Skip to main content

Browse the archive

https://github.com/qemu/qemu
04 August 2024, 22:51:34 UTC
sort by:
Revision Author Date Message Commit Date
80422b0 Peter Maydell 04 December 2018, 18:31:50 UTC Update version for v3.1.0-rc4 release Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 04 December 2018, 18:31:50 UTC
118caff Jason Wang 04 December 2018, 03:53:47 UTC virtio-net-test: add large tx buffer test This test tries to build a packet whose size is greater than INT_MAX which tries to trigger integer overflow in qemu_net_queue_append_iov() which may result OOB. Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20181204035347.6148-6-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 04 December 2018, 11:06:15 UTC
432a82d Jason Wang 04 December 2018, 03:53:46 UTC virtio-net-test: remove unused macro Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Message-id: 20181204035347.6148-5-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 04 December 2018, 11:06:15 UTC
ae4c445 Jason Wang 04 December 2018, 03:53:45 UTC virtio-net-test: accept variable length argument in pci_test_start() This allows flexibility to be reused for all kinds of command line used by other tests. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Message-id: 20181204035347.6148-4-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 04 December 2018, 11:06:15 UTC
56512e1 Jason Wang 04 December 2018, 03:53:44 UTC net: hub: suppress warnings of no host network for qtest If we want to qtest through hub, it would be much more simpler and safer to configure the hub without host network. So silent this warnings for qtest. Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20181204035347.6148-3-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 04 December 2018, 11:06:15 UTC
25c01bd Jason Wang 04 December 2018, 03:53:43 UTC net: drop too large packet early We try to detect and drop too large packet (>INT_MAX) in 1592a9947036 ("net: ignore packet size greater than INT_MAX") during packet delivering. Unfortunately, this is not sufficient as we may hit another integer overflow when trying to queue such large packet in qemu_net_queue_append_iov(): - size of the allocation may overflow on 32bit - packet->size is integer which may overflow even on 64bit Fixing this by moving the check to qemu_sendv_packet_async() which is the entrance of all networking codes and reduce the limit to NET_BUFSIZE to be more conservative. This works since: - For the callers that call qemu_sendv_packet_async() directly, they only care about if zero is returned to determine whether to prevent the source from producing more packets. A callback will be triggered if peer can accept more then source could be enabled. This is usually used by high speed networking implementation like virtio-net or netmap. - For the callers that call qemu_sendv_packet() that calls qemu_sendv_packet_async() indirectly, they often ignore the return value. In this case qemu will just the drop packets if peer can't receive. Qemu will copy the packet if it was queued. So it was safe for both kinds of the callers to assume the packet was sent. Since we move the check from qemu_deliver_packet_iov() to qemu_sendv_packet_async(), it would be safer to make qemu_deliver_packet_iov() static to prevent any external user in the future. This is a revised patch of CVE-2018-17963. Cc: qemu-stable@nongnu.org Cc: Li Qiang <liq3ea@163.com> Fixes: 1592a9947036 ("net: ignore packet size greater than INT_MAX") Reported-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20181204035347.6148-2-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 04 December 2018, 11:06:15 UTC
933cc4b Peter Maydell 03 December 2018, 19:57:59 UTC Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181203-pull-request' into staging usb: mtp fixes. # gpg: Signature made Mon 03 Dec 2018 19:50:26 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-31-20181203-pull-request: usb-mtp: outlaw slashes in filenames usb-mtp: fix utf16_to_str Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 03 December 2018, 19:57:59 UTC
c52d46e Gerd Hoffmann 03 December 2018, 10:10:45 UTC usb-mtp: outlaw slashes in filenames Slash is unix directory separator, so they are not allowed in filenames. Note this also stops the classic escape via "../". Fixes: CVE-2018-16867 Reported-by: Michael Hanselmann <public@hansmi.ch> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181203101045.27976-3-kraxel@redhat.com 03 December 2018, 18:40:17 UTC
6de02a1 Gerd Hoffmann 03 December 2018, 10:10:44 UTC usb-mtp: fix utf16_to_str Make utf16_to_str return an allocated string. Remove the assumtion that the number of string bytes equals the number of utf16 chars (which is only true for ascii chars). Instead call wcstombs twice, once to figure the storage size and once for the actual conversion (as suggested by the wcstombs manpage). FIXME: surrogate pairs are not working correctly. Pre-existing bug, fixing that is left for another day. Reported-by: Michael Hanselmann <public@hansmi.ch> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20181203101045.27976-2-kraxel@redhat.com 03 December 2018, 18:39:04 UTC
9225cd1 Peter Maydell 03 December 2018, 17:43:20 UTC Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-12-03' into staging nbd patches for 2018-12-03 Improve x-dirty-bitmap handling for experimenting with pull mode incremental backups. - Eric Blake: 0/3 NBD dirty bitmap cleanups # gpg: Signature made Mon 03 Dec 2018 15:56:23 GMT # gpg: using RSA key A7A16B4A2527436A # gpg: Good signature from "Eric Blake <eblake@redhat.com>" # gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" # gpg: aka "[jpeg image of size 6874]" # Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A * remotes/ericb/tags/pull-nbd-2018-12-03: nbd/client: Send NBD_CMD_DISC if open fails after connect nbd/client: Make x-dirty-bitmap more reliable nbd/server: Advertise all contexts in response to bare LIST Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 03 December 2018, 17:43:20 UTC
3af8c4b Peter Maydell 03 December 2018, 17:12:48 UTC Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging Block layer patches: - mirror: Fix deadlock # gpg: Signature made Mon 03 Dec 2018 16:57:33 GMT # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: iotests: simple mirror test with kvm on 1G image mirror: fix dead-lock Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 03 December 2018, 17:12:48 UTC
db5e821 Vladimir Sementsov-Ogievskiy 03 December 2018, 15:12:09 UTC iotests: simple mirror test with kvm on 1G image This test is broken without previous commit fixing dead-lock in mirror. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Max Reitz <mreitz@redhat.com> Acked-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 03 December 2018, 15:51:53 UTC
