aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-09-03Update version for v9.1.0 releasev9.1.0Richard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-28Update version for v9.1.0-rc4 releasev9.1.0-rc4Richard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-28Merge tag 'pull-qapi-2024-08-27' of https://repo.or.cz/qemu/armbru into stagingRichard Henderson
QAPI patches patches for 2024-08-27 # -----BEGIN PGP SIGNATURE----- # # iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmbNnv8SHGFybWJydUBy # ZWRoYXQuY29tAAoJEDhwtADrkYZTnfsP+gNO5z7mSHypAD/oGIfYD+HnBrpMK1bL # WIOH9hLiHEZmMH978WBuKH0Ry8mhEoSNi0jQBB67IzGD4qItSYOSUEfsNBL/VpOG # lfR8hIt/akdXshrAXB7zJ0D0phnXh93asUIjNpSQkItYxHkO+OphDBPU+anQy2oi # 71F8z1GSb8DP6rGgcSA7UXq0WUUERdLMrDz8++UAO2hQq9tvQvfNdRh3kTHWZMIP # urha0Qo6HEGsucQboLaBdJVDdJpkr+offr13CpOrNMFLxZWsnXnsJb3ym+svL4JV # 8jLp+QAcfomwvaWpNMlFBlgXoHMDkl8T0qhhp598aGdloc6iv9lHipeQOmi541QD # O/j6sEU4uQ6W3LjPodg/nfHhAyxJ/fI9dKbCVLcSLWHCXbc/yvV623EEWasJIFNE # lRykAWcZlUvX7UwKfkmqPUutZu1IFhPhSYKOdvw8NZ/llqUOgHcPA50q6wGdkMWC # wPlhkijo7VGOJf1XJqA9xWuUYikCoBg5mLituzyaCBYlkOv2QBLnj0Yogi2dv79L # x/tn5/2vDW6tlerCfvF/q5piwXzkDp7KS3i1YRuxnWvbD+b8VAjb7y/7QETpVWXU # 7fWDIWm5Op7c5KBcj5i/NbI8/guVnvBWsVWXtrJZU9E8vqivC7v93riFOUx3y/Qr # oBnbTwGgdilh # =GPSn # -----END PGP SIGNATURE----- # gpg: Signature made Tue 27 Aug 2024 07:40:15 PM AEST # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] * tag 'pull-qapi-2024-08-27' of https://repo.or.cz/qemu/armbru: docs/sphinx: fix extra stuff in TOC after freeform QMP sections Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-27docs/sphinx: fix extra stuff in TOC after freeform QMP sectionsJohn Snow
Freeform sections with titles are currently generating a TOC entry for the first paragraph in the section after the header, which is not what we want. (Easiest to observe directly in the QMP reference manual's "Introduction" section.) When freeform sections are parsed, we create both a section header *and* an empty, title-less section. This causes some problems with sphinx's post-parse tree transforms, see also 2664f317 - this is a similar issue: Sphinx doesn't like section-less titles and it also doesn't like title-less sections. Modify qapidoc.py to parse text directly into the preceding section title as child nodes, eliminating the section duplication. This removes the extra text from the TOC. Only very, very lightly tested: "it looks right at a glance" :tm:. I am still in the process of rewriting qapidoc, so I didn't give it much deeper thought. Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Message-ID: <20240822204803.1649762-1-jsnow@redhat.com>
2024-08-27Merge tag 'pull-nbd-2024-08-26' of https://repo.or.cz/qemu/ericb into stagingRichard Henderson
NBD patches for 2024-08-26 - One more patch for CVE-2024-7409 (use-after-free on nbd-server-stop) # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCAAdFiEEccLMIrHEYCkn0vOqp6FrSiUnQ2oFAmbMh9MACgkQp6FrSiUn # Q2ovfAf/TyHYtJUwSAQ3dgn4PlTym4FqN8CXa+EJQR9xSLJ5jAX3QgLBieUiIT31 # AFr9W6eqWNz4NksbeoHdwZVqUlkGJFsfiyTOK93k4/fYQdTbqSHPwo2FYlOXqdJB # bZN10zEvd7YRMrxTjGyPxNFCm2iIMZy8uEerOrY9hV1PVULHg6u3Pu8a6El4BK8k # k5S0SwluTkUkBLbqtEC6fHjdfFFr/dC8IB11Ly8FdxKHixIaUTVsZ20guNM0Q5Ca # kU2em2PcroDq3B0x3linD3xh3pVmlHdb4H+9runmGPnpJj5wjPL35aDzlU7GCT3B # kEGX5VzOJOJUXoHVyYrvJCD4I7YgMw== # =ZDYx # -----END PGP SIGNATURE----- # gpg: Signature made Mon 26 Aug 2024 11:49:07 PM AEST # gpg: using RSA key 71C2CC22B1C4602927D2F3AAA7A16B4A2527436A # gpg: Good signature from "Eric Blake <eblake@redhat.com>" [full] # gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" [full] # gpg: aka "[jpeg image of size 6874]" [full] * tag 'pull-nbd-2024-08-26' of https://repo.or.cz/qemu/ericb: nbd/server: CVE-2024-7409: Avoid use-after-free when closing server Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-26nbd/server: CVE-2024-7409: Avoid use-after-free when closing serverEric Blake
Commit 3e7ef738 plugged the use-after-free of the global nbd_server object, but overlooked a use-after-free of nbd_server->listener. Although this race is harder to hit, notice that our shutdown path first drops the reference count of nbd_server->listener, then triggers actions that can result in a pending client reaching the nbd_blockdev_client_closed() callback, which in turn calls qio_net_listener_set_client_func on a potentially stale object. If we know we don't want any more clients to connect, and have already told the listener socket to shut down, then we should not be trying to update the listener socket's associated function. Reproducer: > #!/usr/bin/python3 > > import os > from threading import Thread > > def start_stop(): > while 1: > os.system('virsh qemu-monitor-command VM \'{"execute": "nbd-server-start", +"arguments":{"addr":{"type":"unix","data":{"path":"/tmp/nbd-sock"}}}}\'') > os.system('virsh qemu-monitor-command VM \'{"execute": "nbd-server-stop"}\'') > > def nbd_list(): > while 1: > os.system('/path/to/build/qemu-nbd -L -k /tmp/nbd-sock') > > def test(): > sst = Thread(target=start_stop) > sst.start() > nlt = Thread(target=nbd_list) > nlt.start() > > sst.join() > nlt.join() > > test() Fixes: CVE-2024-7409 Fixes: 3e7ef738c8 ("nbd/server: CVE-2024-7409: Close stray clients at server-stop") CC: qemu-stable@nongnu.org Reported-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com> Signed-off-by: Eric Blake <eblake@redhat.com> Message-ID: <20240822143617.800419-2-eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2024-08-26Merge tag 'pull-request-2024-08-26' of https://gitlab.com/thuth/qemu into ↵Richard Henderson
