[PATCH v2 1/6] fuzz: Make fork_fuzz.ld compatible with LLVM's LLD

2020-10-23 Thread Daniele Buono
LLVM's linker, LLD, supports the keyword "INSERT AFTER", starting with version 11. However, when multiple sections are defined in the same "INSERT AFTER", they are added in a reversed order, compared to BFD's LD. This patch makes fork_fuzz.ld generic enough to work with both linkers. Each section

[PATCH v2 0/6] Add support for Control-Flow Integrity

2020-10-23 Thread Daniele Buono
v2: Several months (and structural changes in QEMU) have passed since v1. While the spirit of the patch is similar, the implementation is changed in multiple points, and should address most if not all the comments received in v1. * Instead of disabling CFI in specific functions by using a filter fi

[PATCH v2 3/6] configure: add option to enable LTO

2020-10-23 Thread Daniele Buono
This patch allows to compile QEMU with link-time optimization (LTO). Compilation with LTO is handled directly by meson. This patch adds checks in configure to make sure the toolchain supports LTO. Currently, allow LTO only with clang, since I have found a couple of issues with gcc-based LTO. In c

[PATCH v2 2/6] configure: avoid new clang 11+ warnings

2020-10-23 Thread Daniele Buono
Clang 11 finds a couple of spots in the code that trigger new warnings: ../qemu-base/hw/usb/dev-uas.c:157:31: error: field 'status' with variable sized type 'uas_iu' not at the end of a struct or class is a GNU extension [-Werror,-Wgnu-variable-sized-type-not-at-end] uas_iu

[PATCH v2 6/6] configure: add support for Control-Flow Integrity

2020-10-23 Thread Daniele Buono
This patch adds a flag to enable/disable control flow integrity checks on indirect function calls. This feature only allows indirect function calls at runtime to functions with compatible signatures. This feature is only provided by LLVM/Clang, and depends on link-time optimization which is curren

[PATCH v2 4/6] cfi: Initial support for cfi-icall in QEMU

2020-10-23 Thread Daniele Buono
LLVM/Clang, supports runtime checks for forward-edge Control-Flow Integrity (CFI). CFI on indirect function calls (cfi-icall) ensures that, in indirect function calls, the function called is of the right signature for the pointer type defined at compile time. For this check to work, the code must

[PATCH v2 5/6] check-block: enable iotests with cfi-icall

2020-10-23 Thread Daniele Buono
cfi-icall is a form of Control-Flow Integrity for indirect function calls implemented by llvm. It is enabled with a -fsanitize flag. iotests are currently disabled when -fsanitize options is used, with the exception of SafeStack. This patch implements a generic filtering mechanism to allow iotest

Re: [PATCH v5 12/12] qapi: Use QAPI_LIST_ADD() where possible

2020-10-23 Thread Eric Blake
On 10/23/20 1:36 PM, Eric Blake wrote: > Anywhere we create a list of just one item or by prepending items > (typically because order doesn't matter), we can use the now-public > macro. But places where we must keep the list in order by appending > remain open-coded. > > Signed-off-by: Eric Blake

Re: [PATCH v2 0/6] Add support for Control-Flow Integrity

2020-10-23 Thread Eric Blake
On 10/23/20 3:06 PM, Daniele Buono wrote: > v2: Several months (and structural changes in QEMU) have passed since v1. > While the spirit of the patch is similar, the implementation is changed > in multiple points, and should address most if not all the comments > received in v1. > 5) Most of the l

[PATCH v3 2/6] Move npcm7xx_timer_reached_zero call out of npcm7xx_timer_pause

2020-10-23 Thread Havard Skinnemoen via
This allows us to reuse npcm7xx_timer_pause for the watchdog timer. Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Havard Skinnemoen --- hw/timer/npcm7xx_timer.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hw/timer/npcm7xx_timer.c b/hw/timer/npcm7xx_timer.c ind

[PATCH v3 1/6] tests/qtest: Make npcm7xx_timer-test conditional on CONFIG_NPCM7XX