d12ade5 Vladimir Sementsov-Ogievskiy 29 November 2018, 10:18:00 UTC mirror: fix dead-lock Let start from the beginning: Commit b9e413dd375 (in 2.9) "block: explicitly acquire aiocontext in aio callbacks that need it" added pairs of aio_context_acquire/release to mirror_write_complete and mirror_read_complete, when they were aio callbacks for blk_aio_* calls. Then, commit 2e1990b26e5 (in 3.0) "block/mirror: Convert to coroutines" dropped these blk_aio_* calls, than mirror_write_complete and mirror_read_complete are not callbacks more, and don't need additional aiocontext acquiring. Furthermore, mirror_read_complete calls blk_co_pwritev inside these pair of aio_context_acquire/release, which leads to the following dead-lock with mirror: (gdb) info thr Id Target Id Frame 3 Thread (LWP 145412) "qemu-system-x86" syscall () 2 Thread (LWP 145416) "qemu-system-x86" __lll_lock_wait () * 1 Thread (LWP 145411) "qemu-system-x86" __lll_lock_wait () (gdb) bt #0 __lll_lock_wait () #1 _L_lock_812 () #2 __GI___pthread_mutex_lock #3 qemu_mutex_lock_impl (mutex=0x561032dce420 <qemu_global_mutex>, file=0x5610327d8654 "util/main-loop.c", line=236) at util/qemu-thread-posix.c:66 #4 qemu_mutex_lock_iothread_impl #5 os_host_main_loop_wait (timeout=480116000) at util/main-loop.c:236 #6 main_loop_wait (nonblocking=0) at util/main-loop.c:497 #7 main_loop () at vl.c:1892 #8 main Printing contents of qemu_global_mutex, I see that "__owner = 145416", so, thr1 is main loop, and now it wants BQL, which is owned by thr2. (gdb) thr 2 (gdb) bt #0 __lll_lock_wait () #1 _L_lock_870 () #2 __GI___pthread_mutex_lock #3 qemu_mutex_lock_impl (mutex=0x561034d25dc0, ... #4 aio_context_acquire (ctx=0x561034d25d60) #5 dma_blk_cb #6 dma_blk_io #7 dma_blk_read #8 ide_dma_cb #9 bmdma_cmd_writeb #10 bmdma_write #11 memory_region_write_accessor #12 access_with_adjusted_size #15 flatview_write #16 address_space_write #17 address_space_rw #18 kvm_handle_io #19 kvm_cpu_exec #20 qemu_kvm_cpu_thread_fn #21 qemu_thread_start #22 start_thread #23 clone () Printing mutex in fr 2, I see "__owner = 145411", so thr2 wants aio context mutex, which is owned by thr1. Classic dead-lock. Then, let's check that aio context is hold by mirror coroutine: just print coroutine stack of first tracked request in mirror job target: (gdb) [...] (gdb) qemu coroutine 0x561035dd0860 #0 qemu_coroutine_switch #1 qemu_coroutine_yield #2 qemu_co_mutex_lock_slowpath #3 qemu_co_mutex_lock #4 qcow2_co_pwritev #5 bdrv_driver_pwritev #6 bdrv_aligned_pwritev #7 bdrv_co_pwritev #8 blk_co_pwritev #9 mirror_read_complete () at block/mirror.c:232 #10 mirror_co_read () at block/mirror.c:370 #11 coroutine_trampoline #12 __start_context Yes it is mirror_read_complete calling blk_co_pwritev after acquiring aio context. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 03 December 2018, 15:50:58 UTC
83ea23c Roman Bolshakov 03 December 2018, 10:04:14 UTC i386: hvf: Fix overrun of _decode_tbl1 Single opcode instructions in ff group were incorrectly processed because an overrun of _decode_tbl1[0xff] resulted in access of _decode_tbl2[0x0]. Thus, decode_sldtgroup was called instead of decode_ffgroup: 7d71: decode_sldtgroup: 1 Unimplemented handler (7d71) for 108 (ff 0) While at it correct maximum length for _decode_tbl2 and _decode_tbl3. Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 03 December 2018, 15:09:55 UTC
629457a Corey Minyard 03 December 2018, 12:52:50 UTC i2c: Add a length check to the SMBus write handling Avoid an overflow. Signed-off-by: Corey Minyard <cminyard@mvista.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: QEMU Stable <qemu-stable@nongnu.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 03 December 2018, 13:00:38 UTC
c688e6c Eric Blake 30 November 2018, 02:32:32 UTC nbd/client: Send NBD_CMD_DISC if open fails after connect If nbd_client_init() fails after we are already connected, then the server will spam logs with: Disconnect client, due to: Unexpected end-of-file before all bytes were read unless we gracefully disconnect before closing the connection. Ways to trigger this: $ opts=driver=nbd,export=foo,server.type=inet,server.host=localhost,server.port=10809 $ qemu-img map --output=json --image-opts $opts,read-only=off $ qemu-img map --output=json --image-opts $opts,x-dirty-bitmap=nosuch: Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181130023232.3079982-4-eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> 30 November 2018, 20:13:37 UTC
47829c4 Eric Blake 30 November 2018, 02:32:31 UTC nbd/client: Make x-dirty-bitmap more reliable The implementation of x-dirty-bitmap in qemu 3.0 (commit 216ee365) silently falls back to treating the server as not supporting NBD_CMD_BLOCK_STATUS if a requested meta_context name was not negotiated, which in turn means treating the _entire_ image as data. Since our hack relied on using 'qemu-img map' to view which portions of the image were dirty by seeing what the redirected bdrv_block_status() treats as holes, this means that our fallback treats the entire image as clean. Better would have been to treat the entire image as dirty, or to fail to connect because the user's request for a specific context could not be honored. This patch goes with the latter. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181130023232.3079982-3-eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> 30 November 2018, 20:11:20 UTC
e31d802 Eric Blake 30 November 2018, 02:32:30 UTC nbd/server: Advertise all contexts in response to bare LIST The NBD spec, and even our code comment, says that if the client asks for NBD_OPT_LIST_META_CONTEXT with 0 queries, then we should reply with (a possibly-compressed representation of) ALL contexts that we are willing to let them try. But commit 3d068aff forgot to advertise qemu:dirty-bitmap:FOO. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181130023232.3079982-2-eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> 30 November 2018, 19:55:18 UTC
4750e1a Peter Maydell 28 November 2018, 17:37:34 UTC Update version for v3.1.0-rc3 release Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 28 November 2018, 17:37:34 UTC
3f2f3b3 Thomas Huth 28 November 2018, 09:58:14 UTC target/arm/sve_helper: Fix compilation with clang 3.4 Clang 3.4 does not know the "flatten" attribute yet. We've already introduced the QEMU_FLATTEN macro for this in commit 97ff87c0ed020c2, so use this macro now here, too, to fix this issue. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1543399094-2260-1-git-send-email-thuth@redhat.com Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 28 November 2018, 15:31:15 UTC
ea066d3 Thomas Huth 28 November 2018, 09:35:36 UTC hw/arm/aspeed: Fix build issue with clang 3.4 When using clang 3.4.2, compilation of QEMU fails like this: CC aarch64-softmmu/hw/arm/aspeed.o hw/arm/aspeed.c:36:3: error: redefinition of typedef 'AspeedBoardState' is a C11 feature [-Werror,-Wtypedef-redefinition] } AspeedBoardState; ^ include/hw/arm/aspeed.h:14:33: note: previous definition is here typedef struct AspeedBoardState AspeedBoardState; ^ 1 error generated. make[1]: *** [hw/arm/aspeed.o] Error 1 make: *** [subdir-aarch64-softmmu] Error 2 Remove the duplicated typedef to fix this issue. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-id: 1543397736-8198-1-git-send-email-thuth@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 28 November 2018, 13:51:41 UTC
c566066 Peter Maydell 28 November 2018, 11:32:33 UTC Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging * lsi HBA reselection fix (George) * Small cleanups (Li Qiang) * bugfixes for vhost-user-bridge and hostmem (Marc-André) * single-thread TCG fix (me) * VMX migration blocker (me) * target/i386 fix for LOCK (Richard) * MAINTAINERS update (Philippe, Thomas) # gpg: Signature made Wed 28 Nov 2018 10:51:36 GMT # gpg: using RSA key BFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: hostmem: no need to check for host_memory_backend_mr_inited() in alloc() hostmem-memfd: honour share=on/off property MAINTAINERS: Add an entry for the Firmware Configuration (fw_cfg) device MAINTAINERS: Add some missing entries related to accelerators target/i386: Generate #UD when applying LOCK to a register destination checkpatch: g_test_message does not need a trailing newline vl.c: remove outdated comment vhost-user-bridge: fix recvmsg iovlen vl: Improve error message when we can't load fw_cfg from file vmstate: constify VMStateField migration: savevm: consult migration blockers lsi: Reselection needed to remove pending commands from queue cpus: run work items for all vCPUs if single-threaded target/i386: kvm: add VMX migration blocker Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 28 November 2018, 11:32:33 UTC
8610029 Marc-André Lureau 10 September 2018, 13:49:46 UTC hostmem: no need to check for host_memory_backend_mr_inited() in alloc() memfd_backend_memory_alloc/file_backend_memory_alloc both needlessly are are calling host_memory_backend_mr_inited() which creates an illusion that alloc could be called multiple times but it isn't, it's called once from UserCreatable complete(). Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 28 November 2018, 10:51:24 UTC