staging * Disable the broken qtests in the MSYS2 CI job * Replace deprecated keyword in the Cirrus-CI scripts * Fix a simple leak in the migration-test qtest # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmbMTQ4RHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbWLcA//eRd0MWEZNsDO712KKf6PErd+zY9pI5Wg # 0Vc74ggY1HkID2blsnqmPWgjlgsXoEC0HaDSfvKkF9F64Wmqv1EciYsTCVOqJFAw # WPzUhdchLKSIgIDR/W8GFJgUZ7kaK5pk5PNZBJK5/3Febrd/TQK0hGcWHRqQoelY # moNDuSs2T49wSk1ODbNAkMXJ1xl/nBp6+rCM6ao6dSyHc5wbwEMv954XciyA4Sfy # 3lRwH33CED3wyNFxebqYBiEpF+UVGy1aK9TeSIgjQJ06lS458sm7flozZ+BQD3u9 # wRdtlPi/YTQKbzru0dsIDqzq//M3OfxAcnVZ6R8ThNN6vaj99PdgGCEuy/QWVCth # MKy0CiqtF/RDTgA8I6JPlNOFhS0bq4jXzDbGfZwQJpU5ZyYlSZnWc1I87BV8TdzJ # TNT+rej15NwcsYzr1N4o83FRfJz7snFJjV9fxU49SixNQbl+UKfcZMuwgqpa6NaH # LqL7ocI3QL4TUFk1wqlzQZ9H8iIrCQQCE2Tu7PFgRsfGw7y38Csq101NL/6ABElN # chMTjTHubmi6+VEy4E2t1jpXd1kjoZWTigCFyLet3zIgZQAlz9RELEyYGO9r5h3f # T1KmkC10ANknd3DTNV3WH51WSlDonVHWycQUq1pvdr2HBLsVsekxIIWM8HZCK7aj # 9abyOkdKcpE= # =EjoS # -----END PGP SIGNATURE----- # gpg: Signature made Mon 26 Aug 2024 07:38:22 PM AEST # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] * tag 'pull-request-2024-08-26' of https://gitlab.com/thuth/qemu: tests/qtest: Delete previous boot file .gitlab-ci.d/windows.yml: Disable the qtests in the MSYS2 job gitlab-ci: Replace build_script -> step_script in Cirrus jobs Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-26tests/qtest: Delete previous boot fileAkihiko Odaki
A test run may create boot files several times. Delete the previous boot file before creating a new one. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20240823-san-v4-7-a24c6dfa4ceb@daynix.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-08-26.gitlab-ci.d/windows.yml: Disable the qtests in the MSYS2 jobThomas Huth
The qtests are broken since a while in the MSYS2 job in the gitlab-CI, likely due to some changes in the MSYS2 environment. So far nobody has neither a clue what's going wrong here, nor an idea how to fix this (in fact most QEMU developers even don't have a Windows environment available for properly analyzing this problem), so we should disable the qtests here for the time being to get at least test coverage again for the remaining tests that are run here. Since we already get compile-test coverage for the system emulation in the cross-win64-system job, and since the MSYS2 job is one of the longest running jobs in our CI (it takes more than 1 hour to complete), let's seize the opportunity and also cut the run time by disabling the system emulation completely here, including the libraries that are only useful for system emulation. In case somebody ever figures out the failure of the qtests on MSYS2, we can revert this patch to get everything back. Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240820170142.55324-1-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-08-26gitlab-ci: Replace build_script -> step_script in Cirrus jobsPhilippe Mathieu-Daudé
Long due upgrade, see [1]: In GitLab Runner 13.2 a translation for step_script to build_script was added to the custom executor. In 14.0 the build_script stage will be replaced with step_script. We are using GitLab 17 [2]! This removes the following warning: WARNING: Starting with version 17.0 the 'build_script' stage will be replaced with 'step_script': https://gitlab.com/groups/gitlab-org/-/epics/6112 [1] https://about.gitlab.com/releases/2021/05/22/gitlab-13-12-released/#remove-translation-from-stepscript-to-buildscript-in-custom-executor [2] https://about.gitlab.com/releases/2024/05/16/gitlab-17-0-released/ Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20240816213203.18350-1-philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-08-24Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into stagingRichard Henderson
trivial patches for 2024-08-23 # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCAAdFiEEe3O61ovnosKJMUsicBtPaxppPlkFAmbImVIACgkQcBtPaxpp # PllP3wf/TaYAQs0HkQRQ62/2wqnfABpZYft/g6EhHveZ/04pJ/eNIIiVqqUg4DGs # i8fENABRlRPoeK5HtGVhHYbOg6tzje7MR0qdSmWaKb2R5pPqkLHZ6NTtQlINLpOb # O8Nh1c5/qDW/pDPCWVLkEMTqKhtGfINr0pHSlTfOr0W9FrU1I6srvr6AZtrTORlL # 5b79j5IZGQSj5zR3ViuKyEPdA5NRSeTOewg8WCKGSxZGk4OlVPevrEAGOyQReOuN # HTfNi8KQH/pPzl6+f+THkgKmYYfUAlPvzkJDndV9vcPFLPI8ZncZ1o1Kmog6UERc # s5J2vTcir/ReEukApRRsZkKHLAoYdQ== # =Srl8 # -----END PGP SIGNATURE----- # gpg: Signature made Sat 24 Aug 2024 12:14:42 AM AEST # gpg: using RSA key 7B73BAD68BE7A2C289314B22701B4F6B1A693E59 # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" [full] # gpg: aka "Michael Tokarev <mjt@debian.org>" [full] # gpg: aka "Michael Tokarev <mjt@corpit.ru>" [full] * tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu: hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read() system/vl.c: Print machine name, not "(null)", for unknown machine types hw/x86: add a couple of comments explaining how the kernel image is parsed Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-23hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()Haoran Zhang
fix vhost_user_gpu_chr_read() where `size` was incorrectly passed to `msg->flags`. Fixes: 267f664658 ("hw/display: add vhost-user-vga & gpu-pci") Signed-off-by: Haoran Zhang <wh1sper@zju.edu.cn> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-08-23system/vl.c: Print machine name, not "(null)", for unknown machine typesPeter Maydell
