summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-11-22nvme: call blk_drain in NVMe reset code to avoid lockupsIgor Druzhinin
When blk_flush called in NVMe reset path S/C queues are already freed which means that re-entering AIO handling loop having some IO requests unfinished will lockup or crash as their SG structures being potentially reused. Call blk_drain before freeing the queues to avoid this nasty scenario. Signed-off-by: Igor Druzhinin <igor.druzhinin@citrix.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22iotests: fix nbd test 233 to work correctly with raw imagesDaniel P. Berrangé
The first qemu-io command must honour the $IMGFMT that is set rather than hardcoding qcow2. The qemu-nbd commands should also set $IMGFMT to avoid the insecure format probe warning. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options()Alberto Garcia
Commit e35bdc123a4ace9f4d3fcca added the auto-read-only option and the code to update its corresponding flag in update_flags_from_options(), but forgot to clear the flag if auto-read-only is false. Signed-off-by: Alberto Garcia <berto@igalia.com> Reported-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22scsi-disk: Fix crash if underlying host file or disk returns errorRichard W.M. Jones
Commit 40dce4ee6 "scsi-disk: fix rerror/werror=ignore" introduced a bug which causes qemu to crash with the assertion error below if the host file or disk returns an error: qemu-system-x86_64: hw/scsi/scsi-bus.c:1374: scsi_req_complete: Assertion `req->status == -1' failed. Kevin Wolf suggested this fix: < kwolf> Hm, should the final return false; in that patch actually be a return true? < kwolf> Because I think he didn't intend to change anything except BLOCK_ERROR_ACTION_IGNORE Buglink: https://bugs.launchpad.net/qemu/+bug/1804323 Fixes: 40dce4ee61c68395f6d463fae792f61b7c003bce Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-21qemu-img: Fix leakMax Reitz
create_opts was leaked here. This is not too bad since the process is about to exit anyway, but relying on that does not make the code nicer to read. Fixes: d402b6a21a825a5c07aac9251990860723d49f5d Reported-by: Kevin Wolf <kwolf@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-21qemu-img: Fix typoMax Reitz
Fixes: d402b6a21a825a5c07aac9251990860723d49f5d Reported-by: Kevin Wolf <kwolf@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-21iotests: Skip 233 if certtool not installedEric Blake
The use of TLS while building qemu is optional. While the 'certtool' binary should be available on every platform that supports building against TLS, that does not imply that the developer has installed it. Make the test gracefully skip in that case. Reported-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-21iotests: Replace assertEquals() with assertEqual()Kevin Wolf
TestCase.assertEquals() is deprecated since Python 2.7. Recent Python versions print a warning when the function is called, which makes test cases fail. Replace it with the preferred spelling assertEqual(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-21iotests: Replace time.clock() with TimeoutKevin Wolf
time.clock() is deprecated since Python 3.3. Current Python versions warn that the function will be removed in Python 3.8, and those warnings make the test case 118 fail. Replace it with the Timeout mechanism that is compatible with both Python 2 and 3, and makes the code even a little nicer. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-20Update version for v3.1.0-rc2 releasePeter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-20Merge remote-tracking branch ↵Peter Maydell
'remotes/ehabkost/tags/x86-for-3.1-pull-request' into staging pc-*-3.1 machine-types # gpg: Signature made Tue 20 Nov 2018 13:43:24 GMT # gpg: using RSA key 2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/x86-for-3.1-pull-request: hw/i386: add pc-i440fx-3.1 & pc-q35-3.1 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-20hw/i386: add pc-i440fx-3.1 & pc-q35-3.1Marc-André Lureau
We have a couple of PC_COMPAT_3_0, so we should have 3.1 PC machines, and update the 3.0 machines to make use of those. Fixes a "Known issue" from https://wiki.qemu.org/Planning/3.1. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20181120132604.22854-1-marcandre.lureau@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-11-20Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell
Fixes yet another use-after-free issue that could be triggered by a misbehaving guest. This is a follow-up to commit: commit 5b76ef50f62079a2389ba28cacaf6cce68b1a0ed Author: Greg Kurz <groug@kaod.org> Date: Wed Nov 7 01:00:04 2018 +0100 9p: write lock path in v9fs_co_open2() # gpg: Signature made Tue 20 Nov 2018 12:01:07 GMT # gpg: using RSA key 71D4D5E5822F73D6 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Gregory Kurz <gregory.kurz@free.fr>" # gpg: aka "[jpeg image of size 3330]" # Primary key fingerprint: B482 8BAF 9431 40CE F2A3 4910 71D4 D5E5 822F 73D6 * remotes/gkurz/tags/for-upstream: 9p: take write lock on fid path updates (CVE-2018-19364) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-209p: take write lock on fid path updates (CVE-2018-19364)Greg Kurz
Recent commit 5b76ef50f62079a fixed a race where v9fs_co_open2() could possibly overwrite a fid path with v9fs_path_copy() while it is being accessed by some other thread, ie, use-after-free that can be detected by ASAN with a custom 9p client. It turns out that the same can happen at several locations where v9fs_path_copy() is used to set the fid path. The fix is again to take the write lock. Fixes CVE-2018-19364. Cc: P J P <ppandit@redhat.com> Reported-by: zhibin hu <noirfate@gmail.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Greg Kurz <groug@kaod.org>
2018-11-20Merge remote-tracking branch ↵Peter Maydell
'remotes/huth-gitlab/tags/pull-request-2018-11-20' into staging - One additional simple qmp-test - A fix for ide-test - Add logging of QEMU parameters in libqtest # gpg: Signature made Tue 20 Nov 2018 10:47:12 GMT # gpg: using RSA key 2ED9D774FE702DB5 # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" # gpg: aka "Thomas Huth <thuth@redhat.com>" # gpg: aka "Thomas Huth <huth@tuxfamily.org>" # gpg: aka "Thomas Huth <th.huth@posteo.de>" # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * remotes/huth-gitlab/tags/pull-request-2018-11-20: qtest: log QEMU command line tests/ide: Free pcibus when finishing a test tests: add qmp/missing-any-arg test Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-20Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/seabios-1.12-20181120-pull-request' into staging seabios: update to 1.12-final # gpg: Signature made Tue 20 Nov 2018 06:01:21 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/seabios-1.12-20181120-pull-request: update seabios to 1.12 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-20qtest: log QEMU command linePaolo Bonzini
Record the command line that was used to start QEMU. This can be useful for debugging. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> [thuth: removed trailing \n from the message string] Signed-off-by: Thomas Huth <thuth@redhat.com>
2018-11-20update seabios to 1.12Gerd Hoffmann
Seabios 1.12 has been released yesterday. Update our snapshot builds to the final release. git shortlog ============ Kevin O'Connor (2): shadow: Rework bios copy code to prevent gcc array-bounds warning docs: Note v1.12.0 release Shmuel Eiderman (1): pvscsi: Scan all 64 possible targets Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-19tests/ide: Free pcibus when finishing a testThomas Huth
Once a test has finished, the pcibus structure should be freed, to avoid leaking memory and to make sure that the structure is properly re-initialized when the next test starts. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2018-11-19tests: add qmp/missing-any-arg testMarc-André Lureau
test_qmp_missing_any_arg() is about a bug in infrastructure used by the QMP core, fixed in commit c489780203. We covered the bug in infrastructure unit tests (commit bce3035a44). Let's test it at the QMP level as well. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [thuth: Tweaked the commit message according to Markus' suggestion] Signed-off-by: Thomas Huth <thuth@redhat.com>
2018-11-19Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-11-19' into ↵Peter Maydell
staging nbd patches for 2018-11-19 Add iotest coverage for NBD connections using TLS, including a couple of code fixes that it pointed out - Mao Zhongyi: 0/3 Do some cleaning work in qemu-iotests - Daniel P. Berrangé: io: return 0 for EOF in TLS session read after shutdown - Daniel P. Berrangé: 0/6 Misc fixes to NBD - Eric Blake: iotests: Drop use of bash keyword 'function' # gpg: Signature made Mon 19 Nov 2018 17:43:32 GMT # gpg: using RSA key A7A16B4A2527436A # gpg: Good signature from "Eric Blake <eblake@redhat.com>" # gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" # gpg: aka "[jpeg image of size 6874]" # Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A * remotes/ericb/tags/pull-nbd-2018-11-19: iotests: Drop use of bash keyword 