aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-11-27migration: savevm: consult migration blockersPaolo Bonzini
There is really no difference between live migration and savevm, except that savevm does not require bdrv_invalidate_cache to be implemented by all disks. However, it is unlikely that savevm is used with anything except qcow2 disks, so the penalty is small and worth the improvement in catching bad usage of savevm. Only one place was taking care of savevm when adding a migration blocker, and it can be removed. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27lsi: Reselection needed to remove pending commands from queueGeorge Kennedy
Under heavy IO (e.g. fio) the queue is not checked frequently enough for pending commands. As a result some pending commands are timed out by the linux sym53c8xx driver, which sends SCSI Abort messages for the timed out commands. The SCSI Abort messages result in linux errors, which show up on the console and in /var/log/messages. e.g. sd 0:0:3:0: [sdd] tag#33 ABORT operation started scsi target0:0:3: control msgout: 80 20 47 d sd 0:0:3:0: ABORT operation complete. scsi target0:0:4: message d sent on bad reselection Now following a WAIT DISCONNECT Script instruction, and if there is no current command, check for a pending command on the queue and if one exists call lsi_reselect(). Signed-off-by: George Kennedy <george.kennedy@oracle.com> Message-Id: <1541776692-12271-1-git-send-email-george.kennedy@oracle.com> [For safety, add a s->current check in lsi_update_irq - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27cpus: run work items for all vCPUs if single-threadedPaolo Bonzini
This avoids the following I/O thread deadlock: 1) the I/O thread calls run_on_cpu for CPU 3 from a timer. single_tcg_halt_cond is signaled 2) CPU 1 is running and exits. It finds no work item and enters CPU 2 3) because the I/O thread is stuck in run_on_cpu, the round-robin kick timer never triggers, and CPU 3 never runs the work item 4) run_on_cpu never completes Reviewed-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27target/i386: kvm: add VMX migration blockerPaolo Bonzini
Nested VMX does not support live migration yet. Add a blocker until that is worked out. Nested SVM only does not support it, but unfortunately it is enabled by default for -cpu host so we cannot really disable it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/fixes-31-20181127-pull-request' into staging various bugfixes for 3.1: fmops, ps2, cirrus, hda, usb-host, qapi # gpg: Signature made Tue 27 Nov 2018 06:49:13 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-31-20181127-pull-request: qapi: add query-display-options command usb-host: set ifs.detached as true if kernel driver is not active audio/hda: fix guest triggerable assert cirrus_vga/migration: update the bank offset before use ps2kbd: default to scan enabled after reset fmops: fix off-by-one in AR_TABLE and DR_TABLE array size Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27Merge remote-tracking branch ↵Peter Maydell
'remotes/ehabkost/tags/x86-for-3.1-pull-request' into staging x86 fixes for -rc3 * Fix SynIC crash * Fix x86 crash on MSR code on AMD hosts # gpg: Signature made Mon 26 Nov 2018 20:58:34 GMT # gpg: using RSA key 2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/x86-for-3.1-pull-request: hw/hyperv: fix NULL dereference with pure-kvm SynIC kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES support Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27qapi: add query-display-options commandGerd Hoffmann
Add query-display-options command, which allows querying the qemu display configuration. This isn't particularly useful, except it exposes QAPI type DisplayOptions in query-qmp-schema, so that libvirt can discover recently added -display parameter rendernode (commit d4dc4ab133b). Works around lack of sufficiently powerful command line introspection. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: Eric Blake <eblake@redhat.com> Tested-by: Erik Skultety <eskultet@redhat.com> Message-id: 20181122071613.2889-1-kraxel@redhat.com [ kraxel: reworded commit message as suggested by armbru ]
2018-11-27usb-host: set ifs.detached as true if kernel driver is not activelinzhecheng
If no kernel driver is active, we can already claim and perform I/O on it without detaching it. Signed-off-by: linzhecheng <linzhecheng@huawei.com> Message-id: 20181120083419.17716-1-linzhecheng@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-27audio/hda: fix guest triggerable assertGerd Hoffmann