In commit 412d294ffdc we tried to improve the error message printed when the machine type is unknown, but we used the wrong variable, resulting in: $ ./build/x86/qemu-system-aarch64 -M bang qemu-system-aarch64: unsupported machine type: "(null)" Use -machine help to list supported machines Use the right variable, so we produce more helpful output: $ ./build/x86/qemu-system-aarch64 -M bang qemu-system-aarch64: unsupported machine type: "bang" Use -machine help to list supported machines Note that we must move the qdict_del() to below the error_setg(), because machine_type points into the value of that qdict entry, and deleting it will make the pointer invalid. Cc: qemu-stable@nongnu.org Fixes: 412d294ffdc ("vl.c: select_machine(): add selected machine type to error message") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-08-23hw/x86: add a couple of comments explaining how the kernel image is parsedAni Sinha
Cosmetic: add comments in x86_load_linux() pointing to the kernel documentation so that users can better understand the code. CC: qemu-trivial@nongnu.org Signed-off-by: Ani Sinha <anisinha@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-08-22Update version for v9.1.0-rc3 releasev9.1.0-rc3Richard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-21Merge tag 'pull-loongarch-20240821' of https://gitlab.com/gaosong/qemu into ↵Richard Henderson
staging Fix for 9.1 # -----BEGIN PGP SIGNATURE----- # # iLMEAAEKAB0WIQS4/x2g0v3LLaCcbCxAov/yOSY+3wUCZsVYjgAKCRBAov/yOSY+ # 306ZA/9/DFdJB5WbVtv8ZNaRKT2jj6N9o5YlLbO1HsdMGpJbDWNJAIrOIdfBCYzF # oEvjuYItBI9DXcSUE748ucBkct/x4WkBwfL5mxfTRXOhvx3iKFeC2ZKyKPtsciRO # QE4UDmrFbQ9IrW33Vw0+CRMlN/U8xBO7lPDfbk2MA7fM74ns8A== # =EbRt # -----END PGP SIGNATURE----- # gpg: Signature made Wed 21 Aug 2024 01:01:34 PM AEST # gpg: using RSA key B8FF1DA0D2FDCB2DA09C6C2C40A2FFF239263EDF # gpg: Good signature from "Song Gao <m17746591750@163.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: B8FF 1DA0 D2FD CB2D A09C 6C2C 40A2 FFF2 3926 3EDF * tag 'pull-loongarch-20240821' of https://gitlab.com/gaosong/qemu: hw/loongarch: Fix length for lowram in ACPI SRAT Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-21hw/loongarch: Fix length for lowram in ACPI SRATJiaxun Yang
The size of lowram should be "gap" instead of the whole node. This is failing kernel's sanity check: [ 0.000000] ACPI: SRAT: Node 0 PXM 0 [mem 0x00000000-0xffffffff] [ 0.000000] ACPI: SRAT: Node 0 PXM 0 [mem 0x80000000-0x16fffffff] [ 0.000000] ACPI: SRAT: Node 1 PXM 1 [mem 0x170000000-0x26fffffff] [ 0.000000] Warning: node 0 [mem 0x00000000-0xffffffff] overlaps with itself [mem 0x80000000-0x16fffffff] Fixes: fc100011f38d ("hw/loongarch: Refine acpi srat table for numa memory") Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Bibo Mao <maobibo@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2024-08-21Merge tag 'pull-misc-20240821' of https://gitlab.com/rth7680/qemu into stagingRichard Henderson
target/i386: Fix carry flag for BLSI target/i386: Fix tss access size in switch_tss_ra linux-user: Handle short reads in mmap_h_gt_g bsd-user: Handle short reads in mmap_h_gt_g # -----BEGIN PGP SIGNATURE----- # # iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmbFTzUdHHJpY2hhcmQu # aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV/9+Qf9GiXgmZU51Rk9LaNz # zlaUPIJy/ER+lCpkaeIqMzJ3EysuWa5tZFOrg21rqmfMr19AIuPSRmCFXuwkF6s+ # DnCiToloM/EvczmVQALE/KhOOm0dwvoAwSFBFTCPfg/IKjb9OcOWHGJVSgFV/1u6 # vrTqUc6xny6QhMjTuVWziE/VAH0V9wRjToii2qN9k/5e2oF1hzDGjHx7T9d//4j5 # hbRyzH0luexvob7JCpxHDELlarkoyR5a7cJQHTj0VTfmR5g6yEMLn+z7ocBcUF09 # pJzcRu2BHUYjzQgV6wqdj5aw8N26c+e8pm1XIA8S1CwBnLRnkuuCKKD7I0tdYvFA # VgDntQ== # =XyeR # -----END PGP SIGNATURE----- # gpg: Signature made Wed 21 Aug 2024 12:21:41 PM AEST # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [ultimate] * tag 'pull-misc-20240821' of https://gitlab.com/rth7680/qemu: target/i386: Fix tss access size in switch_tss_ra target/i386: Fix carry flag for BLSI target/i386: Split out gen_prepare_val_nz bsd-user: Handle short reads in mmap_h_gt_g linux-user: Handle short reads in mmap_h_gt_g Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-21target/i386: Fix tss access size in switch_tss_raRichard Henderson
The two limit_max variables represent size - 1, just like the encoding in the GDT, thus the 'old' access was off by one. Access the minimal size of the new tss: the complete tss contains the iopb, which may be a larger block than the access api expects, and irrelevant because the iopb is not accessed during the switch itself. Fixes: 8b131065080a ("target/i386/tcg: use X86Access for TSS access") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2511 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240819074052.207783-1-richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
2024-08-21target/i386: Fix carry flag for BLSIRichard Henderson
BLSI has inverted semantics for C as compared to the other two BMI1 instructions, BLSMSK and BLSR. Introduce CC_OP_BLSI* for this purpose. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2175 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240801075845.573075-3-richard.henderson@linaro.org>
2024-08-21target/i386: Split out gen_prepare_val_nzRichard Henderson
Split out the TCG_COND_TSTEQ logic from gen_prepare_eflags_z, and use it for CC_OP_BMILG* as well. Prepare for requiring both zero and non-zero senses. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240801075845.573075-2-richard.henderson@linaro.org>
2024-08-21bsd-user: Handle short reads in mmap_h_gt_gRichard Henderson
