aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-11-20Update version for v3.1.0-rc2 releasev3.1.0-rc2Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-20Merge remote-tracking branch ↵Peter Maydell
'remotes/ehabkost/tags/x86-for-3.1-pull-request' into staging pc-*-3.1 machine-types # gpg: Signature made Tue 20 Nov 2018 13:43:24 GMT # gpg: using RSA key 2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/x86-for-3.1-pull-request: hw/i386: add pc-i440fx-3.1 & pc-q35-3.1 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-20hw/i386: add pc-i440fx-3.1 & pc-q35-3.1Marc-André Lureau
We have a couple of PC_COMPAT_3_0, so we should have 3.1 PC machines, and update the 3.0 machines to make use of those. Fixes a "Known issue" from https://wiki.qemu.org/Planning/3.1. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20181120132604.22854-1-marcandre.lureau@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-11-20Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell
Fixes yet another use-after-free issue that could be triggered by a misbehaving guest. This is a follow-up to commit: commit 5b76ef50f62079a2389ba28cacaf6cce68b1a0ed Author: Greg Kurz <groug@kaod.org> Date: Wed Nov 7 01:00:04 2018 +0100 9p: write lock path in v9fs_co_open2() # gpg: Signature made Tue 20 Nov 2018 12:01:07 GMT # gpg: using RSA key 71D4D5E5822F73D6 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Gregory Kurz <gregory.kurz@free.fr>" # gpg: aka "[jpeg image of size 3330]" # Primary key fingerprint: B482 8BAF 9431 40CE F2A3 4910 71D4 D5E5 822F 73D6 * remotes/gkurz/tags/for-upstream: 9p: take write lock on fid path updates (CVE-2018-19364) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-209p: take write lock on fid path updates (CVE-2018-19364)Greg Kurz
Recent commit 5b76ef50f62079a fixed a race where v9fs_co_open2() could possibly overwrite a fid path with v9fs_path_copy() while it is being accessed by some other thread, ie, use-after-free that can be detected by ASAN with a custom 9p client. It turns out that the same can happen at several locations where v9fs_path_copy() is used to set the fid path. The fix is again to take the write lock. Fixes CVE-2018-19364. Cc: P J P <ppandit@redhat.com> Reported-by: zhibin hu <noirfate@gmail.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Greg Kurz <groug@kaod.org>
2018-11-20Merge remote-tracking branch ↵Peter Maydell
'remotes/huth-gitlab/tags/pull-request-2018-11-20' into staging - One additional simple qmp-test - A fix for ide-test - Add logging of QEMU parameters in libqtest # gpg: Signature made Tue 20 Nov 2018 10:47:12 GMT # gpg: using RSA key 2ED9D774FE702DB5 # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" # gpg: aka "Thomas Huth <thuth@redhat.com>" # gpg: aka "Thomas Huth <huth@tuxfamily.org>" # gpg: aka "Thomas Huth <th.huth@posteo.de>" # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * remotes/huth-gitlab/tags/pull-request-2018-11-20: qtest: log QEMU command line tests/ide: Free pcibus when finishing a test tests: add qmp/missing-any-arg test Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-20Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/seabios-1.12-20181120-pull-request' into staging seabios: update to 1.12-final # gpg: Signature made Tue 20 Nov 2018 06:01:21 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/seabios-1.12-20181120-pull-request: update seabios to 1.12 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-20qtest: log QEMU command linePaolo Bonzini
Record the command line that was used to start QEMU. This can be useful for debugging. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> [thuth: removed trailing \n from the message string] Signed-off-by: Thomas Huth <thuth@redhat.com>
2018-11-20update seabios to 1.12Gerd Hoffmann
Seabios 1.12 has been released yesterday. Update our snapshot builds to the final release. git shortlog ============ Kevin O'Connor (2): shadow: Rework bios copy code to prevent gcc array-bounds warning docs: Note v1.12.0 release Shmuel Eiderman (1): pvscsi: Scan all 64 possible targets Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-19tests/ide: Free pcibus when finishing a testThomas Huth
Once a test has finished, the pcibus structure should be freed, to avoid leaking memory and to make sure that the structure is properly re-initialized when the next test starts. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2018-11-19tests: add qmp/missing-any-arg testMarc-André Lureau
test_qmp_missing_any_arg() is about a bug in infrastructure used by the QMP core, fixed in commit c489780203. We covered the bug in infrastructure unit tests (commit bce3035a44). Let's test it at the QMP level as well. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [thuth: Tweaked the commit message according to Markus' suggestion] Signed-off-by: Thomas Huth <thuth@redhat.com>
2018-11-19Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-11-19' into ↵Peter Maydell
