qemu.git
3 years ago9p: fix QEMU crash when renaming files
Greg Kurz [Fri, 23 Nov 2018 12:28:03 +0000 (13:28 +0100)] 
9p: fix QEMU crash when renaming files

When using the 9P2000.u version of the protocol, the following shell
command line in the guest can cause QEMU to crash:

    while true; do rm -rf aa; mkdir -p a/b & touch a/b/c & mv a aa; done

With 9P2000.u, file renaming is handled by the WSTAT command. The
v9fs_wstat() function calls v9fs_complete_rename(), which calls
v9fs_fix_path() for every fid whose path is affected by the change.
The involved calls to v9fs_path_copy() may race with any other access
to the fid path performed by some worker thread, causing a crash like
shown below:

Thread 12 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8, path=0x0,
 flags=65536, mode=0) at hw/9pfs/9p-local.c:59
59          while (*path && fd != -1) {
(gdb) bt
#0  0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8,
 path=0x0, flags=65536, mode=0) at hw/9pfs/9p-local.c:59
#1  0x0000555555a25e0c in local_opendir_nofollow (fs_ctx=0x555557d958b8,
 path=0x0) at hw/9pfs/9p-local.c:92
#2  0x0000555555a261b8 in local_lstat (fs_ctx=0x555557d958b8,
 fs_path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/9p-local.c:185
#3  0x0000555555a2b367 in v9fs_co_lstat (pdu=0x555557d97498,
 path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/cofile.c:53
#4  0x0000555555a1e9e2 in v9fs_stat (opaque=0x555557d97498)
 at hw/9pfs/9p.c:1083
#5  0x0000555555e060a2 in coroutine_trampoline (i0=-669165424, i1=32767)
 at util/coroutine-ucontext.c:116
#6  0x00007fffef4f5600 in __start_context () at /lib64/libc.so.6
#7  0x0000000000000000 in  ()
(gdb)

The fix is to take the path write lock when calling v9fs_complete_rename(),
like in v9fs_rename().

Impact:  DoS triggered by unprivileged guest users.

Fixes: CVE-2018-19489
Cc: P J P <ppandit@redhat.com>
Reported-by: zhibin hu <noirfate@gmail.com>
Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Greg Kurz <groug@kaod.org>
3 years agoMerge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Peter Maydell [Fri, 23 Nov 2018 08:54:52 +0000 (08:54 +0000)] 
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches:

- block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options()
- block: Fix option inheritance after stream/commit job graph changes
- qemu-img: Fix memory leak and typo in error message
- nvme: Fixes for lockups and crashes
- scsi-disk: Fix crash if underlying host file or disk returns error
- Several qemu-iotests fixes and improvements

# gpg: Signature made Thu 22 Nov 2018 18:38:30 GMT
# gpg:                using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream:
  block: Update BlockDriverState.inherits_from on bdrv_drop_intermediate()
  block: Update BlockDriverState.inherits_from on bdrv_set_backing_hd()
  iotests: Enhance 223 to cover multiple bitmap granularities
  nvme: fix bug with PCI IRQ pins on teardown
  nvme: fix CMB endianness confusion
  Revert "nvme: fix oob access issue(CVE-2018-16847)"
  nvme: fix out-of-bounds access to the CMB
  nvme: call blk_drain in NVMe reset code to avoid lockups
  iotests: fix nbd test 233 to work correctly with raw images
  block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options()
  scsi-disk: Fix crash if underlying host file or disk returns error
  qemu-img: Fix leak
  qemu-img: Fix typo
  iotests: Skip 233 if certtool not installed
  iotests: Replace assertEquals() with assertEqual()
  iotests: Replace time.clock() with Timeout

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoblock: Update BlockDriverState.inherits_from on bdrv_drop_intermediate()
Alberto Garcia [Wed, 31 Oct 2018 16:16:38 +0000 (18:16 +0200)] 
block: Update BlockDriverState.inherits_from on bdrv_drop_intermediate()

The previous patch fixed the inherits_from pointer after block-stream,
and this one does the same for block-commit.

When block-commit finishes and the 'top' node is not the topmost one
from the backing chain then all nodes above 'base' up to and including
'top' are removed from the chain.

The bdrv_drop_intermediate() call converts a chain like this one:

    base <- intermediate <- top <- active

into this one:

    base <- active

In a simple scenario each backing file from the first chain has the
inherits_from attribute pointing to its parent. This means that
reopening 'active' will recursively reopen all its children, whose
options can be changed in the process.

However after the 'block-commit' call base.inherits_from is NULL and
the chain is broken, so 'base' does not inherit from 'active' and will
not be reopened automatically:

   $ qemu-img create -f qcow2 hd0.qcow2 1M
   $ qemu-img create -f qcow2 -b hd0.qcow2 hd1.qcow2
   $ qemu-img create -f qcow2 -b hd1.qcow2 hd2.qcow2
   $ $QEMU -drive if=none,file=hd2.qcow2

   { 'execute': 'block-commit',
     'arguments': {
       'device': 'none0',
       'top': 'hd1.qcow2' } }

   { 'execute': 'human-monitor-command',
     'arguments': {
        'command-line':
          'qemu-io none0 "reopen -o backing.l2-cache-size=2M"' } }

   { "return": "Cannot change the option 'backing.l2-cache-size'\r\n"}

This patch updates base.inherits_from in this scenario, and adds a
test case.

Signed-off-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agoblock: Update BlockDriverState.inherits_from on bdrv_set_backing_hd()
Alberto Garcia [Wed, 31 Oct 2018 16:16:37 +0000 (18:16 +0200)] 
block: Update BlockDriverState.inherits_from on bdrv_set_backing_hd()

When a BlockDriverState's child is opened (be it a backing file, the
protocol layer, or any other) inherits_from is set to point to the
parent node. Children opened separately and then attached to a parent
don't have this pointer set.

bdrv_reopen_queue_child() uses this to determine whether a node's
children must also be reopened inheriting the options from the parent
or not. If inherits_from points to the parent then the child is
reopened and its options can be changed, like in this example:

   $ qemu-img create -f qcow2 hd0.qcow2 1M
   $ qemu-img create -f qcow2 hd1.qcow2 1M
   $ $QEMU -drive if=none,node-name=hd0,file=hd0.qcow2,\
                  backing.driver=qcow2,backing.file.filename=hd1.qcow2
   (qemu) qemu-io hd0 "reopen -o backing.l2-cache-size=2M"

If the child does not inherit from the parent then it does not get
reopened and its options cannot be changed:

   $ $QEMU -drive if=none,node-name=hd1,file=hd1.qcow2
           -drive if=none,node-name=hd0,file=hd0.qcow2,backing=hd1
   (qemu) qemu-io hd0 "reopen -o backing.l2-cache-size=2M"
   Cannot change the option 'backing.l2-cache-size'

If a disk image has a chain of backing files then all of them are also
connected through their inherits_from pointers (i.e. it's possible to
walk the chain in reverse order from base to top).

However this is broken if the intermediate nodes are removed using
e.g. block-stream because the inherits_from pointer from the base node
becomes NULL:

   $ qemu-img create -f qcow2 hd0.qcow2 1M
   $ qemu-img create -f qcow2 -b hd0.qcow2 hd1.qcow2
   $ qemu-img create -f qcow2 -b hd1.qcow2 hd2.qcow2
   $ $QEMU -drive if=none,file=hd2.qcow2
   (qemu) qemu-io none0 "reopen -o backing.l2-cache-size=2M"
   (qemu) block_stream none0 0 hd0.qcow2
   (qemu) qemu-io none0 "reopen -o backing.l2-cache-size=2M"
   Cannot change the option 'backing.l2-cache-size'

This patch updates the inherits_from pointer if the intermediate nodes
of a backing chain are removed using bdrv_set_backing_hd(), and adds a
test case for this scenario.

Signed-off-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agoiotests: Enhance 223 to cover multiple bitmap granularities
Eric Blake [Mon, 19 Nov 2018 17:29:24 +0000 (11:29 -0600)] 
iotests: Enhance 223 to cover multiple bitmap granularities

Testing granularity at the same size as the cluster isn't quite
as fun as what happens when it is larger or smaller.  This
enhancement also shows that qemu's nbd server can serve the
same disk over multiple exports simultaneously.