2020-10-23 Thread Havard Skinnemoen via
This test won't work if qemu was compiled without CONFIG_NPCM7XX, as pointed out by Thomas Huth on a different patch. Signed-off-by: Havard Skinnemoen --- tests/qtest/meson.build | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/qtest/meson.build b/tests/qtest/meson.bui

[PATCH v3 4/6] hw/misc: Add npcm7xx random number generator

2020-10-23 Thread Havard Skinnemoen via
The RNG module returns a byte of randomness when the Data Valid bit is set. This implementation ignores the prescaler setting, and loads a new value into RNGD every time RNGCS is read while the RNG is enabled and random data is available. A qtest featuring some simple randomness tests is included

[PATCH v3 0/6] Additional NPCM7xx features, devices and tests

2020-10-23 Thread Havard Skinnemoen via
This is an update to the initial NPCM7xx patch series adding - Watchdog timer support. This makes the reboot command work. - Random Number Generator device. - USB Host Controllers. - GPIO Controllers. The watchdog was implemented by my new teammate Hao Wu. Expect to see more patches from

[PATCH v3 5/6] hw/arm/npcm7xx: Add EHCI and OHCI controllers

2020-10-23 Thread Havard Skinnemoen via
The NPCM730 and NPCM750 chips have a single USB host port shared between a USB 2.0 EHCI host controller and a USB 1.1 OHCI host controller. This adds support for both of them. Testing notes: * With -device usb-kbd, qemu will automatically insert a full-speed hub, and the keyboard becomes con

[PATCH v3 3/6] hw/timer: Adding watchdog for NPCM7XX Timer.

2020-10-23 Thread Havard Skinnemoen via
From: Hao Wu The watchdog is part of NPCM7XX's timer module. Its behavior is controlled by the WTCR register in the timer. When enabled, the watchdog issues an interrupt signal after a pre-set amount of cycles, and issues a reset signal shortly after that. Reviewed-by: Tyrone Ting Signed-off-b

[PATCH v3 6/6] hw/gpio: Add GPIO model for Nuvoton NPCM7xx

2020-10-23 Thread Havard Skinnemoen via
The NPCM7xx chips have multiple GPIO controllers that are mostly identical except for some minor differences like the reset values of some registers. Each controller controls up to 32 pins. Each individual pin is modeled as a pair of unnamed GPIOs -- one for emitting the actual pin state, and one

[PATCH 0/2] riscv: Add SiFive test device to sifive targets

2020-10-23 Thread Keith Packard via
The SiFive test device, which is already available in the qemu tree, allows the system under emulation to shut down qemu. This is currently used by OpenSBI to terminate QEMU at powerdown time. These two patches add this device to the two sifive models.

[PATCH 1/2] riscv: Add sifive test device to sifive_e target

2020-10-23 Thread Keith Packard via
The SiFive test device provides a mechanism for terminating the qemu instance from the emulated system. This patch adds that device to the sifive_e target. Signed-off-by: Keith Packard --- hw/riscv/sifive_e.c | 4 include/hw/riscv/sifive_e.h | 1 + 2 files changed, 5 insertions(+)

[PATCH 2/2] riscv: Add sifive test device to sifive_u target

2020-10-23 Thread Keith Packard via
The SiFive test device provides a mechanism for terminating the qemu instance from the emulated system. This patch adds that device to the sifive_u target, including constructing a suitable FDT node. Signed-off-by: Keith Packard --- hw/riscv/sifive_u.c | 15 +++ include/hw/ri

[PATCH] riscv: Add semihosting support [v8]

2020-10-23 Thread Keith Packard via
Adapt the arm semihosting support code for RISCV. This implementation is based on the standard for RISC-V semihosting version 0.2 as documented in https://github.com/riscv/riscv-semihosting-spec/releases/tag/0.2 Signed-off-by: Keith Packard --- v2: Update PC after exception is handl

Re: [PATCH v1 1/5] target/riscv: Add a virtualised MMU Mode

2020-10-23 Thread Alistair Francis
On Fri, Oct 23, 2020 at 12:13 PM Richard Henderson wrote: > > On 10/23/20 8:26 AM, Alistair Francis wrote: > > +++ b/target/riscv/cpu-param.h > > @@ -18,6 +18,6 @@ > > # define TARGET_VIRT_ADDR_SPACE_BITS 32 /* sv32 */ > > #endif > > #define TARGET_PAGE_BITS 12 /* 4 KiB Pages */ > > -#define NB