Guest writes to a readonly register trigger the assert in intel_hda_reg_write(). Add a check and just ignore them. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1628433 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181123063957.9515-1-kraxel@redhat.com
2018-11-27cirrus_vga/migration: update the bank offset before useWang Xin
The cirrus bank0/1 offset should be updated before we update the vram's alias offset. Signed-off-by: Wang Xin <wangxinxin.wang@huawei.com> Message-id: 20181123064646.23036-1-linzhecheng@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-27ps2kbd: default to scan enabled after resetHervé Poussineau
A check for scan_enabled has been added to ps2_keyboard_event in commit 143c04c7e0639e53086519592ead15d2556bfbf2 to prevent stream corruption. This works well as long as operating system is resetting keyboard, or enabling it. This fixes IBM 40p firmware, which doesn't bother sending KBD_CMD_RESET, KBD_CMD_ENABLE or KBD_CMD_RESET_ENABLE before trying to use the keyboard. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20181021190721.2148-1-hpoussin@reactos.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-26hw/hyperv: fix NULL dereference with pure-kvm SynICRoman Kagan
When started in compat configuration of SynIC, e.g. qemu-system-x86_64 -machine pc-i440fx-2.10,accel=kvm \ -cpu host,-vmx,hv-relaxed,hv_spinlocks=0x1fff,hv-vpindex,hv-synic or explicitly qemu-system-x86_64 -enable-kvm -cpu host,hv-synic,x-hv-synic-kvm-only=on QEMU crashes in hyperv_synic_reset() trying to access the non-present qobject for SynIC. Add the missing check for NULL. Reported-by: Vitaly Kuznetsov <vkuznets@redhat.com> Reported-by: Igor Mammedov <imammedo@redhat.com> Fixes: 9b4cf107b09d18ac30f46fd1c4de8585ccba030c Fixes: 4a93722f9c279184e95b1e1ad775c01deec05065 Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Message-Id: <20181126152836.25379-1-rkagan@virtuozzo.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-11-26kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES supportBandan Das
When writing to guest's MSR_IA32_ARCH_CAPABILITIES, check whether it's supported in the guest using the KVM_GET_MSR_INDEX_LIST ioctl. Fixes: d86f963694df27f11b3681ffd225c9362de1b634 Suggested-by: Eduardo Habkost <ehabkost@redhat.com> Tested-by: balducci@units.it Signed-off-by: Bandan Das <bsd@redhat.com> Message-Id: <jpg4lc4iiav.fsf_-_@linux.bootlegged.copy> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-11-26Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20181126' into staging target-arm queue: * some updates to MAINTAINERS file entries * cadence_gem: Remove an incorrect assert() # gpg: Signature made Mon 26 Nov 2018 13:57:34 GMT # gpg: using RSA key 3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20181126: net: cadence_gem: Remove incorrect assert() MAINTAINERS: Add an ARM SMMU section MAINTAINERS: Assign some more files in the hw/arm/ directory Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26net: cadence_gem: Remove incorrect assert()Edgar E. Iglesias
Don't assert on RX descriptor settings when the receiver is disabled. This fixes an issue with incoming packets on an unused GEM. Reported-by: mbilal <muhammad_bilal@mentor.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181123135450.24829-2-edgar.iglesias@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26MAINTAINERS: Add an ARM SMMU sectionEric Auger
Add a new ARM SMMU section and set Eric Auger as the maintainer for ARM SMMU emulation sources. Signed-off-by: Eric Auger <eric.auger@redhat.com> Message-id: 20181122180143.14237-1-eric.auger@redhat.com Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26MAINTAINERS: Assign some more files in the hw/arm/ directoryThomas Huth
I apparently missed some more files and even a complete machine (the "imx25-pdk") in my previous patch... but now we should hopefully have a completely coverage for all available ARM boards. Fixes: 95a5db3ae5698b49c63144610ad02913e780c828 Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 1542782568-20059-1-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell
Fixes a QEMU crash triggerable by guest userspace (CVE-2018-19489). # gpg: Signature made Mon 26 Nov 2018 07:25:01 GMT # gpg: using RSA key 71D4D5E5822F73D6 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Gregory Kurz <gregory.kurz@free.fr>" # gpg: aka "[jpeg image of size 3330]" # Primary key fingerprint: B482 8BAF 9431 40CE F2A3 4910 71D4 D5E5 822F 73D6 * remotes/gkurz/tags/for-upstream: 9p: fix QEMU crash when renaming files Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26Merge remote-tracking branch 'remotes/xtensa/tags/20181125-xtensa' into stagingPeter Maydell