'function' iotests: Also test I/O over NBD TLS tests: exercise NBD server in TLS mode tests: add iotests helpers for dealing with TLS certificates tests: check if qemu-nbd is still alive before waiting tests: pull qemu-nbd iotest helpers into common.nbd file io: return 0 for EOF in TLS session read after shutdown nbd/server: Ignore write errors when replying to NBD_OPT_ABORT nbd: fix whitespace in server error message qemu-iotests: Modern shell scripting (use $() instead of ``) qemu-iotests: convert `pwd` and $(pwd) to $PWD qemu-iotests: remove unused variable 'here' Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19iotests: Drop use of bash keyword 'function'Eric Blake
Bash allows functions to be declared with or without the leading keyword 'function'; but including the keyword does not comply with POSIX syntax, and is confusing to ksh users where the use of the keyword changes the scoping rules for functions. Stick to the POSIX form through iotests. Done mechanically with: sed -i 's/^function //' $(git ls-files tests/qemu-iotests) Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181116215002.2124581-1-eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-19iotests: Also test I/O over NBD TLSEric Blake
Enhance test 233 to also perform I/O beyond the initial handshake. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181118022403.2211483-1-eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2018-11-19tests: exercise NBD server in TLS modeDaniel P. Berrangé
Add tests that validate it is possible to connect to an NBD server running TLS mode. Also test mis-matched TLS vs non-TLS connections correctly fail. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-7-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: Eric Blake <eblake@redhat.com> [eblake: rebase to iotests shell cleanups, use ss instead of socat for port probing, sanitize port number in expected output] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19tests: add iotests helpers for dealing with TLS certificatesDaniel P. Berrangé
Add helpers to common.tls for creating TLS certificates for a CA, server and client. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-6-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: spelling and quoting touchups] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19tests: check if qemu-nbd is still alive before waitingDaniel P. Berrangé
If the qemu-nbd UNIX socket has not shown up, the tests will sleep a bit and then check again repeatedly for up to 30 seconds. This is pointless if the qemu-nbd process has quit due to an error, so check whether the pid is still alive before waiting and retrying. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-5-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19tests: pull qemu-nbd iotest helpers into common.nbd fileDaniel P. Berrangé
The helpers for starting/stopping qemu-nbd in 058 will be useful in other test cases, so move them into a common.nbd file. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-4-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: fix shell quoting] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19io: return 0 for EOF in TLS session read after shutdownDaniel P. Berrangé
GNUTLS takes a paranoid approach when seeing 0 bytes returned by the underlying OS read() function. It will consider this an error and return GNUTLS_E_PREMATURE_TERMINATION instead of propagating the 0 return value. It expects apps to arrange for clean termination at the protocol level and not rely on seeing EOF from a read call to detect shutdown. This is to harden apps against a malicious 3rd party causing termination of the sockets layer. This is unhelpful for the QEMU NBD code which does have a clean protocol level shutdown, but still relies on seeing 0 from the I/O channel read in the coroutine handling incoming replies. The upshot is that when using a plain NBD connection shutdown is silent, but when using TLS, the client spams the console with Cannot read from TLS channel: Broken pipe The NBD connection has, however, called qio_channel_shutdown() at this point to indicate that it is done with I/O. This gives the opportunity to optimize the code such that when the channel has been shutdown in the read direction, the error code GNUTLS_E_PREMATURE_TERMINATION gets turned into a '0' return instead of an error. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20181119134228.11031-1-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19nbd/server: Ignore write errors when replying to NBD_OPT_ABORTEric Blake