Re: [PATCH 1/2] hw/riscv: sifive_u: Allow passing custom DTB

2020-10-23 Thread Alistair Francis
On Wed, Oct 21, 2020 at 10:33 PM Anup Patel wrote: > > Extend sifive_u machine to allow passing custom DTB using "-dtb" > command-line parameter. This will help users pass modified DTB > or Linux SiFive DTB to sifive_u machine. > > Signed-off-by: Anup Patel Reviewed-by: Alistair Francis Alista

Re: [PATCH 2/2] hw/riscv: virt: Allow passing custom DTB

2020-10-23 Thread Alistair Francis
On Wed, Oct 21, 2020 at 10:34 PM Anup Patel wrote: > > Extend virt machine to allow passing custom DTB using "-dtb" > command-line parameter. This will help users pass modified DTB > to virt machine. > > Signed-off-by: Anup Patel Reviewed-by: Alistair Francis Alistair > --- > hw/riscv/virt.c

Re: [PATCH 1/2] riscv: Add sifive test device to sifive_e target

2020-10-23 Thread Alistair Francis
On Fri, Oct 23, 2020 at 2:45 PM Keith Packard via wrote: > > The SiFive test device provides a mechanism for terminating the qemu > instance from the emulated system. This patch adds that device to the > sifive_e target. > > Signed-off-by: Keith Packard > --- > hw/riscv/sifive_e.c | 4 ++

Re: [PATCH 2/2] riscv: Add sifive test device to sifive_u target

2020-10-23 Thread Alistair Francis
On Fri, Oct 23, 2020 at 2:48 PM Keith Packard via wrote: > > The SiFive test device provides a mechanism for terminating the qemu > instance from the emulated system. This patch adds that device to the > sifive_u target, including constructing a suitable FDT node. > > Signed-off-by: Keith Packard

Re: [PATCH V3 1/6] target/riscv: Merge m/vsstatus and m/vsstatush into one uint64_t unit

2020-10-23 Thread Alistair Francis
On Fri, Oct 23, 2020 at 2:17 AM Yifei Jiang wrote: > > mstatus/mstatush and vsstatus/vsstatush are two halved for RISCV32. > This patch expands mstatus and vsstatus to uint64_t instead of > target_ulong so that it can be saved as one unit and reduce some > ifdefs in the code. > > Signed-off-by: Yi

Re: [PATCH V3 2/6] target/riscv: Add basic vmstate description of CPU

2020-10-23 Thread Alistair Francis
On Fri, Oct 23, 2020 at 2:13 AM Yifei Jiang wrote: > > Add basic CPU state description to the newly created machine.c > > Signed-off-by: Yifei Jiang > Signed-off-by: Yipeng Yin Reviewed-by: Alistair Francis Alistair > --- > target/riscv/cpu.c | 8 + > target/riscv/internals.h |

Re: [PATCH V3 3/6] target/riscv: Add PMP state description

2020-10-23 Thread Alistair Francis
On Fri, Oct 23, 2020 at 2:16 AM Yifei Jiang wrote: > > In the case of supporting PMP feature, add PMP state description > to vmstate_riscv_cpu. > > 'vmstate_pmp_addr' and 'num_rules' could be regenerated by > pmp_update_rule(). But there exists the problem of updating > num_rules repeatedly in pmp

Re: [PATCH V3 4/6] target/riscv: Add H extension state description

2020-10-23 Thread Alistair Francis
On Fri, Oct 23, 2020 at 2:16 AM Yifei Jiang wrote: > > In the case of supporting H extension, add H extension description > to vmstate_riscv_cpu. > > Signed-off-by: Yifei Jiang > Signed-off-by: Yipeng Yin Reviewed-by: Alistair Francis Alistair > --- > target/riscv/machine.c | 47 +++

