Eric Blake [Fri, 16 Nov 2018 21:50:02 +0000 (15:50 -0600)]
iotests: Drop use of bash keyword 'function'
Bash allows functions to be declared with or without the leading
keyword 'function'; but including the keyword does not comply with
POSIX syntax, and is confusing to ksh users where the use of the
keyword changes the scoping rules for functions. Stick to the
POSIX form through iotests.
Done mechanically with:
sed -i 's/^function //' $(git ls-files tests/qemu-iotests)
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20181116215002.2124581-1-eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Eric Blake [Sun, 18 Nov 2018 02:24:03 +0000 (20:24 -0600)]
iotests: Also test I/O over NBD TLS
Enhance test 233 to also perform I/O beyond the initial handshake.
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20181118022403.2211483-1-eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Add tests that validate it is possible to connect to an NBD server
running TLS mode. Also test mis-matched TLS vs non-TLS connections
correctly fail.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20181116155325.22428-7-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: Eric Blake <eblake@redhat.com>
[eblake: rebase to iotests shell cleanups, use ss instead of socat for
port probing, sanitize port number in expected output] Signed-off-by: Eric Blake <eblake@redhat.com>
tests: add iotests helpers for dealing with TLS certificates
Add helpers to common.tls for creating TLS certificates for a CA,
server and client.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20181116155325.22428-6-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: spelling and quoting touchups] Signed-off-by: Eric Blake <eblake@redhat.com>
tests: check if qemu-nbd is still alive before waiting
If the qemu-nbd UNIX socket has not shown up, the tests will sleep a bit
and then check again repeatedly for up to 30 seconds. This is pointless
if the qemu-nbd process has quit due to an error, so check whether the
pid is still alive before waiting and retrying.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20181116155325.22428-5-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com>
tests: pull qemu-nbd iotest helpers into common.nbd file
The helpers for starting/stopping qemu-nbd in 058 will be useful in
other test cases, so move them into a common.nbd file.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20181116155325.22428-4-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: fix shell quoting] Signed-off-by: Eric Blake <eblake@redhat.com>
io: return 0 for EOF in TLS session read after shutdown
GNUTLS takes a paranoid approach when seeing 0 bytes returned by the
underlying OS read() function. It will consider this an error and
return GNUTLS_E_PREMATURE_TERMINATION instead of propagating the 0
return value. It expects apps to arrange for clean termination at
the protocol level and not rely on seeing EOF from a read call to
detect shutdown. This is to harden apps against a malicious 3rd party
causing termination of the sockets layer.
This is unhelpful for the QEMU NBD code which does have a clean
protocol level shutdown, but still relies on seeing 0 from the I/O
channel read in the coroutine handling incoming replies.
The upshot is that when using a plain NBD connection shutdown is
silent, but when using TLS, the client spams the console with
Cannot read from TLS channel: Broken pipe
The NBD connection has, however, called qio_channel_shutdown()
at this point to indicate that it is done with I/O. This gives
the opportunity to optimize the code such that when the channel
has been shutdown in the read direction, the error code
GNUTLS_E_PREMATURE_TERMINATION gets turned into a '0' return
instead of an error.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20181119134228.11031-1-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com>
Eric Blake [Sat, 17 Nov 2018 22:32:21 +0000 (16:32 -0600)]
nbd/server: Ignore write errors when replying to NBD_OPT_ABORT
Commit 37ec36f6 intentionally ignores errors when trying to reply
to an NBD_OPT_ABORT request for plaintext clients, but did not make
the same change for a TLS server. Since NBD_OPT_ABORT is
documented as being a potential for an EPIPE when the client hangs
up without waiting for our reply, we don't need to pollute the
server's output with that failure.
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20181117223221.2198751-1-eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
nbd: Send message along with server NBD_REP_ERR errors
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20181116155325.22428-2-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: move lone space to next line] Signed-off-by: Eric Blake <eblake@redhat.com>
Mao Zhongyi [Wed, 24 Oct 2018 09:40:51 +0000 (17:40 +0800)]
qemu-iotests: Modern shell scripting (use $() instead of ``)
Various shell files contain a mix between obsolete ``
and modern $(); It would be nice to convert to using
$() everywhere. For now, just do the qemu-iotests directory.
Cc: kwolf@redhat.com Cc: mreitz@redhat.com Cc: eblake@redhat.com Suggested-by: Eric Blake <eblake@redhat.com> Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Message-Id: <20181024094051.4470-4-maozhongyi@cmss.chinamobile.com> Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: tweak commit message] Signed-off-by: Eric Blake <eblake@redhat.com>
Mao Zhongyi [Fri, 16 Nov 2018 20:33:03 +0000 (14:33 -0600)]
qemu-iotests: convert `pwd` and $(pwd) to $PWD
POSIX requires $PWD to be reliable, and we expect all
shells used by qemu scripts to be relatively close to
POSIX. Thus, it is smarter to avoid forking the pwd
executable for something that is already available in
the environment.
So replace it with the following:
sed -i 's/\(`pwd`\|\$(pwd)\)/$PWD/g' $(git grep -l pwd)
Then delete a pointless line assigning PWD to itself.
Cc: kwolf@redhat.com Cc: mreitz@redhat.com Cc: eblake@redhat.com Suggested-by: Eric Blake <eblake@redhat.com> Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Message-Id: <20181024094051.4470-2-maozhongyi@cmss.chinamobile.com> Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: touch up commit message, reorder series, tweak a couple more files] Signed-off-by: Eric Blake <eblake@redhat.com>
Mao Zhongyi [Wed, 24 Oct 2018 09:40:50 +0000 (17:40 +0800)]
qemu-iotests: remove unused variable 'here'
Running
git grep '\$here' tests/qemu-iotests
has 0 hits, which means we are setting a variable that has
no use. It appears that commit e8f8624d removed the last
use. So execute the following cmd to remove all of
the 'here=...' lines as dead code.