Commit 37ec36f6 intentionally ignores errors when trying to reply to an NBD_OPT_ABORT request for plaintext clients, but did not make the same change for a TLS server. Since NBD_OPT_ABORT is documented as being a potential for an EPIPE when the client hangs up without waiting for our reply, we don't need to pollute the server's output with that failure. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181117223221.2198751-1-eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2018-11-19nbd: fix whitespace in server error messageDaniel P. Berrangé
A space was missing after the option number was printed: Option 0x8not permitted before TLS becomes Option 0x8 not permitted before TLS This fixes commit 3668328303429f3bc93ab3365c66331600b06a2d Author: Eric Blake <eblake@redhat.com> Date: Fri Oct 14 13:33:09 2016 -0500 nbd: Send message along with server NBD_REP_ERR errors Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-2-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: move lone space to next line] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19qemu-iotests: Modern shell scripting (use $() instead of ``)Mao Zhongyi
Various shell files contain a mix between obsolete `` and modern $(); It would be nice to convert to using $() everywhere. For now, just do the qemu-iotests directory. Cc: kwolf@redhat.com Cc: mreitz@redhat.com Cc: eblake@redhat.com Suggested-by: Eric Blake <eblake@redhat.com> Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com> Message-Id: <20181024094051.4470-4-maozhongyi@cmss.chinamobile.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: tweak commit message] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19qemu-iotests: convert `pwd` and $(pwd) to $PWDMao Zhongyi
POSIX requires $PWD to be reliable, and we expect all shells used by qemu scripts to be relatively close to POSIX. Thus, it is smarter to avoid forking the pwd executable for something that is already available in the environment. So replace it with the following: sed -i 's/\(`pwd`\|\$(pwd)\)/$PWD/g' $(git grep -l pwd) Then delete a pointless line assigning PWD to itself. Cc: kwolf@redhat.com Cc: mreitz@redhat.com Cc: eblake@redhat.com Suggested-by: Eric Blake <eblake@redhat.com> Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com> Message-Id: <20181024094051.4470-2-maozhongyi@cmss.chinamobile.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: touch up commit message, reorder series, tweak a couple more files] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19qemu-iotests: remove unused variable 'here'Mao Zhongyi
Running git grep '\$here' tests/qemu-iotests has 0 hits, which means we are setting a variable that has no use. It appears that commit e8f8624d removed the last use. So execute the following cmd to remove all of the 'here=...' lines as dead code. sed -i '/^here=/d' $(git grep -l '^here=' tests/qemu-iotests) Cc: kwolf@redhat.com Cc: mreitz@redhat.com Cc: eblake@redhat.com Suggested-by: Eric Blake <eblake@redhat.com> Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com> Message-Id: <20181024094051.4470-3-maozhongyi@cmss.chinamobile.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: touch up commit message, reorder series, rebase to master] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-11-19Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20181119' into staging target-arm queue: * various MAINTAINERS file updates * hw/block/onenand: use qemu_log_mask() for reporting * hw/block/onenand: Fix off-by-one error allowing out-of-bounds read on the n800 and n810 machine models * target/arm: fix smc incorrectly trapping to EL3 when secure is off * hw/arm/stm32f205: Fix the UART and Timer region size * target/arm: read ID registers for KVM guests so they can be used to gate "is feature X present" checks # gpg: Signature made Mon 19 Nov 2018 15:56:44 GMT # gpg: using RSA key 3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20181119: MAINTAINERS: list myself as maintainer for various Arm boards hw/block/onenand: use qemu_log_mask() for reporting hw/block/onenand: Fix off-by-one error allowing out-of-bounds read target/arm: fix smc incorrectly trapping to EL3 when secure is off hw/arm/stm32f205: Fix the UART and Timer region size MAINTAINERS: Add entries for missing ARM boards target/arm: Fill in ARMISARegisters for kvm32 target/arm: Introduce read_sys_reg32 for kvm32 target/arm: Fill in ARMISARegisters for kvm64 target/arm: Install ARMISARegisters from kvm host Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19MAINTAINERS: list myself as maintainer for various Arm boardsPeter Maydell
