aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2018-12-12virtio-blk: fix comment for virtio_blk_rw_complete as nalloc is initially -1Dongli Zhang
The initial value of nalloc is -1, but not 1. Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-id: 1541479952-32355-1-git-send-email-dongli.zhang@oracle.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2018-12-12virtio-blk: rename iov to out_iov in virtio_blk_handle_request()Dongli Zhang
In virtio_blk_handle_request(), in_iov is used for input header while iov is used for output header. Rename iov to out_iov to pair output header's name with in_iov to avoid confusing people when reading source code. Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com> Message-id: 1541520556-8334-1-git-send-email-dongli.zhang@oracle.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2018-12-11qom: remove unimplemented class_finalizeMarc-André Lureau
Instead of trying to implement something that isn't well specified, remove it. (it would be tricky to implement, since a class struct is memcpy on children types...) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20181204142023.15982-7-marcandre.lureau@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-12-11qdev: move qdev_prop_register_global_list() to testsMarc-André Lureau
The function is only used by a test, move it there. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20181204142023.15982-6-marcandre.lureau@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-12-11accel: register global_props like machine globalsMarc-André Lureau
global_props is only used for Xen xen_compat_props. It's a static array of GlobalProperty, like machine globals in SET_MACHINE_COMPAT(). Let's register the globals the same way, without extra copy allocation. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20181204142023.15982-5-marcandre.lureau@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-12-11qom: make user_creatable_complete() specific to UserCreatableMarc-André Lureau
Instead of accepting any Object*, change user_creatable_complete() to require a UserCreatable*. Modify the callers to pass the appropriate argument, removing redundant dynamic cast checks in object creation. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20181204142023.15982-4-marcandre.lureau@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-12-11pc: Use default_machine_opts to set suppress_vmdescEduardo Habkost
Instead of setting suppress_vmdesc at instance_init time, set default_machine_opts on pc_i440fx_2_2_machine_options() to implement equivalent behavior. This will let us eliminate the need for pc_compat_*() functions for PC machine-types. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20181205205827.19387-6-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-12-11spapr: Delete instance_options functionsEduardo Habkost
Now that all instance_options functions for spapr are empty, delete them. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20181205205827.19387-5-ehabkost@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-12-11spapr: Use default_machine_opts to set suppress_vmdescEduardo Habkost
Instead of setting suppress_vmdesc at instance_init time, set default_machine_opts on spapr_machine_2_2_class_options() to implement equivalent behavior. This will let us eliminate the need for separate instance_init functions for each spapr machine-type. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20181205205827.19387-4-ehabkost@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-12-11spapr: Use default_machine_opts to set use_hotplug_event_sourceEduardo Habkost
Instead of setting use_hotplug_event_source at instance_init time, set default_machine_opts on spapr_machine_2_7_class_options() to implement equivalent behavior. This will let us eliminate the need for separate instance_init functions for each spapr machine-type. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20181205205827.19387-3-ehabkost@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-12-11virt: Eliminate separate instance_init functionsEduardo Habkost
All instance_init functions for all virt machine-types run exactly the same code, so we don't need separate functions. We only need to set instance_init for TYPE_VIRT_MACHINE. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20181205205827.19387-2-ehabkost@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-12-11q35/440fx/arm/spapr: Add QEMU 4.0 machine typeAlex Williamson
Including all machine types that might have a pcie-root-port. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Eduardo Habkost <ehabkost@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Message-Id: <154394083644.28192.8501647946108201466.stgit@gimli.home> Reviewed-by: Eric Auger <eric.auger@redhat.com> [ehabkost: fixed accidental recursion at spapr_machine_3_1_class_options()] Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-12-11i386: Rename bools in PCMachineState to end in _enabledCorey Minyard