039d4e3 John Snow 27 November 2018, 18:49:29 UTC scsi: Address spurious clang warning Some versions of Clang prior to 6.0 (and some builds of clang after, such as 6.0.1-2.fc28) fail to recognize { 0 } as a valid initializer for a struct with subobjects when -Wmissing-braces is enabled. https://bugs.llvm.org/show_bug.cgi?id=21689 and https://reviews.llvm.org/rL314499 suggests this should be fixed in 6.0, but it might not be the case for older versions or downstream versions. For now, follow the precedent of ebf2a499 and replace the standard { 0 } with the accepted { } to silence this warning and allow the build to work under clang 6.0.1-2.fc28, and builds prior to 6.0. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 20181127184929.20065-1-jsnow@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 27 November 2018, 23:56:12 UTC
549b50a Markus Armbruster 27 November 2018, 08:41:43 UTC vfio-helpers: Fix qemu_vfio_open_pci() crash qemu_vfio_open_common() initializes s->lock only after passing s to qemu_vfio_dma_map() via qemu_vfio_init_ramblock(). qemu_vfio_dma_map() tries to lock the uninitialized lock and crashes. Fix by initializing s->lock first. RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1645840 Fixes: 418026ca43bc2626db092d7558258f9594366f28 Cc: qemu-stable@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20181127084143.1113-1-armbru@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 27 November 2018, 18:39:32 UTC
36ea397 Marc-André Lureau 28 August 2018, 15:38:40 UTC hostmem-memfd: honour share=on/off property The share=on/off property is used to modified mmap() MAP_SHARED setting. Make it on by default for convenience and compatibility reasons. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 November 2018, 18:36:22 UTC
15ffb43 Philippe Mathieu-Daudé 22 November 2018, 02:11:39 UTC MAINTAINERS: Add an entry for the Firmware Configuration (fw_cfg) device Step in to maintain it, with Laszlo (EDK2) and Gerd (SeaBIOS) as designated reviewers. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20181122021139.1486-1-philmd@redhat.com> Acked-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 November 2018, 14:35:19 UTC
9681ad3 Thomas Huth 22 November 2018, 12:57:18 UTC MAINTAINERS: Add some missing entries related to accelerators Add some files from accel/stubs/, include/hw/kvm/ and scripts/kvm/ to the MAINTAINERS file. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <1542891438-13329-1-git-send-email-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 November 2018, 14:35:19 UTC
e84fcd7 Richard Henderson 13 November 2018, 19:35:10 UTC target/i386: Generate #UD when applying LOCK to a register destination Fixes a TCG crash due to attempting the atomic operation without having set up the address first. This does not attempt to fix all of the other missing checks for LOCK. Fixes: a7cee522f35 Fixes: https://bugs.launchpad.net/qemu/+bug/1803160 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20181113193510.24862-1-richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 November 2018, 14:35:19 UTC
f1e35ac Paolo Bonzini 21 November 2018, 18:27:20 UTC checkpatch: g_test_message does not need a trailing newline Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 November 2018, 14:35:19 UTC
d4c7e7e Li Qiang 15 November 2018, 10:06:25 UTC vl.c: remove outdated comment Cc: qemu-trivial@nongnu.org Signed-off-by: Li Qiang <liq3ea@gmail.com> Message-Id: <1542276385-7638-1-git-send-email-liq3ea@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 November 2018, 14:35:19 UTC
8f1d22d Marc-André Lureau 09 November 2018, 17:30:28 UTC vhost-user-bridge: fix recvmsg iovlen After iov_discard_front(), the iov may be smaller than its initial size. Fixes the heap-buffer-overflow spotted by ASAN: ==9036==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060000001e0 at pc 0x7fe632eca3f0 bp 0x7ffddc4a05a0 sp 0x7ffddc49fd48 WRITE of size 32 at 0x6060000001e0 thread T0 #0 0x7fe632eca3ef (/lib64/libasan.so.5+0x773ef) #1 0x7fe632ecad23 in __interceptor_recvmsg (/lib64/libasan.so.5+0x77d23) #2 0x561e7491936b in vubr_backend_recv_cb /home/elmarco/src/qemu/tests/vhost-user-bridge.c:333 #3 0x561e74917711 in dispatcher_wait /home/elmarco/src/qemu/tests/vhost-user-bridge.c:160 #4 0x561e7491c3b5 in vubr_run /home/elmarco/src/qemu/tests/vhost-user-bridge.c:725 #5 0x561e7491c85c in main /home/elmarco/src/qemu/tests/vhost-user-bridge.c:806 #6 0x7fe631a6c412 in __libc_start_main (/lib64/libc.so.6+0x24412) #7 0x561e7491667d in _start (/home/elmarco/src/qemu/build/tests/vhost-user-bridge+0x3967d) 0x6060000001e0 is located 0 bytes to the right of 64-byte region [0x6060000001a0,0x6060000001e0) allocated by thread T0 here: #0 0x7fe632f42848 in __interceptor_malloc (/lib64/libasan.so.5+0xef848) #1 0x561e7493acd8 in virtqueue_alloc_element /home/elmarco/src/qemu/contrib/libvhost-user/libvhost-user.c:1848 #2 0x561e7493c2a8 in vu_queue_pop /home/elmarco/src/qemu/contrib/libvhost-user/libvhost-user.c:1954 #3 0x561e749189bf in vubr_backend_recv_cb /home/elmarco/src/qemu/tests/vhost-user-bridge.c:297 #4 0x561e74917711 in dispatcher_wait /home/elmarco/src/qemu/tests/vhost-user-bridge.c:160 #5 0x561e7491c3b5 in vubr_run /home/elmarco/src/qemu/tests/vhost-user-bridge.c:725 #6 0x561e7491c85c in main /home/elmarco/src/qemu/tests/vhost-user-bridge.c:806 #7 0x7fe631a6c412 in __libc_start_main (/lib64/libc.so.6+0x24412) SUMMARY: AddressSanitizer: heap-buffer-overflow (/lib64/libasan.so.5+0x773ef) Shadow bytes around the buggy address: 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c0c7fff8000: fa fa fa fa 00 00 00 00 00 00 05 fa fa fa fa fa 0x0c0c7fff8010: 00 00 00 00 00 00 00 00 fa fa fa fa fd fd fd fd 0x0c0c7fff8020: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00 00 00[fa]fa fa fa 0x0c0c7fff8040: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd 0x0c0c7fff8050: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd 0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0c7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20181109173028.3372-1-marcandre.lureau@redhat.com> Signed-off-by: Paolo BOnzini <pbonzini@redhat.com> 27 November 2018, 14:35:18 UTC
353c7d5 Li Qiang 01 November 2018, 05:59:31 UTC vl: Improve error message when we can't load fw_cfg from file parse_fw_cfg() reports "can't load" without further details. Get the details from g_file_get_contents(), and include them in the error message. Signed-off-by: Li Qiang <liq3ea@gmail.com> Message-Id: <1541051971-28584-1-git-send-email-liq3ea@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 November 2018, 14:35:18 UTC
03fee66 Marc-André Lureau 14 November 2018, 13:29:30 UTC vmstate: constify VMStateField Because they are supposed to remain const. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20181114132931.22624-1-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 November 2018, 14:35:15 UTC
59ed3fe Peter Maydell 27 November 2018, 14:35:11 UTC Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging Block layer patches: - block: Fix crash on migration with explicit child nodes - nvme: Fix spurious interrupts # gpg: Signature made Tue 27 Nov 2018 11:59:40 GMT # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: nvme: Fix spurious interrupts iotests: Test migration with -blockdev block: Don't inactivate children before parents Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 27 November 2018, 14:35:11 UTC
5aaac46 Paolo Bonzini 14 November 2018, 09:48:00 UTC migration: savevm: consult migration blockers There is really no difference between live migration and savevm, except that savevm does not require bdrv_invalidate_cache to be implemented by all disks. However, it is unlikely that savevm is used with anything except qcow2 disks, so the penalty is small and worth the improvement in catching bad usage of savevm. Only one place was taking care of savevm when adding a migration blocker, and it can be removed. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 November 2018, 14:06:14 UTC