Re: [PATCH V3 5/6] target/riscv: Add V extension state description

2020-10-23 Thread Alistair Francis
On Fri, Oct 23, 2020 at 2:18 AM Yifei Jiang wrote: > > In the case of supporting V extension, add V extension description > to vmstate_riscv_cpu. > > Signed-off-by: Yifei Jiang > Signed-off-by: Yipeng Yin > Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis Alistair > --- > targe

Re: [PATCH V3 6/6] target/riscv: Add sifive_plic vmstate

2020-10-23 Thread Alistair Francis
On Fri, Oct 23, 2020 at 2:13 AM Yifei Jiang wrote: > > Add sifive_plic vmstate for supporting sifive_plic migration. > Current vmstate framework only supports one structure parameter > as num field to describe variable length arrays, so introduce > num_enables. > > Signed-off-by: Yifei Jiang > Si

Re: [PATCH 1/2] riscv: Add sifive test device to sifive_e target

2020-10-23 Thread Keith Packard
Alistair Francis writes: > I don't see this mentioned in the FE310 data sheet. Is it included in > the hardware? This is strictly a virtual device used to support 'power off' when running under QEMU. We need either this or semihosting support for doing automated testing. Our tests currently use

Re: [PATCH 1/2] riscv: Add sifive test device to sifive_e target

2020-10-23 Thread Alistair Francis
On Fri, Oct 23, 2020 at 5:13 PM Keith Packard wrote: > > Alistair Francis writes: > > > I don't see this mentioned in the FE310 data sheet. Is it included in > > the hardware? > > This is strictly a virtual device used to support 'power off' when > running under QEMU. We need either this or semih

Re: [PATCH 2/2] riscv: Add sifive test device to sifive_u target

2020-10-23 Thread Keith Packard
Alistair Francis writes: > I also don't see this in the FU540 memory map. Same as for the FE310 -- this is a QEMU-only device. In addition, OpenSBI expects to use this when built for QEMU. -- -keith signature.asc Description: PGP signature

Re: [PATCH] riscv: Add semihosting support [v8]

2020-10-23 Thread Alistair Francis
On Fri, Oct 23, 2020 at 2:51 PM Keith Packard via wrote: > > Adapt the arm semihosting support code for RISCV. This implementation > is based on the standard for RISC-V semihosting version 0.2 as > documented in > >https://github.com/riscv/riscv-semihosting-spec/releases/tag/0.2 > > Signed-off

Re: [PATCH v6 1/6] [RISCV_PM] Add J-extension into RISC-V

2020-10-23 Thread Alistair Francis
On Thu, Oct 22, 2020 at 1:05 AM Alexey Baturo wrote: > > Signed-off-by: Alexey Baturo > --- > target/riscv/cpu.c | 1 + > target/riscv/cpu.h | 2 ++ > 2 files changed, 3 insertions(+) > > diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c > index 0bbfd7f457..4e305249b3 100644 > --- a/target/ri

Re: [PATCH v6 0/6] RISC-V Pointer Masking implementation

2020-10-23 Thread Alistair Francis
On Thu, Oct 22, 2020 at 1:04 AM Alexey Baturo wrote: > > Hi, > > Added missing sign-off on the first patch. > > Thanks > > Alexey Baturo (5): > [RISCV_PM] Add J-extension into RISC-V > [RISCV_PM] Support CSRs required for RISC-V PM extension except for > ones in hypervisor mode > [RISCV_

Re: [PATCH v1 3/4] device_tree: add qemu_fdt_setprop_string_array helper

2020-10-23 Thread Alistair Francis
On Wed, Oct 21, 2020 at 10:11 AM Alex Bennée wrote: > > A string array in device tree is simply a series of \0 terminated > strings next to each other. As libfdt doesn't support that directly > we need to build it ourselves. > > Signed-off-by: Alex Bennée Reviewed-by: Alistair Francis Alistair

Re: [PATCH v1 4/4] hw/core: implement a guest-loader to support static hypervisor guests

2020-10-23 Thread Alistair Francis
On Wed, Oct 21, 2020 at 10:09 AM Alex Bennée wrote: > > Hypervisors, especially type-1 ones, need the firmware/bootcode to put > their initial guest somewhere in memory and pass the information to it > via platform data. The guest-loader is modelled after the generic > loader for exactly this sort