xtensa fixes for 3.1: - fix register counting logic for linux-user gdbserver; - provide default memory sizes for XTFPGA boards; - add missing xtensa patterns to MAINTAINTERS. # gpg: Signature made Sun 25 Nov 2018 23:07:54 GMT # gpg: using RSA key 51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <filippov@cadence.com>" # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20181125-xtensa: MAINTAINERS: add missing xtensa patterns target/xtensa: xtfpga: provide default memory sizes target/xtensa: drop num_[core_]regs from dc232b/dc233c configs target/xtensa: gdbstub fix register counting Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26fmops: fix off-by-one in AR_TABLE and DR_TABLE array sizeGerd Hoffmann
Cc: P J P <ppandit@redhat.com> Reported-by: Wangjunqing <wangjunqing@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20181030082340.17170-1-kraxel@redhat.com Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-239p: fix QEMU crash when renaming filesGreg Kurz
When using the 9P2000.u version of the protocol, the following shell command line in the guest can cause QEMU to crash: while true; do rm -rf aa; mkdir -p a/b & touch a/b/c & mv a aa; done With 9P2000.u, file renaming is handled by the WSTAT command. The v9fs_wstat() function calls v9fs_complete_rename(), which calls v9fs_fix_path() for every fid whose path is affected by the change. The involved calls to v9fs_path_copy() may race with any other access to the fid path performed by some worker thread, causing a crash like shown below: Thread 12 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8, path=0x0, flags=65536, mode=0) at hw/9pfs/9p-local.c:59 59 while (*path && fd != -1) { (gdb) bt #0 0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8, path=0x0, flags=65536, mode=0) at hw/9pfs/9p-local.c:59 #1 0x0000555555a25e0c in local_opendir_nofollow (fs_ctx=0x555557d958b8, path=0x0) at hw/9pfs/9p-local.c:92 #2 0x0000555555a261b8 in local_lstat (fs_ctx=0x555557d958b8, fs_path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/9p-local.c:185 #3 0x0000555555a2b367 in v9fs_co_lstat (pdu=0x555557d97498, path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/cofile.c:53 #4 0x0000555555a1e9e2 in v9fs_stat (opaque=0x555557d97498) at hw/9pfs/9p.c:1083 #5 0x0000555555e060a2 in coroutine_trampoline (i0=-669165424, i1=32767) at util/coroutine-ucontext.c:116 #6 0x00007fffef4f5600 in __start_context () at /lib64/libc.so.6 #7 0x0000000000000000 in () (gdb) The fix is to take the path write lock when calling v9fs_complete_rename(), like in v9fs_rename(). Impact: DoS triggered by unprivileged guest users. Fixes: CVE-2018-19489 Cc: P J P <ppandit@redhat.com> Reported-by: zhibin hu <noirfate@gmail.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Greg Kurz <groug@kaod.org>
2018-11-23Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches: - block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options() - block: Fix option inheritance after stream/commit job graph changes - qemu-img: Fix memory leak and typo in error message - nvme: Fixes for lockups and crashes - scsi-disk: Fix crash if underlying host file or disk returns error - Several qemu-iotests fixes and improvements # gpg: Signature made Thu 22 Nov 2018 18:38:30 GMT # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: block: Update BlockDriverState.inherits_from on bdrv_drop_intermediate() block: Update BlockDriverState.inherits_from on bdrv_set_backing_hd() iotests: Enhance 223 to cover multiple bitmap granularities nvme: fix bug with PCI IRQ pins on teardown nvme: fix CMB endianness confusion Revert "nvme: fix oob access issue(CVE-2018-16847)" nvme: fix out-of-bounds access to the CMB nvme: call blk_drain in NVMe reset code to avoid lockups iotests: fix nbd test 233 to work correctly with raw images block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options() scsi-disk: Fix crash if underlying host file or disk returns error qemu-img: Fix leak qemu-img: Fix typo iotests: Skip 233 if certtool not installed iotests: Replace assertEquals() with assertEqual() iotests: Replace time.clock() with Timeout Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-22MAINTAINERS: add missing xtensa patternsMax Filippov
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-22block: Update BlockDriverState.inherits_from on bdrv_drop_intermediate()Alberto Garcia
