avatarRichard Henderson <richard.henderson@linaro.org>
      Message-id: 20210430162212.825-1-peter.maydell@linaro.org
      5b2c8af8
    • Peter Maydell's avatar
      target/arm: Make translate-neon.c.inc its own compilation unit · 4800b852
      Peter Maydell authored
      
      Switch translate-neon.c.inc from being #included into translate.c
      to being its own compilation unit.
      
      Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      Reviewed-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
      Reviewed-by: default avatarRichard Henderson <richard.henderson@linaro.org>
      Message-id: 20210430132740.10391-14-peter.maydell@linaro.org
      4800b852
Loading