56333e6 George Kennedy 09 November 2018, 15:18:12 UTC lsi: Reselection needed to remove pending commands from queue Under heavy IO (e.g. fio) the queue is not checked frequently enough for pending commands. As a result some pending commands are timed out by the linux sym53c8xx driver, which sends SCSI Abort messages for the timed out commands. The SCSI Abort messages result in linux errors, which show up on the console and in /var/log/messages. e.g. sd 0:0:3:0: [sdd] tag#33 ABORT operation started scsi target0:0:3: control msgout: 80 20 47 d sd 0:0:3:0: ABORT operation complete. scsi target0:0:4: message d sent on bad reselection Now following a WAIT DISCONNECT Script instruction, and if there is no current command, check for a pending command on the queue and if one exists call lsi_reselect(). Signed-off-by: George Kennedy <george.kennedy@oracle.com> Message-Id: <1541776692-12271-1-git-send-email-george.kennedy@oracle.com> [For safety, add a s->current check in lsi_update_irq - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 November 2018, 14:06:14 UTC
a8efa60 Paolo Bonzini 14 November 2018, 11:36:57 UTC cpus: run work items for all vCPUs if single-threaded This avoids the following I/O thread deadlock: 1) the I/O thread calls run_on_cpu for CPU 3 from a timer. single_tcg_halt_cond is signaled 2) CPU 1 is running and exits. It finds no work item and enters CPU 2 3) because the I/O thread is stuck in run_on_cpu, the round-robin kick timer never triggers, and CPU 3 never runs the work item 4) run_on_cpu never completes Reviewed-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 November 2018, 14:06:14 UTC
d98f260 Paolo Bonzini 14 November 2018, 09:38:13 UTC target/i386: kvm: add VMX migration blocker Nested VMX does not support live migration yet. Add a blocker until that is worked out. Nested SVM only does not support it, but unfortunately it is enabled by default for -cpu host so we cannot really disable it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 November 2018, 14:06:14 UTC
2264faa ZhiPeng Lu 27 November 2018, 11:02:45 UTC hw/virt/arm: Add support for Cortex-A72 in virt Signed-off-by: ZhiPeng Lu <luzhipeng@uniudc.com> Message-id: 1543316565-1101590-1-git-send-email-luzhipeng@uniudc.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 27 November 2018, 14:03:06 UTC
6da0218 Keith Busch 26 November 2018, 17:17:45 UTC nvme: Fix spurious interrupts The code had asserted an interrupt every time it was requested to check for new completion queue entries.This can result in spurious interrupts seen by the guest OS. Fix this by asserting an interrupt only if there are un-acknowledged completion queue entries available. Reported-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Keith Busch <keith.busch@intel.com> Tested-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 27 November 2018, 11:59:00 UTC
330ca11 Kevin Wolf 26 November 2018, 11:21:07 UTC iotests: Test migration with -blockdev Check that block node activation and inactivation works with a block graph that is built with individually created nodes. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> 27 November 2018, 11:59:00 UTC
9e37271 Kevin Wolf 23 November 2018, 14:11:14 UTC block: Don't inactivate children before parents bdrv_child_cb_inactivate() asserts that parents are already inactive when children get inactivated. This precondition is necessary because parents could still issue requests in their inactivation code. When block nodes are created individually with -blockdev, all of them are monitor owned and will be returned by bdrv_next() in an undefined order (in practice, in the order of their creation, which is usually children before parents), which obviously fails the assertion: qemu: block.c:899: bdrv_child_cb_inactivate: Assertion `bs->open_flags & BDRV_O_INACTIVE' failed. This patch fixes the ordering by skipping nodes with still active parents in bdrv_inactivate_recurse() because we know that they will be covered by recursion when the last active parent becomes inactive. With the correct parents-before-children ordering, we also got rid of the reason why commit aad0b7a0bfb introduced two passes, so we can go back to a single-pass recursion. This is necessary so we can rely on the BDRV_O_INACTIVE flag to skip nodes with active parents (the flag used to be set only in pass 2, so we would always skip non-root nodes in pass 1 because all parents would still be considered active; setting the flag in pass 1 would mean, that we never skip anything in pass 2 because all parents are already considered inactive). Because of the change to single pass, this patch is best reviewed with whitespace changes ignored. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> 27 November 2018, 11:59:00 UTC
4822f1e Peter Maydell 27 November 2018, 11:21:38 UTC Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181127-pull-request' into staging various bugfixes for 3.1: fmops, ps2, cirrus, hda, usb-host, qapi # gpg: Signature made Tue 27 Nov 2018 06:49:13 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-31-20181127-pull-request: qapi: add query-display-options command usb-host: set ifs.detached as true if kernel driver is not active audio/hda: fix guest triggerable assert cirrus_vga/migration: update the bank offset before use ps2kbd: default to scan enabled after reset fmops: fix off-by-one in AR_TABLE and DR_TABLE array size Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 27 November 2018, 11:21:38 UTC
d5d31c9 Peter Maydell 27 November 2018, 09:55:05 UTC Merge remote-tracking branch 'remotes/ehabkost/tags/x86-for-3.1-pull-request' into staging x86 fixes for -rc3 * Fix SynIC crash * Fix x86 crash on MSR code on AMD hosts # gpg: Signature made Mon 26 Nov 2018 20:58:34 GMT # gpg: using RSA key 2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/x86-for-3.1-pull-request: hw/hyperv: fix NULL dereference with pure-kvm SynIC kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES support Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 27 November 2018, 09:55:05 UTC
e1ca8f7 Gerd Hoffmann 22 November 2018, 07:16:13 UTC qapi: add query-display-options command Add query-display-options command, which allows querying the qemu display configuration. This isn't particularly useful, except it exposes QAPI type DisplayOptions in query-qmp-schema, so that libvirt can discover recently added -display parameter rendernode (commit d4dc4ab133b). Works around lack of sufficiently powerful command line introspection. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: Eric Blake <eblake@redhat.com> Tested-by: Erik Skultety <eskultet@redhat.com> Message-id: 20181122071613.2889-1-kraxel@redhat.com [ kraxel: reworded commit message as suggested by armbru ] 27 November 2018, 06:47:57 UTC
933d2d4 linzhecheng 20 November 2018, 08:34:19 UTC usb-host: set ifs.detached as true if kernel driver is not active If no kernel driver is active, we can already claim and perform I/O on it without detaching it. Signed-off-by: linzhecheng <linzhecheng@huawei.com> Message-id: 20181120083419.17716-1-linzhecheng@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> 27 November 2018, 06:47:57 UTC
7ec9106 Gerd Hoffmann 23 November 2018, 06:39:57 UTC audio/hda: fix guest triggerable assert Guest writes to a readonly register trigger the assert in intel_hda_reg_write(). Add a check and just ignore them. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1628433 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181123063957.9515-1-kraxel@redhat.com 27 November 2018, 06:47:57 UTC
b7ee9e4 Wang Xin 23 November 2018, 06:46:46 UTC cirrus_vga/migration: update the bank offset before use The cirrus bank0/1 offset should be updated before we update the vram's alias offset. Signed-off-by: Wang Xin <wangxinxin.wang@huawei.com> Message-id: 20181123064646.23036-1-linzhecheng@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> 27 November 2018, 06:47:57 UTC