Signed-off-by: Eric Blake <eblake@redhat.com>
Tested-by: John Snow <jsnow@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agonvme: fix bug with PCI IRQ pins on teardown
Logan Gunthorpe [Wed, 21 Nov 2018 18:10:13 +0000 (11:10 -0700)] 
nvme: fix bug with PCI IRQ pins on teardown

When the submission and completion queues are being torn down
the IRQ will be asserted for the completion queue when the
submsission queue is deleted. Then when the completion queue
is deleted it stays asserted. Thus, on systems that do
not use MSI, no further interrupts can be triggered on the host.

Linux sees this as a long delay when unbinding the nvme device.
Eventually the interrupt timeout occurs and it continues.

To fix this we ensure we deassert the IRQ for a CQ when it is
deleted.

Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agonvme: fix CMB endianness confusion
Paolo Bonzini [Thu, 22 Nov 2018 18:23:35 +0000 (19:23 +0100)] 
nvme: fix CMB endianness confusion

The CMB is marked as DEVICE_LITTLE_ENDIAN, so the data must be
read/written as if it was little-endian output (in the case of
big endian, we get two swaps, one in the memory core and one
in nvme.c).

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agoRevert "nvme: fix oob access issue(CVE-2018-16847)"
Kevin Wolf [Thu, 22 Nov 2018 14:52:20 +0000 (15:52 +0100)] 
Revert "nvme: fix oob access issue(CVE-2018-16847)"

This reverts commit 5e3c0220d7e4f0361c4d36c697a8842f2b583402.
We have a better fix commited for this now.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agonvme: fix out-of-bounds access to the CMB
Paolo Bonzini [Tue, 20 Nov 2018 18:41:48 +0000 (19:41 +0100)] 
nvme: fix out-of-bounds access to the CMB

Because the CMB BAR has a min_access_size of 2, if you read the last
byte it will try to memcpy *2* bytes from n->cmbuf, causing an off-by-one
error.  This is CVE-2018-16847.

Another way to fix this might be to register the CMB as a RAM memory
region, which would also be more efficient.  However, that might be a
change for big-endian machines; I didn't think this through and I don't
know how real hardware works.  Add a basic testcase for the CMB in case
somebody does this change later on.

Cc: Keith Busch <keith.busch@intel.com>
Cc: qemu-block@nongnu.org
Reported-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Tested-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agonvme: call blk_drain in NVMe reset code to avoid lockups
Igor Druzhinin [Tue, 6 Nov 2018 12:16:55 +0000 (12:16 +0000)] 
nvme: call blk_drain in NVMe reset code to avoid lockups

When blk_flush called in NVMe reset path S/C queues are already freed
which means that re-entering AIO handling loop having some IO requests
unfinished will lockup or crash as their SG structures being potentially
reused. Call blk_drain before freeing the queues to avoid this nasty
scenario.

Signed-off-by: Igor Druzhinin <igor.druzhinin@citrix.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agoiotests: fix nbd test 233 to work correctly with raw images
Daniel P. Berrangé [Tue, 20 Nov 2018 17:56:46 +0000 (17:56 +0000)] 
iotests: fix nbd test 233 to work correctly with raw images

The first qemu-io command must honour the $IMGFMT that is set rather
than hardcoding qcow2. The qemu-nbd commands should also set $IMGFMT
to avoid the insecure format probe warning.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agoblock: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options()
Alberto Garcia [Mon, 12 Nov 2018 14:00:48 +0000 (16:00 +0200)] 
block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options()

Commit e35bdc123a4ace9f4d3fcca added the auto-read-only option and the
code to update its corresponding flag in update_flags_from_options(),
but forgot to clear the flag if auto-read-only is false.

Signed-off-by: Alberto Garcia <berto@igalia.com>
Reported-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agoscsi-disk: Fix crash if underlying host file or disk returns error
Richard W.M. Jones [Wed, 21 Nov 2018 12:47:47 +0000 (12:47 +0000)] 
scsi-disk: Fix crash if underlying host file or disk returns error

Commit 40dce4ee6 "scsi-disk: fix rerror/werror=ignore" introduced a
bug which causes qemu to crash with the assertion error below if the
host file or disk returns an error:

  qemu-system-x86_64: hw/scsi/scsi-bus.c:1374: scsi_req_complete:
  Assertion `req->status == -1' failed.

Kevin Wolf suggested this fix:

  < kwolf> Hm, should the final return false; in that patch
           actually be a return true?
  < kwolf> Because I think he didn't intend to change anything
           except BLOCK_ERROR_ACTION_IGNORE

Buglink: https://bugs.launchpad.net/qemu/+bug/1804323
Fixes: 40dce4ee61c68395f6d463fae792f61b7c003bce
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agoMerge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20181121a' into...
Peter Maydell [Thu, 22 Nov 2018 13:45:06 +0000 (13:45 +0000)] 
Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20181121a' into staging

Migration fixes 2018-11-21

Notably the fix for building with --disable-replication

# gpg: Signature made Wed 21 Nov 2018 13:03:20 GMT
# gpg:                using RSA key 0516331EBC5BFDE7
# gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>"
# Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A  9FA9 0516 331E BC5B FDE7

* remotes/dgilbert/tags/pull-migration-20181121a:
  migration/migration.c: Add COLO dependency checks
  migration/colo.c: Fix compilation issue when disable replication

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoqemu-img: Fix leak
Max Reitz [Mon, 19 Nov 2018 10:19:21 +0000 (11:19 +0100)] 
qemu-img: Fix leak

create_opts was leaked here.  This is not too bad since the process is
about to exit anyway, but relying on that does not make the code nicer
to read.

Fixes: d402b6a21a825a5c07aac9251990860723d49f5d
Reported-by: Kevin Wolf <kwolf@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agoqemu-img: Fix typo
Max Reitz [Mon, 19 Nov 2018 10:19:20 +0000 (11:19 +0100)] 
qemu-img: Fix typo

Fixes: d402b6a21a825a5c07aac9251990860723d49f5d
Reported-by: Kevin Wolf <kwolf@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agoiotests: Skip 233 if certtool not installed
Eric Blake [Tue, 20 Nov 2018 22:52:41 +0000 (16:52 -0600)] 
iotests: Skip 233 if certtool not installed

The use of TLS while building qemu is optional. While the
'certtool' binary should be available on every platform that
supports building against TLS, that does not imply that the
developer has installed it.  Make the test gracefully skip
in that case.

Reported-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agomigration/migration.c: Add COLO dependency checks
Zhang Chen [Wed, 14 Nov 2018 19:09:12 +0000 (03:09 +0800)] 
migration/migration.c: Add COLO dependency checks

Current COLO mode(independent disk mode) need replication module work
together. Suggested by Dr. David Alan Gilbert <dgilbert@redhat.com>.

Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Message-Id: <20181114190912.7242-1-chen.zhang@intel.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
3 years agomigration/colo.c: Fix compilation issue when disable replication
Zhang Chen [Thu, 1 Nov 2018 02:12:26 +0000 (10:12 +0800)] 
migration/colo.c: Fix compilation issue when disable replication

This compilation issue will occur when user use --disable-replication
to config Qemu.

Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Zhang Chen <zhangckid@gmail.com>
Message-Id: <20181101021226.6353-1-zhangckid@gmail.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
3 years agoiotests: Replace assertEquals() with assertEqual()
Kevin Wolf [Tue, 20 Nov 2018 17:12:21 +0000 (18:12 +0100)] 
iotests: Replace assertEquals() with assertEqual()

TestCase.assertEquals() is deprecated since Python 2.7. Recent Python
versions print a warning when the function is called, which makes test
cases fail.

Replace it with the preferred spelling assertEqual().

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
3 years agoiotests: Replace time.clock() with Timeout
Kevin Wolf [Tue, 20 Nov 2018 17:09:49 +0000 (18:09 +0100)] 
iotests: Replace time.clock() with Timeout

time.clock() is deprecated since Python 3.3. Current Python versions
warn that the function will be removed in Python 3.8, and those warnings
make the test case 118 fail.

