Branch: refs/heads/master Home: https://github.com/qemu/qemu Commit: d95f260aee3ea1b12779cdede7456480ea9ea3d1 https://github.com/qemu/qemu/commit/d95f260aee3ea1b12779cdede7456480ea9ea3d1 Author: Peter Maydell <peter.mayd...@linaro.org> Date: 2024-01-15 (Mon, 15 Jan 2024)
Changed paths: M MAINTAINERS A docs/devel/docs.rst M docs/devel/index-build.rst M hmp-commands-info.hx M hmp-commands.hx M qemu-img-cmds.hx M qemu-options.hx Log Message: ----------- docs/devel/docs: Document .hx file syntax We don't currently document the syntax of .hx files anywhere except in a few comments at the top of individual .hx files. We don't even have somewhere in the developer docs where we could do this. Add a new files docs/devel/docs.rst which can be a place to document how our docs build process works. For the moment, put in only a brief introductory paragraph and the documentation of the .hx files. We could later add to this file by for example describing how the QAPI-schema-to-docs process works, or anything else that developers might need to know about how to add documentation. Make the .hx files refer to this doc file, and clean up their header comments to be more accurate for the usage in each file and less cut-n-pasted. Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Reviewed-by: Luc Michel <luc.mic...@amd.com> Reviewed-by: David Woodhouse <d...@amazon.co.uk> Message-id: 20231212162313.1742462-1-peter.mayd...@linaro.org Commit: 71e269fb7bd14b5e4b055b6978a4ab193e11ee8e https://github.com/qemu/qemu/commit/71e269fb7bd14b5e4b055b6978a4ab193e11ee8e Author: Peter Maydell <peter.mayd...@linaro.org> Date: 2024-01-15 (Mon, 15 Jan 2024) Changed paths: M target/arm/ptw.c Log Message: ----------- target/arm: arm_pamax() no longer needs to do feature propagation In arm_pamax(), we need to cope with the virt board calling this function on a CPU object which has been inited but not realize. We used to do propagation of feature-flag implications (such as "V7VE implies LPAE") at realize, so we have some code in arm_pamax() which manually checks for both V7VE and LPAE feature flags. In commit b8f7959f28c4f36 we moved the feature propagation for almost all features from realize to post-init. That means that now when the virt board calls arm_pamax(), the feature propagation has been done. So we can drop the manual propagation handling and check only for the feature we actually care about, which is ARM_FEATURE_LPAE. Retain the comment that the virt board is calling this function with a not completely realized CPU object, because that is a potential beartrap for later changes which is worth calling out. (Note that b8f7959f28c4f36 actually fixed a bug in the arm_pamax() handling: arm_pamax() was missing a check for ARM_FEATURE_V8, so it incorrectly thought that the qemu-system-arm 'max' CPU did not have LPAE and turned off 'highmem' support in the virt board. Following b8f7959f28c4f36 qemu-system-arm 'max' is treated the same as 'cortex-a15' and other v7 LPAE CPUs, because the generic feature propagation code does correctly propagate V8 -> V7VE -> LPAE.) Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Reviewed-by: Richard Henderson <richard.hender...@linaro.org> Message-id: 20240109143804.1118307-1-peter.mayd...@linaro.org Commit: 8cf1da729170b7cc47ebaca46912a4f37675dc95 https://github.com/qemu/qemu/commit/8cf1da729170b7cc47ebaca46912a4f37675dc95 Author: Peter Maydell <peter.mayd...