d2e550a Hervé Poussineau 21 October 2018, 19:07:21 UTC ps2kbd: default to scan enabled after reset A check for scan_enabled has been added to ps2_keyboard_event in commit 143c04c7e0639e53086519592ead15d2556bfbf2 to prevent stream corruption. This works well as long as operating system is resetting keyboard, or enabling it. This fixes IBM 40p firmware, which doesn't bother sending KBD_CMD_RESET, KBD_CMD_ENABLE or KBD_CMD_RESET_ENABLE before trying to use the keyboard. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20181021190721.2148-1-hpoussin@reactos.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> 27 November 2018, 06:47:50 UTC
30a759b Roman Kagan 26 November 2018, 15:28:44 UTC hw/hyperv: fix NULL dereference with pure-kvm SynIC When started in compat configuration of SynIC, e.g. qemu-system-x86_64 -machine pc-i440fx-2.10,accel=kvm \ -cpu host,-vmx,hv-relaxed,hv_spinlocks=0x1fff,hv-vpindex,hv-synic or explicitly qemu-system-x86_64 -enable-kvm -cpu host,hv-synic,x-hv-synic-kvm-only=on QEMU crashes in hyperv_synic_reset() trying to access the non-present qobject for SynIC. Add the missing check for NULL. Reported-by: Vitaly Kuznetsov <vkuznets@redhat.com> Reported-by: Igor Mammedov <imammedo@redhat.com> Fixes: 9b4cf107b09d18ac30f46fd1c4de8585ccba030c Fixes: 4a93722f9c279184e95b1e1ad775c01deec05065 Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Message-Id: <20181126152836.25379-1-rkagan@virtuozzo.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> 26 November 2018, 16:14:38 UTC
aec5e9c Bandan Das 26 November 2018, 04:17:28 UTC kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES support When writing to guest's MSR_IA32_ARCH_CAPABILITIES, check whether it's supported in the guest using the KVM_GET_MSR_INDEX_LIST ioctl. Fixes: d86f963694df27f11b3681ffd225c9362de1b634 Suggested-by: Eduardo Habkost <ehabkost@redhat.com> Tested-by: balducci@units.it Signed-off-by: Bandan Das <bsd@redhat.com> Message-Id: <jpg4lc4iiav.fsf_-_@linux.bootlegged.copy> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> 26 November 2018, 15:00:38 UTC
d522fba Peter Maydell 26 November 2018, 13:58:46 UTC Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20181126' into staging target-arm queue: * some updates to MAINTAINERS file entries * cadence_gem: Remove an incorrect assert() # gpg: Signature made Mon 26 Nov 2018 13:57:34 GMT # gpg: using RSA key 3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20181126: net: cadence_gem: Remove incorrect assert() MAINTAINERS: Add an ARM SMMU section MAINTAINERS: Assign some more files in the hw/arm/ directory Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 26 November 2018, 13:58:46 UTC
58102ce Edgar E. Iglesias 23 November 2018, 13:54:50 UTC net: cadence_gem: Remove incorrect assert() Don't assert on RX descriptor settings when the receiver is disabled. This fixes an issue with incoming packets on an unused GEM. Reported-by: mbilal <muhammad_bilal@mentor.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181123135450.24829-2-edgar.iglesias@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 26 November 2018, 13:41:42 UTC
49154ea Eric Auger 22 November 2018, 18:01:43 UTC MAINTAINERS: Add an ARM SMMU section Add a new ARM SMMU section and set Eric Auger as the maintainer for ARM SMMU emulation sources. Signed-off-by: Eric Auger <eric.auger@redhat.com> Message-id: 20181122180143.14237-1-eric.auger@redhat.com Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 26 November 2018, 13:40:48 UTC
123a069 Thomas Huth 26 November 2018, 13:39:23 UTC MAINTAINERS: Assign some more files in the hw/arm/ directory I apparently missed some more files and even a complete machine (the "imx25-pdk") in my previous patch... but now we should hopefully have a completely coverage for all available ARM boards. Fixes: 95a5db3ae5698b49c63144610ad02913e780c828 Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 1542782568-20059-1-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 26 November 2018, 13:39:23 UTC
72138f9 Peter Maydell 26 November 2018, 11:46:03 UTC Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging Fixes a QEMU crash triggerable by guest userspace (CVE-2018-19489). # gpg: Signature made Mon 26 Nov 2018 07:25:01 GMT # gpg: using RSA key 71D4D5E5822F73D6 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Gregory Kurz <gregory.kurz@free.fr>" # gpg: aka "[jpeg image of size 3330]" # Primary key fingerprint: B482 8BAF 9431 40CE F2A3 4910 71D4 D5E5 822F 73D6 * remotes/gkurz/tags/for-upstream: 9p: fix QEMU crash when renaming files Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 26 November 2018, 11:46:04 UTC
b05730a Peter Maydell 26 November 2018, 11:07:35 UTC Merge remote-tracking branch 'remotes/xtensa/tags/20181125-xtensa' into staging xtensa fixes for 3.1: - fix register counting logic for linux-user gdbserver; - provide default memory sizes for XTFPGA boards; - add missing xtensa patterns to MAINTAINTERS. # gpg: Signature made Sun 25 Nov 2018 23:07:54 GMT # gpg: using RSA key 51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <filippov@cadence.com>" # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20181125-xtensa: MAINTAINERS: add missing xtensa patterns target/xtensa: xtfpga: provide default memory sizes target/xtensa: drop num_[core_]regs from dc232b/dc233c configs target/xtensa: gdbstub fix register counting Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 26 November 2018, 11:07:35 UTC
57ac4a7 Gerd Hoffmann 30 October 2018, 08:23:40 UTC fmops: fix off-by-one in AR_TABLE and DR_TABLE array size Cc: P J P <ppandit@redhat.com> Reported-by: Wangjunqing <wangjunqing@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20181030082340.17170-1-kraxel@redhat.com Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> 26 November 2018, 10:15:32 UTC
1d20398 Greg Kurz 23 November 2018, 12:28:03 UTC 9p: fix QEMU crash when renaming files When using the 9P2000.u version of the protocol, the following shell command line in the guest can cause QEMU to crash: while true; do rm -rf aa; mkdir -p a/b & touch a/b/c & mv a aa; done With 9P2000.u, file renaming is handled by the WSTAT command. The v9fs_wstat() function calls v9fs_complete_rename(), which calls v9fs_fix_path() for every fid whose path is affected by the change. The involved calls to v9fs_path_copy() may race with any other access to the fid path performed by some worker thread, causing a crash like shown below: Thread 12 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8, path=0x0, flags=65536, mode=0) at hw/9pfs/9p-local.c:59 59 while (*path && fd != -1) { (gdb) bt #0 0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8, path=0x0, flags=65536, mode=0) at hw/9pfs/9p-local.c:59 #1 0x0000555555a25e0c in local_opendir_nofollow (fs_ctx=0x555557d958b8, path=0x0) at hw/9pfs/9p-local.c:92 #2 0x0000555555a261b8 in local_lstat (fs_ctx=0x555557d958b8, fs_path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/9p-local.c:185 #3 0x0000555555a2b367 in v9fs_co_lstat (pdu=0x555557d97498, path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/cofile.c:53 #4 0x0000555555a1e9e2 in v9fs_stat (opaque=0x555557d97498) at hw/9pfs/9p.c:1083 #5 0x0000555555e060a2 in coroutine_trampoline (i0=-669165424, i1=32767) at util/coroutine-ucontext.c:116 #6 0x00007fffef4f5600 in __start_context () at /lib64/libc.so.6 #7 0x0000000000000000 in () (gdb) The fix is to take the path write lock when calling v9fs_complete_rename(), like in v9fs_rename(). Impact: DoS triggered by unprivileged guest users. Fixes: CVE-2018-19489 Cc: P J P <ppandit@redhat.com> Reported-by: zhibin hu <noirfate@gmail.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Greg Kurz <groug@kaod.org> 23 November 2018, 12:28:03 UTC