Replace it with the Timeout mechanism that is compatible with both
Python 2 and 3, and makes the code even a little nicer.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
3 years agoUpdate version for v3.1.0-rc2 release v3.1.0-rc2
Peter Maydell [Tue, 20 Nov 2018 18:10:26 +0000 (18:10 +0000)] 
Update version for v3.1.0-rc2 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoMerge remote-tracking branch 'remotes/ehabkost/tags/x86-for-3.1-pull-request' into...
Peter Maydell [Tue, 20 Nov 2018 14:11:00 +0000 (14:11 +0000)] 
Merge remote-tracking branch 'remotes/ehabkost/tags/x86-for-3.1-pull-request' into staging

pc-*-3.1 machine-types

# gpg: Signature made Tue 20 Nov 2018 13:43:24 GMT
# gpg:                using RSA key 2807936F984DC5A6
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* remotes/ehabkost/tags/x86-for-3.1-pull-request:
  hw/i386: add pc-i440fx-3.1 & pc-q35-3.1

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agohw/i386: add pc-i440fx-3.1 & pc-q35-3.1
Marc-André Lureau [Tue, 20 Nov 2018 13:26:04 +0000 (17:26 +0400)] 
hw/i386: add pc-i440fx-3.1 & pc-q35-3.1

We have a couple of PC_COMPAT_3_0, so we should have 3.1 PC machines,
and update the 3.0 machines to make use of those.

Fixes a "Known issue" from https://wiki.qemu.org/Planning/3.1.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20181120132604.22854-1-marcandre.lureau@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
3 years agoMerge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging
Peter Maydell [Tue, 20 Nov 2018 12:24:09 +0000 (12:24 +0000)] 
Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging

Fixes yet another use-after-free issue that could be triggered by a
misbehaving guest. This is a follow-up to commit:

commit 5b76ef50f62079a2389ba28cacaf6cce68b1a0ed
Author: Greg Kurz <groug@kaod.org>
Date:   Wed Nov 7 01:00:04 2018 +0100

    9p: write lock path in v9fs_co_open2()

# gpg: Signature made Tue 20 Nov 2018 12:01:07 GMT
# gpg:                using RSA key 71D4D5E5822F73D6
# gpg: Good signature from "Greg Kurz <groug@kaod.org>"
# gpg:                 aka "Gregory Kurz <gregory.kurz@free.fr>"
# gpg:                 aka "[jpeg image of size 3330]"
# Primary key fingerprint: B482 8BAF 9431 40CE F2A3  4910 71D4 D5E5 822F 73D6

* remotes/gkurz/tags/for-upstream:
  9p: take write lock on fid path updates (CVE-2018-19364)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years ago9p: take write lock on fid path updates (CVE-2018-19364)
Greg Kurz [Tue, 20 Nov 2018 12:00:35 +0000 (13:00 +0100)] 
9p: take write lock on fid path updates (CVE-2018-19364)

Recent commit 5b76ef50f62079a fixed a race where v9fs_co_open2() could
possibly overwrite a fid path with v9fs_path_copy() while it is being
accessed by some other thread, ie, use-after-free that can be detected
by ASAN with a custom 9p client.

It turns out that the same can happen at several locations where
v9fs_path_copy() is used to set the fid path. The fix is again to
take the write lock.

Fixes CVE-2018-19364.

Cc: P J P <ppandit@redhat.com>
Reported-by: zhibin hu <noirfate@gmail.com>
Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Greg Kurz <groug@kaod.org>
3 years agoMerge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2018-11-20' into...
Peter Maydell [Tue, 20 Nov 2018 10:56:57 +0000 (10:56 +0000)] 
Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2018-11-20' into staging

- One additional simple qmp-test
- A fix for ide-test
- Add logging of QEMU parameters in libqtest

# gpg: Signature made Tue 20 Nov 2018 10:47:12 GMT
# gpg:                using RSA key 2ED9D774FE702DB5
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>"
# gpg:                 aka "Thomas Huth <thuth@redhat.com>"
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>"
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>"
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* remotes/huth-gitlab/tags/pull-request-2018-11-20:
  qtest: log QEMU command line
  tests/ide: Free pcibus when finishing a test
  tests: add qmp/missing-any-arg test

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoMerge remote-tracking branch 'remotes/kraxel/tags/seabios-1.12-20181120-pull-request...
Peter Maydell [Tue, 20 Nov 2018 10:20:37 +0000 (10:20 +0000)] 
Merge remote-tracking branch 'remotes/kraxel/tags/seabios-1.12-20181120-pull-request' into staging

seabios: update to 1.12-final

# gpg: Signature made Tue 20 Nov 2018 06:01:21 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/seabios-1.12-20181120-pull-request:
  update seabios to 1.12

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoqtest: log QEMU command line
Paolo Bonzini [Thu, 15 Nov 2018 12:29:30 +0000 (13:29 +0100)] 
qtest: log QEMU command line

Record the command line that was used to start QEMU.  This can be
useful for debugging.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
[thuth: removed trailing \n from the message string]
Signed-off-by: Thomas Huth <thuth@redhat.com>
3 years agoupdate seabios to 1.12
Gerd Hoffmann [Tue, 20 Nov 2018 05:57:48 +0000 (06:57 +0100)] 
update seabios to 1.12

Seabios 1.12 has been released yesterday.  Update
our snapshot builds to the final release.

git shortlog
============

Kevin O'Connor (2):
      shadow: Rework bios copy code to prevent gcc array-bounds warning
      docs: Note v1.12.0 release

Shmuel Eiderman (1):
      pvscsi: Scan all 64 possible targets

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
3 years agotests/ide: Free pcibus when finishing a test
Thomas Huth [Tue, 13 Nov 2018 15:03:21 +0000 (16:03 +0100)] 
tests/ide: Free pcibus when finishing a test

Once a test has finished, the pcibus structure should be freed, to
avoid leaking memory and to make sure that the structure is properly
re-initialized when the next test starts.

Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
3 years agotests: add qmp/missing-any-arg test
Marc-André Lureau [Mon, 29 Oct 2018 14:57:09 +0000 (18:57 +0400)] 
tests: add qmp/missing-any-arg test

test_qmp_missing_any_arg() is about a bug in infrastructure used by
the QMP core, fixed in commit c489780203.  We covered the bug in
infrastructure unit tests (commit bce3035a44).  Let's test
it at the QMP level as well.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[thuth: Tweaked the commit message according to Markus' suggestion]
Signed-off-by: Thomas Huth <thuth@redhat.com>
3 years agoMerge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-11-19' into staging
Peter Maydell [Mon, 19 Nov 2018 18:11:10 +0000 (18:11 +0000)] 
Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-11-19' into staging

nbd patches for 2018-11-19

Add iotest coverage for NBD connections using TLS, including
a couple of code fixes that it pointed out

- Mao Zhongyi: 0/3 Do some cleaning work in qemu-iotests
- Daniel P. Berrangé: io: return 0 for EOF in TLS session read after shutdown
- Daniel P. Berrangé: 0/6 Misc fixes to NBD
- Eric Blake: iotests: Drop use of bash keyword 'function'

# gpg: Signature made Mon 19 Nov 2018 17:43:32 GMT
# gpg:                using RSA key A7A16B4A2527436A
# gpg: Good signature from "Eric Blake <eblake@redhat.com>"
# gpg:                 aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>"
# gpg:                 aka "[jpeg image of size 6874]"
# Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2  F3AA A7A1 6B4A 2527 436A

* remotes/ericb/tags/pull-nbd-2018-11-19:
  iotests: Drop use of bash keyword 'function'
  iotests: Also test I/O over NBD TLS
  tests: exercise NBD server in TLS mode
  tests: add iotests helpers for dealing with TLS certificates
  tests: check if qemu-nbd is still alive before waiting
  tests: pull qemu-nbd iotest helpers into common.nbd file
  io: return 0 for EOF in TLS session read after shutdown
  nbd/server: Ignore write errors when replying to NBD_OPT_ABORT
  nbd: fix whitespace in server error message
  qemu-iotests: Modern shell scripting (use $() instead of ``)
  qemu-iotests: convert `pwd` and $(pwd) to $PWD
  qemu-iotests: remove unused variable 'here'

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoiotests: Drop use of bash keyword 'function'
Eric Blake [Fri, 16 Nov 2018 21:50:02 +0000 (15:50 -0600)] 
iotests: Drop use of bash keyword 'function'

Bash allows functions to be declared with or without the leading
keyword 'function'; but including the keyword does not comply with
POSIX syntax, and is confusing to ksh users where the use of the
keyword changes the scoping rules for functions.  Stick to the
POSIX form through iotests.