sed -i '/^here=/d' $(git grep -l '^here=' tests/qemu-iotests)
Cc: kwolf@redhat.com Cc: mreitz@redhat.com Cc: eblake@redhat.com Suggested-by: Eric Blake <eblake@redhat.com> Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Message-Id: <20181024094051.4470-3-maozhongyi@cmss.chinamobile.com> Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: touch up commit message, reorder series, rebase to master] Signed-off-by: Eric Blake <eblake@redhat.com>
Peter Maydell [Mon, 19 Nov 2018 14:31:48 +0000 (14:31 +0000)]
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Block layer patches:
- file-posix: Fix shared permission locks after reopen
- block: Fix error path for failed .bdrv_reopen_prepare
- qcow2: Catch invalid allocations when the image becomes too large
- vvfat/fdc/nvme: Fix segfaults and leaks
# gpg: Signature made Mon 19 Nov 2018 14:28:18 GMT
# gpg: using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6
* remotes/kevin/tags/for-upstream:
iotests: Test file-posix locking and reopen
file-posix: Fix shared locks on reopen commit
block: Always abort reopen after prepare succeeded
iotests: Add new test 220 for max compressed cluster offset
qcow2: Don't allow overflow during cluster allocation
qcow2: Document some maximum size constraints
vvfat: Fix memory leak
fdc: fix segfault in fdctrl_stop_transfer() when DMA is disabled
nvme: fix oob access issue(CVE-2018-16847)
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Max Reitz [Fri, 16 Nov 2018 16:45:25 +0000 (17:45 +0100)]
file-posix: Fix shared locks on reopen commit
s->locked_shared_perm is the set of bits locked in the file, which is
the inverse of the permissions actually shared. So we need to pass them
as they are to raw_apply_lock_bytes() instead of inverting them again.
Reported-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Max Reitz [Fri, 16 Nov 2018 16:45:24 +0000 (17:45 +0100)]
block: Always abort reopen after prepare succeeded
bdrv_reopen_multiple() does not invoke bdrv_reopen_abort() for the
element of the reopen queue for which bdrv_reopen_prepare() failed,
because it assumes that the prepare function will have rolled back all
changes already.
However, bdrv_reopen_prepare() does not do this in every case: It may
notice an error after BlockDriver.bdrv_reopen_prepare() succeeded, and
it will not invoke BlockDriver.bdrv_reopen_abort() then; and neither
will bdrv_reopen_multiple(), as explained above.
This is wrong because we must always call .bdrv_reopen_commit() or
.bdrv_reopen_abort() after .bdrv_reopen_prepare() has succeeded.
Otherwise, the block driver has no chance to undo what it has done in
its implementation of .bdrv_reopen_prepare().
To fix this, bdrv_reopen_prepare() has to call .bdrv_reopen_abort() if
it wants to return an error after .bdrv_reopen_prepare() has succeeded.
Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Eric Blake [Tue, 13 Nov 2018 23:03:19 +0000 (17:03 -0600)]
iotests: Add new test 220 for max compressed cluster offset
If you have a capable file system (tmpfs is good, ext4 not so much;
run ./check with TEST_DIR pointing to a good location so as not
to skip the test), it's actually possible to create a qcow2 file
that expands to a sparse 512T image with just over 38M of content.
The test is not the world's fastest (qemu crawling through 256M
bits of refcount table to find the next cluster to allocate takes
several seconds, as does qemu-img check reporting millions of
leaked clusters); but it DOES catch the problem that the previous
patch just fixed where writing a compressed cluster to a full
image ended up overwriting the wrong cluster.
Suggested-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Eric Blake [Tue, 13 Nov 2018 23:03:18 +0000 (17:03 -0600)]
qcow2: Don't allow overflow during cluster allocation
Our code was already checking that we did not attempt to
allocate more clusters than what would fit in an INT64 (the
physical maximimum if we can access a full off_t's worth of
data). But this does not catch smaller limits enforced by
various spots in the qcow2 image description: L1 and normal
clusters of L2 are documented as having bits 63-56 reserved
for other purposes, capping our maximum offset at 64PB (bit
55 is the maximum bit set). And for compressed images with
2M clusters, the cap drops the maximum offset to bit 48, or
a maximum offset of 512TB. If we overflow that offset, we
would write compressed data into one place, but try to
decompress from another, which won't work.
It's actually possible to prove that overflow can cause image
corruption without this patch; I'll add the iotests separately
in the next commit.
Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Eric Blake [Thu, 15 Nov 2018 18:34:08 +0000 (12:34 -0600)]
qcow2: Document some maximum size constraints
Although off_t permits up to 63 bits (8EB) of file offsets, in
practice, we're going to hit other limits first. Document some
of those limits in the qcow2 spec (some are inherent, others are
implementation choices of qemu), and how choice of cluster size
can influence some of the limits.
While we cannot map any uncompressed virtual cluster to any
address higher than 64 PB (56 bits) (due to the current L1/L2
field encoding stopping at bit 55), qemu's cap of 8M for the
refcount table can still access larger host addresses for some
combinations of large clusters and small refcount_order. For
comparison, ext4 with 4k blocks caps files at 16PB.
Another interesting limit: for compressed clusters, the L2 layout
requires an ever-smaller maximum host offset as cluster size gets
larger, down to a 512 TB maximum with 2M clusters. In particular,
note that with a cluster size of 8k or smaller, the L2 entry for
a compressed cluster could technically point beyond the 64PB mark,
but when you consider that with 8k clusters and refcount_order = 0,
you cannot access beyond 512T without exceeding qemu's limit of an
8M cap on the refcount table, it is unlikely that any image in the
wild has attempted to do so. To be safe, let's document that bits
beyond 55 in a compressed cluster must be 0.
Signed-off-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Kevin Wolf [Wed, 14 Nov 2018 12:50:16 +0000 (13:50 +0100)]
vvfat: Fix memory leak
Don't leak 'cluster' in the mapping == NULL case. Found by Coverity
(CID 1055918).