@linaro.org> Date: 2024-01-15 (Mon, 15 Jan 2024) Changed paths: M docs/system/arm/virt.rst Log Message: ----------- docs/system/arm/virt.rst: Improve 'highmem' option docs Improve the 'highmem' option docs to note that by default we assume that a 32-bit kernel on an LPAE-capable CPU has LPAE enabled, and what the consequences are. Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Reviewed-by: Alex Bennée <alex.ben...@linaro.org> Reviewed-by: Eric Auger <eric.au...@redhat.com> Message-id: 20240109170834.1387457-1-peter.mayd...@linaro.org Commit: c9948fdd023dd2031d868c8e26f387e6705c918c https://github.com/qemu/qemu/commit/c9948fdd023dd2031d868c8e26f387e6705c918c Author: Inès Varhol <ines.var...@telecom-paris.fr> Date: 2024-01-15 (Mon, 15 Jan 2024) Changed paths: M docs/system/arm/b-l475e-iot01a.rst M hw/misc/Kconfig M hw/misc/meson.build A hw/misc/stm32l4x5_exti.c M hw/misc/trace-events A include/hw/misc/stm32l4x5_exti.h Log Message: ----------- hw/misc: Implement STM32L4x5 EXTI Although very similar to the STM32F4xx EXTI, STM32L4x5 EXTI generates more than 32 event/interrupt requests and thus uses more registers than STM32F4xx EXTI which generates 23 event/interrupt requests. Acked-by: Alistair Francis <alistair.fran...@wdc.com> Signed-off-by: Arnaud Minier <arnaud.min...@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.var...@telecom-paris.fr> Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org> Message-id: 20240109160658.311932-2-ines.var...@telecom-paris.fr Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: 52671f69f7a4cdc235903fd9005ac4b2e4770593 https://github.com/qemu/qemu/commit/52671f69f7a4cdc235903fd9005ac4b2e4770593 Author: Inès Varhol <ines.var...@telecom-paris.fr> Date: 2024-01-15 (Mon, 15 Jan 2024) Changed paths: M hw/arm/Kconfig M hw/arm/stm32l4x5_soc.c M include/hw/arm/stm32l4x5_soc.h Log Message: ----------- hw/arm: Connect STM32L4x5 EXTI to STM32L4x5 SoC Tested-by: Philippe Mathieu-Daudé <phi...@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org> Reviewed-by: Alistair Francis <alistair.fran...@wdc.com> Signed-off-by: Arnaud Minier <arnaud.min...@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.var...@telecom-paris.fr> Message-id: 20240109160658.311932-3-ines.var...@telecom-paris.fr Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: 4cb445717eed79b3b1db0bfe5c4ccf838f895751 https://github.com/qemu/qemu/commit/4cb445717eed79b3b1db0bfe5c4ccf838f895751 Author: Inès Varhol <ines.var...@telecom-paris.fr> Date: 2024-01-15 (Mon, 15 Jan 2024) Changed paths: M tests/qtest/meson.build A tests/qtest/stm32l4x5_exti-test.c Log Message: ----------- tests/qtest: Add STM32L4x5 EXTI QTest testcase Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org> Acked-by: Alistair Francis <alistair.fran...@wdc.com> Signed-off-by: Arnaud Minier <arnaud.min...@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.var...@telecom-paris.fr> Message-id: 20240109160658.311932-4-ines.var...@telecom-paris.fr Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: 20936684b6dd02eec35591661553a57f3515cf5b https://github.com/qemu/qemu/commit/20936684b6dd02eec35591661553a57f3515cf5b Author: Inès Varhol <ines.var...@telecom-paris.fr> Date: 2024-01-15 (Mon, 15 Jan 2024) Changed paths: M docs/system/arm/b-l475e-iot01a.rst M hw/misc/Kconfig M hw/misc/meson.build A hw/misc/stm32l4x5_syscfg.c M hw/misc/trace-events A include/hw/misc/stm32l4x5_syscfg.h Log Message: ----------- hw/misc: Implement STM32L4x5 SYSCFG Acked-by: Alistair Francis <alistair.fran...