Done mechanically with:
  sed -i 's/^function //' $(git ls-files tests/qemu-iotests)

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20181116215002.2124581-1-eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
3 years agoiotests: Also test I/O over NBD TLS
Eric Blake [Sun, 18 Nov 2018 02:24:03 +0000 (20:24 -0600)] 
iotests: Also test I/O over NBD TLS

Enhance test 233 to also perform I/O beyond the initial handshake.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20181118022403.2211483-1-eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
3 years agotests: exercise NBD server in TLS mode
Daniel P. Berrangé [Fri, 16 Nov 2018 15:53:25 +0000 (15:53 +0000)] 
tests: exercise NBD server in TLS mode

Add tests that validate it is possible to connect to an NBD server
running TLS mode. Also test mis-matched TLS vs non-TLS connections
correctly fail.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20181116155325.22428-7-berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Tested-by: Eric Blake <eblake@redhat.com>
[eblake: rebase to iotests shell cleanups, use ss instead of socat for
port probing, sanitize port number in expected output]
Signed-off-by: Eric Blake <eblake@redhat.com>
3 years agotests: add iotests helpers for dealing with TLS certificates
Daniel P. Berrangé [Fri, 16 Nov 2018 15:53:24 +0000 (15:53 +0000)] 
tests: add iotests helpers for dealing with TLS certificates

Add helpers to common.tls for creating TLS certificates for a CA,
server and client.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20181116155325.22428-6-berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: spelling and quoting touchups]
Signed-off-by: Eric Blake <eblake@redhat.com>
3 years agotests: check if qemu-nbd is still alive before waiting
Daniel P. Berrangé [Fri, 16 Nov 2018 15:53:23 +0000 (15:53 +0000)] 
tests: check if qemu-nbd is still alive before waiting

If the qemu-nbd UNIX socket has not shown up, the tests will sleep a bit
and then check again repeatedly for up to 30 seconds. This is pointless
if the qemu-nbd process has quit due to an error, so check whether the
pid is still alive before waiting and retrying.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20181116155325.22428-5-berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
3 years agotests: pull qemu-nbd iotest helpers into common.nbd file
Daniel P. Berrangé [Fri, 16 Nov 2018 15:53:22 +0000 (15:53 +0000)] 
tests: pull qemu-nbd iotest helpers into common.nbd file

The helpers for starting/stopping qemu-nbd in 058 will be useful in
other test cases, so move them into a common.nbd file.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20181116155325.22428-4-berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: fix shell quoting]
Signed-off-by: Eric Blake <eblake@redhat.com>
3 years agoio: return 0 for EOF in TLS session read after shutdown
Daniel P. Berrangé [Mon, 19 Nov 2018 13:42:28 +0000 (13:42 +0000)] 
io: return 0 for EOF in TLS session read after shutdown

GNUTLS takes a paranoid approach when seeing 0 bytes returned by the
underlying OS read() function. It will consider this an error and
return GNUTLS_E_PREMATURE_TERMINATION instead of propagating the 0
return value. It expects apps to arrange for clean termination at
the protocol level and not rely on seeing EOF from a read call to
detect shutdown. This is to harden apps against a malicious 3rd party
causing termination of the sockets layer.

This is unhelpful for the QEMU NBD code which does have a clean
protocol level shutdown, but still relies on seeing 0 from the I/O
channel read in the coroutine handling incoming replies.

The upshot is that when using a plain NBD connection shutdown is
silent, but when using TLS, the client spams the console with

  Cannot read from TLS channel: Broken pipe

The NBD connection has, however, called qio_channel_shutdown()
at this point to indicate that it is done with I/O. This gives
the opportunity to optimize the code such that when the channel
has been shutdown in the read direction, the error code
GNUTLS_E_PREMATURE_TERMINATION gets turned into a '0' return
instead of an error.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20181119134228.11031-1-berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
3 years agonbd/server: Ignore write errors when replying to NBD_OPT_ABORT
Eric Blake [Sat, 17 Nov 2018 22:32:21 +0000 (16:32 -0600)] 
nbd/server: Ignore write errors when replying to NBD_OPT_ABORT

Commit 37ec36f6 intentionally ignores errors when trying to reply
to an NBD_OPT_ABORT request for plaintext clients, but did not make
the same change for a TLS server.  Since NBD_OPT_ABORT is
documented as being a potential for an EPIPE when the client hangs
up without waiting for our reply, we don't need to pollute the
server's output with that failure.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20181117223221.2198751-1-eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
3 years agonbd: fix whitespace in server error message
Daniel P. Berrangé [Fri, 16 Nov 2018 15:53:20 +0000 (15:53 +0000)] 
nbd: fix whitespace in server error message

A space was missing after the option number was printed:

  Option 0x8not permitted before TLS

becomes

  Option 0x8 not permitted before TLS

This fixes

  commit 3668328303429f3bc93ab3365c66331600b06a2d
  Author: Eric Blake <eblake@redhat.com>
  Date:   Fri Oct 14 13:33:09 2016 -0500

    nbd: Send message along with server NBD_REP_ERR errors

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20181116155325.22428-2-berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: move lone space to next line]
Signed-off-by: Eric Blake <eblake@redhat.com>
3 years agoqemu-iotests: Modern shell scripting (use $() instead of ``)
Mao Zhongyi [Wed, 24 Oct 2018 09:40:51 +0000 (17:40 +0800)] 
qemu-iotests: Modern shell scripting (use $() instead of ``)

Various shell files contain a mix between obsolete ``
and modern $(); It would be nice to convert to using
$() everywhere.  For now, just do the qemu-iotests directory.

Cc: kwolf@redhat.com
Cc: mreitz@redhat.com
Cc: eblake@redhat.com
Suggested-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Message-Id: <20181024094051.4470-4-maozhongyi@cmss.chinamobile.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: tweak commit message]
Signed-off-by: Eric Blake <eblake@redhat.com>
3 years agoqemu-iotests: convert `pwd` and $(pwd) to $PWD
Mao Zhongyi [Fri, 16 Nov 2018 20:33:03 +0000 (14:33 -0600)] 
qemu-iotests: convert `pwd` and $(pwd) to $PWD

POSIX requires $PWD to be reliable, and we expect all
shells used by qemu scripts to be relatively close to
POSIX.  Thus, it is smarter to avoid forking the pwd
executable for something that is already available in
the environment.

So replace it with the following:

sed -i 's/\(`pwd`\|\$(pwd)\)/$PWD/g' $(git grep -l pwd)

Then delete a pointless line assigning PWD to itself.

Cc: kwolf@redhat.com
Cc: mreitz@redhat.com
Cc: eblake@redhat.com
Suggested-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Message-Id: <20181024094051.4470-2-maozhongyi@cmss.chinamobile.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: touch up commit message, reorder series, tweak a couple more files]
Signed-off-by: Eric Blake <eblake@redhat.com>
3 years agoqemu-iotests: remove unused variable 'here'
Mao Zhongyi [Wed, 24 Oct 2018 09:40:50 +0000 (17:40 +0800)] 
qemu-iotests: remove unused variable 'here'

Running
git grep '\$here' tests/qemu-iotests

has 0 hits, which means we are setting a variable that has
no use.  It appears that commit e8f8624d removed the last
use.  So execute the following cmd to remove all of
the 'here=...' lines as dead code.

sed -i '/^here=/d' $(git grep -l '^here=' tests/qemu-iotests)

Cc: kwolf@redhat.com
Cc: mreitz@redhat.com
Cc: eblake@redhat.com
Suggested-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Message-Id: <20181024094051.4470-3-maozhongyi@cmss.chinamobile.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: touch up commit message, reorder series, rebase to master]
Signed-off-by: Eric Blake <eblake@redhat.com>
3 years agoMerge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20181119' into...
Peter Maydell [Mon, 19 Nov 2018 15:58:17 +0000 (15:58 +0000)] 
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20181119' into staging

target-arm queue:
 * various MAINTAINERS file updates
 * hw/block/onenand: use qemu_log_mask() for reporting
 * hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
   on the n800 and n810 machine models
 * target/arm: fix smc incorrectly trapping to EL3 when secure is off
 * hw/arm/stm32f205: Fix the UART and Timer region size
 * target/arm: read ID registers for KVM guests so they can be
   used to gate "is feature X present" checks

# gpg: Signature made Mon 19 Nov 2018 15:56:44 GMT
# gpg:                using RSA key 3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>"
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20181119:
  MAINTAINERS: list myself as maintainer for various Arm boards
  hw/block/onenand: use qemu_log_mask() for reporting
  hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
  target/arm: fix smc incorrectly trapping to EL3 when secure is off
  hw/arm/stm32f205: Fix the UART and Timer region size
  MAINTAINERS: Add entries for missing ARM boards
  target/arm: Fill in ARMISARegisters for kvm32
  target/arm: Introduce read_sys_reg32 for kvm32
  target/arm: Fill in ARMISARegisters for kvm64
  target/arm: Install ARMISARegisters from kvm host

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoMAINTAINERS: list myself as maintainer for various Arm boards
Peter Maydell [Mon, 19 Nov 2018 15:29:08 +0000 (15:29 +0000)] 
MAINTAINERS: list myself as maintainer for various Arm boards

In practice for most of the more-or-less orphan Arm board models,
I will review patches and put them in via the target-arm tree.
So list myself as an "Odd Fixes" status maintainer for them.