In particular, if an image has a large bss, we can hit EOF before reading all bytes of the mapping. Mirror the similar change to linux-user. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240820050848.165253-3-richard.henderson@linaro.org>
2024-08-21linux-user: Handle short reads in mmap_h_gt_gRichard Henderson
In particular, if an image has a large bss, we can hit EOF before reading all host_len bytes of the mapping. Create a helper, mmap_pread to handle the job for both the larger block in mmap_h_gt_g itself, as well as the smaller block in mmap_frag. Cc: qemu-stable@nongnu.org Fixes: eb5027ac618 ("linux-user: Split out mmap_h_gt_g") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2504 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240820050848.165253-2-richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-08-21Merge tag 'migration-20240820-pull-request' of ↵Richard Henderson
https://gitlab.com/farosas/qemu into staging Migration pull request - Peter's fix for a leak in multifd recv side # -----BEGIN PGP SIGNATURE----- # # iQJEBAABCAAuFiEEqhtIsKIjJqWkw2TPx5jcdBvsMZ0FAmbEzJcQHGZhcm9zYXNA # c3VzZS5kZQAKCRDHmNx0G+wxnVc4D/9WJ5AhBxgyYvjRD/X3rKryL1oz7C5/WI8i # M4Q0Mo+JFeuFjSGvAOrOU8qbI2SdOyFFpvBItmvRgyfFePaFVJrsuD4trHj7s2a+ # 6QwXAR7z5emhUFOneb7AaFDDruKGJ/dRsLK6C5ukJQm162l8vqc+YExmx/snQwFY # M0KusPfdv/M2JjFiN+XCJM7Yrqosajju+Kyc3KwLzXCEyXGmKBN5O+DzxGU5iXG8 # CqrSllJpjiQyTp297LLjKZCDpIk+U/BlA3XXhF7kuCAFjCB1NORuHVn47Ka9EuwV # iffEYw9i7ZiJXF9XdKrXRE5tj92tl+RIcgF6LLILdIuvfUa5IZ624ZjHxvQTNSEi # dwWI1RSX/XbXYloz4hJ/3rdxtkS+2IzjP5bN8q+x3XkT37Qb7dm76ePwCLxxZ/nq # 45DSQlgtZGsB+eH5Ac8v/5hLkxqKVg1zFa7W/J445Ckwv4GQyLCKP6hJInrkjYPJ # qBKTj1Q+cmWfoUpYiVA90eUHHnQqkOehvYutFo4GZ3/vsQOJ7QNIJChBnsDaKwXF # 9soKEbQhgj3YuBrZd8CsSR6ugPw6u111Y3Kw5ZssfbOf2703/R1GmB1YZBBUvyNm # KEjLeOz2/IBUvNVTqO7OXfHbayjzA26Gi0T/roOmdOItg/GQ4T8/FhPOfVoKuCOr # 6BCeefzxoQ== # =CPa0 # -----END PGP SIGNATURE----- # gpg: Signature made Wed 21 Aug 2024 03:04:23 AM AEST # gpg: using RSA key AA1B48B0A22326A5A4C364CFC798DC741BEC319D # gpg: issuer "farosas@suse.de" # gpg: Good signature from "Fabiano Rosas <farosas@suse.de>" [unknown] # gpg: aka "Fabiano Almeida Rosas <fabiano.rosas@suse.com>" [unknown] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: AA1B 48B0 A223 26A5 A4C3 64CF C798 DC74 1BEC 319D * tag 'migration-20240820-pull-request' of https://gitlab.com/farosas/qemu: migration/multifd: Free MultiFDRecvParams::data Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-20migration/multifd: Free MultiFDRecvParams::dataPeter Maydell
In multifd_recv_setup() we allocate (among other things) * a MultiFDRecvData struct to multifd_recv_state::data * a MultiFDRecvData struct to each multfd_recv_state->params[i].data (Then during execution we might swap these pointers around.) But in multifd_recv_cleanup() we free multifd_recv_state->data in multifd_recv_cleanup_state() but we don't ever free the multifd_recv_state->params[i].data. This results in a memory leak reported by LeakSanitizer: (cd build/asan && \ ASAN_OPTIONS="fast_unwind_on_malloc=0:strip_path_prefix=/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../" \ QTEST_QEMU_BINARY=./qemu-system-x86_64 \ ./tests/qtest/migration-test --tap -k -p /x86_64/migration/multifd/file/mapped-ram ) [...] Direct leak of 72 byte(s) in 3 object(s) allocated from: #0 0x561cc0afcfd8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-x86_64+0x218efd8) (BuildId: be72e086d4e47b172b0a72779972213fd9916466) #1 0x7f89d37acc50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13 #2 0x561cc1e9c83c in multifd_recv_setup migration/multifd.c:1606:19 #3 0x561cc1e68618 in migration_ioc_process_incoming migration/migration.c:972:9 #4 0x561cc1e3ac59 in migration_channel_process_incoming migration/channel.c:45:9 #5 0x561cc1e4fa0b in file_accept_incoming_migration migration/file.c:132:5 #6 0x561cc30f2c0c in qio_channel_fd_source_dispatch io/channel-watch.c:84:12 #7 0x7f89d37a3c43 in g_main_dispatch debian/build/deb/../../../glib/gmain.c:3419:28 #8 0x7f89d37a3c43 in g_main_context_dispatch debian/build/deb/../../../glib/gmain.c:4137:7 #9 0x561cc3b21659 in glib_pollfds_poll util/main-loop.c:287:9 #10 0x561cc3b1ff93 in os_host_main_loop_wait util/main-loop.c:310:5 #11 0x561cc3b1fb5c in main_loop_wait util/main-loop.c:589:11 #12 0x561cc1da2917 in qemu_main_loop system/runstate.c:801:9 #13 0x561cc3796c1c in qemu_default_main system/main.c:37:14 #14 0x561cc3796c67 in main system/main.c:48:12 #15 0x7f89d163bd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #16 0x7f89d163be3f in __libc_start_main csu/../csu/libc-start.c:392:3 #17 0x561cc0a79fa4 in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-x86_64+0x210bfa4) (BuildId: be72e086d4e47b172b0a72779972213fd9916466) Direct leak of 24 byte(s) in 1 object(s) allocated from: #0 0x561cc0afcfd8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-x86_64+0x218efd8) (BuildId: be72e086d4e47b172b0a72779972213fd9916466) #1 0x7f89d37acc50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13 #2 0x561cc1e9bed9 in multifd_recv_setup migration/multifd.c:1588:32 #3 0x561cc1e68618 in migration_ioc_process_incoming migration/migration.c:972:9 #4 0x561cc1e3ac59 in migration_channel_process_incoming migration/channel.c:45:9 #5 0x561cc1e4fa0b in file_accept_incoming_migration migration/file.c:132:5 #6 0x561cc30f2c0c in qio_channel_fd_source_dispatch io/channel-watch.c:84:12 #7 0x7f89d37a3c43 in g_main_dispatch debian/build/deb/../../../glib/gmain.c:3419:28 #8 0x7f89d37a3c43 in g_main_context_dispatch