staging nbd patches for 2018-11-19 Add iotest coverage for NBD connections using TLS, including a couple of code fixes that it pointed out - Mao Zhongyi: 0/3 Do some cleaning work in qemu-iotests - Daniel P. Berrangé: io: return 0 for EOF in TLS session read after shutdown - Daniel P. Berrangé: 0/6 Misc fixes to NBD - Eric Blake: iotests: Drop use of bash keyword 'function' # gpg: Signature made Mon 19 Nov 2018 17:43:32 GMT # gpg: using RSA key A7A16B4A2527436A # gpg: Good signature from "Eric Blake <eblake@redhat.com>" # gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" # gpg: aka "[jpeg image of size 6874]" # Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A * remotes/ericb/tags/pull-nbd-2018-11-19: iotests: Drop use of bash keyword 'function' iotests: Also test I/O over NBD TLS tests: exercise NBD server in TLS mode tests: add iotests helpers for dealing with TLS certificates tests: check if qemu-nbd is still alive before waiting tests: pull qemu-nbd iotest helpers into common.nbd file io: return 0 for EOF in TLS session read after shutdown nbd/server: Ignore write errors when replying to NBD_OPT_ABORT nbd: fix whitespace in server error message qemu-iotests: Modern shell scripting (use $() instead of ``) qemu-iotests: convert `pwd` and $(pwd) to $PWD qemu-iotests: remove unused variable 'here' Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19iotests: Drop use of bash keyword 'function'Eric Blake
Bash allows functions to be declared with or without the leading keyword 'function'; but including the keyword does not comply with POSIX syntax, and is confusing to ksh users where the use of the keyword changes the scoping rules for functions. Stick to the POSIX form through iotests. Done mechanically with: sed -i 's/^function //' $(git ls-files tests/qemu-iotests) Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181116215002.2124581-1-eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-19iotests: Also test I/O over NBD TLSEric Blake
Enhance test 233 to also perform I/O beyond the initial handshake. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181118022403.2211483-1-eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2018-11-19tests: exercise NBD server in TLS modeDaniel P. Berrangé
Add tests that validate it is possible to connect to an NBD server running TLS mode. Also test mis-matched TLS vs non-TLS connections correctly fail. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-7-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: Eric Blake <eblake@redhat.com> [eblake: rebase to iotests shell cleanups, use ss instead of socat for port probing, sanitize port number in expected output] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19tests: add iotests helpers for dealing with TLS certificatesDaniel P. Berrangé
Add helpers to common.tls for creating TLS certificates for a CA, server and client. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-6-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: spelling and quoting touchups] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19tests: check if qemu-nbd is still alive before waitingDaniel P. Berrangé
If the qemu-nbd UNIX socket has not shown up, the tests will sleep a bit and then check again repeatedly for up to 30 seconds. This is pointless if the qemu-nbd process has quit due to an error, so check whether the pid is still alive before waiting and retrying. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-5-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19tests: pull qemu-nbd iotest helpers into common.nbd fileDaniel P. Berrangé
The helpers for starting/stopping qemu-nbd in 058 will be useful in other test cases, so move them into a common.nbd file. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-4-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: fix shell quoting] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19io: return 0 for EOF in TLS session read after shutdownDaniel P. Berrangé
GNUTLS takes a paranoid approach when seeing 0 bytes returned by the underlying OS read() function. It will consider this an error and return GNUTLS_E_PREMATURE_TERMINATION instead of propagating the 0 return value. It expects apps to arrange for clean termination at the protocol level and not rely on seeing EOF from a read call to detect shutdown. This is to harden apps against a malicious 3rd party causing termination of the sockets layer. This is unhelpful for the QEMU NBD code which does have a clean protocol level shutdown, but still relies on seeing 0 from the I/O channel read in the coroutine handling incoming replies. The upshot is that when using a plain NBD connection shutdown is silent, but when using TLS, the client spams the console with Cannot read from TLS channel: Broken pipe The NBD connection has, however, called qio_channel_shutdown() at this point to indicate that it is done with I/O. This gives the opportunity to optimize the code such that when the channel has been shutdown in the read direction, the error code GNUTLS_E_PREMATURE_TERMINATION gets turned into a '0' return instead of an error. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20181119134228.11031-1-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19nbd/server: Ignore write errors when replying to NBD_OPT_ABORTEric Blake