This commit downgrades these boards to "Odd Fixes":
 * Allwinner-A10
 * Exynos
 * Calxeda Highbank
 * Canon DIGIC
 * Musicpal
 * nSeries
 * Palm
 * PXA2xx

These boards were already "Odd Fixes":
 * Gumstix
 * i.MX31 (kzm)

Philippe Mathieu-Daudé has requested to be moved to R:
status for Gumstix now that I am listed as the M: contact.

Some boards are maintained, but their patches still go
via the target-arm tree, so add myself as a secondary
maintainer contact for those:
 * Xilinx Zynq
 * Xilinx ZynqMP
 * STM32F205
 * Netduino 2
 * SmartFusion2
 * Mecraft M2S-FG484
 * ASPEED BMCs
 * NRF51

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20181108134139.31666-1-peter.maydell@linaro.org

3 years agohw/block/onenand: use qemu_log_mask() for reporting
Peter Maydell [Mon, 19 Nov 2018 15:29:08 +0000 (15:29 +0000)] 
hw/block/onenand: use qemu_log_mask() for reporting

Update the onenand device to use qemu_log_mask() for reporting
guest errors and unimplemented features, rather than plain
fprintf() and hw_error().

(We leave the hw_error() in onenand_reset(), as that is
triggered by a failure to read the underlying block device
for the bootRAM, not by guest action.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20181115143535.5885-3-peter.maydell@linaro.org

3 years agohw/block/onenand: Fix off-by-one error allowing out-of-bounds read
Peter Maydell [Mon, 19 Nov 2018 15:29:08 +0000 (15:29 +0000)] 
hw/block/onenand: Fix off-by-one error allowing out-of-bounds read

An off-by-one error in a switch case in onenand_read() allowed
a misbehaving guest to read off the end of a block of memory.

NB: the onenand device is used only by the "n800" and "n810"
machines, which are usable only with TCG, not KVM, so this is
not a security issue.

Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20181115143535.5885-2-peter.maydell@linaro.org
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agotarget/arm: fix smc incorrectly trapping to EL3 when secure is off
Luc Michel [Mon, 19 Nov 2018 15:29:08 +0000 (15:29 +0000)] 
target/arm: fix smc incorrectly trapping to EL3 when secure is off

This commit fixes a case where the CPU would try to go to EL3 when
executing an smc instruction, even though ARM_FEATURE_EL3 is false. This
case is raised when the PSCI conduit is set to smc, but the smc
instruction does not lead to a valid PSCI call.

QEMU crashes with an assertion failure latter on because of incoherent
mmu_idx.

This commit refactors the pre_smc helper by enumerating all the possible
way of handling an scm instruction, and covering the previously missing
case leading to the crash.

The following minimal test would crash before this commit:

.global _start
    .text
_start:
    ldr x0, =0xdeadbeef  ; invalid PSCI call
    smc #0

run with the following command line:

aarch64-linux-gnu-gcc -nostdinc -nostdlib -Wl,-Ttext=40000000 \
                      -o test test.s

qemu-system-aarch64 -M virt,virtualization=on,secure=off \
                    -cpu cortex-a57 -kernel test

Signed-off-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20181117160213.18995-1-luc.michel@greensocs.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agohw/arm/stm32f205: Fix the UART and Timer region size
Seth Kintigh [Mon, 19 Nov 2018 15:29:08 +0000 (15:29 +0000)] 
hw/arm/stm32f205: Fix the UART and Timer region size

The UART and timer devices for the stm32f205 were being created
with memory regions that were too large. Use the size specified
in the chip datasheet.

The old sizes were so large that the devices would overlap with
each other in the SoC memory map, so this fixes a bug that
caused odd behavior and/or crashes when trying to set up multiple
UARTs.

Signed-off-by: Seth Kintigh <skintigh@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: rephrased commit message to follow our usual standard]
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoMAINTAINERS: Add entries for missing ARM boards
Thomas Huth [Mon, 19 Nov 2018 15:29:08 +0000 (15:29 +0000)] 
MAINTAINERS: Add entries for missing ARM boards

Add entries for the boards "mcimx6ul-evk", "mcimx7d-sabre", "raspi2",
"raspi3", "sabrelite", "vexpress-a15", "vexpress-a9" and "virt".
While we're at it, also adjust the "i.MX31" section a little bit,
so that the wildcards there do not match anymore for unrelated files
(e.g. the new hw/misc/imx6ul_ccm.c file).

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1542184999-11145-1-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agotarget/arm: Fill in ARMISARegisters for kvm32
Richard Henderson [Mon, 19 Nov 2018 15:29:08 +0000 (15:29 +0000)] 
target/arm: Fill in ARMISARegisters for kvm32

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-5-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agotarget/arm: Introduce read_sys_reg32 for kvm32
Richard Henderson [Mon, 19 Nov 2018 15:29:07 +0000 (15:29 +0000)] 
target/arm: Introduce read_sys_reg32 for kvm32

Assert that the value to be written is the correct size.
No change in functionality here, just mirroring the same
function from kvm64.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agotarget/arm: Fill in ARMISARegisters for kvm64
Richard Henderson [Mon, 19 Nov 2018 15:29:07 +0000 (15:29 +0000)] 
target/arm: Fill in ARMISARegisters for kvm64

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agotarget/arm: Install ARMISARegisters from kvm host
Richard Henderson [Mon, 19 Nov 2018 15:29:07 +0000 (15:29 +0000)] 
target/arm: Install ARMISARegisters from kvm host

The ID registers are replacing (some of) the feature bits.
We need (some of) these values to determine the set of data
to be handled during migration.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoMerge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Peter Maydell [Mon, 19 Nov 2018 14:31:48 +0000 (14:31 +0000)] 
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches:

- file-posix: Fix shared permission locks after reopen
- block: Fix error path for failed .bdrv_reopen_prepare
- qcow2: Catch invalid allocations when the image becomes too large
- vvfat/fdc/nvme: Fix segfaults and leaks

# gpg: Signature made Mon 19 Nov 2018 14:28:18 GMT
# gpg:                using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream:
  iotests: Test file-posix locking and reopen
  file-posix: Fix shared locks on reopen commit
  block: Always abort reopen after prepare succeeded
  iotests: Add new test 220 for max compressed cluster offset
  qcow2: Don't allow overflow during cluster allocation
  qcow2: Document some maximum size constraints
  vvfat: Fix memory leak
  fdc: fix segfault in fdctrl_stop_transfer() when DMA is disabled
  nvme: fix oob access issue(CVE-2018-16847)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoiotests: Test file-posix locking and reopen
Max Reitz [Fri, 16 Nov 2018 16:45:26 +0000 (17:45 +0100)] 
iotests: Test file-posix locking and reopen

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agofile-posix: Fix shared locks on reopen commit
Max Reitz [Fri, 16 Nov 2018 16:45:25 +0000 (17:45 +0100)] 
file-posix: Fix shared locks on reopen commit

s->locked_shared_perm is the set of bits locked in the file, which is
the inverse of the permissions actually shared.  So we need to pass them
as they are to raw_apply_lock_bytes() instead of inverting them again.