Fixes: 8d9401c2791ee2d2805b741b1ee3006041edcd3e Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Liam Merwick <liam.merwick@oracle.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Mark Cave-Ayland [Sun, 11 Nov 2018 09:40:23 +0000 (09:40 +0000)]
fdc: fix segfault in fdctrl_stop_transfer() when DMA is disabled
Commit c8a35f1cf0f "fdc: use IsaDma interface instead of global DMA_*
functions" accidentally introduced a segfault in fdctrl_stop_transfer() for
non-DMA transfers.
If fdctrl->dma_chann has not been configured then the fdctrl->dma interface
reference isn't initialised during isabus_fdc_realize(). Unfortunately
fdctrl_stop_transfer() unconditionally references the DMA interface when
finishing the transfer causing a NULL pointer dereference.
Fix the issue by adding a check in fdctrl_stop_transfer() so that the DMA
interface reference and release method is only invoked if fdctrl->dma_chann
has been set.
(This issue was discovered by Martin testing a recent change in the NetBSD
installer under qemu-system-sparc)
Cc: qemu-stable@nongnu.org Reported-by: Martin Husemann <martin@duskware.de> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Li Qiang [Fri, 2 Nov 2018 01:22:43 +0000 (18:22 -0700)]
nvme: fix oob access issue(CVE-2018-16847)
Currently, the nvme_cmb_ops mr doesn't check the addr and size.
This can lead an oob access issue. This is triggerable in the guest.
Add check to avoid this issue.
Fixes CVE-2018-16847.
Reported-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Cornelia Huck [Fri, 26 Oct 2018 10:57:11 +0000 (12:57 +0200)]
MAINTAINERS: clarify some of the tags
The MAINTAINERS file is a bit sparse on information about what
the different designators are. Let's add some more information
to give contributors a better idea about what the different
roles are.
Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20181026105711.29605-1-cohuck@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Mon, 19 Nov 2018 10:23:45 +0000 (10:23 +0000)]
Merge remote-tracking branch 'remotes/amarkovic/tags/mips-queue-november-2018-v2' into staging
MIPS queue for QEMU 3.1-rc2 - v2
# gpg: Signature made Sat 17 Nov 2018 18:30:46 GMT
# gpg: using RSA key D4972A8967F75A65
# gpg: Good signature from "Aleksandar Markovic <amarkovic@wavecomp.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 8526 FBF1 5DA3 811F 4A01 DD75 D497 2A89 67F7 5A65
* remotes/amarkovic/tags/mips-queue-november-2018-v2:
MAINTAINERS: Add Stefan Markovic as a MIPS reviewer
target/mips: Disable R5900 support
target/mips: Rename MMI-related functions
target/mips: Rename MMI-related opcodes
target/mips: Rename MMI-related masks
target/mips: Guard check_insn with INSN_R5900 check
target/mips: Guard check_insn_opc_user_only with INSN_R5900 check
target/mips: Fix decoding mechanism of special R5900 opcodes
target/mips: Fix decoding mechanism of R5900 DIV1 and DIVU1
target/mips: Fix decoding mechanism of R5900 MFLO1, MFHI1, MTLO1 and MTHI1
linux-user: Update MIPS specific prctl() implementation
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Mon, 19 Nov 2018 09:35:27 +0000 (09:35 +0000)]
Merge remote-tracking branch 'remotes/riscv/tags/riscv-for-master-3.1-rc2' into staging
RISC-V Patches for 3.1-rc2
This pull request contains four patches that aren't really related to
each other aside from all being bug fixes that I think should go in for
3.1.0:
* The second half of Alistair's memory leak patch set that I missed last
week.
* A fix to make fclass.d availiable only on RV64IFD systems (without
this it's availiable on RV32IFD systems, truncating the result).
* A fix to make sfence.vm availiable only in priv-1.9.1, and sfence.vma
only availiable in priv-1.10.
* A change to respect fences in user-mode emulators, which were
previously treated as NOPs.
As usual, this builds and boot Linux for me. I don't think I have
anything else planned for 3.1.0, but I may be wrong as things are a bit
hectic this week.
# gpg: Signature made Tue 13 Nov 2018 23:48:38 GMT
# gpg: using RSA key EF4CA1502CCBAB41
# gpg: Good signature from "Palmer Dabbelt <palmer@dabbelt.com>"
# gpg: aka "Palmer Dabbelt <palmer@sifive.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 00CE 76D1 8349 60DF CE88 6DF8 EF4C A150 2CCB AB41
* remotes/riscv/tags/riscv-for-master-3.1-rc2:
RISC-V: Respect fences for user-only emulators
target/riscv: Fix sfence.vm/a both available in any priv version
target/riscv: Fix FCLASS_D being treated as RV64 only
hw/riscv/virt: Free the test device tree node name
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
MAINTAINERS: Add Stefan Markovic as a MIPS reviewer
Add Stefan Markovic as a MIPS reviewer. He had several key
contributions to QEMU for MIPS this year. He is a meticulous
person with the ability to think and act on many levels.
Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Disable R5900 support. There are some outstanding issues related
to ABI support and emulation accuracy, that were not understood
well during review process. Disable to avoid backward compatibility
issues.
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Fredrik Noring [Wed, 7 Nov 2018 19:19:45 +0000 (20:19 +0100)]
target/mips: Guard check_insn with INSN_R5900 check
Explicitely mark handling of PREF instruction for R5900 as
treating the same as NOP.
Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Fredrik Noring <noring@nocrew.org> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Fredrik Noring [Wed, 7 Nov 2018 19:19:34 +0000 (20:19 +0100)]
target/mips: Guard check_insn_opc_user_only with INSN_R5900 check
Avoid using check_opc_user_only() as a decision making code wrt
various architectures. Use ctx->insn_flags checks instead.
Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Fredrik Noring <noring@nocrew.org> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Fredrik Noring [Wed, 7 Nov 2018 19:19:14 +0000 (20:19 +0100)]
target/mips: Fix decoding mechanism of special R5900 opcodes
MOVN, MOVZ, MFHI, MFLO, MTHI, MTLO, MULT, MULTU, DIV, DIVU, DMULT,
DMULTU, DDIV, DDIVU and JR are decoded in decode_opc_special_tx79
instead of the generic decode_opc_special_legacy.
Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Fredrik Noring <noring@nocrew.org> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Fredrik Noring [Wed, 7 Nov 2018 19:18:15 +0000 (20:18 +0100)]
target/mips: Fix decoding mechanism of R5900 DIV1 and DIVU1
DIV1 and DIVU1 are generated in gen_div1_tx79 instead of the generic
gen_muldiv.
Signed-off-by: Fredrik Noring <noring@nocrew.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Fredrik Noring [Wed, 7 Nov 2018 19:18:01 +0000 (20:18 +0100)]
target/mips: Fix decoding mechanism of R5900 MFLO1, MFHI1, MTLO1 and MTHI1
MFLO1, MFHI1, MTLO1 and MTHI1 are generated in gen_HILO1_tx79 instead of
the generic gen_HILO.
Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Fredrik Noring <noring@nocrew.org> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
* remotes/kraxel/tags/fixes-31-20181116-pull-request:
help: Provide help for egl-headless
ui: Allow specifying 'rendernode' display option for egl-headless
qapi: Add "rendernode" display option for egl-headless
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Erik Skultety [Fri, 16 Nov 2018 10:14:44 +0000 (11:14 +0100)]
help: Provide help for egl-headless
EGL headless has been missing from QEMU's help or man page, we should
mention that such a thing exists, especially since projects like libvirt
might rely on that. This patch also adds the newly introduced option for
egl-headless 'rendernode'.
Erik Skultety [Fri, 16 Nov 2018 10:14:43 +0000 (11:14 +0100)]
ui: Allow specifying 'rendernode' display option for egl-headless
As libvirt can't predict which rendernode QEMU would pick, it
won't adjust the permissions on the device, hence QEMU getting
"Permission denied" when opening the DRI device. Therefore, enable
'rendernode' option for egl-headless display type.
Erik Skultety [Fri, 16 Nov 2018 10:14:42 +0000 (11:14 +0100)]
qapi: Add "rendernode" display option for egl-headless
Unlike SPICE, egl-headless doesn't offer a way of specifying the DRM
node used for OpenGL, hence QEMU always selecting the first one that is
available. Thus, add the 'rendernode' option for egl-headless to QAPI.
Peter Maydell [Fri, 16 Nov 2018 10:01:04 +0000 (10:01 +0000)]
Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging
# gpg: Signature made Fri 16 Nov 2018 03:38:58 GMT
# gpg: using RSA key EF04965B398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg: It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211
Peter Maydell [Thu, 15 Nov 2018 14:18:25 +0000 (14:18 +0000)]
Merge remote-tracking branch 'remotes/stefanberger/tags/pull-tpm-2018-11-15-1' into staging
Merge tpm 2018/11/15 v1
# gpg: Signature made Thu 15 Nov 2018 14:03:45 GMT
# gpg: using RSA key 75AD65802A0B4211
# gpg: Good signature from "Stefan Berger <stefanb@linux.vnet.ibm.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B818 B9CA DF90 89C2 D5CE C66B 75AD 6580 2A0B 4211
* remotes/stefanberger/tags/pull-tpm-2018-11-15-1:
tests: tpm: Use g_test_message rather than fprintf
tpm: use loop iterator to set sts data field
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Thu, 15 Nov 2018 11:46:16 +0000 (11:46 +0000)]
linux-user/sparc/signal.c: Remove dead code
Coverity complains (CID 1390847) about some dead code in
do_sigreturn(). This is an if (err) clause that can never be
true, copied from the kernel (where __get_user returns an error).
The one code path that could report an error is in the
currently commented-out pseudocode for handling FPU register
restoring, so move the if into that comment (and fix the
broken indent in the comment in the process).
(The new position for the error check is also the semantically
correct one -- we should not restore the signal mask from
the signal frame if we get an error here, so the check must
be done before set_sigmask(), not after.)
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-id: 20181115114616.26265-1-peter.maydell@linaro.org
Michael Roth [Fri, 9 Nov 2018 16:13:52 +0000 (10:13 -0600)]
make-release: add skiboot .version file
This is needed to build skiboot from tarball-distributed sources
since the git data the make_release.sh script relies on to generate
it is not available.
Cc: qemu-stable@nongnu.org Reported-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20181109161352.29873-1-mdroth@linux.vnet.ibm.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Laurent Vivier [Tue, 13 Nov 2018 17:54:37 +0000 (18:54 +0100)]
tests/tcg/multiarch: fix 32bit linux-test on 64bit host
Fix:
TEST linux-test on i386
.../tests/tcg/multiarch/linux-test.c:201: readdir
readdir() calls getdents64() to have the list of the entries in a
directory, and getdents64() can return 64bit d_off values (with ext4,
for instance) that will not fit in the 32bit d_off field of the
readdir() dirent structure.
To avoid that, use readdir64() to use a 64bit d_off field too.
Signed-off-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Alex Bennée [Mon, 8 Oct 2018 10:56:13 +0000 (11:56 +0100)]
.travis.yml: split MacOSX builds and reduce target list
We have reached the point where the MacOSX build was regularly timing
out. So as before I've reduced the target list to "major"
architectures to try and bring the build time down. I've added an
additional MacOSX build with the latest XCode with a minimal list of
"most likely" targets on MacOS.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Palmer Dabbelt [Fri, 9 Nov 2018 18:56:50 +0000 (10:56 -0800)]
RISC-V: Respect fences for user-only emulators
Our current fence implementation ignores fences for the user-only
configurations. This is incorrect but unlikely to manifest: it requires
multi-threaded user-only code that takes advantage of the weakness in
the host's memory model and can be inlined by TCG.
This patch simply treats fences the same way for all our emulators.
I've given it to testing as I don't want to construct a test that would
actually trigger the failure.
Our fence implementation has an additional deficiency where we map all
RISC-V fences to full fences. Now that we have a formal memory model
for RISC-V we can start to take advantage of the strength bits on our
fence instructions. This requires a bit more though, so I'm going to
split it out because the implementation is still correct without taking
advantage of these weaker fences.
Thanks to Richard Henderson for pointing out both of the issues.