In practice for most of the more-or-less orphan Arm board models, I will review patches and put them in via the target-arm tree. So list myself as an "Odd Fixes" status maintainer for them. This commit downgrades these boards to "Odd Fixes": * Allwinner-A10 * Exynos * Calxeda Highbank * Canon DIGIC * Musicpal * nSeries * Palm * PXA2xx These boards were already "Odd Fixes": * Gumstix * i.MX31 (kzm) Philippe Mathieu-Daudé has requested to be moved to R: status for Gumstix now that I am listed as the M: contact. Some boards are maintained, but their patches still go via the target-arm tree, so add myself as a secondary maintainer contact for those: * Xilinx Zynq * Xilinx ZynqMP * STM32F205 * Netduino 2 * SmartFusion2 * Mecraft M2S-FG484 * ASPEED BMCs * NRF51 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20181108134139.31666-1-peter.maydell@linaro.org
2018-11-19hw/block/onenand: use qemu_log_mask() for reportingPeter Maydell
Update the onenand device to use qemu_log_mask() for reporting guest errors and unimplemented features, rather than plain fprintf() and hw_error(). (We leave the hw_error() in onenand_reset(), as that is triggered by a failure to read the underlying block device for the bootRAM, not by guest action.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181115143535.5885-3-peter.maydell@linaro.org
2018-11-19hw/block/onenand: Fix off-by-one error allowing out-of-bounds readPeter Maydell
An off-by-one error in a switch case in onenand_read() allowed a misbehaving guest to read off the end of a block of memory. NB: the onenand device is used only by the "n800" and "n810" machines, which are usable only with TCG, not KVM, so this is not a security issue. Reported-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20181115143535.5885-2-peter.maydell@linaro.org Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19target/arm: fix smc incorrectly trapping to EL3 when secure is offLuc Michel
This commit fixes a case where the CPU would try to go to EL3 when executing an smc instruction, even though ARM_FEATURE_EL3 is false. This case is raised when the PSCI conduit is set to smc, but the smc instruction does not lead to a valid PSCI call. QEMU crashes with an assertion failure latter on because of incoherent mmu_idx. This commit refactors the pre_smc helper by enumerating all the possible way of handling an scm instruction, and covering the previously missing case leading to the crash. The following minimal test would crash before this commit: .global _start .text _start: ldr x0, =0xdeadbeef ; invalid PSCI call smc #0 run with the following command line: aarch64-linux-gnu-gcc -nostdinc -nostdlib -Wl,-Ttext=40000000 \ -o test test.s qemu-system-aarch64 -M virt,virtualization=on,secure=off \ -cpu cortex-a57 -kernel test Signed-off-by: Luc Michel <luc.michel@greensocs.com> Message-id: 20181117160213.18995-1-luc.michel@greensocs.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19hw/arm/stm32f205: Fix the UART and Timer region sizeSeth Kintigh
The UART and timer devices for the stm32f205 were being created with memory regions that were too large. Use the size specified in the chip datasheet. The old sizes were so large that the devices would overlap with each other in the SoC memory map, so this fixes a bug that caused odd behavior and/or crashes when trying to set up multiple UARTs. Signed-off-by: Seth Kintigh <skintigh@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: rephrased commit message to follow our usual standard] Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19MAINTAINERS: Add entries for missing ARM boardsThomas Huth
Add entries for the boards "mcimx6ul-evk", "mcimx7d-sabre", "raspi2", "raspi3", "sabrelite", "vexpress-a15", "vexpress-a9" and "virt". While we're at it, also adjust the "i.MX31" section a little bit, so that the wildcards there do not match anymore for unrelated files (e.g. the new hw/misc/imx6ul_ccm.c file). Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1542184999-11145-1-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19target/arm: Fill in ARMISARegisters for kvm32Richard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181113180154.17903-5-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19target/arm: Introduce read_sys_reg32 for kvm32Richard Henderson