The previous patch fixed the inherits_from pointer after block-stream, and this one does the same for block-commit. When block-commit finishes and the 'top' node is not the topmost one from the backing chain then all nodes above 'base' up to and including 'top' are removed from the chain. The bdrv_drop_intermediate() call converts a chain like this one: base <- intermediate <- top <- active into this one: base <- active In a simple scenario each backing file from the first chain has the inherits_from attribute pointing to its parent. This means that reopening 'active' will recursively reopen all its children, whose options can be changed in the process. However after the 'block-commit' call base.inherits_from is NULL and the chain is broken, so 'base' does not inherit from 'active' and will not be reopened automatically: $ qemu-img create -f qcow2 hd0.qcow2 1M $ qemu-img create -f qcow2 -b hd0.qcow2 hd1.qcow2 $ qemu-img create -f qcow2 -b hd1.qcow2 hd2.qcow2 $ $QEMU -drive if=none,file=hd2.qcow2 { 'execute': 'block-commit', 'arguments': { 'device': 'none0', 'top': 'hd1.qcow2' } } { 'execute': 'human-monitor-command', 'arguments': { 'command-line': 'qemu-io none0 "reopen -o backing.l2-cache-size=2M"' } } { "return": "Cannot change the option 'backing.l2-cache-size'\r\n"} This patch updates base.inherits_from in this scenario, and adds a test case. Signed-off-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22block: Update BlockDriverState.inherits_from on bdrv_set_backing_hd()Alberto Garcia
When a BlockDriverState's child is opened (be it a backing file, the protocol layer, or any other) inherits_from is set to point to the parent node. Children opened separately and then attached to a parent don't have this pointer set. bdrv_reopen_queue_child() uses this to determine whether a node's children must also be reopened inheriting the options from the parent or not. If inherits_from points to the parent then the child is reopened and its options can be changed, like in this example: $ qemu-img create -f qcow2 hd0.qcow2 1M $ qemu-img create -f qcow2 hd1.qcow2 1M $ $QEMU -drive if=none,node-name=hd0,file=hd0.qcow2,\ backing.driver=qcow2,backing.file.filename=hd1.qcow2 (qemu) qemu-io hd0 "reopen -o backing.l2-cache-size=2M" If the child does not inherit from the parent then it does not get reopened and its options cannot be changed: $ $QEMU -drive if=none,node-name=hd1,file=hd1.qcow2 -drive if=none,node-name=hd0,file=hd0.qcow2,backing=hd1 (qemu) qemu-io hd0 "reopen -o backing.l2-cache-size=2M" Cannot change the option 'backing.l2-cache-size' If a disk image has a chain of backing files then all of them are also connected through their inherits_from pointers (i.e. it's possible to walk the chain in reverse order from base to top). However this is broken if the intermediate nodes are removed using e.g. block-stream because the inherits_from pointer from the base node becomes NULL: $ qemu-img create -f qcow2 hd0.qcow2 1M $ qemu-img create -f qcow2 -b hd0.qcow2 hd1.qcow2 $ qemu-img create -f qcow2 -b hd1.qcow2 hd2.qcow2 $ $QEMU -drive if=none,file=hd2.qcow2 (qemu) qemu-io none0 "reopen -o backing.l2-cache-size=2M" (qemu) block_stream none0 0 hd0.qcow2 (qemu) qemu-io none0 "reopen -o backing.l2-cache-size=2M" Cannot change the option 'backing.l2-cache-size' This patch updates the inherits_from pointer if the intermediate nodes of a backing chain are removed using bdrv_set_backing_hd(), and adds a test case for this scenario. Signed-off-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22iotests: Enhance 223 to cover multiple bitmap granularitiesEric Blake
Testing granularity at the same size as the cluster isn't quite as fun as what happens when it is larger or smaller. This enhancement also shows that qemu's nbd server can serve the same disk over multiple exports simultaneously. Signed-off-by: Eric Blake <eblake@redhat.com> Tested-by: John Snow <jsnow@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22nvme: fix bug with PCI IRQ pins on teardownLogan Gunthorpe
When the submission and completion queues are being torn down the IRQ will be asserted for the completion queue when the submsission queue is deleted. Then when the completion queue is deleted it stays asserted. Thus, on systems that do not use MSI, no further interrupts can be triggered on the host. Linux sees this as a long delay when unbinding the nvme device. Eventually the interrupt timeout occurs and it continues. To fix this we ensure we deassert the IRQ for a CQ when it is deleted. Signed-off-by: Logan Gunthorpe <logang@deltatee.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22nvme: fix CMB endianness confusionPaolo Bonzini
The CMB is marked as DEVICE_LITTLE_ENDIAN, so the data must be read/written as if it was little-endian output (in the case of big endian, we get two swaps, one in the memory core and one in nvme.c). Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22Revert "nvme: fix oob access issue(CVE-2018-16847)"Kevin Wolf