5298f4d Peter Maydell 23 November 2018, 08:54:52 UTC Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging Block layer patches: - block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options() - block: Fix option inheritance after stream/commit job graph changes - qemu-img: Fix memory leak and typo in error message - nvme: Fixes for lockups and crashes - scsi-disk: Fix crash if underlying host file or disk returns error - Several qemu-iotests fixes and improvements # gpg: Signature made Thu 22 Nov 2018 18:38:30 GMT # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: block: Update BlockDriverState.inherits_from on bdrv_drop_intermediate() block: Update BlockDriverState.inherits_from on bdrv_set_backing_hd() iotests: Enhance 223 to cover multiple bitmap granularities nvme: fix bug with PCI IRQ pins on teardown nvme: fix CMB endianness confusion Revert "nvme: fix oob access issue(CVE-2018-16847)" nvme: fix out-of-bounds access to the CMB nvme: call blk_drain in NVMe reset code to avoid lockups iotests: fix nbd test 233 to work correctly with raw images block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options() scsi-disk: Fix crash if underlying host file or disk returns error qemu-img: Fix leak qemu-img: Fix typo iotests: Skip 233 if certtool not installed iotests: Replace assertEquals() with assertEqual() iotests: Replace time.clock() with Timeout Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 23 November 2018, 08:54:52 UTC
895e489 Max Filippov 22 November 2018, 23:06:21 UTC MAINTAINERS: add missing xtensa patterns Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> 23 November 2018, 05:16:43 UTC
6bd858b Alberto Garcia 31 October 2018, 16:16:38 UTC block: Update BlockDriverState.inherits_from on bdrv_drop_intermediate() The previous patch fixed the inherits_from pointer after block-stream, and this one does the same for block-commit. When block-commit finishes and the 'top' node is not the topmost one from the backing chain then all nodes above 'base' up to and including 'top' are removed from the chain. The bdrv_drop_intermediate() call converts a chain like this one: base <- intermediate <- top <- active into this one: base <- active In a simple scenario each backing file from the first chain has the inherits_from attribute pointing to its parent. This means that reopening 'active' will recursively reopen all its children, whose options can be changed in the process. However after the 'block-commit' call base.inherits_from is NULL and the chain is broken, so 'base' does not inherit from 'active' and will not be reopened automatically: $ qemu-img create -f qcow2 hd0.qcow2 1M $ qemu-img create -f qcow2 -b hd0.qcow2 hd1.qcow2 $ qemu-img create -f qcow2 -b hd1.qcow2 hd2.qcow2 $ $QEMU -drive if=none,file=hd2.qcow2 { 'execute': 'block-commit', 'arguments': { 'device': 'none0', 'top': 'hd1.qcow2' } } { 'execute': 'human-monitor-command', 'arguments': { 'command-line': 'qemu-io none0 "reopen -o backing.l2-cache-size=2M"' } } { "return": "Cannot change the option 'backing.l2-cache-size'\r\n"} This patch updates base.inherits_from in this scenario, and adds a test case. Signed-off-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 22 November 2018, 18:37:31 UTC
0065c45 Alberto Garcia 31 October 2018, 16:16:37 UTC block: Update BlockDriverState.inherits_from on bdrv_set_backing_hd() When a BlockDriverState's child is opened (be it a backing file, the protocol layer, or any other) inherits_from is set to point to the parent node. Children opened separately and then attached to a parent don't have this pointer set. bdrv_reopen_queue_child() uses this to determine whether a node's children must also be reopened inheriting the options from the parent or not. If inherits_from points to the parent then the child is reopened and its options can be changed, like in this example: $ qemu-img create -f qcow2 hd0.qcow2 1M $ qemu-img create -f qcow2 hd1.qcow2 1M $ $QEMU -drive if=none,node-name=hd0,file=hd0.qcow2,\ backing.driver=qcow2,backing.file.filename=hd1.qcow2 (qemu) qemu-io hd0 "reopen -o backing.l2-cache-size=2M" If the child does not inherit from the parent then it does not get reopened and its options cannot be changed: $ $QEMU -drive if=none,node-name=hd1,file=hd1.qcow2 -drive if=none,node-name=hd0,file=hd0.qcow2,backing=hd1 (qemu) qemu-io hd0 "reopen -o backing.l2-cache-size=2M" Cannot change the option 'backing.l2-cache-size' If a disk image has a chain of backing files then all of them are also connected through their inherits_from pointers (i.e. it's possible to walk the chain in reverse order from base to top). However this is broken if the intermediate nodes are removed using e.g. block-stream because the inherits_from pointer from the base node becomes NULL: $ qemu-img create -f qcow2 hd0.qcow2 1M $ qemu-img create -f qcow2 -b hd0.qcow2 hd1.qcow2 $ qemu-img create -f qcow2 -b hd1.qcow2 hd2.qcow2 $ $QEMU -drive if=none,file=hd2.qcow2 (qemu) qemu-io none0 "reopen -o backing.l2-cache-size=2M" (qemu) block_stream none0 0 hd0.qcow2 (qemu) qemu-io none0 "reopen -o backing.l2-cache-size=2M" Cannot change the option 'backing.l2-cache-size' This patch updates the inherits_from pointer if the intermediate nodes of a backing chain are removed using bdrv_set_backing_hd(), and adds a test case for this scenario. Signed-off-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 22 November 2018, 18:37:31 UTC
a237dea Eric Blake 19 November 2018, 17:29:24 UTC iotests: Enhance 223 to cover multiple bitmap granularities Testing granularity at the same size as the cluster isn't quite as fun as what happens when it is larger or smaller. This enhancement also shows that qemu's nbd server can serve the same disk over multiple exports simultaneously. Signed-off-by: Eric Blake <eblake@redhat.com> Tested-by: John Snow <jsnow@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 22 November 2018, 18:37:31 UTC
ad3a7e4 Logan Gunthorpe 21 November 2018, 18:10:13 UTC nvme: fix bug with PCI IRQ pins on teardown When the submission and completion queues are being torn down the IRQ will be asserted for the completion queue when the submsission queue is deleted. Then when the completion queue is deleted it stays asserted. Thus, on systems that do not use MSI, no further interrupts can be triggered on the host. Linux sees this as a long delay when unbinding the nvme device. Eventually the interrupt timeout occurs and it continues. To fix this we ensure we deassert the IRQ for a CQ when it is deleted. Signed-off-by: Logan Gunthorpe <logang@deltatee.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 22 November 2018, 18:37:31 UTC
71a86dd Paolo Bonzini 22 November 2018, 18:23:35 UTC nvme: fix CMB endianness confusion The CMB is marked as DEVICE_LITTLE_ENDIAN, so the data must be read/written as if it was little-endian output (in the case of big endian, we get two swaps, one in the memory core and one in nvme.c). Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 22 November 2018, 18:37:31 UTC
2067d39 Kevin Wolf 22 November 2018, 14:52:20 UTC Revert "nvme: fix oob access issue(CVE-2018-16847)" This reverts commit 5e3c0220d7e4f0361c4d36c697a8842f2b583402. We have a better fix commited for this now. Signed-off-by: Kevin Wolf <kwolf@redhat.com> 22 November 2018, 15:43:52 UTC
87ad860 Paolo Bonzini 20 November 2018, 18:41:48 UTC nvme: fix out-of-bounds access to the CMB Because the CMB BAR has a min_access_size of 2, if you read the last byte it will try to memcpy *2* bytes from n->cmbuf, causing an off-by-one error. This is CVE-2018-16847. Another way to fix this might be to register the CMB as a RAM memory region, which would also be more efficient. However, that might be a change for big-endian machines; I didn't think this through and I don't know how real hardware works. Add a basic testcase for the CMB in case somebody does this change later on. Cc: Keith Busch <keith.busch@intel.com> Cc: qemu-block@nongnu.org Reported-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Tested-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 22 November 2018, 15:43:52 UTC