Re: [RFC PATCH 0/4] tests/acceptance: Test U-Boot/Linux from Armbian 20.08 on Orange Pi PC

2020-10-23 Thread Bin Meng
Hi Philippe, On Sat, Oct 24, 2020 at 1:56 AM Philippe Mathieu-Daudé wrote: > > On 10/23/20 7:42 PM, Bin Meng wrote: > > Hi Philippe, > > > > On Fri, Oct 23, 2020 at 9:18 PM Philippe Mathieu-Daudé > > wrote: > >> > >> Series meant to help Bin Meng to debug the SD card issue > >> reported by Mich

[PATCH] hw/sd: Zero out function selection fields before being populated

2020-10-23 Thread Bin Meng
From: Bin Meng The function selection fields (399:376) should be zeroed out to prevent leftover from being or'ed into the switch function status data structure. This fixes the boot failure as seen in the acceptance testing on the orangepi target. Fixes: b638627c723a ("hw/sd: Fix incorrect popul

Re: Ramping up Continuous Fuzzing of Virtual Devices in QEMU

2020-10-23 Thread Li Qiang
Alexander Bulekov 于2020年10月23日周五 上午12:20写道: > > Hello, > QEMU was accepted into Google's oss-fuzz continuous-fuzzing platform [1] > earlier this year. The fuzzers currently running on oss-fuzz are based on my > 2019 Google Summer of Code Project, which leveraged libfuzzer, qtest and > libqos > to

Re: [PATCH v2 2/6] configure: avoid new clang 11+ warnings

2020-10-23 Thread Thomas Huth
On 23/10/2020 22.06, Daniele Buono wrote: > Clang 11 finds a couple of spots in the code that trigger new warnings: > > ../qemu-base/hw/usb/dev-uas.c:157:31: error: field 'status' with variable > sized type 'uas_iu' not at the end of a struct or class is a GNU extension > [-Werror,-Wgnu-variable

Re: [PATCH v3 1/6] tests/qtest: Make npcm7xx_timer-test conditional on CONFIG_NPCM7XX

2020-10-23 Thread Thomas Huth
On 23/10/2020 23.06, Havard Skinnemoen wrote: > This test won't work if qemu was compiled without CONFIG_NPCM7XX, as > pointed out by Thomas Huth on a different patch. > > Signed-off-by: Havard Skinnemoen > --- > tests/qtest/meson.build | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) >

Re: [PATCH 1/4] qdev: Fix two typos

2020-10-23 Thread Thomas Huth
On 19/10/2020 18.36, Maxim Levitsky wrote: > Signed-off-by: Maxim Levitsky > --- > include/hw/qdev-core.h | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h > index 868973319e..3761186804 100644 > --- a/include/hw/qdev-cor

Re: [PATCH 3/4] libqtest: fix memory leak in the qtest_qmp_event_ref

2020-10-23 Thread Thomas Huth
On 19/10/2020 18.37, Maxim Levitsky wrote: > The g_list_remove_link doesn't free the link element, > opposed to what I thought. > Switch to g_list_delete_link that does free it. > > Also refactor the code a bit. > Thanks for Max Reitz for helping me with this. > > Signed-off-by: Maxim Levitsky >

Re: [PATCH v4 06/12] tests/qtest/qos-test: dump environment variables if verbose

2020-10-23 Thread Thomas Huth
On 08/10/2020 20.34, Christian Schoenebeck wrote: > If qtests are run in verbose mode (i.e. if --verbose CL argument > was provided) then print all environment variables to stdout > before running the individual tests. Why? ... you should provide some rationale in the patch description here, at le

Re: [PATCH] riscv: Add semihosting support [v8]

2020-10-23 Thread Keith Packard
Alistair Francis writes: Thanks much for taking time to review this patch in detail. I've left the indicated changes in a new version of my riscv-semihost branch here: https://github.com/keith-packard/qemu/tree/riscv-semihost I'll post a new version once we've wound up discussion on the