Reported-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agoblock: Always abort reopen after prepare succeeded
Max Reitz [Fri, 16 Nov 2018 16:45:24 +0000 (17:45 +0100)] 
block: Always abort reopen after prepare succeeded

bdrv_reopen_multiple() does not invoke bdrv_reopen_abort() for the
element of the reopen queue for which bdrv_reopen_prepare() failed,
because it assumes that the prepare function will have rolled back all
changes already.

However, bdrv_reopen_prepare() does not do this in every case: It may
notice an error after BlockDriver.bdrv_reopen_prepare() succeeded, and
it will not invoke BlockDriver.bdrv_reopen_abort() then; and neither
will bdrv_reopen_multiple(), as explained above.

This is wrong because we must always call .bdrv_reopen_commit() or
.bdrv_reopen_abort() after .bdrv_reopen_prepare() has succeeded.
Otherwise, the block driver has no chance to undo what it has done in
its implementation of .bdrv_reopen_prepare().

To fix this, bdrv_reopen_prepare() has to call .bdrv_reopen_abort() if
it wants to return an error after .bdrv_reopen_prepare() has succeeded.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agoiotests: Add new test 220 for max compressed cluster offset
Eric Blake [Tue, 13 Nov 2018 23:03:19 +0000 (17:03 -0600)] 
iotests: Add new test 220 for max compressed cluster offset

If you have a capable file system (tmpfs is good, ext4 not so much;
run ./check with TEST_DIR pointing to a good location so as not
to skip the test), it's actually possible to create a qcow2 file
that expands to a sparse 512T image with just over 38M of content.
The test is not the world's fastest (qemu crawling through 256M
bits of refcount table to find the next cluster to allocate takes
several seconds, as does qemu-img check reporting millions of
leaked clusters); but it DOES catch the problem that the previous
patch just fixed where writing a compressed cluster to a full
image ended up overwriting the wrong cluster.

Suggested-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agoqcow2: Don't allow overflow during cluster allocation
Eric Blake [Tue, 13 Nov 2018 23:03:18 +0000 (17:03 -0600)] 
qcow2: Don't allow overflow during cluster allocation

Our code was already checking that we did not attempt to
allocate more clusters than what would fit in an INT64 (the
physical maximimum if we can access a full off_t's worth of
data).  But this does not catch smaller limits enforced by
various spots in the qcow2 image description: L1 and normal
clusters of L2 are documented as having bits 63-56 reserved
for other purposes, capping our maximum offset at 64PB (bit
55 is the maximum bit set).  And for compressed images with
2M clusters, the cap drops the maximum offset to bit 48, or
a maximum offset of 512TB.  If we overflow that offset, we
would write compressed data into one place, but try to
decompress from another, which won't work.

It's actually possible to prove that overflow can cause image
corruption without this patch; I'll add the iotests separately
in the next commit.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agoqcow2: Document some maximum size constraints
Eric Blake [Thu, 15 Nov 2018 18:34:08 +0000 (12:34 -0600)] 
qcow2: Document some maximum size constraints

Although off_t permits up to 63 bits (8EB) of file offsets, in
practice, we're going to hit other limits first.  Document some
of those limits in the qcow2 spec (some are inherent, others are
implementation choices of qemu), and how choice of cluster size
can influence some of the limits.

While we cannot map any uncompressed virtual cluster to any
address higher than 64 PB (56 bits) (due to the current L1/L2
field encoding stopping at bit 55), qemu's cap of 8M for the
refcount table can still access larger host addresses for some
combinations of large clusters and small refcount_order.  For
comparison, ext4 with 4k blocks caps files at 16PB.

Another interesting limit: for compressed clusters, the L2 layout
requires an ever-smaller maximum host offset as cluster size gets
larger, down to a 512 TB maximum with 2M clusters.  In particular,
note that with a cluster size of 8k or smaller, the L2 entry for
a compressed cluster could technically point beyond the 64PB mark,
but when you consider that with 8k clusters and refcount_order = 0,
you cannot access beyond 512T without exceeding qemu's limit of an
8M cap on the refcount table, it is unlikely that any image in the
wild has attempted to do so.  To be safe, let's document that bits
beyond 55 in a compressed cluster must be 0.

Signed-off-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agovvfat: Fix memory leak
Kevin Wolf [Wed, 14 Nov 2018 12:50:16 +0000 (13:50 +0100)] 
vvfat: Fix memory leak

Don't leak 'cluster' in the mapping == NULL case. Found by Coverity
(CID 1055918).

Fixes: 8d9401c2791ee2d2805b741b1ee3006041edcd3e
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Liam Merwick <liam.merwick@oracle.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
3 years agofdc: fix segfault in fdctrl_stop_transfer() when DMA is disabled
Mark Cave-Ayland [Sun, 11 Nov 2018 09:40:23 +0000 (09:40 +0000)] 
fdc: fix segfault in fdctrl_stop_transfer() when DMA is disabled

Commit c8a35f1cf0f "fdc: use IsaDma interface instead of global DMA_*
functions" accidentally introduced a segfault in fdctrl_stop_transfer() for
non-DMA transfers.

If fdctrl->dma_chann has not been configured then the fdctrl->dma interface
reference isn't initialised during isabus_fdc_realize(). Unfortunately
fdctrl_stop_transfer() unconditionally references the DMA interface when
finishing the transfer causing a NULL pointer dereference.

Fix the issue by adding a check in fdctrl_stop_transfer() so that the DMA
interface reference and release method is only invoked if fdctrl->dma_chann
has been set.

(This issue was discovered by Martin testing a recent change in the NetBSD
installer under qemu-system-sparc)

Cc: qemu-stable@nongnu.org
Reported-by: Martin Husemann <martin@duskware.de>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Hervé Poussineau <hpoussin@reactos.org>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agonvme: fix oob access issue(CVE-2018-16847)
Li Qiang [Fri, 2 Nov 2018 01:22:43 +0000 (18:22 -0700)] 
nvme: fix oob access issue(CVE-2018-16847)

Currently, the nvme_cmb_ops mr doesn't check the addr and size.
This can lead an oob access issue. This is triggerable in the guest.
Add check to avoid this issue.

Fixes CVE-2018-16847.

Reported-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
3 years agoMAINTAINERS: clarify some of the tags
Cornelia Huck [Fri, 26 Oct 2018 10:57:11 +0000 (12:57 +0200)] 
MAINTAINERS: clarify some of the tags

The MAINTAINERS file is a bit sparse on information about what
the different designators are. Let's add some more information
to give contributors a better idea about what the different
roles are.

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20181026105711.29605-1-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoMerge remote-tracking branch 'remotes/amarkovic/tags/mips-queue-november-2018-v2...
Peter Maydell [Mon, 19 Nov 2018 10:23:45 +0000 (10:23 +0000)] 
Merge remote-tracking branch 'remotes/amarkovic/tags/mips-queue-november-2018-v2' into staging

MIPS queue for QEMU 3.1-rc2 - v2

# gpg: Signature made Sat 17 Nov 2018 18:30:46 GMT
# gpg:                using RSA key D4972A8967F75A65
# gpg: Good signature from "Aleksandar Markovic <amarkovic@wavecomp.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 8526 FBF1 5DA3 811F 4A01  DD75 D497 2A89 67F7 5A65

* remotes/amarkovic/tags/mips-queue-november-2018-v2:
  MAINTAINERS: Add Stefan Markovic as a MIPS reviewer
  target/mips: Disable R5900 support
  target/mips: Rename MMI-related functions
  target/mips: Rename MMI-related opcodes
  target/mips: Rename MMI-related masks
  target/mips: Guard check_insn with INSN_R5900 check
  target/mips: Guard check_insn_opc_user_only with INSN_R5900 check
  target/mips: Fix decoding mechanism of special R5900 opcodes
  target/mips: Fix decoding mechanism of R5900 DIV1 and DIVU1
  target/mips: Fix decoding mechanism of R5900 MFLO1, MFHI1, MTLO1 and MTHI1
  linux-user: Update MIPS specific prctl() implementation

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoMerge remote-tracking branch 'remotes/riscv/tags/riscv-for-master-3.1-rc2' into staging
Peter Maydell [Mon, 19 Nov 2018 09:35:27 +0000 (09:35 +0000)] 
Merge remote-tracking branch 'remotes/riscv/tags/riscv-for-master-3.1-rc2' into staging

RISC-V Patches for 3.1-rc2

This pull request contains four patches that aren't really related to
each other aside from all being bug fixes that I think should go in for
3.1.0:

* The second half of Alistair's memory leak patch set that I missed last
  week.
* A fix to make fclass.d availiable only on RV64IFD systems (without
  this it's availiable on RV32IFD systems, truncating the result).
* A fix to make sfence.vm availiable only in priv-1.9.1, and sfence.vma
  only availiable in priv-1.10.
* A change to respect fences in user-mode emulators, which were
  previously treated as NOPs.