Signed-off-by: Palmer Dabbelt <palmer@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
s390x/pci: properly fail if the zPCI device cannot be created
Right now, errors during realize()/pre_plug/plug of the zPCI device
would result in QEMU crashing instead of failing nicely when creating
a zPCI device for a PCI device.
Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Collin Walling <walling@linux.ibm.com> Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20181113121710.18490-1-david@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* remotes/vivier2/tags/linux-user-for-3.1-pull-request:
linux-user: Add support for SO_REUSEPORT
linux-user: Clean up nios2 main loop signal handling
linux-user: Don't call gdb_handlesig() before queue_signal()
linux-user: Remove dead error-checking code
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Tue, 13 Nov 2018 10:52:32 +0000 (10:52 +0000)]
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20181113' into staging
target/arm queue:
* Remove no-longer-needed workaround for small SAU regions for v8M
* Remove antique TODO comment
* MAINTAINERS: Add an entry for the 'collie' machine
* hw/arm/sysbus-fdt: Only call match_fn callback if the type matches
* Fix infinite recursion in tlbi_aa64_vmalle1_write()
* ARM KVM: fix various bugs in handling of guest debugging
* Correctly implement handling of HCR_EL2.{VI, VF}
* Hyp mode R14 is shared with User and System
* Give Cortex-A15 and -A7 the EL2 feature
# gpg: Signature made Tue 13 Nov 2018 10:51:53 GMT
# gpg: using RSA key 3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg: aka "Peter Maydell <pmaydell@gmail.com>"
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE
* remotes/pmaydell/tags/pull-target-arm-20181113:
target/arm/cpu: Give Cortex-A15 and -A7 the EL2 feature
target/arm: Hyp mode R14 is shared with User and System
target/arm: Correctly implement handling of HCR_EL2.{VI, VF}
target/arm: Track the state of our irq lines from the GIC explicitly
Revert "target/arm: Implement HCR.VI and VF"
arm: fix aa64_generate_debug_exceptions to work with EL2
arm: use symbolic MDCR_TDE in arm_debug_target_el
tests/guest-debug: fix scoping of failcount
target/arm64: kvm debug set target_el when passing exception to guest
target/arm64: hold BQL when calling do_interrupt()
target/arm64: properly handle DBGVR RESS bits
target/arm: Fix typo in tlbi_aa64_vmalle1_write
hw/arm/sysbus-fdt: Only call match_fn callback if the type matches
MAINTAINERS: Add an entry for the 'collie' machine
target/arm: Remove antique TODO comment
target/arm: Remove workaround for small SAU regions
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Tue, 13 Nov 2018 10:47:59 +0000 (10:47 +0000)]
target/arm/cpu: Give Cortex-A15 and -A7 the EL2 feature
The Cortex-A15 and Cortex-A7 both have EL2; now we've implemented
it properly we can enable the feature bit.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20181109173553.22341-3-peter.maydell@linaro.org
Peter Maydell [Tue, 13 Nov 2018 10:47:59 +0000 (10:47 +0000)]
target/arm: Hyp mode R14 is shared with User and System
Hyp mode is an exception to the general rule that each AArch32
mode has its own r13, r14 and SPSR -- it has a banked r13 and
SPSR but shares its r14 with User and System mode. We were
incorrectly implementing it as banked, which meant that on
entry to Hyp mode r14 was 0 rather than the USR/SYS r14.
We provide a new function r14_bank_number() which is like
the existing bank_number() but provides the index into
env->banked_r14[]; bank_number() provides the index to use
for env->banked_r13[] and env->banked_cpsr[].
All the points in the code that were using bank_number()
to index into env->banked_r14[] are updated for consintency:
* switch_mode() -- this is the only place where we fix
an actual bug
* aarch64_sync_32_to_64() and aarch64_sync_64_to_32():
no behavioural change as we already special-cased Hyp R14
* kvm32.c: no behavioural change since the guest can't ever
be in Hyp mode, but conceptually the right thing to do
* msr_banked()/mrs_banked(): we can never get to the case
that accesses banked_r14[] with tgtmode == ARM_CPU_MODE_HYP,
so no behavioural change
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20181109173553.22341-2-peter.maydell@linaro.org
Peter Maydell [Tue, 13 Nov 2018 10:47:59 +0000 (10:47 +0000)]
target/arm: Correctly implement handling of HCR_EL2.{VI, VF}
In commit 8a0fc3a29fc2315325400 we tried to implement HCR_EL2.{VI,VF},
but we got it wrong and had to revert it.
In that commit we implemented them as simply tracking whether there
is a pending virtual IRQ or virtual FIQ. This is not correct -- these
bits cause a software-generated VIRQ/VFIQ, which is distinct from
whether there is a hardware-generated VIRQ/VFIQ caused by the
external interrupt controller. So we need to track separately
the HCR_EL2 bit state and the external virq/vfiq line state, and
OR the two together to get the actual pending VIRQ/VFIQ state.
Fixes: 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20181109134731.11605-4-peter.maydell@linaro.org
Peter Maydell [Tue, 13 Nov 2018 10:47:59 +0000 (10:47 +0000)]
target/arm: Track the state of our irq lines from the GIC explicitly
Currently we track the state of the four irq lines from the GIC
only via the cs->interrupt_request or KVM irq state. That means
that we assume that an interrupt is asserted if and only if the
external line is set. This assumption is incorrect for VIRQ
and VFIQ, because the HCR_EL2.{VI,VF} bits allow assertion
of VIRQ and VFIQ separately from the state of the external line.
To handle this, start tracking the state of the external lines
explicitly in a CPU state struct field, as is common practice
for devices.
The complicated part of this is dealing with inbound migration
from an older QEMU which didn't have this state. We assume in
that case that the older QEMU did not implement the HCR_EL2.{VI,VF}
bits as generating interrupts, and so the line state matches
the current state in cs->interrupt_request. (This is not quite
true between commit 8a0fc3a29fc2315325400c7 and its revert, but
that commit is broken and never made it into any released QEMU
version.)