This makes their function more clear and prevents conflicts when adding the actual devices to the machine state, if necessary. Signed-off-by: Corey Minyard <cminyard@mvista.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20181107152434.22219-1-minyard@acm.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-12-11memory-device: avoid overflows on very huge devicesDavid Hildenbrand
Should not be a problem right now, but it could theoretically happen in the future. Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20181023152306.3123-7-david@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-12-11memory-device: use QEMU_IS_ALIGNEDDavid Hildenbrand
Shorter and easier to read. Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20181023152306.3123-6-david@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-12-11hw/timer/sun4v-rtc: Fix tracing at sun4v_rtc_write()Eduardo Habkost
The code was converted to use sun4v_rtc_read() by mistake, fix it. Reported-by: David Gibson <david@gibson.dropbear.id.au> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20181031001843.12892-1-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-12-06i2c: pm_smbus: check smb_index before block transfer writePrasad J Pandit
While performing block transfer write in smb_ioport_writeb(), 'smb_index' is incremented and used to index smb_data[] array. Check 'smb_index' value to avoid OOB access. Note that this bug is exploitable by a guest to escape from the virtual machine. However the commit which introduced the bug was only made after the 3.0 release, and so it is not present in any released QEMU versions. Fixes: 38ad4fae43 i2c: pm_smbus: Add block transfer capability Reported-by: Michael Hanselmann <public@hansmi.ch> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Michael Hanselmann <public@hansmi.ch> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20181206121830.6177-1-ppandit@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/fixes-31-20181203-pull-request' into staging usb: mtp fixes. # gpg: Signature made Mon 03 Dec 2018 19:50:26 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-31-20181203-pull-request: usb-mtp: outlaw slashes in filenames usb-mtp: fix utf16_to_str Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03usb-mtp: outlaw slashes in filenamesGerd Hoffmann
Slash is unix directory separator, so they are not allowed in filenames. Note this also stops the classic escape via "../". Fixes: CVE-2018-16867 Reported-by: Michael Hanselmann <public@hansmi.ch> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181203101045.27976-3-kraxel@redhat.com
2018-12-03usb-mtp: fix utf16_to_strGerd Hoffmann
Make utf16_to_str return an allocated string. Remove the assumtion that the number of string bytes equals the number of utf16 chars (which is only true for ascii chars). Instead call wcstombs twice, once to figure the storage size and once for the actual conversion (as suggested by the wcstombs manpage). FIXME: surrogate pairs are not working correctly. Pre-existing bug, fixing that is left for another day. Reported-by: Michael Hanselmann <public@hansmi.ch> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20181203101045.27976-2-kraxel@redhat.com
2018-12-03i2c: Add a length check to the SMBus write handlingCorey Minyard
Avoid an overflow. Signed-off-by: Corey Minyard <cminyard@mvista.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: QEMU Stable <qemu-stable@nongnu.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-28hw/arm/aspeed: Fix build issue with clang 3.4Thomas Huth
When using clang 3.4.2, compilation of QEMU fails like this: CC aarch64-softmmu/hw/arm/aspeed.o hw/arm/aspeed.c:36:3: error: redefinition of typedef 'AspeedBoardState' is a C11 feature [-Werror,-Wtypedef-redefinition] } AspeedBoardState; ^ include/hw/arm/aspeed.h:14:33: note: previous definition is here typedef struct AspeedBoardState AspeedBoardState; ^ 1 error generated. make[1]: *** [hw/arm/aspeed.o] Error 1 make: *** [subdir-aarch64-softmmu] Error 2 Remove the duplicated typedef to fix this issue. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-id: 1543397736-8198-1-git-send-email-thuth@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-28Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* lsi HBA reselection fix (George) * Small cleanups (Li Qiang) * bugfixes for vhost-user-bridge and hostmem (Marc-André) * single-thread TCG fix (me) * VMX migration blocker (me) * target/i386 fix for LOCK (Richard) * MAINTAINERS update (Philippe, Thomas) # gpg: Signature made Wed 28 Nov 2018 10:51:36 GMT # gpg: using RSA key BFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: hostmem: no need to check for host_memory_backend_mr_inited() in alloc() hostmem-memfd: honour share=on/off property MAINTAINERS: Add an entry for the Firmware Configuration (fw_cfg) device MAINTAINERS: Add some missing entries related to accelerators target/i386: Generate #UD when applying LOCK to a register destination checkpatch: g_test_message does not need a trailing newline vl.c: remove outdated comment vhost-user-bridge: fix recvmsg iovlen vl: Improve error message when we can't load fw_cfg from file vmstate: constify VMStateField migration: savevm: consult migration blockers lsi: Reselection needed to remove pending commands from queue cpus: run work items for all vCPUs if single-threaded target/i386: kvm: add VMX migration blocker Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27vmstate: constify VMStateFieldMarc-André Lureau