This reverts commit 5e3c0220d7e4f0361c4d36c697a8842f2b583402. We have a better fix commited for this now. Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22nvme: fix out-of-bounds access to the CMBPaolo Bonzini
Because the CMB BAR has a min_access_size of 2, if you read the last byte it will try to memcpy *2* bytes from n->cmbuf, causing an off-by-one error. This is CVE-2018-16847. Another way to fix this might be to register the CMB as a RAM memory region, which would also be more efficient. However, that might be a change for big-endian machines; I didn't think this through and I don't know how real hardware works. Add a basic testcase for the CMB in case somebody does this change later on. Cc: Keith Busch <keith.busch@intel.com> Cc: qemu-block@nongnu.org Reported-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Tested-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22nvme: call blk_drain in NVMe reset code to avoid lockupsIgor Druzhinin
When blk_flush called in NVMe reset path S/C queues are already freed which means that re-entering AIO handling loop having some IO requests unfinished will lockup or crash as their SG structures being potentially reused. Call blk_drain before freeing the queues to avoid this nasty scenario. Signed-off-by: Igor Druzhinin <igor.druzhinin@citrix.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22iotests: fix nbd test 233 to work correctly with raw imagesDaniel P. Berrangé
The first qemu-io command must honour the $IMGFMT that is set rather than hardcoding qcow2. The qemu-nbd commands should also set $IMGFMT to avoid the insecure format probe warning. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options()Alberto Garcia
Commit e35bdc123a4ace9f4d3fcca added the auto-read-only option and the code to update its corresponding flag in update_flags_from_options(), but forgot to clear the flag if auto-read-only is false. Signed-off-by: Alberto Garcia <berto@igalia.com> Reported-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22scsi-disk: Fix crash if underlying host file or disk returns errorRichard W.M. Jones
Commit 40dce4ee6 "scsi-disk: fix rerror/werror=ignore" introduced a bug which causes qemu to crash with the assertion error below if the host file or disk returns an error: qemu-system-x86_64: hw/scsi/scsi-bus.c:1374: scsi_req_complete: Assertion `req->status == -1' failed. Kevin Wolf suggested this fix: < kwolf> Hm, should the final return false; in that patch actually be a return true? < kwolf> Because I think he didn't intend to change anything except BLOCK_ERROR_ACTION_IGNORE Buglink: https://bugs.launchpad.net/qemu/+bug/1804323 Fixes: 40dce4ee61c68395f6d463fae792f61b7c003bce Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22Merge remote-tracking branch ↵Peter Maydell
'remotes/dgilbert/tags/pull-migration-20181121a' into staging Migration fixes 2018-11-21 Notably the fix for building with --disable-replication # gpg: Signature made Wed 21 Nov 2018 13:03:20 GMT # gpg: using RSA key 0516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert/tags/pull-migration-20181121a: migration/migration.c: Add COLO dependency checks migration/colo.c: Fix compilation issue when disable replication Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-21target/xtensa: xtfpga: provide default memory sizesMax Filippov
Provide default RAM sizes for all XTFPGA boards, so that when started without -m option they do the right thing. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-21qemu-img: Fix leakMax Reitz
create_opts was leaked here. This is not too bad since the process is about to exit anyway, but relying on that does not make the code nicer to read. Fixes: d402b6a21a825a5c07aac9251990860723d49f5d Reported-by: Kevin Wolf <kwolf@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-21qemu-img: Fix typoMax Reitz
Fixes: d402b6a21a825a5c07aac9251990860723d49f5d Reported-by: Kevin Wolf <kwolf@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-21iotests: Skip 233 if certtool not installedEric Blake
The use of TLS while building qemu is optional. While the 'certtool' binary should be available on every platform that supports building against TLS, that does not imply that the developer has installed it. Make the test gracefully skip in that case. Reported-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-21migration/migration.c: Add COLO dependency checksZhang Chen