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20181109134731.11605-3-peter.maydell@linaro.org
The implementation of HCR.VI and VF in that commit is not
correct -- they do not track the overall "is there a pending
VIRQ or VFIQ" status, but whether there is a pending interrupt
due to "this mechanism", ie the hypervisor having set the VI/VF
bits. The overall pending state for VIRQ and VFIQ is effectively
the logical OR of the inbound lines from the GIC with the
VI and VF bits. Commit 8a0fc3a29fc231 would result in pending
VIRQ/VFIQ possibly being lost when the hypervisor wrote to HCR.
As a preliminary to implementing the HCR.VI/VF feature properly,
revert the broken one entirely.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20181109134731.11605-2-peter.maydell@linaro.org
Alex Bennée [Tue, 13 Nov 2018 10:47:59 +0000 (10:47 +0000)]
arm: fix aa64_generate_debug_exceptions to work with EL2
The test was incomplete and incorrectly caused debug exceptions to be
generated when returning to EL2 after a failed attempt to single-step
an EL1 instruction. Fix this while cleaning up the function a little.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181109152119.9242-8-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Tue, 13 Nov 2018 10:47:59 +0000 (10:47 +0000)]
arm: use symbolic MDCR_TDE in arm_debug_target_el
We already have this symbol defined so lets use it.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181109152119.9242-7-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Tue, 13 Nov 2018 10:47:59 +0000 (10:47 +0000)]
tests/guest-debug: fix scoping of failcount
You should declare you are using a global version of a variable before
you attempt to modify it in a function.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181109152119.9242-5-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Tue, 13 Nov 2018 10:47:59 +0000 (10:47 +0000)]
target/arm64: kvm debug set target_el when passing exception to guest
When we are debugging the guest all exceptions come our way but might
be for the guest's own debug exceptions. We use the ->do_interrupt()
infrastructure to inject the exception into the guest. However, we are
missing a full setup of the exception structure, causing an assert
later down the line.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181109152119.9242-4-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Tue, 13 Nov 2018 10:47:59 +0000 (10:47 +0000)]
target/arm64: hold BQL when calling do_interrupt()
Fix the assertion failure when running interrupts.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181109152119.9242-3-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Tue, 13 Nov 2018 10:47:59 +0000 (10:47 +0000)]
target/arm64: properly handle DBGVR RESS bits
This only fails with some (broken) versions of gdb but we should
treat the top bits of DBGBVR as RESS. Properly sign extend QEMU's
reference copy of dbgbvr and also update the register descriptions in
the comment.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181109152119.9242-2-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20181110121711.15257-1-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Eric Auger [Tue, 13 Nov 2018 10:47:58 +0000 (10:47 +0000)]
hw/arm/sysbus-fdt: Only call match_fn callback if the type matches
Commit af7d64ede0b9 (hw/arm/sysbus-fdt: Allow device matching with DT
compatible value) introduced a match_fn callback which gets called
for each registered combo to check whether a sysbus device can be
dynamically instantiated. However the callback gets called even if
the device type does not match the binding combo typename field.
This causes an assert when passing "-device ramfb" to the qemu
command line as vfio_platform_match() gets called on a non
vfio-platform device.
To fix this regression, let's change the add_fdt_node() logic so
that we first check the type and if the match_fn callback is defined,
then we also call it.
Binding combos only requesting a type check do not define the
match_fn callback.
Fixes: af7d64ede0b9 (hw/arm/sysbus-fdt: Allow device matching with
DT compatible value)
Signed-off-by: Eric Auger <eric.auger@redhat.com> Reported-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alex Williamson <alex.williamson@redhat.com> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Message-id: 20181106184212.29377-1-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Thomas Huth [Tue, 13 Nov 2018 10:47:58 +0000 (10:47 +0000)]
MAINTAINERS: Add an entry for the 'collie' machine
There is no active maintainer, but since Peter is picking up
patches via qemu-arm@nongnu.org, I think we could at least use
"Odd Fixes" as status here.
Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 1541528230-31817-1-git-send-email-thuth@redhat.com
[PMM: Also add myself as an M: contact] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Tue, 13 Nov 2018 10:47:58 +0000 (10:47 +0000)]
target/arm: Remove antique TODO comment
Remove a TODO comment about implementing the vectored interrupt
controller. We have had an implementation of that for a decade;
it's in hw/intc/pl190.c.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181106164118.16184-1-peter.maydell@linaro.org Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Peter Maydell [Tue, 13 Nov 2018 10:47:58 +0000 (10:47 +0000)]
target/arm: Remove workaround for small SAU regions
Before we supported direct execution from MMIO regions, we
implemented workarounds in commit 720424359917887c926a33d2
which let us avoid doing so, even if the SAU or MPU region
was less than page-sized.
Once we implemented execute-from-MMIO, we removed part
of those workarounds in commit d4b6275df320cee76; but
we forgot the one in get_phys_addr_pmsav8() which
suppressed use of small SAU regions in executable regions.