Re: [PATCH 1/2] riscv: Add sifive test device to sifive_e target

2020-10-23 Thread Keith Packard
Alistair Francis writes: > The sifive_u and sifive_e model real hardware (the names are confusing > I agree) so I would rather not add a virtual device. That seems reasonable; semihosting will be a much better solution for the long term anyways. I posted this because we've been maintaining it ou

Re: [PATCH v4 05/12] tests/qtest/qos-test: dump qos graph if verbose

2020-10-23 Thread Thomas Huth
On 08/10/2020 20.34, Christian Schoenebeck wrote: > If qtests were run in verbose mode (i.e. if --verbose CL argument was > provided) then dump the generated qos graph (all nodes and edges, > along with their current individual availability status) to stdout. > > See API doc comment on function qo

Re: [PATCH v4 04/12] libqos/qgraph: add qos_dump_graph()

2020-10-23 Thread Thomas Huth
On 08/10/2020 20.34, Christian Schoenebeck wrote: > This new function is purely for debugging purposes. It prints the > current qos graph to stdout and allows to identify problems in the > created qos graph e.g. when writing new qos tests. > > Coloured output is used to mark available nodes in gre

Re: [PATCH v4 01/12] libqos/qgraph: add qemu_name to QOSGraphNode

2020-10-23 Thread Thomas Huth
On 19/10/2020 12.35, Christian Schoenebeck wrote: > On Donnerstag, 8. Oktober 2020 20:34:56 CEST Christian Schoenebeck wrote: >> Add new member variable 'qemu_name' to struct QOSGraphNode. >> >> This new member may be optionally set in case a different >> name for the node (which must always be a u

Re: [PATCH 2/6] tests/acceptance: Use .ppm extention for Portable PixMap files

2020-10-23 Thread Thomas Huth
On 21/10/2020 12.50, Philippe Mathieu-Daudé wrote: > The HMP 'screendump' command generates Portable PixMap files. > Make it obvious by using the .ppm file extention. > > Signed-off-by: Philippe Mathieu-Daudé > --- > tests/acceptance/machine_m68k_nextcube.py | 6 +++--- > 1 file changed, 3 inser

Re: [PATCH 3/6] tests/acceptance: Extract tesseract_available() helper in new namespace

2020-10-23 Thread Thomas Huth
On 21/10/2020 12.50, Philippe Mathieu-Daudé wrote: > We are going to reuse tesseract_available(). Extract it to > a new 'tesseract_utils' namespace. > > Signed-off-by: Philippe Mathieu-Daudé > --- > tests/acceptance/machine_m68k_nextcube.py | 25 +++- > tests/acceptance/tesseract

Re: [PATCH 4/6] tests/acceptance: Introduce tesseract_ocr() helper

2020-10-23 Thread Thomas Huth
On 21/10/2020 12.50, Philippe Mathieu-Daudé wrote: > We are going to reuse the tesseract OCR code. > Create a new tesseract_ocr() helper and use it. > > Signed-off-by: Philippe Mathieu-Daudé > --- > tests/acceptance/machine_m68k_nextcube.py | 21 + > tests/acceptance/tesserac

Re: [PATCH 4/6] tests/acceptance: Introduce tesseract_ocr() helper

2020-10-23 Thread Thomas Huth
On 24/10/2020 08.35, Thomas Huth wrote: > On 21/10/2020 12.50, Philippe Mathieu-Daudé wrote: >> We are going to reuse the tesseract OCR code. >> Create a new tesseract_ocr() helper and use it. >> >> Signed-off-by: Philippe Mathieu-Daudé >> --- >> tests/acceptance/machine_m68k_nextcube.py | 21 +++

Re: [PATCH 1/6] tests/acceptance: Remove unused import

2020-10-23 Thread Thomas Huth
On 21/10/2020 12.50, Philippe Mathieu-Daudé wrote: > Signed-off-by: Philippe Mathieu-Daudé > --- > tests/acceptance/machine_m68k_nextcube.py | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/tests/acceptance/machine_m68k_nextcube.py > b/tests/acceptance/machine_m68k_nextcube.py > index 32

<    1   2   3   4   5