Current COLO mode(independent disk mode) need replication module work together. Suggested by Dr. David Alan Gilbert <dgilbert@redhat.com>. Signed-off-by: Zhang Chen <chen.zhang@intel.com> Message-Id: <20181114190912.7242-1-chen.zhang@intel.com> Reviewed-by: Peter Xu <peterx@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2018-11-21migration/colo.c: Fix compilation issue when disable replicationZhang Chen
This compilation issue will occur when user use --disable-replication to config Qemu. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Zhang Chen <zhangckid@gmail.com> Message-Id: <20181101021226.6353-1-zhangckid@gmail.com> Tested-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2018-11-21iotests: Replace assertEquals() with assertEqual()Kevin Wolf
TestCase.assertEquals() is deprecated since Python 2.7. Recent Python versions print a warning when the function is called, which makes test cases fail. Replace it with the preferred spelling assertEqual(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-21iotests: Replace time.clock() with TimeoutKevin Wolf
time.clock() is deprecated since Python 3.3. Current Python versions warn that the function will be removed in Python 3.8, and those warnings make the test case 118 fail. Replace it with the Timeout mechanism that is compatible with both Python 2 and 3, and makes the code even a little nicer. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-20target/xtensa: drop num_[core_]regs from dc232b/dc233c configsMax Filippov
Now that xtensa_count_regs does the right thing, remove manual initialization of these fields from the affected configurations and let xtensa_finalize_config initialize them. Add XTREG_END to terminate register lists. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2018-11-20target/xtensa: gdbstub fix register countingMax Filippov
In order to communicate correctly with gdb xtensa gdbstub must provide expected number of registers in 'g' packet response. xtensa-elf-gdb expects both nonprivileged and privileged registers. xtensa-linux-gdb only expects nonprivileged registers. gdb only counts one contiguous stretch of registers, do the same for the core registers in the xtensa_count_regs. With this change qemu-system-xtensa is able to communicate with all xtensa-elf-gdb versions (versions prior to 8.2 require overlay fixup), and qemu-xtensa is able to communicate with all xtensa-linux-gdb versions, except 8.2. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2018-11-20Update version for v3.1.0-rc2 releasev3.1.0-rc2Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-20Merge remote-tracking branch ↵Peter Maydell
'remotes/ehabkost/tags/x86-for-3.1-pull-request' into staging pc-*-3.1 machine-types # gpg: Signature made Tue 20 Nov 2018 13:43:24 GMT # gpg: using RSA key 2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/x86-for-3.1-pull-request: hw/i386: add pc-i440fx-3.1 & pc-q35-3.1 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-20hw/i386: add pc-i440fx-3.1 & pc-q35-3.1Marc-André Lureau
We have a couple of PC_COMPAT_3_0, so we should have 3.1 PC machines, and update the 3.0 machines to make use of those. Fixes a "Known issue" from https://wiki.qemu.org/Planning/3.1. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20181120132604.22854-1-marcandre.lureau@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-11-20Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell
Fixes yet another use-after-free issue that could be triggered by a misbehaving guest. This is a follow-up to commit: commit 5b76ef50f62079a2389ba28cacaf6cce68b1a0ed Author: Greg Kurz <groug@kaod.org> Date: Wed Nov 7 01:00:04 2018 +0100 9p: write lock path in v9fs_co_open2() # gpg: Signature made Tue 20 Nov 2018 12:01:07 GMT # gpg: using RSA key 71D4D5E5822F73D6 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Gregory Kurz <gregory.kurz@free.fr>" # gpg: aka "[jpeg image of size 3330]" # Primary key fingerprint: B482 8BAF 9431 40CE F2A3 4910 71D4 D5E5 822F 73D6 * remotes/gkurz/tags/for-upstream: 9p: take write lock on fid path updates (CVE-2018-19364) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-209p: take write lock on fid path updates (CVE-2018-19364)Greg Kurz
Recent commit 5b76ef50f62079a fixed a race where v9fs_co_open2() could possibly overwrite a fid path with v9fs_path_copy() while it is being accessed by some other thread, ie, use-after-free that can be detected by ASAN with a custom 9p client. It turns out that the same can happen at several locations where v9fs_path_copy() is used to set the fid path. The fix is again to take the write lock. Fixes CVE-2018-19364. Cc: P J P <ppandit@redhat.com> Reported-by: zhibin hu <noirfate@gmail.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Greg Kurz <groug@kaod.org>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-04 10:39:41 +0000