debian/build/deb/../../../glib/gmain.c:4137:7 #9 0x561cc3b21659 in glib_pollfds_poll util/main-loop.c:287:9 #10 0x561cc3b1ff93 in os_host_main_loop_wait util/main-loop.c:310:5 #11 0x561cc3b1fb5c in main_loop_wait util/main-loop.c:589:11 #12 0x561cc1da2917 in qemu_main_loop system/runstate.c:801:9 #13 0x561cc3796c1c in qemu_default_main system/main.c:37:14 #14 0x561cc3796c67 in main system/main.c:48:12 #15 0x7f89d163bd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #16 0x7f89d163be3f in __libc_start_main csu/../csu/libc-start.c:392:3 #17 0x561cc0a79fa4 in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-x86_64+0x210bfa4) (BuildId: be72e086d4e47b172b0a72779972213fd9916466) SUMMARY: AddressSanitizer: 96 byte(s) leaked in 4 allocation(s). Free the params[i].data too. Cc: qemu-stable@nongnu.org Fixes: d117ed0699d41 ("migration/multifd: Allow receiving pages without packets") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Fabiano Rosas <farosas@suse.de>
2024-08-20Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Richard Henderson
into staging virtio: regression fixes 3 small patches to make sure we don't ship regressions. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmbEdw8PHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRp0dsIAKTzhmBR3IviFQVo223RgcDfthxoKejTB5tv # EhGVUi4ddrViIIHsKFZ0pTHXnRcwHpPRokg6GrbqNhrAM6K7ptP8pkEK1DDkbGtq # HaeceK55nNZ/wM1O5xHpRLVc2WtxmBrliDTFHGB2HjURO/kpjoHqWbE6Sn4GILc1 # EYU2T3Wn1UFgj+H4L7yF4SzmQSmyzq+7Tml6Z2GzpsatdwCoFQz2nA28piCnRMCq # lusMo2YdE6js9JS/h+zMqgKValuCyuU7S7ZbSO2dvYQwt/hgk07BegBrdsAENNh6 # 0IWRHrojwAg+4U6ULzbrBG6/hW2A8Q5065D8Nf9Bjy4eAU7QSbU= # =K6xx # -----END PGP SIGNATURE----- # gpg: Signature made Tue 20 Aug 2024 08:59:27 PM AEST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [undefined] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [undefined] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: virtio-pci: Fix the use of an uninitialized irqfd hw/audio/virtio-snd: fix invalid param check vhost: Add VIRTIO_NET_F_RSC_EXT to vhost feature bits Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-20virtio-pci: Fix the use of an uninitialized irqfdCindy Lu
The crash was reported in MAC OS and NixOS, here is the link for this bug https://gitlab.com/qemu-project/qemu/-/issues/2334 https://gitlab.com/qemu-project/qemu/-/issues/2321 In this bug, they are using the virtio_input device. The guest notifier was not supported for this device, The function virtio_pci_set_guest_notifiers() was not called, and the vector_irqfd was not initialized. So the fix is adding the check for vector_irqfd in virtio_pci_get_notifier() The function virtio_pci_get_notifier() can be used in various devices. It could also be called when VIRTIO_CONFIG_S_DRIVER_OK is not set. In this situation, the vector_irqfd being NULL is acceptable. We can allow the device continue to boot If the vector_irqfd still hasn't been initialized after VIRTIO_CONFIG_S_DRIVER_OK is set, it means that the function set_guest_notifiers was not called before the driver started. This indicates that the device is not using the notifier. At this point, we will let the check fail. This fix is verified in vyatta,MacOS,NixOS,fedora system. The bt tree for this bug is: Thread 6 "CPU 0/KVM" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7c817be006c0 (LWP 1269146)] kvm_virtio_pci_vq_vector_use () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:817 817 if (irqfd->users == 0) { (gdb) thread apply all bt ... Thread 6 (Thread 0x7c817be006c0 (LWP 1269146) "CPU 0/KVM"): 0 kvm_virtio_pci_vq_vector_use () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:817 1 kvm_virtio_pci_vector_use_one () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:893 2 0x00005983657045e2 in memory_region_write_accessor () at ../qemu-9.0.0/system/memory.c:497 3 0x0000598365704ba6 in access_with_adjusted_size () at ../qemu-9.0.0/system/memory.c:573 4 0x0000598365705059 in memory_region_dispatch_write () at ../qemu-9.0.0/system/memory.c:1528 5 0x00005983659b8e1f in flatview_write_continue_step.isra.0 () at ../qemu-9.0.0/system/physmem.c:2713 6 0x000059836570ba7d in flatview_write_continue () at ../qemu-9.0.0/system/physmem.c:2743 7 flatview_write () at ../qemu-9.0.0/system/physmem.c:2774 8 0x000059836570bb76 in address_space_write () at ../qemu-9.0.0/system/physmem.c:2894 9 0x0000598365763afe in address_space_rw () at ../qemu-9.0.0/system/physmem.c:2904 10 kvm_cpu_exec () at ../qemu-9.0.0/accel/kvm/kvm-all.c:2917 11 0x000059836576656e in kvm_vcpu_thread_fn () at ../qemu-9.0.0/accel/kvm/kvm-accel-ops.c:50 12 0x0000598365926ca8 in qemu_thread_start () at ../qemu-9.0.0/util/qemu-thread-posix.c:541 13 0x00007c8185bcd1cf in ??? () at /usr/lib/libc.so.6 14 0x00007c8185c4e504 in clone () at /usr/lib/libc.so.6 Fixes: 2ce6cff94d ("virtio-pci: fix use of a released vector") Cc: qemu-stable@nongnu.org Signed-off-by: Cindy Lu <lulu@redhat.com> Message-Id: <20240806093715.65105-1-lulu@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-08-20hw/audio/virtio-snd: fix invalid param checkVolker Rümelin
Commit 9b6083465f ("virtio-snd: check for invalid param shift operands") tries to prevent invalid parameters specified by the guest. However, the code is not correct. Change the code so that the parameters format and rate, which are a bit numbers, are compared with the bit size of the data type. Fixes: 9b6083465f ("virtio-snd: check for invalid param shift operands") Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20240802071805.7123-1-vr_qemu@t-online.de> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-08-20vhost: Add VIRTIO_NET_F_RSC_EXT to vhost feature bitsAkihiko Odaki