Remove that workaround now.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181106163801.14474-1-peter.maydell@linaro.org
Peter Maydell [Mon, 12 Nov 2018 17:11:22 +0000 (17:11 +0000)]
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Block layer patches:
- file-posix: Don't waste a file descriptor for locking, don't lock the
same bit multiple times
- nvme: Fix double free and memory leak
- Misc error handling fixes
- Added NULL checks found by static analysis
- Allow more block drivers to not be included in the qemu build
# gpg: Signature made Mon 12 Nov 2018 17:05:00 GMT
# gpg: using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6
* remotes/kevin/tags/for-upstream:
qcow2: Read outside array bounds in qcow2_pre_write_overlap_check()
block: Fix potential Null pointer dereferences in vvfat.c
qemu-img: assert block_job_get() does not return NULL in img_commit()
block: Null pointer dereference in blk_root_get_parent_desc()
job: Fix off-by-one assert checks for JobSTT and JobVerbTable
block: Make more block drivers compile-time configurable
tests: Add unit tests for image locking
file-posix: Drop s->lock_fd
file-posix: Skip effectiveless OFD lock operations
nvme: free cmbuf in nvme_exit
nvme: don't unref ctrl_mem when device unrealized
blockdev: Consistently use snapshot_node_name in external_snapshot_prepare()
blockdev: handle error on block latency histogram set error
file-posix: Use error API properly
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Kevin Wolf [Mon, 12 Nov 2018 16:57:32 +0000 (17:57 +0100)]
Merge remote-tracking branch 'mreitz/tags/pull-block-2018-11-12' into queue-block
Block patches:
- Added NULL checks found by static analysis
- Allow more block drivers to not be included in the qemu build
# gpg: Signature made Mon Nov 12 17:51:18 2018 CET
# gpg: using RSA key F407DB0061D5CF40
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>"
# Primary key fingerprint: 91BE B60A 30DB 3E88 57D1 1829 F407 DB00 61D5 CF40
* mreitz/tags/pull-block-2018-11-12:
qcow2: Read outside array bounds in qcow2_pre_write_overlap_check()
block: Fix potential Null pointer dereferences in vvfat.c
qemu-img: assert block_job_get() does not return NULL in img_commit()
block: Null pointer dereference in blk_root_get_parent_desc()
job: Fix off-by-one assert checks for JobSTT and JobVerbTable
block: Make more block drivers compile-time configurable
Liam Merwick [Mon, 5 Nov 2018 21:38:39 +0000 (21:38 +0000)]
qcow2: Read outside array bounds in qcow2_pre_write_overlap_check()
The commit for 0e4e4318eaa5 increments QCOW2_OL_MAX_BITNR but does not
add an array entry for QCOW2_OL_BITMAP_DIRECTORY_BITNR to metadata_ol_names[].
As a result, an array dereference of metadata_ol_names[8] in
qcow2_pre_write_overlap_check() could result in a read outside of the array bounds.
Fixes: 0e4e4318eaa5 ('qcow2: add overlap check for bitmap directory') Cc: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1541453919-25973-6-git-send-email-Liam.Merwick@oracle.com Signed-off-by: Max Reitz <mreitz@redhat.com>
Liam Merwick [Mon, 5 Nov 2018 21:38:38 +0000 (21:38 +0000)]
block: Fix potential Null pointer dereferences in vvfat.c
The calls to find_mapping_for_cluster() may return NULL but it
isn't always checked for before dereferencing the value returned.
Additionally, add some asserts to cover cases where NULL can't
be returned but which might not be obvious at first glance.
Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com>
Message-id: 1541453919-25973-5-git-send-email-Liam.Merwick@oracle.com
[mreitz: Dropped superfluous check of "mapping" following an assertion
that it is not NULL, and fixed some indentation] Signed-off-by: Max Reitz <mreitz@redhat.com>
Liam Merwick [Mon, 5 Nov 2018 21:38:37 +0000 (21:38 +0000)]
qemu-img: assert block_job_get() does not return NULL in img_commit()
Although the function block_job_get() can return NULL, it would be a
serious bug if it did so (because the job yields before executing anything
(if it started successfully); but otherwise, commit_active_start() would
have returned an error). However, as a precaution, before dereferencing
the 'job' pointer in img_commit() assert it is not NULL.
Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1541453919-25973-4-git-send-email-Liam.Merwick@oracle.com Signed-off-by: Max Reitz <mreitz@redhat.com>
Liam Merwick [Mon, 5 Nov 2018 21:38:36 +0000 (21:38 +0000)]
block: Null pointer dereference in blk_root_get_parent_desc()
The dev_id returned by the call to blk_get_attached_dev_id() in
blk_root_get_parent_desc() can be NULL (an internal call to
object_get_canonical_path may have returned NULL).
Instead of just checking this case before before dereferencing,
adjust blk_get_attached_dev_id() to return the empty string if no
object path can be found (similar to the case when blk->dev is NULL
and an empty string is returned).
Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com>
Message-id: 1541453919-25973-3-git-send-email-Liam.Merwick@oracle.com Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
Liam Merwick [Mon, 5 Nov 2018 21:38:35 +0000 (21:38 +0000)]
job: Fix off-by-one assert checks for JobSTT and JobVerbTable
In the assert checking the array dereference of JobVerbTable[verb]
in job_apply_verb() the check of the index, verb, allows an overrun
because an index equal to the array size is permitted.
Similarly, in the assert check of JobSTT[s0][s1] with index s1
in job_state_transition(), an off-by-one overrun is not flagged
either.
This is not a run-time issue as there are no callers actually
passing in the max value.
Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com> Reviewed-by: Darren Kenny <Darren.Kenny@oracle.com> Reviewed-by: Mark Kanda <Mark.Kanda@oracle.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 1541453919-25973-2-git-send-email-Liam.Merwick@oracle.com Signed-off-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20181107063644.2254-1-armbru@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com>
Fam Zheng [Thu, 11 Oct 2018 07:21:34 +0000 (15:21 +0800)]
file-posix: Drop s->lock_fd
The lock_fd field is not strictly necessary because transferring locked
bytes from old fd to the new one shouldn't fail anyway. This spares the
user one fd per image.
Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
If we know we've already locked the bytes, don't do it again; similarly
don't unlock a byte if we haven't locked it. This doesn't change the
behavior, but fixes a corner case explained below.
Libvirt had an error handling bug that an image can get its (ownership,
file mode, SELinux) permissions changed (RHBZ 1584982) by mistake behind
QEMU. Specifically, an image in use by Libvirt VM has:
$ ls -lhZ b.img
-rw-r--r--. qemu qemu system_u:object_r:svirt_image_t:s0:c600,c690 b.img
Trying to attach it a second time won't work because of image locking.
And after the error, it becomes:
$ ls -lhZ b.img
-rw-r--r--. root root system_u:object_r:virt_image_t:s0 b.img
Then, we won't be able to do OFD lock operations with the existing fd.
In other words, the code such as in blk_detach_dev:
blk_set_perm(blk, 0, BLK_PERM_ALL, &error_abort);
can abort() QEMU, out of environmental changes.
This patch is an easy fix to this and the change is regardlessly
reasonable, so do it.
Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Peter Maydell [Thu, 1 Nov 2018 16:30:37 +0000 (16:30 +0000)]
blockdev: Consistently use snapshot_node_name in external_snapshot_prepare()
In the function external_snapshot_prepare() we have a
BlockdevSnapshotSync struct, which has the usual combination
of has_snapshot_node_name and snapshot_node_name fields for an
optional field. We set up a local variable
const char *snapshot_node_name =
s->has_snapshot_node_name ? s->snapshot_node_name : NULL;
and then mostly use "if (!snapshot_node_name)" for checking
whether we have a snapshot node name. The exception is that in
one place we check s->has_snapshot_node_name instead. This
confuses Coverity (CID 1396473), which thinks it might be
possible to get here with s->has_snapshot_node_name true but
snapshot_node_name NULL, and warns that the call to
qdict_put_str() will segfault in that case.
Make the code consistent and unconfuse Coverity by using
the same check for this conditional that we do in the rest
of the surrounding code.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
zhenwei pi [Mon, 5 Nov 2018 03:04:56 +0000 (11:04 +0800)]
blockdev: handle error on block latency histogram set error
Function block_latency_histogram_set may return error, but qapi ignore this.
This can be reproduced easily by qmp command:
virsh qemu-monitor-command INSTANCE '{"execute":"x-block-latency-histogram-set",
"arguments":{"device":"drive-virtio-disk1","boundaries":[10,200,40]}}'
In fact this command does not work, but we still get success result.
qmp_x_block_latency_histogram_set is a batch setting API, report error ASAP.
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Fam Zheng [Thu, 1 Nov 2018 06:29:09 +0000 (14:29 +0800)]
file-posix: Use error API properly
Use error_report for situations that affect user operation (i.e. we're
actually returning error), and warn_report/warn_report_err when some
less critical error happened but the user operation can still carry on.
For raw_normalize_devicepath, add Error parameter to propagate to
its callers.
Suggested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* remotes/kraxel/tags/fixes-31-20181112-pull-request:
ui/gtk: fix cursor in egl mode
pulseaudio: process audio data in smaller chunks
edid: silence a stringop-overflow warning
bt: Mark the bluetooth subsystem as deprecated
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Yunqiang Su [Tue, 30 Oct 2018 12:55:08 +0000 (13:55 +0100)]
linux-user: Add support for SO_REUSEPORT
Add support for SO_REUSEPORT, including strace support. SO_REUSEPORT
was introduced relatively recently, since Linux 3.9, so use
'#if defined SO_REUSEPORT'.
Signed-off-by: Yunqiang Su <ysu@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <1540904108-30873-4-git-send-email-aleksandar.markovic@rt-rk.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Peter Maydell [Tue, 16 Oct 2018 17:52:36 +0000 (18:52 +0100)]
hw/acpi/nvdimm: Don't take address of fields in packed structs
Taking the address of a field in a packed struct is a bad idea, because
it might not be actually aligned enough for that pointer type (and
thus cause a crash on dereference on some host architectures). Newer
versions of clang warn about this. Avoid the bug by not using the
"modify in place" byte swapping functions.
Patch produced with scripts/coccinelle/inplace-byteswaps.cocci.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 20181016175236.5840-1-peter.maydell@linaro.org
Peter Maydell [Fri, 19 Oct 2018 17:49:58 +0000 (18:49 +0100)]
linux-user: Clean up nios2 main loop signal handling
The nios2 main loop code's code does some odd
things with gdb_handlesig() that no other target
CPU does: it has some signals that are delivered
to gdb and only to gdb. Stop doing this, and instead
behave like all the other targets:
* a trap instruction becomes a SIGTRAP
* an unhandled exception type returned from cpu_exec()
causes us to abort(), not to try to hand gdb a SIGILL
This fixes in passing Coverity issue CID 1390853,
which was a complaint that the old code failed to
check the return value from gdb_handlesig().
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20181019174958.26616-3-peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[lv: removed gdbsig unused variable] Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Peter Maydell [Fri, 19 Oct 2018 17:49:57 +0000 (18:49 +0100)]
linux-user: Don't call gdb_handlesig() before queue_signal()
The CPU main-loop routines for linux-user generally
call gdb_handlesig() when they're about to queue a
SIGTRAP signal. This is wrong, because queue_signal()
will cause us to pend a signal, and process_pending_signals()
will then call gdb_handlesig() itself. So the effect is that
we notify gdb of the SIGTRAP, and then if gdb says "OK,
continue with signal X" we will incorrectly notify
gdb of the signal X as well. We don't do this double-notify
for anything else, only SIGTRAP.
Remove this unnecessary and incorrect code from all
the targets except for nios2 (whose main loop is
doing something different and broken, and will be handled
in a separate patch).
This bug only manifests if the user responds to the reported
SIGTRAP using "signal SIGFOO" rather than "continue"; since
the latter is the overwhelmingly common thing to do after a
breakpoint most people won't have hit this.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20181019174958.26616-2-peter.maydell@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Peter Maydell [Fri, 19 Oct 2018 16:17:15 +0000 (17:17 +0100)]
linux-user: Remove dead error-checking code
Remove some dead code spotted by Coverity (CID 1009855, 1390854, 1390847). The underlying cause in all these cases
is the same: QEMU's put_user operations can't result in
errors, but the kernel's equivalent does. So when code
was copied from the kernel signal-frame-setup/teardown
code, checks on error flags that were needed in the kernel
became dead code for us.
Gerd Hoffmann [Fri, 9 Nov 2018 14:20:32 +0000 (15:20 +0100)]
pulseaudio: process audio data in smaller chunks
The rate of pulseaudio absorbing the audio stream is used to control the
the rate of the guests audio stream. When the emulated hardware uses
small chunks (like intel-hda does) we need small chunks on the audio
backend side too, otherwise that feedback loop doesn't work very well.
Cc: Max Ehrlich <maxehr@umiacs.umd.edu> Cc: Martin Schrodt <martin@schrodt.org> Buglink: https://bugs.launchpad.net/bugs/1795527 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20181109142032.1628-1-kraxel@redhat.com
projects / mirror_qemu.git / log