Because they are supposed to remain const. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20181114132931.22624-1-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches: - block: Fix crash on migration with explicit child nodes - nvme: Fix spurious interrupts # gpg: Signature made Tue 27 Nov 2018 11:59:40 GMT # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: nvme: Fix spurious interrupts iotests: Test migration with -blockdev block: Don't inactivate children before parents Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27lsi: Reselection needed to remove pending commands from queueGeorge Kennedy
Under heavy IO (e.g. fio) the queue is not checked frequently enough for pending commands. As a result some pending commands are timed out by the linux sym53c8xx driver, which sends SCSI Abort messages for the timed out commands. The SCSI Abort messages result in linux errors, which show up on the console and in /var/log/messages. e.g. sd 0:0:3:0: [sdd] tag#33 ABORT operation started scsi target0:0:3: control msgout: 80 20 47 d sd 0:0:3:0: ABORT operation complete. scsi target0:0:4: message d sent on bad reselection Now following a WAIT DISCONNECT Script instruction, and if there is no current command, check for a pending command on the queue and if one exists call lsi_reselect(). Signed-off-by: George Kennedy <george.kennedy@oracle.com> Message-Id: <1541776692-12271-1-git-send-email-george.kennedy@oracle.com> [For safety, add a s->current check in lsi_update_irq - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27hw/virt/arm: Add support for Cortex-A72 in virtZhiPeng Lu
Signed-off-by: ZhiPeng Lu <luzhipeng@uniudc.com> Message-id: 1543316565-1101590-1-git-send-email-luzhipeng@uniudc.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27nvme: Fix spurious interruptsKeith Busch
The code had asserted an interrupt every time it was requested to check for new completion queue entries.This can result in spurious interrupts seen by the guest OS. Fix this by asserting an interrupt only if there are un-acknowledged completion queue entries available. Reported-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Keith Busch <keith.busch@intel.com> Tested-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-27Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/fixes-31-20181127-pull-request' into staging various bugfixes for 3.1: fmops, ps2, cirrus, hda, usb-host, qapi # gpg: Signature made Tue 27 Nov 2018 06:49:13 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-31-20181127-pull-request: qapi: add query-display-options command usb-host: set ifs.detached as true if kernel driver is not active audio/hda: fix guest triggerable assert cirrus_vga/migration: update the bank offset before use ps2kbd: default to scan enabled after reset fmops: fix off-by-one in AR_TABLE and DR_TABLE array size Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27usb-host: set ifs.detached as true if kernel driver is not activelinzhecheng
If no kernel driver is active, we can already claim and perform I/O on it without detaching it. Signed-off-by: linzhecheng <linzhecheng@huawei.com> Message-id: 20181120083419.17716-1-linzhecheng@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-27audio/hda: fix guest triggerable assertGerd Hoffmann
Guest writes to a readonly register trigger the assert in intel_hda_reg_write(). Add a check and just ignore them. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1628433 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181123063957.9515-1-kraxel@redhat.com
2018-11-27cirrus_vga/migration: update the bank offset before useWang Xin
The cirrus bank0/1 offset should be updated before we update the vram's alias offset. Signed-off-by: Wang Xin <wangxinxin.wang@huawei.com> Message-id: 20181123064646.23036-1-linzhecheng@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-27ps2kbd: default to scan enabled after resetHervé Poussineau
A check for scan_enabled has been added to ps2_keyboard_event in commit 143c04c7e0639e53086519592ead15d2556bfbf2 to prevent stream corruption. This works well as long as operating system is resetting keyboard, or enabling it. This fixes IBM 40p firmware, which doesn't bother sending KBD_CMD_RESET, KBD_CMD_ENABLE or KBD_CMD_RESET_ENABLE before trying to use the keyboard. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20181021190721.2148-1-hpoussin@reactos.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-26hw/hyperv: fix NULL dereference with pure-kvm SynICRoman Kagan