@wdc.com> Signed-off-by: Arnaud Minier <arnaud.min...@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.var...@telecom-paris.fr> Message-id: 20240109194438.70934-2-ines.var...@telecom-paris.fr Reviewed-by: Peter Maydell <peter.mayd...@linaro.org> Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: 7dfe2312e4653dd796dc2731668ad65237563e39 https://github.com/qemu/qemu/commit/7dfe2312e4653dd796dc2731668ad65237563e39 Author: Inès Varhol <ines.var...@telecom-paris.fr> Date: 2024-01-15 (Mon, 15 Jan 2024) Changed paths: M hw/arm/Kconfig M hw/arm/stm32l4x5_soc.c M include/hw/arm/stm32l4x5_soc.h Log Message: ----------- hw/arm: Connect STM32L4x5 SYSCFG to STM32L4x5 SoC The SYSCFG input GPIOs aren't connected yet. When the STM32L4x5 GPIO device will be implemented, its output GPIOs will be connected to the SYSCFG input GPIOs. Tested-by: Philippe Mathieu-Daudé <phi...@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org> Signed-off-by: Arnaud Minier <arnaud.min...@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.var...@telecom-paris.fr> Reviewed-by: Alistair Francis <alistair.fran...@wdc.com> Message-id: 20240109194438.70934-3-ines.var...@telecom-paris.fr Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: a96bff6157ca89bbf7fc7aabd670fa4072c922cd https://github.com/qemu/qemu/commit/a96bff6157ca89bbf7fc7aabd670fa4072c922cd Author: Inès Varhol <ines.var...@telecom-paris.fr> Date: 2024-01-15 (Mon, 15 Jan 2024) Changed paths: M tests/qtest/meson.build A tests/qtest/stm32l4x5_syscfg-test.c Log Message: ----------- tests/qtest: Add STM32L4x5 SYSCFG QTest testcase Tested-by: Philippe Mathieu-Daudé <phi...@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org> Acked-by: Alistair Francis <alistair.fran...@wdc.com> Signed-off-by: Arnaud Minier <arnaud.min...@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.var...@telecom-paris.fr> Message-id: 20240109194438.70934-4-ines.var...@telecom-paris.fr Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: cfae0537049d10e84a01cf9ce3e2d3833fd8e92d https://github.com/qemu/qemu/commit/cfae0537049d10e84a01cf9ce3e2d3833fd8e92d Author: Thomas Huth <th...@redhat.com> Date: 2024-01-16 (Tue, 16 Jan 2024) Changed paths: M tests/qtest/meson.build Log Message: ----------- tests/qtest/meson.build: Bump the boot-serial-test timeout to 4 minutes When running with TCI, the boot-serial-test can take longer than 3 minutes: https://gitlab.com/qemu-project/qemu/-/jobs/5890481086#L4774 Bump the timeout to 4 minutes to avoid CI failures here. Message-ID: <20240115071146.31213-1-th...@redhat.com> Reviewed-by: "Daniel P. Berrangé" <berra...@redhat.com> Signed-off-by: Thomas Huth <th...@redhat.com> Commit: d9e2da0ccc5b636afc632ba9cb95d83885e2d8dc https://github.com/qemu/qemu/commit/d9e2da0ccc5b636afc632ba9cb95d83885e2d8dc Author: Thomas Huth <th...@redhat.com> Date: 2024-01-16 (Tue, 16 Jan 2024) Changed paths: M tests/qtest/npcm7xx_watchdog_timer-test.c Log Message: ----------- tests/qtest/npcm7xx_watchdog_timer: Only test the corner cases by default The test_prescaler() part in the npcm7xx_watchdog_timer test is quite repetitive, testing all possible combinations of the WTCLK and WTIS bitfields. Since each test spins up a new instance of QEMU, this is rather an expensive test, especially on loaded host systems. For the normal quick test mode, it should be sufficient to test the corner settings of these fields (i.e. 0 and 3), so we can speed up this test in the default mode quite a bit. Message-ID: <20240115070223.30178-1-th...