VIRTIO_NET_F_RSC_EXT is implemented in the rx data path, which vhost implements, so vhost needs to support the feature if it is ever to be enabled with vhost. The feature must be disabled otherwise. Fixes: 2974e916df87 ("virtio-net: support RSC v4/v6 tcp traffic for Windows HCK") Reported-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240802-rsc-v1-1-2b607bd2f555@daynix.com> Acked-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-08-20Merge tag 'nvme-next-pull-request' of https://gitlab.com/birkelund/qemu into ↵Richard Henderson
staging hw/nvme late fix # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmbEHsUACgkQTeGvMW1P # DenlQgf/dzz4B5pzdD0HsjNVNulxygAJEnYitiF/50LRj564hQDoisNYPvHeKMA7 # wfk8jSSimTM6YkETksiR2DvnXlZ3wXn/HAhqE15GSW8vtRK2/RO9vNn51gyoFvl3 # z/Wm8ahoFaNpygQQkQMIJ9QHVD3GheZH4OxMhqI1523+s7dGcUNetoZiyoBAdJ6m # 7KOa/zUTPBmvpKMOEa25Ss+nZIPp9eFuCwQxhToV0gEuJFHolRZYv7GA4UjnodvJ # HrBrbsB8W4vh65FmC7WLAG9XFvNMgC0h8qtzWyKhNcxf478E7FckLvnAzSZExitj # fJzrSJV0bJHlQEM2q0yHYpL0urh5XA== # =ZeRF # -----END PGP SIGNATURE----- # gpg: Signature made Tue 20 Aug 2024 02:42:45 PM AEST # gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9 # gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown] # gpg: aka "Klaus Jensen <k.jensen@samsung.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838 # Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9 * tag 'nvme-next-pull-request' of https://gitlab.com/birkelund/qemu: hw/nvme: fix leak of uninitialized memory in io_mgmt_recv Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-20hw/nvme: fix leak of uninitialized memory in io_mgmt_recvKlaus Jensen
Yutaro Shimizu from the Cyber Defense Institute discovered a bug in the NVMe emulation that leaks contents of an uninitialized heap buffer if subsystem and FDP emulation are enabled. Cc: qemu-stable@nongnu.org Reported-by: Yutaro Shimizu <shimizu@cyberdefense.jp> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2024-08-20Merge tag 'hw-misc-20240820' of https://github.com/philmd/qemu into stagingRichard Henderson
Various fixes - Null pointer dereference in IPI IOCSR (Jiaxun) - Correct '-smbios type=4' in man page (Heinrich) - Use correct MMU index in MIPS get_pte (Phil) - Reset MPQEMU remote message using device_cold_reset (Peter) - Update linux-user MIPS CPU list (Phil) - Do not let exec_command read console if no pattern to wait for (Nick) - Remove shadowed declaration warning (Pierrick) - Restrict STQF opcode to SPARC V9 (Richard) - Add missing Kconfig dependency for POWERNV ISA serial port (Bernhard) - Do not allow vmport device without i8042 PS/2 controller (Kamil) - Fix QCryptoTLSCredsPSK leak (Peter) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmbDzAsACgkQ4+MsLN6t # wN7SvBAAwM0Frtg4ZKDZQu8XgMjLq1xVoSWjC3YJZKTpyGap5gO+7StvHg0sf9iB # YyGqocCO+qdj9a7pTSasfGDyufpwoIZkOqkwGUWKBos76cOcHWt4e/gkl9O65Lf1 # VVKX4/xdY+a5w2eVAAdWWrYdaPWkKLm0ZZXKoeSIvN4R9A41j7J4kANhE2SweczF # NnTt2gBnSlpRzghlVWPJKhnq+aYbvLeR7ApdNGUJDpSI1ZTh9gH1GtZFwBN7aeDo # PvDucoui0EmuyHTVdOYOH3zihTfzKlNZECcT3Y6/6i8y5p7jLHyINHHexsKw6T56 # i5RidJMPTfM0EO6LU1GvUN5FzZy24zXOf298Fe/GMYczQsOznQd4+aFHYPb3d4hZ # 8Vc1wB1s8XF5WGj+7bchBAUdynUnbwUqfMOb2pMXLIm21pSDnOTVgmYMnp1Kt4AA # 9WbHiS6tUJf/HjQsep8BBNGUiVSsUPDNNhL8QN43u2C0NgNRPgtRuIV+ytgVXS1G # 2t1QiRX0lX4ACHmw88agUCU3OhorumuDOpoitQK5jn2VutT7TqbGgibkQMFSgn9E # Xwrmtlf7nYU9MVgXYJjH2bBh7wbOmQCqbHniEj0targkxccAMJoswG4vtKsP9zkd # tBs6qMiZ8qSj5eoq8JBRF8bF4tONmboPZjRlboACJ0kTD5wCElA= # =lPMG # -----END PGP SIGNATURE----- # gpg: Signature made Tue 20 Aug 2024 08:49:47 AM AEST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'hw-misc-20240820' of https://github.com/philmd/qemu: crypto/tlscredspsk: Free username on finalize hw/i386/pc: Ensure vmport prerequisites are fulfilled hw/i386/pc: Unify vmport=auto handling hw/ppc/Kconfig: Add missing SERIAL_ISA dependency to POWERNV machine target/sparc: Restrict STQF to sparcv9 contrib/plugins/execlog: Fix shadowed declaration warning tests/avocado: Mark ppc_hv_tests.py as non-flaky after fixed console interaction tests/avocado: exec_command should not consume console output linux-user/mips: Select Loongson CPU for Loongson binaries linux-user/mips: Select MIPS64R2-generic for Rel2 binaries linux-user/mips: Select Octeon68XX CPU for Octeon binaries linux-user/mips: Do not try to use removed R5900 CPU hw/remote/message.c: Don't directly invoke DeviceClass:reset hw/dma/xilinx_axidma: Use semicolon at end of statement, not comma target/mips: Load PTE as DATA target/mips: Use correct MMU index in get_pte() target/mips: Pass page table entry size as MemOp to get_pte() qemu-options.hx: correct formatting -smbios type=4 hw/mips/loongson3_virt: Fix condition of IPI IOCSR connection hw/mips/loongson3_virt: Store core_iocsr into LoongsonMachineState Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-20crypto/tlscredspsk: Free username on finalizePeter Maydell