When started in compat configuration of SynIC, e.g. qemu-system-x86_64 -machine pc-i440fx-2.10,accel=kvm \ -cpu host,-vmx,hv-relaxed,hv_spinlocks=0x1fff,hv-vpindex,hv-synic or explicitly qemu-system-x86_64 -enable-kvm -cpu host,hv-synic,x-hv-synic-kvm-only=on QEMU crashes in hyperv_synic_reset() trying to access the non-present qobject for SynIC. Add the missing check for NULL. Reported-by: Vitaly Kuznetsov <vkuznets@redhat.com> Reported-by: Igor Mammedov <imammedo@redhat.com> Fixes: 9b4cf107b09d18ac30f46fd1c4de8585ccba030c Fixes: 4a93722f9c279184e95b1e1ad775c01deec05065 Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Message-Id: <20181126152836.25379-1-rkagan@virtuozzo.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-11-26net: cadence_gem: Remove incorrect assert()Edgar E. Iglesias
Don't assert on RX descriptor settings when the receiver is disabled. This fixes an issue with incoming packets on an unused GEM. Reported-by: mbilal <muhammad_bilal@mentor.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181123135450.24829-2-edgar.iglesias@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell
Fixes a QEMU crash triggerable by guest userspace (CVE-2018-19489). # gpg: Signature made Mon 26 Nov 2018 07:25:01 GMT # gpg: using RSA key 71D4D5E5822F73D6 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Gregory Kurz <gregory.kurz@free.fr>" # gpg: aka "[jpeg image of size 3330]" # Primary key fingerprint: B482 8BAF 9431 40CE F2A3 4910 71D4 D5E5 822F 73D6 * remotes/gkurz/tags/for-upstream: 9p: fix QEMU crash when renaming files Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26Merge remote-tracking branch 'remotes/xtensa/tags/20181125-xtensa' into stagingPeter Maydell
xtensa fixes for 3.1: - fix register counting logic for linux-user gdbserver; - provide default memory sizes for XTFPGA boards; - add missing xtensa patterns to MAINTAINTERS. # gpg: Signature made Sun 25 Nov 2018 23:07:54 GMT # gpg: using RSA key 51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <filippov@cadence.com>" # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20181125-xtensa: MAINTAINERS: add missing xtensa patterns target/xtensa: xtfpga: provide default memory sizes target/xtensa: drop num_[core_]regs from dc232b/dc233c configs target/xtensa: gdbstub fix register counting Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26fmops: fix off-by-one in AR_TABLE and DR_TABLE array sizeGerd Hoffmann
Cc: P J P <ppandit@redhat.com> Reported-by: Wangjunqing <wangjunqing@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20181030082340.17170-1-kraxel@redhat.com Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-239p: fix QEMU crash when renaming filesGreg Kurz
When using the 9P2000.u version of the protocol, the following shell command line in the guest can cause QEMU to crash: while true; do rm -rf aa; mkdir -p a/b & touch a/b/c & mv a aa; done With 9P2000.u, file renaming is handled by the WSTAT command. The v9fs_wstat() function calls v9fs_complete_rename(), which calls v9fs_fix_path() for every fid whose path is affected by the change. The involved calls to v9fs_path_copy() may race with any other access to the fid path performed by some worker thread, causing a crash like shown below: Thread 12 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8, path=0x0, flags=65536, mode=0) at hw/9pfs/9p-local.c:59 59 while (*path && fd != -1) { (gdb) bt #0 0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8, path=0x0, flags=65536, mode=0) at hw/9pfs/9p-local.c:59 #1 0x0000555555a25e0c in local_opendir_nofollow (fs_ctx=0x555557d958b8, path=0x0) at hw/9pfs/9p-local.c:92 #2 0x0000555555a261b8 in local_lstat (fs_ctx=0x555557d958b8, fs_path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/9p-local.c:185 #3 0x0000555555a2b367 in v9fs_co_lstat (pdu=0x555557d97498, path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/cofile.c:53 #4 0x0000555555a1e9e2 in v9fs_stat (opaque=0x555557d97498) at hw/9pfs/9p.c:1083 #5 0x0000555555e060a2 in coroutine_trampoline (i0=-669165424, i1=32767) at util/coroutine-ucontext.c:116 #6 0x00007fffef4f5600 in __start_context () at /lib64/libc.so.6 #7 0x0000000000000000 in () (gdb) The fix is to take the path write lock when calling v9fs_complete_rename(), like in v9fs_rename(). Impact: DoS triggered by unprivileged guest users. Fixes: CVE-2018-19489 Cc: P J P <ppandit@redhat.com> Reported-by: zhibin hu <noirfate@gmail.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Greg Kurz <groug@kaod.org>
2018-11-22nvme: fix bug with PCI IRQ pins on teardownLogan Gunthorpe
When the submission and completion queues are being torn down the IRQ will be asserted for the completion queue when the submsission queue is deleted. Then when the completion queue is deleted it stays asserted. Thus, on systems that do not use MSI, no further interrupts can be triggered on the host. Linux sees this as a long delay when unbinding the nvme device. Eventually the interrupt timeout occurs and it continues. To fix this we ensure we deassert the IRQ for a CQ when it is deleted. Signed-off-by: Logan Gunthorpe <logang@deltatee.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22nvme: fix CMB endianness confusionPaolo Bonzini