@redhat.com> Reviewed-by: Alex Bennée <alex.ben...@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org> Signed-off-by: Thomas Huth <th...@redhat.com> Commit: 2d1f10229adde680234b8c975a4306b697c3b505 https://github.com/qemu/qemu/commit/2d1f10229adde680234b8c975a4306b697c3b505 Author: Thomas Huth <th...@redhat.com> Date: 2024-01-16 (Tue, 16 Jan 2024) Changed paths: M tests/qtest/meson.build Log Message: ----------- qtest: Bump npcm7xx_watchdog_timer-test timeout to 2 minutes The npcm7xx_watchdog_timer-test can take more than 60 seconds in SPEED=slow mode on a loaded host system. Bumping to 2 minutes will give more headroom. Message-ID: <20240112164717.1063954-1-th...@redhat.com> Reviewed-by: "Daniel P. Berrangé" <berra...@redhat.com> Signed-off-by: Thomas Huth <th...@redhat.com> Commit: 043eaa0f0c8618382b2dba2f2e4fe762215b2e29 https://github.com/qemu/qemu/commit/043eaa0f0c8618382b2dba2f2e4fe762215b2e29 Author: Daniel P. Berrangé <berra...@redhat.com> Date: 2024-01-16 (Tue, 16 Jan 2024) Changed paths: M meson.build Log Message: ----------- meson: mitigate against ROP exploits with -fzero-call-used-regs To quote wikipedia: "Return-oriented programming (ROP) is a computer security exploit technique that allows an attacker to execute code in the presence of security defenses such as executable space protection and code signing. In this technique, an attacker gains control of the call stack to hijack program control flow and then executes carefully chosen machine instruction sequences that are already present in the machine's memory, called "gadgets". Each gadget typically ends in a return instruction and is located in a subroutine within the existing program and/or shared library code. Chained together, these gadgets allow an attacker to perform arbitrary operations on a machine employing defenses that thwart simpler attacks." QEMU is by no means perfect with an ever growing set of CVEs from flawed hardware device emulation, which could potentially be exploited using ROP techniques. Since GCC 11 there has been a compiler option that can mitigate against this exploit technique: -fzero-call-user-regs To understand it refer to these two resources: https://www.jerkeby.se/newsletter/posts/rop-reduction-zero-call-user-regs/ https://gcc.gnu.org/pipermail/gcc-patches/2020-August/552262.html I used two programs to scan qemu-system-x86_64 for ROP gadgets: https://github.com/0vercl0k/rp https://github.com/JonathanSalwan/ROPgadget When asked to find 8 byte gadgets, the 'rp' tool reports: A total of 440278 gadgets found. You decided to keep only the unique ones, 156143 unique gadgets found. While the ROPgadget tool reports: Unique gadgets found: 353122 With the --ropchain argument, the latter attempts to use the found gadgets to product a chain that can execute arbitrary syscalls. With current QEMU it succeeds in this task, which is an undesirable situation. With QEMU modified to use -fzero-call-user-regs=used-gpr the 'rp' tool reports A total of 528991 gadgets found. You decided to keep only the unique ones, 121128 unique gadgets found. This is 22% fewer unique gadgets While the ROPgadget tool