When the creds->username property is set we allocate memory for it in qcrypto_tls_creds_psk_prop_set_username(), but we never free this when the QCryptoTLSCredsPSK is destroyed. Free the memory in finalize. This fixes a LeakSanitizer complaint in migration-test: $ (cd build/asan; ASAN_OPTIONS="fast_unwind_on_malloc=0" QTEST_QEMU_BINARY=./qemu-system-x86_64 ./tests/qtest/migration-test --tap -k -p /x86_64/migration/precopy/unix/tls/psk) ================================================================= ==3867512==ERROR: LeakSanitizer: detected memory leaks Direct leak of 5 byte(s) in 1 object(s) allocated from: #0 0x5624e5c99dee in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-x86_64+0x218edee) (BuildId: a9e623fa1009a9435c0142c037cd7b8c1ad04ce3) #1 0x7fb199ae9738 in g_malloc debian/build/deb/../../../glib/gmem.c:128:13 #2 0x7fb199afe583 in g_strdup debian/build/deb/../../../glib/gstrfuncs.c:361:17 #3 0x5624e82ea919 in qcrypto_tls_creds_psk_prop_set_username /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../crypto/tlscredspsk.c:255:23 #4 0x5624e812c6b5 in property_set_str /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object.c:2277:5 #5 0x5624e8125ce5 in object_property_set /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object.c:1463:5 #6 0x5624e8136e7c in object_set_properties_from_qdict /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object_interfaces.c:55:14 #7 0x5624e81372d2 in user_creatable_add_type /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object_interfaces.c:112:5 #8 0x5624e8137964 in user_creatable_add_qapi /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object_interfaces.c:157:11 #9 0x5624e891ba3c in qmp_object_add /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/qom-qmp-cmds.c:227:5 #10 0x5624e8af9118 in qmp_marshal_object_add /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qapi/qapi-commands-qom.c:337:5 #11 0x5624e8bd1d49 in do_qmp_dispatch_bh /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qapi/qmp-dispatch.c:128:5 #12 0x5624e8cb2531 in aio_bh_call /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/async.c:171:5 #13 0x5624e8cb340c in aio_bh_poll /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/async.c:218:13 #14 0x5624e8c0be98 in aio_dispatch /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/aio-posix.c:423:5 #15 0x5624e8cba3ce in aio_ctx_dispatch /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/async.c:360:5 #16 0x7fb199ae0d3a in g_main_dispatch debian/build/deb/../../../glib/gmain.c:3419:28 #17 0x7fb199ae0d3a in g_main_context_dispatch debian/build/deb/../../../glib/gmain.c:4137:7 #18 0x5624e8cbe1d9 in glib_pollfds_poll /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/main-loop.c:287:9 #19 0x5624e8cbcb13 in os_host_main_loop_wait /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/main-loop.c:310:5 #20 0x5624e8cbc6dc in main_loop_wait /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/main-loop.c:589:11 #21 0x5624e6f3f917 in qemu_main_loop /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../system/runstate.c:801:9 #22 0x5624e893379c in qemu_default_main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../system/main.c:37:14 #23 0x5624e89337e7 in main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../system/main.c:48:12 #24 0x7fb197972d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #25 0x7fb197972e3f in __libc_start_main csu/../csu/libc-start.c:392:3 #26 0x5624e5c16fa4 in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-x86_64+0x210bfa4) (BuildId: a9e623fa1009a9435c0142c037cd7b8c1ad04ce3) SUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-ID: <20240819145021.38524-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-08-20hw/i386/pc: Ensure vmport prerequisites are fulfilledKamil Szczęk
Since commit 4ccd5fe22feb95137d325f422016a6473541fe9f ('pc: add option to disable PS/2 mouse/keyboard'), the vmport will not be created unless the i8042 PS/2 controller is enabled. To avoid confusion, let's fail if vmport was explicitly requested, but the i8042 controller is disabled. This also changes the behavior of vmport=auto to take i8042 controller availability into account. Signed-off-by: Kamil Szczęk <kamil@szczek.dev> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Message-ID: <0MS3y5E-hHqODIhiuFxmCnIrXd612JIGq31UuMsz4KGCKZ_wWuF-PHGKTRSGS0nWaPEddOdF4YOczHdgorulECPo792OhWov7O9BBF6UMX4=@szczek.dev> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-08-20hw/i386/pc: Unify vmport=auto handlingKamil Szczęk
The code which translates vmport=auto to on/off is currently separate for each PC machine variant, while being functionally equivalent. This moves the translation into a shared initialization function, while also tightening the enum assertion. Signed-off-by: Kamil Szczęk <kamil@szczek.dev> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <v8pz1uwgIYWkidgZK-o8H-qJvnSyl0641XVmNO43Qls307AA3QRPuad_py6xGe0JAxB6yDEe76oZ8tau_n-2Y6sJBCKzCujNbEUUFhd-ahI=@szczek.dev> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-08-20hw/ppc/Kconfig: Add missing SERIAL_ISA dependency to POWERNV machineBernhard Beschow
The machine calls serial_hds_isa_init() which is provided by serial-isa.c, guarded by SERIAL_ISA. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240814181534.218964-4-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-08-20target/sparc: Restrict STQF to sparcv9Richard Henderson
Prior to sparcv9, the same encoding was STDFQ. Cc: qemu-stable@nongnu.org Fixes: 06c060d9e5b ("target/sparc: Move simple fp load/store to decodetree") Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240816072311.353234-2-richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-08-20contrib/plugins/execlog: Fix shadowed declaration warningPierrick Bouvier