6bf7463 Igor Druzhinin 06 November 2018, 12:16:55 UTC nvme: call blk_drain in NVMe reset code to avoid lockups When blk_flush called in NVMe reset path S/C queues are already freed which means that re-entering AIO handling loop having some IO requests unfinished will lockup or crash as their SG structures being potentially reused. Call blk_drain before freeing the queues to avoid this nasty scenario. Signed-off-by: Igor Druzhinin <igor.druzhinin@citrix.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 22 November 2018, 15:43:52 UTC
e4c8f29 Daniel P. Berrangé 20 November 2018, 17:56:46 UTC iotests: fix nbd test 233 to work correctly with raw images The first qemu-io command must honour the $IMGFMT that is set rather than hardcoding qcow2. The qemu-nbd commands should also set $IMGFMT to avoid the insecure format probe warning. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 22 November 2018, 15:43:52 UTC
2a3d433 Alberto Garcia 12 November 2018, 14:00:48 UTC block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options() Commit e35bdc123a4ace9f4d3fcca added the auto-read-only option and the code to update its corresponding flag in update_flags_from_options(), but forgot to clear the flag if auto-read-only is false. Signed-off-by: Alberto Garcia <berto@igalia.com> Reported-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 22 November 2018, 15:43:52 UTC
1c7f618 Richard W.M. Jones 21 November 2018, 12:47:47 UTC scsi-disk: Fix crash if underlying host file or disk returns error Commit 40dce4ee6 "scsi-disk: fix rerror/werror=ignore" introduced a bug which causes qemu to crash with the assertion error below if the host file or disk returns an error: qemu-system-x86_64: hw/scsi/scsi-bus.c:1374: scsi_req_complete: Assertion `req->status == -1' failed. Kevin Wolf suggested this fix: < kwolf> Hm, should the final return false; in that patch actually be a return true? < kwolf> Because I think he didn't intend to change anything except BLOCK_ERROR_ACTION_IGNORE Buglink: https://bugs.launchpad.net/qemu/+bug/1804323 Fixes: 40dce4ee61c68395f6d463fae792f61b7c003bce Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 22 November 2018, 15:43:48 UTC
ebfd621 Peter Maydell 22 November 2018, 13:45:06 UTC Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20181121a' into staging Migration fixes 2018-11-21 Notably the fix for building with --disable-replication # gpg: Signature made Wed 21 Nov 2018 13:03:20 GMT # gpg: using RSA key 0516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert/tags/pull-migration-20181121a: migration/migration.c: Add COLO dependency checks migration/colo.c: Fix compilation issue when disable replication Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 22 November 2018, 13:45:06 UTC
59b5e9b Max Filippov 20 November 2018, 20:31:24 UTC target/xtensa: xtfpga: provide default memory sizes Provide default RAM sizes for all XTFPGA boards, so that when started without -m option they do the right thing. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> 21 November 2018, 18:53:21 UTC
3ecd5a4 Max Reitz 19 November 2018, 10:19:21 UTC qemu-img: Fix leak create_opts was leaked here. This is not too bad since the process is about to exit anyway, but relying on that does not make the code nicer to read. Fixes: d402b6a21a825a5c07aac9251990860723d49f5d Reported-by: Kevin Wolf <kwolf@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 21 November 2018, 14:17:46 UTC
f099887 Max Reitz 19 November 2018, 10:19:20 UTC qemu-img: Fix typo Fixes: d402b6a21a825a5c07aac9251990860723d49f5d Reported-by: Kevin Wolf <kwolf@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 21 November 2018, 14:17:46 UTC
155af09 Eric Blake 20 November 2018, 22:52:41 UTC iotests: Skip 233 if certtool not installed The use of TLS while building qemu is optional. While the 'certtool' binary should be available on every platform that supports building against TLS, that does not imply that the developer has installed it. Make the test gracefully skip in that case. Reported-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 21 November 2018, 14:17:37 UTC
7e934f5 Zhang Chen 14 November 2018, 19:09:12 UTC migration/migration.c: Add COLO dependency checks Current COLO mode(independent disk mode) need replication module work together. Suggested by Dr. David Alan Gilbert <dgilbert@redhat.com>. Signed-off-by: Zhang Chen <chen.zhang@intel.com> Message-Id: <20181114190912.7242-1-chen.zhang@intel.com> Reviewed-by: Peter Xu <peterx@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> 21 November 2018, 11:38:12 UTC
3ebb9c4 Zhang Chen 01 November 2018, 02:12:26 UTC migration/colo.c: Fix compilation issue when disable replication This compilation issue will occur when user use --disable-replication to config Qemu. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Zhang Chen <zhangckid@gmail.com> Message-Id: <20181101021226.6353-1-zhangckid@gmail.com> Tested-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> 21 November 2018, 11:20:14 UTC
fa1cfb4 Kevin Wolf 20 November 2018, 17:12:21 UTC iotests: Replace assertEquals() with assertEqual() TestCase.assertEquals() is deprecated since Python 2.7. Recent Python versions print a warning when the function is called, which makes test cases fail. Replace it with the preferred spelling assertEqual(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> 21 November 2018, 09:30:05 UTC
d8336c6 Kevin Wolf 20 November 2018, 17:09:49 UTC iotests: Replace time.clock() with Timeout time.clock() is deprecated since Python 3.3. Current Python versions warn that the function will be removed in Python 3.8, and those warnings make the test case 118 fail. Replace it with the Timeout mechanism that is compatible with both Python 2 and 3, and makes the code even a little nicer. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> 21 November 2018, 09:30:05 UTC
7da9111 Max Filippov 31 October 2018, 21:21:49 UTC target/xtensa: drop num_[core_]regs from dc232b/dc233c configs Now that xtensa_count_regs does the right thing, remove manual initialization of these fields from the affected configurations and let xtensa_finalize_config initialize them. Add XTREG_END to terminate register lists. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> 20 November 2018, 20:20:41 UTC
4614f0f Max Filippov 20 November 2018, 02:02:32 UTC target/xtensa: gdbstub fix register counting In order to communicate correctly with gdb xtensa gdbstub must provide expected number of registers in 'g' packet response. xtensa-elf-gdb expects both nonprivileged and privileged registers. xtensa-linux-gdb only expects nonprivileged registers. gdb only counts one contiguous stretch of registers, do the same for the core registers in the xtensa_count_regs. With this change qemu-system-xtensa is able to communicate with all xtensa-elf-gdb versions (versions prior to 8.2 require overlay fixup), and qemu-xtensa is able to communicate with all xtensa-linux-gdb versions, except 8.2. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> 20 November 2018, 20:20:41 UTC
47c1cc3 Peter Maydell 20 November 2018, 18:10:26 UTC Update version for v3.1.0-rc2 release Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 20 November 2018, 18:10:26 UTC
53744e0 Peter Maydell 20 November 2018, 14:11:00 UTC Merge remote-tracking branch 'remotes/ehabkost/tags/x86-for-3.1-pull-request' into staging pc-*-3.1 machine-types # gpg: Signature made Tue 20 Nov 2018 13:43:24 GMT # gpg: using RSA key 2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/x86-for-3.1-pull-request: hw/i386: add pc-i440fx-3.1 & pc-q35-3.1 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 20 November 2018, 14:11:00 UTC
4a93722 Marc-André Lureau 20 November 2018, 13:26:04 UTC hw/i386: add pc-i440fx-3.1 & pc-q35-3.1 We have a couple of PC_COMPAT_3_0, so we should have 3.1 PC machines, and update the 3.0 machines to make use of those. Fixes a "Known issue" from https://wiki.qemu.org/Planning/3.1. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20181120132604.22854-1-marcandre.lureau@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> 20 November 2018, 13:42:32 UTC