reports: Unique gadgets found: 328605 This is 7% fewer unique gadgets. Crucially though, despite this more modest reduction, the ROPgadget tool is no longer able to identify a chain of gadgets for executing arbitrary syscalls. It fails at the very first step, unable to find gadgets for populating registers for a future syscall. Having said that, more advanced tools do still manage to put together a viable ROP chain. Also this only takes into account QEMU code. QEMU links to many 3rd party shared libraries and ideally all of them would be compiled with this same hardening. That becomes a distro policy question though. In terms of performance impact, TCG was used as an evaluation test case. We're not interested in protecting TCG since it isn't designed to provide a security barrier, but it is performance sensitive code, so useful as a guide to how other areas of QEMU might be impacted. With the -fzero-call-user-regs=used-gpr argument present, using the real world test of booting a linux kernel and having init immediately poweroff, there is a ~1% slow down in performance under TCG. The QEMU binary size also grows by approximately 1%. By comparison, using the more aggressive -fzero-call-user-regs=all, results in a slowdown of over 25% in TCG, which is clearly not an acceptable impact, and a binary size increase of 5%. Considering that 'used-gpr' successfully stopped ROPgadget assembling a chain, this more targeted protection is a justifiable hardening / performance tradeoff. Reviewed-by: Thomas Huth <th...@redhat.com> Signed-off-by: "Daniel P. Berrangé" <berra...@redhat.com> Message-ID: <20240103123414.2401208-2-berra...@redhat.com> Signed-off-by: Thomas Huth <th...@redhat.com> Commit: 7ff9ff039380008952c6fd32011dd2a4d5666906 https://github.com/qemu/qemu/commit/7ff9ff039380008952c6fd32011dd2a4d5666906 Author: Daniel P. Berrangé <berra...@redhat.com> Date: 2024-01-16 (Tue, 16 Jan 2024) Changed paths: M meson.build Log Message: ----------- meson: mitigate against use of uninitialize stack for exploits When variables are used without being initialized, there is potential to take advantage of data that was pre-existing on the stack from an earlier call, to drive an exploit. It is good practice to always initialize variables, and the compiler can warn about flaws when -Wuninitialized is present. This warning, however, is by no means foolproof with its output varying depending on compiler version and which optimizations are enabled. The -ftrivial-auto-var-init option can be used to tell the compiler to always initialize all variables. This increases the security and predictability of the program, closing off certain attack vectors, reducing the risk of unsafe memory disclosure. While the option takes several possible values, using 'zero' is considered to be the option that is likely to lead to semantically correct or safe behaviour[1]. eg sizes/indexes are not likely to lead to out-of-bounds accesses when initialized to zero. Pointers are less likely to point something useful if initialized to zero. Even with -ftrivial-auto-var-init=zero set, GCC will still issue warnings with -Wuninitialized if it discovers a problem, so we are not loosing diagnostics for developers, just hardening runtime behaviour and making QEMU behave more predictably in case of hitting bad codepaths. [1] https://lists.llvm.org/pipermail/cfe-dev/2020-April/065221.html Signed-off-by: "Daniel P. Berrangé" <berra...