The CMB is marked as DEVICE_LITTLE_ENDIAN, so the data must be read/written as if it was little-endian output (in the case of big endian, we get two swaps, one in the memory core and one in nvme.c). Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22Revert "nvme: fix oob access issue(CVE-2018-16847)"Kevin Wolf
This reverts commit 5e3c0220d7e4f0361c4d36c697a8842f2b583402. We have a better fix commited for this now. Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22nvme: fix out-of-bounds access to the CMBPaolo Bonzini
Because the CMB BAR has a min_access_size of 2, if you read the last byte it will try to memcpy *2* bytes from n->cmbuf, causing an off-by-one error. This is CVE-2018-16847. Another way to fix this might be to register the CMB as a RAM memory region, which would also be more efficient. However, that might be a change for big-endian machines; I didn't think this through and I don't know how real hardware works. Add a basic testcase for the CMB in case somebody does this change later on. Cc: Keith Busch <keith.busch@intel.com> Cc: qemu-block@nongnu.org Reported-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Tested-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22nvme: call blk_drain in NVMe reset code to avoid lockupsIgor Druzhinin
When blk_flush called in NVMe reset path S/C queues are already freed which means that re-entering AIO handling loop having some IO requests unfinished will lockup or crash as their SG structures being potentially reused. Call blk_drain before freeing the queues to avoid this nasty scenario. Signed-off-by: Igor Druzhinin <igor.druzhinin@citrix.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22scsi-disk: Fix crash if underlying host file or disk returns errorRichard W.M. Jones
Commit 40dce4ee6 "scsi-disk: fix rerror/werror=ignore" introduced a bug which causes qemu to crash with the assertion error below if the host file or disk returns an error: qemu-system-x86_64: hw/scsi/scsi-bus.c:1374: scsi_req_complete: Assertion `req->status == -1' failed. Kevin Wolf suggested this fix: < kwolf> Hm, should the final return false; in that patch actually be a return true? < kwolf> Because I think he didn't intend to change anything except BLOCK_ERROR_ACTION_IGNORE Buglink: https://bugs.launchpad.net/qemu/+bug/1804323 Fixes: 40dce4ee61c68395f6d463fae792f61b7c003bce Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-21target/xtensa: xtfpga: provide default memory sizesMax Filippov
Provide default RAM sizes for all XTFPGA boards, so that when started without -m option they do the right thing. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-20hw/i386: add pc-i440fx-3.1 & pc-q35-3.1Marc-André Lureau
We have a couple of PC_COMPAT_3_0, so we should have 3.1 PC machines, and update the 3.0 machines to make use of those. Fixes a "Known issue" from https://wiki.qemu.org/Planning/3.1. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20181120132604.22854-1-marcandre.lureau@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-11-209p: take write lock on fid path updates (CVE-2018-19364)Greg Kurz
Recent commit 5b76ef50f62079a fixed a race where v9fs_co_open2() could possibly overwrite a fid path with v9fs_path_copy() while it is being accessed by some other thread, ie, use-after-free that can be detected by ASAN with a custom 9p client. It turns out that the same can happen at several locations where v9fs_path_copy() is used to set the fid path. The fix is again to take the write lock. Fixes CVE-2018-19364. Cc: P J P <ppandit@redhat.com> Reported-by: zhibin hu <noirfate@gmail.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Greg Kurz <groug@kaod.org>
2018-11-19hw/block/onenand: use qemu_log_mask() for reportingPeter Maydell
Update the onenand device to use qemu_log_mask() for reporting guest errors and unimplemented features, rather than plain fprintf() and hw_error(). (We leave the hw_error() in onenand_reset(), as that is triggered by a failure to read the underlying block device for the bootRAM, not by guest action.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181115143535.5885-3-peter.maydell@linaro.org
2018-11-19hw/block/onenand: Fix off-by-one error allowing out-of-bounds readPeter Maydell
An off-by-one error in a switch case in onenand_read() allowed a misbehaving guest to read off the end of a block of memory. NB: the onenand device is used only by the "n800" and "n810" machines, which are usable only with TCG, not KVM, so this is not a security issue. Reported-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20181115143535.5885-2-peter.maydell@linaro.org Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-08 15:39:22 +0000