46cabfb Peter Maydell 20 November 2018, 12:24:09 UTC Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging Fixes yet another use-after-free issue that could be triggered by a misbehaving guest. This is a follow-up to commit: commit 5b76ef50f62079a2389ba28cacaf6cce68b1a0ed Author: Greg Kurz <groug@kaod.org> Date: Wed Nov 7 01:00:04 2018 +0100 9p: write lock path in v9fs_co_open2() # gpg: Signature made Tue 20 Nov 2018 12:01:07 GMT # gpg: using RSA key 71D4D5E5822F73D6 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Gregory Kurz <gregory.kurz@free.fr>" # gpg: aka "[jpeg image of size 3330]" # Primary key fingerprint: B482 8BAF 9431 40CE F2A3 4910 71D4 D5E5 822F 73D6 * remotes/gkurz/tags/for-upstream: 9p: take write lock on fid path updates (CVE-2018-19364) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 20 November 2018, 12:24:09 UTC
5b3c77a Greg Kurz 20 November 2018, 12:00:35 UTC 9p: take write lock on fid path updates (CVE-2018-19364) Recent commit 5b76ef50f62079a fixed a race where v9fs_co_open2() could possibly overwrite a fid path with v9fs_path_copy() while it is being accessed by some other thread, ie, use-after-free that can be detected by ASAN with a custom 9p client. It turns out that the same can happen at several locations where v9fs_path_copy() is used to set the fid path. The fix is again to take the write lock. Fixes CVE-2018-19364. Cc: P J P <ppandit@redhat.com> Reported-by: zhibin hu <noirfate@gmail.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Greg Kurz <groug@kaod.org> 20 November 2018, 12:00:35 UTC
3c035a4 Peter Maydell 20 November 2018, 10:56:57 UTC Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2018-11-20' into staging - One additional simple qmp-test - A fix for ide-test - Add logging of QEMU parameters in libqtest # gpg: Signature made Tue 20 Nov 2018 10:47:12 GMT # gpg: using RSA key 2ED9D774FE702DB5 # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" # gpg: aka "Thomas Huth <thuth@redhat.com>" # gpg: aka "Thomas Huth <huth@tuxfamily.org>" # gpg: aka "Thomas Huth <th.huth@posteo.de>" # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * remotes/huth-gitlab/tags/pull-request-2018-11-20: qtest: log QEMU command line tests/ide: Free pcibus when finishing a test tests: add qmp/missing-any-arg test Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 20 November 2018, 10:56:57 UTC
11f303a Peter Maydell 20 November 2018, 10:20:37 UTC Merge remote-tracking branch 'remotes/kraxel/tags/seabios-1.12-20181120-pull-request' into staging seabios: update to 1.12-final # gpg: Signature made Tue 20 Nov 2018 06:01:21 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/seabios-1.12-20181120-pull-request: update seabios to 1.12 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 20 November 2018, 10:20:37 UTC
ced09f9 Paolo Bonzini 15 November 2018, 12:29:30 UTC qtest: log QEMU command line Record the command line that was used to start QEMU. This can be useful for debugging. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> [thuth: removed trailing \n from the message string] Signed-off-by: Thomas Huth <thuth@redhat.com> 20 November 2018, 09:49:12 UTC
af51dbe Gerd Hoffmann 20 November 2018, 05:57:48 UTC update seabios to 1.12 Seabios 1.12 has been released yesterday. Update our snapshot builds to the final release. git shortlog ============ Kevin O'Connor (2): shadow: Rework bios copy code to prevent gcc array-bounds warning docs: Note v1.12.0 release Shmuel Eiderman (1): pvscsi: Scan all 64 possible targets Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> 20 November 2018, 05:57:53 UTC
3b6b0a8 Thomas Huth 13 November 2018, 15:03:21 UTC tests/ide: Free pcibus when finishing a test Once a test has finished, the pcibus structure should be freed, to avoid leaking memory and to make sure that the structure is properly re-initialized when the next test starts. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> 19 November 2018, 20:59:44 UTC
61793a6 Marc-André Lureau 29 October 2018, 14:57:09 UTC tests: add qmp/missing-any-arg test test_qmp_missing_any_arg() is about a bug in infrastructure used by the QMP core, fixed in commit c489780203. We covered the bug in infrastructure unit tests (commit bce3035a44). Let's test it at the QMP level as well. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [thuth: Tweaked the commit message according to Markus' suggestion] Signed-off-by: Thomas Huth <thuth@redhat.com> 19 November 2018, 20:56:36 UTC
393aac1 Peter Maydell 19 November 2018, 18:11:10 UTC Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-11-19' into staging nbd patches for 2018-11-19 Add iotest coverage for NBD connections using TLS, including a couple of code fixes that it pointed out - Mao Zhongyi: 0/3 Do some cleaning work in qemu-iotests - Daniel P. Berrangé: io: return 0 for EOF in TLS session read after shutdown - Daniel P. Berrangé: 0/6 Misc fixes to NBD - Eric Blake: iotests: Drop use of bash keyword 'function' # gpg: Signature made Mon 19 Nov 2018 17:43:32 GMT # gpg: using RSA key A7A16B4A2527436A # gpg: Good signature from "Eric Blake <eblake@redhat.com>" # gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" # gpg: aka "[jpeg image of size 6874]" # Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A * remotes/ericb/tags/pull-nbd-2018-11-19: iotests: Drop use of bash keyword 'function' iotests: Also test I/O over NBD TLS tests: exercise NBD server in TLS mode tests: add iotests helpers for dealing with TLS certificates tests: check if qemu-nbd is still alive before waiting tests: pull qemu-nbd iotest helpers into common.nbd file io: return 0 for EOF in TLS session read after shutdown nbd/server: Ignore write errors when replying to NBD_OPT_ABORT nbd: fix whitespace in server error message qemu-iotests: Modern shell scripting (use $() instead of ``) qemu-iotests: convert `pwd` and $(pwd) to $PWD qemu-iotests: remove unused variable 'here' Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 19 November 2018, 18:11:10 UTC
8cedcff Eric Blake 16 November 2018, 21:50:02 UTC iotests: Drop use of bash keyword 'function' Bash allows functions to be declared with or without the leading keyword 'function'; but including the keyword does not comply with POSIX syntax, and is confusing to ksh users where the use of the keyword changes the scoping rules for functions. Stick to the POSIX form through iotests. Done mechanically with: sed -i 's/^function //' $(git ls-files tests/qemu-iotests) Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181116215002.2124581-1-eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> 19 November 2018, 17:16:46 UTC
bb39c47 Eric Blake 18 November 2018, 02:24:03 UTC iotests: Also test I/O over NBD TLS Enhance test 233 to also perform I/O beyond the initial handshake. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181118022403.2211483-1-eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> 19 November 2018, 17:16:46 UTC
afcd1c2 Daniel P. Berrangé 16 November 2018, 15:53:25 UTC tests: exercise NBD server in TLS mode Add tests that validate it is possible to connect to an NBD server running TLS mode. Also test mis-matched TLS vs non-TLS connections correctly fail. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-7-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: Eric Blake <eblake@redhat.com> [eblake: rebase to iotests shell cleanups, use ss instead of socat for port probing, sanitize port number in expected output] Signed-off-by: Eric Blake <eblake@redhat.com> 19 November 2018, 17:16:46 UTC
a46b684 Daniel P. Berrangé 16 November 2018, 15:53:24 UTC tests: add iotests helpers for dealing with TLS certificates Add helpers to common.tls for creating TLS certificates for a CA, server and client. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-6-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: spelling and quoting touchups] Signed-off-by: Eric Blake <eblake@redhat.com> 19 November 2018, 17:16:46 UTC
back to top