@redhat.com> Message-ID: <20240103123414.2401208-3-berra...@redhat.com> Signed-off-by: Thomas Huth <th...@redhat.com> Commit: 7c8faaf2a4fa8ad2d291662ac7e7eeea1fe8d47c https://github.com/qemu/qemu/commit/7c8faaf2a4fa8ad2d291662ac7e7eeea1fe8d47c Author: Samuel Tardieu <s...@rfc1149.net> Date: 2024-01-18 (Thu, 18 Jan 2024) Changed paths: M hw/timer/trace-events Log Message: ----------- hw/timer: fix systick trace message Signed-off-by: Samuel Tardieu <s...@rfc1149.net> Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org> Reviewed-by: Laurent Vivier <laur...@vivier.eu> Message-id: 20240109184508.3189599-1-...@rfc1149.net Fixes: ff68dacbc786 ("armv7m: Split systick out from NVIC") Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: c2d7faf713e04fc6b2d5b33d77cab0672c5bb30e https://github.com/qemu/qemu/commit/c2d7faf713e04fc6b2d5b33d77cab0672c5bb30e Author: Gavin Shan <gs...@redhat.com> Date: 2024-01-18 (Thu, 18 Jan 2024) Changed paths: M hw/arm/virt.c Log Message: ----------- hw/arm/virt: Consolidate valid CPU types It's found that some of the CPU type names in the array of valid CPU types are invalid because their corresponding classes aren't registered, as reported by Peter Maydell. [gshan@gshan build]$ ./qemu-system-arm -machine virt -cpu cortex-a9 qemu-system-arm: Invalid CPU model: cortex-a9 The valid models are: cortex-a7, cortex-a15, (null), (null), (null), (null), (null), (null), (null), (null), (null), (null), (null), max Fix it by consolidating the array of valid CPU types. After it's applied, we have the following output when TCG is enabled. [gshan@gshan build]$ ./qemu-system-arm -machine virt -cpu cortex-a9 qemu-system-arm: Invalid CPU model: cortex-a9 The valid models are: cortex-a7, cortex-a15, max [gshan@gshan build]$ ./qemu-system-aarch64 -machine virt -cpu cortex-a9 qemu-system-aarch64: Invalid CPU model: cortex-a9 The valid models are: cortex-a7, cortex-a15, cortex-a35, cortex-a55, cortex-a72, cortex-a76, cortex-a710, a64fx, neoverse-n1, neoverse-v1, neoverse-n2, cortex-a53, cortex-a57, max Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2084 Reported-by: Peter Maydell <peter.mayd...@linaro.org> Signed-off-by: Gavin Shan <gs...@redhat.com> Reviewed-by: Cornelia Huck <coh...@redhat.com> Message-id: 20240111051054.83304-1-gs...@redhat.com Fixes: fa8c617791 ("hw/arm/virt: Check CPU type in machine_run_board_init()") Signed-off-by: Gavin Shan <gs...@redhat.com> Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: 410c2a4d75f52f6a2fe978eda5a9b6f854afe5ea https://github.com/qemu/qemu/commit/410c2a4d75f52f6a2fe978eda5a9b6f854afe5ea Author: Anastasia Belova <abel...@astralinux.ru> Date: 2024-01-18 (Thu, 18 Jan 2024) Changed paths: M include/hw/elf_ops.h Log Message: ----------- load_elf: fix iterator's type for elf file processing j is used while loading an ELF file to byteswap segments' data. If data is larger than 2GB an overflow may happen. So j should be elf_word. This commit fixes a minor bug: it's unlikely anybody is trying to load ELF files with 2GB+ segments for wrong-endianness targets, but if they did, it wouldn't work correctly. Found by Linux Verification Center (linuxtesting.org) with SVACE. Cc: qemu-sta...@nongnu.org Fixes: 7ef295ea5b ("loader: Add data swap option to load-elf") Signed-off-by: Anastasia Belova <abel...@astralinux.ru> Reviewed-by: Peter Maydell <peter.mayd...