Commit 37ec36f6 intentionally ignores errors when trying to reply to an NBD_OPT_ABORT request for plaintext clients, but did not make the same change for a TLS server. Since NBD_OPT_ABORT is documented as being a potential for an EPIPE when the client hangs up without waiting for our reply, we don't need to pollute the server's output with that failure. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181117223221.2198751-1-eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2018-11-19nbd: fix whitespace in server error messageDaniel P. Berrangé
A space was missing after the option number was printed: Option 0x8not permitted before TLS becomes Option 0x8 not permitted before TLS This fixes commit 3668328303429f3bc93ab3365c66331600b06a2d Author: Eric Blake <eblake@redhat.com> Date: Fri Oct 14 13:33:09 2016 -0500 nbd: Send message along with server NBD_REP_ERR errors Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-2-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: move lone space to next line] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19qemu-iotests: Modern shell scripting (use $() instead of ``)Mao Zhongyi
Various shell files contain a mix between obsolete `` and modern $(); It would be nice to convert to using $() everywhere. For now, just do the qemu-iotests directory. Cc: kwolf@redhat.com Cc: mreitz@redhat.com Cc: eblake@redhat.com Suggested-by: Eric Blake <eblake@redhat.com> Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com> Message-Id: <20181024094051.4470-4-maozhongyi@cmss.chinamobile.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: tweak commit message] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19qemu-iotests: convert `pwd` and $(pwd) to $PWDMao Zhongyi
POSIX requires $PWD to be reliable, and we expect all shells used by qemu scripts to be relatively close to POSIX. Thus, it is smarter to avoid forking the pwd executable for something that is already available in the environment. So replace it with the following: sed -i 's/\(`pwd`\|\$(pwd)\)/$PWD/g' $(git grep -l pwd) Then delete a pointless line assigning PWD to itself. Cc: kwolf@redhat.com Cc: mreitz@redhat.com Cc: eblake@redhat.com Suggested-by: Eric Blake <eblake@redhat.com> Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com> Message-Id: <20181024094051.4470-2-maozhongyi@cmss.chinamobile.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: touch up commit message, reorder series, tweak a couple more files] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19qemu-iotests: remove unused variable 'here'Mao Zhongyi
Running git grep '\$here' tests/qemu-iotests has 0 hits, which means we are setting a variable that has no use. It appears that commit e8f8624d removed the last use. So execute the following cmd to remove all of the 'here=...' lines as dead code. sed -i '/^here=/d' $(git grep -l '^here=' tests/qemu-iotests) Cc: kwolf@redhat.com Cc: mreitz@redhat.com Cc: eblake@redhat.com Suggested-by: Eric Blake <eblake@redhat.com> Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com> Message-Id: <20181024094051.4470-3-maozhongyi@cmss.chinamobile.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: touch up commit message, reorder series, rebase to master] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20181119' into staging target-arm queue: * various MAINTAINERS file updates * hw/block/onenand: use qemu_log_mask() for reporting * hw/block/onenand: Fix off-by-one error allowing out-of-bounds read on the n800 and n810 machine models * target/arm: fix smc incorrectly trapping to EL3 when secure is off * hw/arm/stm32f205: Fix the UART and Timer region size * target/arm: read ID registers for KVM guests so they can be used to gate "is feature X present" checks # gpg: Signature made Mon 19 Nov 2018 15:56:44 GMT # gpg: using RSA key 3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20181119: MAINTAINERS: list myself as maintainer for various Arm boards hw/block/onenand: use qemu_log_mask() for reporting hw/block/onenand: Fix off-by-one error allowing out-of-bounds read target/arm: fix smc incorrectly trapping to EL3 when secure is off hw/arm/stm32f205: Fix the UART and Timer region size MAINTAINERS: Add entries for missing ARM boards target/arm: Fill in ARMISARegisters for kvm32 target/arm: Introduce read_sys_reg32 for kvm32 target/arm: Fill in ARMISARegisters for kvm64 target/arm: Install ARMISARegisters from kvm host Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19MAINTAINERS: list myself as maintainer for various Arm boardsPeter Maydell