As usual, this builds and boot Linux for me.  I don't think I have
anything else planned for 3.1.0, but I may be wrong as things are a bit
hectic this week.

# gpg: Signature made Tue 13 Nov 2018 23:48:38 GMT
# gpg:                using RSA key EF4CA1502CCBAB41
# gpg: Good signature from "Palmer Dabbelt <palmer@dabbelt.com>"
# gpg:                 aka "Palmer Dabbelt <palmer@sifive.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 00CE 76D1 8349 60DF CE88  6DF8 EF4C A150 2CCB AB41

* remotes/riscv/tags/riscv-for-master-3.1-rc2:
  RISC-V: Respect fences for user-only emulators
  target/riscv: Fix sfence.vm/a both available in any priv version
  target/riscv: Fix FCLASS_D being treated as RV64 only
  hw/riscv/virt: Free the test device tree node name

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoMAINTAINERS: Add Stefan Markovic as a MIPS reviewer
Aleksandar Markovic [Sat, 17 Nov 2018 14:04:33 +0000 (15:04 +0100)] 
MAINTAINERS: Add Stefan Markovic as a MIPS reviewer

Add Stefan Markovic as a MIPS reviewer. He had several key
contributions to QEMU for MIPS this year. He is a meticulous
person with the ability to think and act on many levels.

Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
3 years agotarget/mips: Disable R5900 support
Aleksandar Markovic [Sat, 17 Nov 2018 14:08:57 +0000 (15:08 +0100)] 
target/mips: Disable R5900 support

Disable R5900 support. There are some outstanding issues related
to ABI support and emulation accuracy, that were not understood
well during review process. Disable to avoid backward compatibility
issues.

Reverts commit ed4f49ba9bb56ebca6987b1083255daf6c89b5de.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
3 years agotarget/mips: Rename MMI-related functions
Aleksandar Markovic [Sat, 17 Nov 2018 15:02:22 +0000 (16:02 +0100)] 
target/mips: Rename MMI-related functions

Rename MMI-related functions.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
3 years agotarget/mips: Rename MMI-related opcodes
Aleksandar Markovic [Sat, 17 Nov 2018 14:53:58 +0000 (15:53 +0100)] 
target/mips: Rename MMI-related opcodes

Rename MMI-related opcodes.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
3 years agotarget/mips: Rename MMI-related masks
Aleksandar Markovic [Tue, 30 Oct 2018 17:28:14 +0000 (18:28 +0100)] 
target/mips: Rename MMI-related masks

Rename MMI-related masks.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
3 years agotarget/mips: Guard check_insn with INSN_R5900 check
Fredrik Noring [Wed, 7 Nov 2018 19:19:45 +0000 (20:19 +0100)] 
target/mips: Guard check_insn with INSN_R5900 check

Explicitely mark handling of PREF instruction for R5900 as
treating the same as NOP.

Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Fredrik Noring <noring@nocrew.org>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
3 years agotarget/mips: Guard check_insn_opc_user_only with INSN_R5900 check
Fredrik Noring [Wed, 7 Nov 2018 19:19:34 +0000 (20:19 +0100)] 
target/mips: Guard check_insn_opc_user_only with INSN_R5900 check

Avoid using check_opc_user_only() as a decision making code wrt
various architectures. Use ctx->insn_flags checks instead.

Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Fredrik Noring <noring@nocrew.org>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
3 years agotarget/mips: Fix decoding mechanism of special R5900 opcodes
Fredrik Noring [Wed, 7 Nov 2018 19:19:14 +0000 (20:19 +0100)] 
target/mips: Fix decoding mechanism of special R5900 opcodes

MOVN, MOVZ, MFHI, MFLO, MTHI, MTLO, MULT, MULTU, DIV, DIVU, DMULT,
DMULTU, DDIV, DDIVU and JR are decoded in decode_opc_special_tx79
instead of the generic decode_opc_special_legacy.

Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Fredrik Noring <noring@nocrew.org>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
3 years agotarget/mips: Fix decoding mechanism of R5900 DIV1 and DIVU1
Fredrik Noring [Wed, 7 Nov 2018 19:18:15 +0000 (20:18 +0100)] 
target/mips: Fix decoding mechanism of R5900 DIV1 and DIVU1

DIV1 and DIVU1 are generated in gen_div1_tx79 instead of the generic
gen_muldiv.

Signed-off-by: Fredrik Noring <noring@nocrew.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
3 years agotarget/mips: Fix decoding mechanism of R5900 MFLO1, MFHI1, MTLO1 and MTHI1
Fredrik Noring [Wed, 7 Nov 2018 19:18:01 +0000 (20:18 +0100)] 
target/mips: Fix decoding mechanism of R5900 MFLO1, MFHI1, MTLO1 and MTHI1

MFLO1, MFHI1, MTLO1 and MTHI1 are generated in gen_HILO1_tx79 instead of
the generic gen_HILO.

Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Fredrik Noring <noring@nocrew.org>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
3 years agolinux-user: Update MIPS specific prctl() implementation
Stefan Markovic [Wed, 14 Nov 2018 13:37:08 +0000 (14:37 +0100)] 
linux-user: Update MIPS specific prctl() implementation

Perform needed checks before actual prctl() PR_SET_FP_MODE and
PR_GET_FP_MODE work based on kernel implementation. Also, update
necessary hflags.

Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
3 years agoMerge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181116-pull-request...
Peter Maydell [Fri, 16 Nov 2018 13:53:01 +0000 (13:53 +0000)] 
Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181116-pull-request' into staging

ui: add rendernode arg for egl-headless (fixes permission issues with libvirt)

# gpg: Signature made Fri 16 Nov 2018 13:29:15 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/fixes-31-20181116-pull-request:
  help: Provide help for egl-headless
  ui: Allow specifying 'rendernode' display option for egl-headless
  qapi: Add "rendernode" display option for egl-headless

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agohelp: Provide help for egl-headless
Erik Skultety [Fri, 16 Nov 2018 10:14:44 +0000 (11:14 +0100)] 
help: Provide help for egl-headless

EGL headless has been missing from QEMU's help or man page, we should
mention that such a thing exists, especially since projects like libvirt
might rely on that. This patch also adds the newly introduced option for
egl-headless 'rendernode'.

Signed-off-by: Erik Skultety <eskultet@redhat.com>
Message-id: 87ef678b0934d3abba66c46c9e65b57119d29295.1542362949.git.eskultet@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
3 years agoui: Allow specifying 'rendernode' display option for egl-headless
Erik Skultety [Fri, 16 Nov 2018 10:14:43 +0000 (11:14 +0100)] 
ui: Allow specifying 'rendernode' display option for egl-headless

As libvirt can't predict which rendernode QEMU would pick, it
won't adjust the permissions on the device, hence QEMU getting
"Permission denied" when opening the DRI device. Therefore, enable
'rendernode' option for egl-headless display type.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1648236

Signed-off-by: Erik Skultety <eskultet@redhat.com>
Message-id: 27f4617f19aa1072114f10f1aa9dd199735ef982.1542362949.git.eskultet@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
3 years agoqapi: Add "rendernode" display option for egl-headless
Erik Skultety [Fri, 16 Nov 2018 10:14:42 +0000 (11:14 +0100)] 
qapi: Add "rendernode" display option for egl-headless

Unlike SPICE, egl-headless doesn't offer a way of specifying the DRM
node used for OpenGL, hence QEMU always selecting the first one that is
available. Thus, add the 'rendernode' option for egl-headless to QAPI.