@linaro.org> Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: 7ef4c41e91d59d72a3b8bc022a6cb3e81787a50a https://github.com/qemu/qemu/commit/7ef4c41e91d59d72a3b8bc022a6cb3e81787a50a Author: Ani Sinha <anisi...@redhat.com> Date: 2024-01-18 (Thu, 18 Jan 2024) Changed paths: M tests/avocado/acpi-bits.py Log Message: ----------- acpi/tests/avocado/bits: wait for 200 seconds for SHUTDOWN event from bits VM By default, the timeout to receive any specified event from the QEMU VM is 60 seconds set by the python avocado test framework. Please see event_wait() and events_wait() in python/qemu/machine/machine.py. If the matching event is not triggered within that interval, an asyncio.TimeoutError is generated. Since the timeout for the bits avocado test is 200 secs, we need to make event_wait() timeout of the same value as well so that an early timeout is not triggered by the avocado framework. CC: peter.mayd...@linaro.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2077 Signed-off-by: Ani Sinha <anisi...@redhat.com> Reviewed-by: Daniel P. Berrangé <berra...@redhat.com> Message-id: 20240117042556.3360190-1-anisi...@redhat.com Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: f94e74a7e29482582cbb98acd0b3b10142c7712a https://github.com/qemu/qemu/commit/f94e74a7e29482582cbb98acd0b3b10142c7712a Author: Peter Maydell <peter.mayd...@linaro.org> Date: 2024-01-18 (Thu, 18 Jan 2024) Changed paths: M meson.build M tests/qtest/meson.build M tests/qtest/npcm7xx_watchdog_timer-test.c Log Message: ----------- Merge tag 'pull-request-2024-01-16' of https://gitlab.com/thuth/qemu into staging * Improve the timeouts for some problematic qtests * Enable some ROP mitigation compiler switches # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmWmNDURHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbVM0w/+Nafbtnw9Q1gp633CIYQRsNDGiKiCND5H # epLfd3DFAG2jATZm/hIIrV3dlEkGRQh916XKik572eUm2yyu3i3EqVNooTcLr0k/ # 4MI1ZzG0rnAnAr15zVdUaDCiaGdlpcSGTwLDAlQjIR4n0MdugQ/bkrfkDRU0YD/6 # mv/yDck5fHOUDm88LA7Gxep0G7U8Wi8oiQXx+WlbQpmDHfBJM7ERQSPhXobtVtFO # 8wpceUcMwlGBecxEsRggrRhdn09CJUyuirP8UHG4rT8xMjkXpqHJVqZ+gVDyV65J # y9y6snCk+oFyCTDSstQxVbzHg/1C4xE2gVUMaXv4Wu1TcCgBpF1WDQymXb35Buuh # pbgAaF1ZsBGwE7rUUJIF3NBTpjmedP4NbCR2EPsiL06w08mG7IRuU/b8JStuAHef # qUqxiHfpEwAxXY8O83XOvBb+zJ625OQHGi/MGDnaYczBfqBJAx2AKiuSmMWBAWo2 # gO4kQX25sPzov6xsLcjEwh0HcJ9W5mkGRJ/x8GSjWnvDlGBDBYWPUShJlohDKGU0 # 4+JGk4+8RKMoKE97bO8DItOp9ahh87up/qHDFkJJo+VKuDaBPdzlS6PURzc8wv0T # QquWUkfdE6qYIPr8ShVYT00NNThIKLyn0qaN4s1mQ+2h8p8nXc4aYsWgcr2wxJFm # sOoVvwOXzDE= # =Yuwq # -----END PGP SIGNATURE----- # gpg: Signature made Tue 16 Jan 2024 07:45:57 GMT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "th...@redhat.com" # gpg: Good signature from "Thomas Huth <th.h...@gmx.de>" [full] # gpg: aka "Thomas Huth <th...@redhat.com>" [full] # gpg: aka "Thomas Huth <h...@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.h...@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2024-01-16' of https://gitlab.com/thuth/qemu: meson: mitigate against use of uninitialize stack for exploits meson: mitigate against ROP exploits with -fzero-call-used-regs qtest: Bump npcm7xx_watchdog_timer-test timeout to 2 minutes tests/qtest/npcm7xx_watchdog_timer: Only test the corner cases by default tests/qtest/meson.build: Bump the boot-serial-test timeout to 4 minutes Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: 88cf5fec91e50cd34bc002b633b4116228db0bc8 https://github.com/qemu/qemu/commit/88cf5fec91e50cd34bc002b633b4116228db0bc8 Author: Peter Maydell <peter.mayd...