In practice for most of the more-or-less orphan Arm board models, I will review patches and put them in via the target-arm tree. So list myself as an "Odd Fixes" status maintainer for them. This commit downgrades these boards to "Odd Fixes": * Allwinner-A10 * Exynos * Calxeda Highbank * Canon DIGIC * Musicpal * nSeries * Palm * PXA2xx These boards were already "Odd Fixes": * Gumstix * i.MX31 (kzm) Philippe Mathieu-Daudé has requested to be moved to R: status for Gumstix now that I am listed as the M: contact. Some boards are maintained, but their patches still go via the target-arm tree, so add myself as a secondary maintainer contact for those: * Xilinx Zynq * Xilinx ZynqMP * STM32F205 * Netduino 2 * SmartFusion2 * Mecraft M2S-FG484 * ASPEED BMCs * NRF51 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20181108134139.31666-1-peter.maydell@linaro.org
2018-11-19hw/block/onenand: use qemu_log_mask() for reportingPeter Maydell
Update the onenand device to use qemu_log_mask() for reporting guest errors and unimplemented features, rather than plain fprintf() and hw_error(). (We leave the hw_error() in onenand_reset(), as that is triggered by a failure to read the underlying block device for the bootRAM, not by guest action.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181115143535.5885-3-peter.maydell@linaro.org
2018-11-19hw/block/onenand: Fix off-by-one error allowing out-of-bounds readPeter Maydell
An off-by-one error in a switch case in onenand_read() allowed a misbehaving guest to read off the end of a block of memory. NB: the onenand device is used only by the "n800" and "n810" machines, which are usable only with TCG, not KVM, so this is not a security issue. Reported-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20181115143535.5885-2-peter.maydell@linaro.org Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19target/arm: fix smc incorrectly trapping to EL3 when secure is offLuc Michel
This commit fixes a case where the CPU would try to go to EL3 when executing an smc instruction, even though ARM_FEATURE_EL3 is false. This case is raised when the PSCI conduit is set to smc, but the smc instruction does not lead to a valid PSCI call. QEMU crashes with an assertion failure latter on because of incoherent mmu_idx. This commit refactors the pre_smc helper by enumerating all the possible way of handling an scm instruction, and covering the previously missing case leading to the crash. The following minimal test would crash before this commit: .global _start .text _start: ldr x0, =0xdeadbeef ; invalid PSCI call smc #0 run with the following command line: aarch64-linux-gnu-gcc -nostdinc -nostdlib -Wl,-Ttext=40000000 \ -o test test.s qemu-system-aarch64 -M virt,virtualization=on,secure=off \ -cpu cortex-a57 -kernel test Signed-off-by: Luc Michel <luc.michel@greensocs.com> Message-id: 20181117160213.18995-1-luc.michel@greensocs.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19hw/arm/stm32f205: Fix the UART and Timer region sizeSeth Kintigh
The UART and timer devices for the stm32f205 were being created with memory regions that were too large. Use the size specified in the chip datasheet. The old sizes were so large that the devices would overlap with each other in the SoC memory map, so this fixes a bug that caused odd behavior and/or crashes when trying to set up multiple UARTs. Signed-off-by: Seth Kintigh <skintigh@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: rephrased commit message to follow our usual standard] Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19MAINTAINERS: Add entries for missing ARM boardsThomas Huth
Add entries for the boards "mcimx6ul-evk", "mcimx7d-sabre", "raspi2", "raspi3", "sabrelite", "vexpress-a15", "vexpress-a9" and "virt". While we're at it, also adjust the "i.MX31" section a little bit, so that the wildcards there do not match anymore for unrelated files (e.g. the new hw/misc/imx6ul_ccm.c file). Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1542184999-11145-1-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19target/arm: Fill in ARMISARegisters for kvm32Richard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181113180154.17903-5-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19target/arm: Introduce read_sys_reg32 for kvm32Richard Henderson
Assert that the value to be written is the correct size. No change in functionality here, just mirroring the same function from kvm64. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181113180154.17903-4-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19target/arm: Fill in ARMISARegisters for kvm64Richard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181113180154.17903-3-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19target/arm: Install ARMISARegisters from kvm hostRichard Henderson
The ID registers are replacing (some of) the feature bits. We need (some of) these values to determine the set of data to be handled during migration. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181113180154.17903-2-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches: - file-posix: Fix shared permission locks after reopen - block: Fix error path for failed .bdrv_reopen_prepare - qcow2: Catch invalid allocations when the image becomes too large - vvfat/fdc/nvme: Fix segfaults and leaks # gpg: Signature made Mon 19 Nov 2018 14:28:18 GMT # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: iotests: Test file-posix locking and reopen file-posix: Fix shared locks on reopen commit block: Always abort reopen after prepare succeeded iotests: Add new test 220 for max compressed cluster offset qcow2: Don't allow overflow during cluster allocation qcow2: Document some maximum size constraints vvfat: Fix memory leak fdc: fix segfault in fdctrl_stop_transfer() when DMA is disabled nvme: fix oob access issue(CVE-2018-16847) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19iotests: Test file-posix locking and reopenMax Reitz
Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19file-posix: Fix shared locks on reopen commitMax Reitz
s->locked_shared_perm is the set of bits locked in the file, which is the inverse of the permissions actually shared. So we need to pass them as they are to raw_apply_lock_bytes() instead of inverting them again. Reported-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19block: Always abort reopen after prepare succeededMax Reitz
bdrv_reopen_multiple() does not invoke bdrv_reopen_abort() for the element of the reopen queue for which bdrv_reopen_prepare() failed, because it assumes that the prepare function will have rolled back all changes already. However, bdrv_reopen_prepare() does not do this in every case: It may notice an error after BlockDriver.bdrv_reopen_prepare() succeeded, and it will not invoke BlockDriver.bdrv_reopen_abort() then; and neither will bdrv_reopen_multiple(), as explained above. This is wrong because we must always call .bdrv_reopen_commit() or .bdrv_reopen_abort() after .bdrv_reopen_prepare() has succeeded. Otherwise, the block driver has no chance to undo what it has done in its implementation of .bdrv_reopen_prepare(). To fix this, bdrv_reopen_prepare() has to call .bdrv_reopen_abort() if it wants to return an error after .bdrv_reopen_prepare() has succeeded. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19iotests: Add new test 220 for max compressed cluster offsetEric Blake
If you have a capable file system (tmpfs is good, ext4 not so much; run ./check with TEST_DIR pointing to a good location so as not to skip the test), it's actually possible to create a qcow2 file that expands to a sparse 512T image with just over 38M of content. The test is not the world's fastest (qemu crawling through 256M bits of refcount table to find the next cluster to allocate takes several seconds, as does qemu-img check reporting millions of leaked clusters); but it DOES catch the problem that the previous patch just fixed where writing a compressed cluster to a full image ended up overwriting the wrong cluster. Suggested-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19qcow2: Don't allow overflow during cluster allocationEric Blake
Our code was already checking that we did not attempt to allocate more clusters than what would fit in an INT64 (the physical maximimum if we can access a full off_t's worth of data). But this does not catch smaller limits enforced by various spots in the qcow2 image description: L1 and normal clusters of L2 are documented as having bits 63-56 reserved for other purposes, capping our maximum offset at 64PB (bit 55 is the maximum bit set). And for compressed images with 2M clusters, the cap drops the maximum offset to bit 48, or a maximum offset of 512TB. If we overflow that offset, we would write compressed data into one place, but try to decompress from another, which won't work. It's actually possible to prove that overflow can cause image corruption without this patch; I'll add the iotests separately in the next commit. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19qcow2: Document some maximum size constraintsEric Blake
Although off_t permits up to 63 bits (8EB) of file offsets, in practice, we're going to hit other limits first. Document some of those limits in the qcow2 spec (some are inherent, others are implementation choices of qemu), and how choice of cluster size can influence some of the limits. While we cannot map any uncompressed virtual cluster to any address higher than 64 PB (56 bits) (due to the current L1/L2 field encoding stopping at bit 55), qemu's cap of 8M for the refcount table can still access larger host addresses for some combinations of large clusters and small refcount_order. For comparison, ext4 with 4k blocks caps files at 16PB. Another interesting limit: for compressed clusters, the L2 layout requires an ever-smaller maximum host offset as cluster size gets larger, down to a 512 TB maximum with 2M clusters. In particular, note that with a cluster size of 8k or smaller, the L2 entry for a compressed cluster could technically point beyond the 64PB mark, but when you consider that with 8k clusters and refcount_order = 0, you cannot access beyond 512T without exceeding qemu's limit of an 8M cap on the refcount table, it is unlikely that any image in the wild has attempted to do so. To be safe, let's document that bits beyond 55 in a compressed cluster must be 0. Signed-off-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19vvfat: Fix memory leakKevin Wolf