Signed-off-by: Erik Skultety <eskultet@redhat.com>
Message-id: 7658e15eca72d520e7a5fb1c2e724702d83d4f7f.1542362949.git.eskultet@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
3 years agoMerge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging
Peter Maydell [Fri, 16 Nov 2018 10:01:04 +0000 (10:01 +0000)] 
Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging

# gpg: Signature made Fri 16 Nov 2018 03:38:58 GMT
# gpg:                using RSA key EF04965B398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F  3562 EF04 965B 398D 6211

* remotes/jasowang/tags/net-pull-request:
  net/filter-rewriter.c: Fix coverity static analysis issue

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agonet/filter-rewriter.c: Fix coverity static analysis issue
Zhang Chen [Wed, 31 Oct 2018 00:50:15 +0000 (08:50 +0800)] 
net/filter-rewriter.c: Fix coverity static analysis issue

The original code just follow the TCP state diagram,
but in this case, we can skip the TCPS_TIME_WAIT state to simplify
the implementation.

Signed-off-by: Zhang Chen <zhangckid@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
3 years agoMerge remote-tracking branch 'remotes/stefanberger/tags/pull-tpm-2018-11-15-1' into...
Peter Maydell [Thu, 15 Nov 2018 14:18:25 +0000 (14:18 +0000)] 
Merge remote-tracking branch 'remotes/stefanberger/tags/pull-tpm-2018-11-15-1' into staging

Merge tpm 2018/11/15 v1

# gpg: Signature made Thu 15 Nov 2018 14:03:45 GMT
# gpg:                using RSA key 75AD65802A0B4211
# gpg: Good signature from "Stefan Berger <stefanb@linux.vnet.ibm.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B818 B9CA DF90 89C2 D5CE  C66B 75AD 6580 2A0B 4211

* remotes/stefanberger/tags/pull-tpm-2018-11-15-1:
  tests: tpm: Use g_test_message rather than fprintf
  tpm: use loop iterator to set sts data field

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agolinux-user/sparc/signal.c: Remove dead code
Peter Maydell [Thu, 15 Nov 2018 11:46:16 +0000 (11:46 +0000)] 
linux-user/sparc/signal.c: Remove dead code

Coverity complains (CID 1390847) about some dead code in
do_sigreturn(). This is an if (err) clause that can never be
true, copied from the kernel (where __get_user returns an error).
The one code path that could report an error is in the
currently commented-out pseudocode for handling FPU register
restoring, so move the if into that comment (and fix the
broken indent in the comment in the process).

(The new position for the error check is also the semantically
correct one -- we should not restore the signal mask from
the signal frame if we get an error here, so the check must
be done before set_sigmask(), not after.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-id: 20181115114616.26265-1-peter.maydell@linaro.org

3 years agomake-release: add skiboot .version file
Michael Roth [Fri, 9 Nov 2018 16:13:52 +0000 (10:13 -0600)] 
make-release: add skiboot .version file

This is needed to build skiboot from tarball-distributed sources
since the git data the make_release.sh script relies on to generate
it is not available.

Cc: qemu-stable@nongnu.org
Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20181109161352.29873-1-mdroth@linux.vnet.ibm.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoMerge remote-tracking branch 'remotes/stsquad/tags/pull-testing-fixes-for-3.1-141118...
Peter Maydell [Thu, 15 Nov 2018 11:26:48 +0000 (11:26 +0000)] 
Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-fixes-for-3.1-141118-1' into staging

Testing tweaks:

  - split MacOSX build
  - fix for readdir() failures in check-tcg

# gpg: Signature made Wed 14 Nov 2018 13:08:24 GMT
# gpg:                using RSA key FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>"
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8  DF35 FBD0 DB09 5A9E 2A44

* remotes/stsquad/tags/pull-testing-fixes-for-3.1-141118-1:
  tests/tcg/multiarch: fix 32bit linux-test on 64bit host
  .travis.yml: split MacOSX builds and reduce target list

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agoMerge remote-tracking branch 'remotes/cohuck/tags/s390x-20181114' into staging
Peter Maydell [Thu, 15 Nov 2018 10:01:16 +0000 (10:01 +0000)] 
Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20181114' into staging

Fix error handling during zpci device creation.

# gpg: Signature made Wed 14 Nov 2018 10:08:43 GMT
# gpg:                using RSA key DECF6B93C6F02FAF
# gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>"
# gpg:                 aka "Cornelia Huck <huckc@linux.vnet.ibm.com>"
# gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"
# gpg:                 aka "Cornelia Huck <cohuck@kernel.org>"
# gpg:                 aka "Cornelia Huck <cohuck@redhat.com>"
# Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0  18CE DECF 6B93 C6F0 2FAF

* remotes/cohuck/tags/s390x-20181114:
  s390x/pci: properly fail if the zPCI device cannot be created

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 years agotests: tpm: Use g_test_message rather than fprintf
Stefan Berger [Tue, 6 Nov 2018 14:08:40 +0000 (09:08 -0500)] 
tests: tpm: Use g_test_message rather than fprintf

Display a message during the test using g_test_message rather
than fprintf.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
3 years agotpm: use loop iterator to set sts data field
Prasad J Pandit [Tue, 6 Nov 2018 05:21:44 +0000 (10:51 +0530)] 
tpm: use loop iterator to set sts data field

When TIS request is done, set 'sts' data field across all localities.

Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
3 years agotests/tcg/multiarch: fix 32bit linux-test on 64bit host
Laurent Vivier [Tue, 13 Nov 2018 17:54:37 +0000 (18:54 +0100)] 
tests/tcg/multiarch: fix 32bit linux-test on 64bit host

Fix:

  TEST    linux-test on i386
  .../tests/tcg/multiarch/linux-test.c:201: readdir

readdir() calls getdents64() to have the list of the entries in a
directory, and getdents64() can return 64bit d_off values (with ext4,
for instance) that will not fit in the 32bit d_off field of the
readdir() dirent structure.

To avoid that, use readdir64() to use a 64bit d_off field too.

Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
3 years ago.travis.yml: split MacOSX builds and reduce target list
Alex Bennée [Mon, 8 Oct 2018 10:56:13 +0000 (11:56 +0100)] 
.travis.yml: split MacOSX builds and reduce target list

We have reached the point where the MacOSX build was regularly timing
out. So as before I've reduced the target list to "major"
architectures to try and bring the build time down. I've added an
additional MacOSX build with the latest XCode with a minimal list of
"most likely" targets on MacOS.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
3 years agoRISC-V: Respect fences for user-only emulators
Palmer Dabbelt [Fri, 9 Nov 2018 18:56:50 +0000 (10:56 -0800)] 
RISC-V: Respect fences for user-only emulators

Our current fence implementation ignores fences for the user-only
configurations.  This is incorrect but unlikely to manifest: it requires
multi-threaded user-only code that takes advantage of the weakness in
the host's memory model and can be inlined by TCG.

This patch simply treats fences the same way for all our emulators.
I've given it to testing as I don't want to construct a test that would
actually trigger the failure.

Our fence implementation has an additional deficiency where we map all
RISC-V fences to full fences.  Now that we have a formal memory model
for RISC-V we can start to take advantage of the strength bits on our
fence instructions.  This requires a bit more though, so I'm going to
split it out because the implementation is still correct without taking
advantage of these weaker fences.

Thanks to Richard Henderson for pointing out both of the issues.

Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
3 years agotarget/riscv: Fix sfence.vm/a both available in any priv version
Bastian Koppelmann [Thu, 8 Nov 2018 12:06:28 +0000 (13:06 +0100)] 
target/riscv: Fix sfence.vm/a both available in any priv version

sfence.vm has been replaced in priv v1.10 spec by sfence.vma.

Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
3 years agotarget/riscv: Fix FCLASS_D being treated as RV64 only
Bastian Koppelmann [Thu, 8 Nov 2018 12:06:27 +0000 (13:06 +0100)] 
target/riscv: Fix FCLASS_D being treated as RV64 only

Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
3 years agohw/riscv/virt: Free the test device tree node name
Alistair Francis [Wed, 7 Nov 2018 21:51:45 +0000 (21:51 +0000)] 
hw/riscv/virt: Free the test device tree node name

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
3 years agoUpdate version for v3.1.0-rc1 release v3.1.0-rc1
Peter Maydell [Tue, 13 Nov 2018 18:16:14 +0000 (18:16 +0000)] 
Update version for v3.1.0-rc1 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>