@linaro.org> Date: 2024-01-18 (Thu, 18 Jan 2024) Changed paths: M MAINTAINERS A docs/devel/docs.rst M docs/devel/index-build.rst M docs/system/arm/b-l475e-iot01a.rst M docs/system/arm/virt.rst M hmp-commands-info.hx M hmp-commands.hx M hw/arm/Kconfig M hw/arm/stm32l4x5_soc.c M hw/arm/virt.c M hw/misc/Kconfig M hw/misc/meson.build A hw/misc/stm32l4x5_exti.c A hw/misc/stm32l4x5_syscfg.c M hw/misc/trace-events M hw/timer/trace-events M include/hw/arm/stm32l4x5_soc.h M include/hw/elf_ops.h A include/hw/misc/stm32l4x5_exti.h A include/hw/misc/stm32l4x5_syscfg.h M qemu-img-cmds.hx M qemu-options.hx M target/arm/ptw.c M tests/qtest/meson.build A tests/qtest/stm32l4x5_exti-test.c A tests/qtest/stm32l4x5_syscfg-test.c Log Message: ----------- Merge tag 'pull-target-arm-20240118' of https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * docs/devel/docs: Document .hx file syntax * arm_pamax() no longer needs to do feature propagation * docs/system/arm/virt.rst: Improve 'highmem' option docs * STM32L4x5 Implement SYSCFG and EXTI devices * hw/timer: fix systick trace message * hw/arm/virt: Consolidate valid CPU types * load_elf: fix iterator's type for elf file processing # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmWpHM4ZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3pZxD/sGIXvTeoOCsum7OFpArKoQ # J+wcy74pO526IDzjudgtwP8kFW09oVblMPgrt/68F9LY4Oa7sDNAZX/Xqlhs/hdJ # SVbOXArRmyLvgLpn8KVii9xk9iI/olMGt0S6KcXAErdgFud+JcCevbS0D5fAF4Ua # /G/4ldnwr+WcYUA5IIoi02ymSBm5VNeH2bKu0MPS3xpizjzgOFxWTBYwq3zkZYWD # w5GjH9+F+IC67CiAlCLvuQBqpGLdRwFBttU05hLtGXuSlnvS+FtJTooI7gGD17CR # 2wTa7qF716qDN1lNSIvxA6t8/dWNMIYCZYdlxJml476WzP3jECpth2WFWqE0G3yg # Orr7sFVB8X6JmtlR34srW6e3CZA3t+4FIWqcdELFLi5IQtJeer90jqQ9xwx4SttJ # nsHdy5M8txWSa61yAaDTXMID/smVlC7sWTKJrR9kV7v5+b9OPQ/R8k0mCODl5Aer # mzAVuCvUQVYK3j7fzprGrlldla57s3v78OAhqACLgKflK0+aJSJjglulPrSMK1z5 # bRPS5jLZjFwEi2VaLVg3LPJiBMDj1s/wAl0ycfCQSv2oEzvmpkw+Ar1HDc2NFe+d # 9dunbdhAZJMwh+ABIg7iMj+l0ncOXDa4DS+6BnjRxfECCa172u3viq1HATkLLAFI # GTkcJ5hIQzNEeg9ob0MDIg== # =Rfpe # -----END PGP SIGNATURE----- # gpg: Signature made Thu 18 Jan 2024 12:42:54 GMT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.mayd...@linaro.org" # gpg: Good signature from "Peter Maydell <peter.mayd...@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmayd...@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmayd...@chiark.greenend.org.uk>" [ultimate] # gpg: aka "Peter Maydell <pe...@archaic.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20240118' of https://git.linaro.org/people/pmaydell/qemu-arm: load_elf: fix iterator's type for elf file processing hw/arm/virt: Consolidate valid CPU types hw/timer: fix systick trace message tests/qtest: Add STM32L4x5 SYSCFG QTest testcase hw/arm: Connect STM32L4x5 SYSCFG to STM32L4x5 SoC hw/misc: Implement STM32L4x5 SYSCFG tests/qtest: Add STM32L4x5 EXTI QTest testcase hw/arm: Connect STM32L4x5 EXTI to STM32L4x5 SoC hw/misc: Implement STM32L4x5 EXTI docs/system/arm/virt.rst: Improve 'highmem' option docs target/arm: arm_pamax() no longer needs to do feature propagation docs/devel/docs: Document .hx file syntax Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Compare: https://github.com/qemu/qemu/compare/d0f4aa7d50d4...88cf5fec91e5