Found on debian stable. ../contrib/plugins/execlog.c: In function ‘vcpu_tb_trans’: ../contrib/plugins/execlog.c:236:22: error: declaration of ‘n’ shadows a previous local [-Werror=shadow=local] 236 | for (int n = 0; n < all_reg_names->len; n++) { | ^ ../contrib/plugins/execlog.c:184:12: note: shadowed declaration is here 184 | size_t n = qemu_plugin_tb_n_insns(tb); | Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20240814233645.944327-2-pierrick.bouvier@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-08-20tests/avocado: Mark ppc_hv_tests.py as non-flaky after fixed console interactionNicholas Piggin
Now that exec_command doesn't incorrectly consume console output, and guest time is set correctly, ppc_hv_tests.py is working more reliably. Try marking it non-flaky. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <20240805232814.267843-3-npiggin@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-08-20tests/avocado: exec_command should not consume console outputNicholas Piggin
_console_interaction reads data from the console even when there is only an input string to send, and no output data to wait on. This can cause lines to be missed by wait_for_console_pattern calls that follows an exec_command. Fix this by not reading the console if there is no pattern to wait for. This solves occasional hangs in ppc_hv_tests.py, usually when run on KVM hosts that are fast enough to output important lines quickly enough to be consumed by exec_command, so they get missed by subsequent wait for pattern calls. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20240805232814.267843-2-npiggin@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-08-20linux-user/mips: Select Loongson CPU for Loongson binariesPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240814133928.6746-5-philmd@linaro.org>
2024-08-20linux-user/mips: Select MIPS64R2-generic for Rel2 binariesPhilippe Mathieu-Daudé
Cc: YunQiang Su <syq@debian.org> Reported-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240814133928.6746-4-philmd@linaro.org>
2024-08-20linux-user/mips: Select Octeon68XX CPU for Octeon binariesPhilippe Mathieu-Daudé
The Octeon68XX CPU is available since commit 9a6046a655 ("target/mips: introduce Cavium Octeon CPU model"). Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1722 Reported-by: Johnathan Hữu Trí <nhtri2003@gmail.com> Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240814133928.6746-3-philmd@linaro.org>
2024-08-20linux-user/mips: Do not try to use removed R5900 CPUPhilippe Mathieu-Daudé
R5900 emulation was removed in commit 823f2897bd. Remove it from ELF parsing in order to avoid: $ qemu-mipsn32 ./test5900 qemu-mipsn32: unable to find CPU model 'R5900' This reverts commit 4d9e5a0eb7df6e98ac6cf5e16029f35dd05b9537. Fixes: 823f2897bd ("target/mips: Disable R5900 support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240814133928.6746-2-philmd@linaro.org>
2024-08-20hw/remote/message.c: Don't directly invoke DeviceClass:resetPeter Maydell
Directly invoking the DeviceClass::reset method is a bad idea, because if the device is using three-phase reset then it relies on transitional reset machinery which is likely to disappear at some point. Reset the device in the standard way, by calling device_cold_reset(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240813165250.2717650-7-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-08-20hw/dma/xilinx_axidma: Use semicolon at end of statement, not commaPeter Maydell
In axidma_class_init() we accidentally used a comma at the end of a statement rather than a semicolon. This has no ill effects, but it's obviously not intended and it means that Coccinelle scripts for instance will fail to match on the two statements. Use a semicolon instead. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20240813165250.2717650-6-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-08-20target/mips: Load PTE as DATAPhilippe Mathieu-Daudé
PTE is not CODE so load it as normal DATA access. Fixes: 074cfcb4da ("Implement hardware page table walker for MIPS32") Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240814090452.2591-4-philmd@linaro.org>
2024-08-20target/mips: Use correct MMU index in get_pte()Philippe Mathieu-Daudé
When refactoring page_table_walk_refill() in commit 4e999bf419 we missed the indirect call to cpu_mmu_index() in get_pte(): page_table_walk_refill() -> get_pte() -> cpu_ld[lq]_code() -> cpu_mmu_index() Since we don't mask anymore the modes in hflags, cpu_mmu_index() can return UM or SM, while we only expect KM or ERL. Fix by propagating ptw_mmu_idx to get_pte(), and use the cpu_ld/st_code_mmu() API with the correct MemOpIdx. Reported-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> Reported-by: Waldemar Brodkorb <wbx@uclibc-ng.org> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2470 Fixes: 4e999bf419 ("target/mips: Pass ptw_mmu_idx down from mips_cpu_tlb_fill") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240814090452.2591-3-philmd@linaro.org>
2024-08-20target/mips: Pass page table entry size as MemOp to get_pte()Philippe Mathieu-Daudé
In order to simplify the next commit, pass the PTE size as MemOp. Rename: native_shift -> native_op directory_shift -> directory_mop leaf_shift -> leaf_mop Suggested-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240814090452.2591-2-philmd@linaro.org>
2024-08-20qemu-options.hx: correct formatting -smbios type=4Heinrich Schuchardt
processor-family and processor-id can be assigned independently. Add missing brackets. Fixes: b5831d79671c ("smbios: add processor-family option") Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240729204816.11905-1-heinrich.schuchardt@canonical.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-02 13:02:28 +0000