Assert that the value to be written is the correct size. No change in functionality here, just mirroring the same function from kvm64. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181113180154.17903-4-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19target/arm: Fill in ARMISARegisters for kvm64Richard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181113180154.17903-3-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19target/arm: Install ARMISARegisters from kvm hostRichard Henderson
The ID registers are replacing (some of) the feature bits. We need (some of) these values to determine the set of data to be handled during migration. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181113180154.17903-2-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches: - file-posix: Fix shared permission locks after reopen - block: Fix error path for failed .bdrv_reopen_prepare - qcow2: Catch invalid allocations when the image becomes too large - vvfat/fdc/nvme: Fix segfaults and leaks # gpg: Signature made Mon 19 Nov 2018 14:28:18 GMT # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: iotests: Test file-posix locking and reopen file-posix: Fix shared locks on reopen commit block: Always abort reopen after prepare succeeded iotests: Add new test 220 for max compressed cluster offset qcow2: Don't allow overflow during cluster allocation qcow2: Document some maximum size constraints vvfat: Fix memory leak fdc: fix segfault in fdctrl_stop_transfer() when DMA is disabled nvme: fix oob access issue(CVE-2018-16847) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-19iotests: Test file-posix locking and reopenMax Reitz
Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19file-posix: Fix shared locks on reopen commitMax Reitz
s->locked_shared_perm is the set of bits locked in the file, which is the inverse of the permissions actually shared. So we need to pass them as they are to raw_apply_lock_bytes() instead of inverting them again. Reported-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19block: Always abort reopen after prepare succeededMax Reitz
bdrv_reopen_multiple() does not invoke bdrv_reopen_abort() for the element of the reopen queue for which bdrv_reopen_prepare() failed, because it assumes that the prepare function will have rolled back all changes already. However, bdrv_reopen_prepare() does not do this in every case: It may notice an error after BlockDriver.bdrv_reopen_prepare() succeeded, and it will not invoke BlockDriver.bdrv_reopen_abort() then; and neither will bdrv_reopen_multiple(), as explained above. This is wrong because we must always call .bdrv_reopen_commit() or .bdrv_reopen_abort() after .bdrv_reopen_prepare() has succeeded. Otherwise, the block driver has no chance to undo what it has done in its implementation of .bdrv_reopen_prepare(). To fix this, bdrv_reopen_prepare() has to call .bdrv_reopen_abort() if it wants to return an error after .bdrv_reopen_prepare() has succeeded. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19iotests: Add new test 220 for max compressed cluster offsetEric Blake
If you have a capable file system (tmpfs is good, ext4 not so much; run ./check with TEST_DIR pointing to a good location so as not to skip the test), it's actually possible to create a qcow2 file that expands to a sparse 512T image with just over 38M of content. The test is not the world's fastest (qemu crawling through 256M bits of refcount table to find the next cluster to allocate takes several seconds, as does qemu-img check reporting millions of leaked clusters); but it DOES catch the problem that the previous patch just fixed where writing a compressed cluster to a full image ended up overwriting the wrong cluster. Suggested-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-19qcow2: Don't allow overflow during cluster allocationEric Blake
Our code was already checking that we did not attempt to allocate more clusters than what would fit in an INT64 (the physical maximimum if we can access a full off_t's worth of data). But this does not catch smaller limits enforced by various spots in the qcow2 image description: L1 and normal clusters of L2 are documented as having bits 63-56 reserved for other purposes, capping our maximum offset at 64PB (bit 55 is the maximum bit set). And for compressed images with 2M clusters, the cap drops the maximum offset to bit 48, or a maximum offset of 512TB. If we overflow that offset, we would write compressed data into one place, but try to decompress from another, which won't work. It's actually possible to prove that overflow can cause image corruption without this patch; I'll add the iotests separately in the next commit. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-16 20:35:55 +0000