Don't leak 'cluster' in the mapping == NULL case. Found by Coverity (CID 1055918). Fixes: 8d9401c2791ee2d2805b741b1ee3006041edcd3e Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Liam Merwick <liam.merwick@oracle.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-19fdc: fix segfault in fdctrl_stop_transfer() when DMA is disabledMark Cave-Ayland
Commit c8a35f1cf0f "fdc: use IsaDma interface instead of global DMA_* functions" accidentally introduced a segfault in fdctrl_stop_transfer() for non-DMA transfers. If fdctrl->dma_chann has not been configured then the fdctrl->dma interface reference isn't initialised during isabus_fdc_realize(). Unfortunately fdctrl_stop_transfer() unconditionally references the DMA interface when finishing the transfer causing a NULL pointer dereference. Fix the issue by adding a check in fdctrl_stop_transfer() so that the DMA interface reference and release method is only invoked if fdctrl->dma_chann has been set. (This issue was discovered by Martin testing a recent change in the NetBSD installer under qemu-system-sparc) Cc: qemu-stable@nongnu.org Reported-by: Martin Husemann <martin@duskware.de> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19nvme: fix oob access issue(CVE-2018-16847)Li Qiang
Currently, the nvme_cmb_ops mr doesn't check the addr and size. This can lead an oob access issue. This is triggerable in the guest. Add check to avoid this issue. Fixes CVE-2018-16847. Reported-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19MAINTAINERS: clarify some of the tagsCornelia Huck
The MAINTAINERS file is a bit sparse on information about what the different designators are. Let's add some more information to give contributors a better idea about what the different roles are. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20181026105711.29605-1-cohuck@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19Merge remote-tracking branch ↵Peter Maydell
'remotes/amarkovic/tags/mips-queue-november-2018-v2' into staging MIPS queue for QEMU 3.1-rc2 - v2 # gpg: Signature made Sat 17 Nov 2018 18:30:46 GMT # gpg: using RSA key D4972A8967F75A65 # gpg: Good signature from "Aleksandar Markovic <amarkovic@wavecomp.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 8526 FBF1 5DA3 811F 4A01 DD75 D497 2A89 67F7 5A65 * remotes/amarkovic/tags/mips-queue-november-2018-v2: MAINTAINERS: Add Stefan Markovic as a MIPS reviewer target/mips: Disable R5900 support target/mips: Rename MMI-related functions target/mips: Rename MMI-related opcodes target/mips: Rename MMI-related masks target/mips: Guard check_insn with INSN_R5900 check target/mips: Guard check_insn_opc_user_only with INSN_R5900 check target/mips: Fix decoding mechanism of special R5900 opcodes target/mips: Fix decoding mechanism of R5900 DIV1 and DIVU1 target/mips: Fix decoding mechanism of R5900 MFLO1, MFHI1, MTLO1 and MTHI1 linux-user: Update MIPS specific prctl() implementation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19Merge remote-tracking branch 'remotes/riscv/tags/riscv-for-master-3.1-rc2' ↵Peter Maydell
into staging RISC-V Patches for 3.1-rc2 This pull request contains four patches that aren't really related to each other aside from all being bug fixes that I think should go in for 3.1.0: * The second half of Alistair's memory leak patch set that I missed last week. * A fix to make fclass.d availiable only on RV64IFD systems (without this it's availiable on RV32IFD systems, truncating the result). * A fix to make sfence.vm availiable only in priv-1.9.1, and sfence.vma only availiable in priv-1.10. * A change to respect fences in user-mode emulators, which were previously treated as NOPs. As usual, this builds and boot Linux for me. I don't think I have anything else planned for 3.1.0, but I may be wrong as things are a bit hectic this week. # gpg: Signature made Tue 13 Nov 2018 23:48:38 GMT # gpg: using RSA key EF4CA1502CCBAB41 # gpg: Good signature from "Palmer Dabbelt <palmer@dabbelt.com>" # gpg: aka "Palmer Dabbelt <palmer@sifive.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 00CE 76D1 8349 60DF CE88 6DF8 EF4C A150 2CCB AB41 * remotes/riscv/tags/riscv-for-master-3.1-rc2: RISC-V: Respect fences for user-only emulators target/riscv: Fix sfence.vm/a both available in any priv version target/riscv: Fix FCLASS_D being treated as RV64 only hw/riscv/virt: Free the test device tree node name Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-17MAINTAINERS: Add Stefan Markovic as a MIPS reviewerAleksandar Markovic
Add Stefan Markovic as a MIPS reviewer. He had several key contributions to QEMU for MIPS this year. He is a meticulous person with the ability to think and act on many levels. Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
2018-11-17target/mips: Disable R5900 supportAleksandar Markovic
Disable R5900 support. There are some outstanding issues related to ABI support and emulation accuracy, that were not understood well during review process. Disable to avoid backward compatibility issues. Reverts commit ed4f49ba9bb56ebca6987b1083255daf6c89b5de. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-11-24 20:13:26 +0000