- Jul 21, 2020
-
-
Peter Maydell authored
Signed-off-by:Peter Maydell <peter.maydell@linaro.org>
-
Peter Maydell authored
Block layer patches: - file-posix: Handle `EINVAL` fallocate return value - qemu-img convert -n: Keep qcow2 v2 target sparse # gpg: Signature made Tue 21 Jul 2020 16:45:28 BST # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: iotests: Test sparseness for qemu-img convert -n qcow2: Implement v2 zero writes with discard if possible file-posix: Handle `EINVAL` fallocate return value Signed-off-by: -
Peter Maydell authored
QOM patches for 2020-07-21 # gpg: Signature made Tue 21 Jul 2020 16:40:27 BST # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qom-2020-07-21: qom: Make info qom-tree sort children more efficiently qom: Document object_get_canonical_path() returns malloced string qom: Change object_get_canonical_path_component() not to malloc Signed-off-by: -
Peter Maydell authored
fixes for xhci and modular builds. # gpg: Signature made Tue 21 Jul 2020 15:02:33 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-20200721-pull-request: module: ignore NULL type qxl: fix modular builds with dtrace xhci: fix valid.max_access_size to access address registers Signed-off-by: -
Peter Maydell authored
# gpg: Signature made Tue 21 Jul 2020 14:31:13 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: hw/net/xgmac: Fix buffer overflow in xgmac_enet_send() hw/net: Added plen fix for IPv6 Signed-off-by: -
Kevin Wolf authored
Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Message-Id: <20200721135520.72355-3-kwolf@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com> Signed-off-by:
-
Markus Armbruster authored
Commit e8c9e658 "qom: Make "info qom-tree" show children sorted" sorts children the simple, stupid, quadratic way. I thought the number of children would be small enough for this not to matter. I was wrong: there are outliers with several hundred children, e.g ARM machines nuri and smdkc210 each have a node with 513 children. While n^2 sorting isn't noticeable in normal, human usage even for n=513, it can be quite noticeable in certain automated tests. In particular, the sort made device-introspect-test even slower. Commit 3e7b80f8 "tests: improve performance of device-introspect-test" just fixed that by cutting back its excessive use of "info qom-tree". Sorting more efficiently makes sense regardless, so do it. Signed-off-by:
Markus Armbruster <armbru@redhat.com> Message-Id: <20200714160202.3121879-6-armbru@redhat.com> Reviewed-by:
Dr. David Alan Gilbert <dgilbert@redhat.com>
-
Peter Maydell authored
QAPI patches patches for 2020-07-21 # gpg: Signature made Tue 21 Jul 2020 14:05:05 BST # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qapi-2020-07-21: qapi: Fix visit_type_STRUCT() not to fail for null object Signed-off-by: -
Kevin Wolf authored
qcow2 version 2 images don't support the zero flag for clusters, so for write_zeroes requests, we return -ENOTSUP and get explicit zero buffer writes. If the image doesn't have a backing file, we can do better: Just discard the respective clusters. This is relevant for 'qemu-img convert -O qcow2 -n', where qemu-img has to assume that the existing target image may contain any data, so it has to write zeroes. Without this patch, this results in a fully allocated target image, even if the source image was empty. Reported-by:
Nir Soffer <nsoffer@redhat.com> Signed-off-by:
-
Antoine Damhet authored
The `detect-zeroes=unmap` option may issue unaligned `FALLOC_FL_PUNCH_HOLE` requests, raw block devices can (and will) return `EINVAL`, qemu should then write the zeroes to the blockdev instead of issuing an `IO_ERROR`. The problem can be reprodced like this: $ qemu-io -c 'write -P 0 42 1234' --image-opts driver=host_device,filename=/dev/loop0,detect-zeroes=unmap write failed: Invalid argument Signed-off-by:
Antoine Damhet <antoine.damhet@blade-group.com> Message-Id: <20200717135603.51180-1-antoine.damhet@blade-group.com> Signed-off-by:
-
Markus Armbruster authored
Signed-off-by:
Philippe Mathieu-Daudé <philmd@redhat.com>
-
Markus Armbruster authored
object_get_canonical_path_component() returns a malloced copy of a property name on success, null on failure. 19 of its 25 callers immediately free the returned copy. Change object_get_canonical_path_component() to return the property name directly. Since modifying the name would be wrong, adjust the return type to const char *. Drop the free from the 19 callers become simpler, add the g_strdup() to the other six. Signed-off-by:
Li Qiang <liq3ea@gmail.com>
-
Mauro Matteo Cascella authored
A buffer overflow issue was reported by Mr. Ziming Zhang, CC'd here. It occurs while sending an Ethernet frame due to missing break statements and improper checking of the buffer size. Reported-by:
Ziming Zhang <ezrakiez@gmail.com> Signed-off-by:
Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by:
Jason Wang <jasowang@redhat.com>
-
Andrew authored
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1708065 With network backend with 'virtual header' - there was an issue in 'plen' field. Overall, during TSO, 'plen' would be changed, but with 'vheader' this field should be set to the size of the payload itself instead of '0'. Signed-off-by:
Andrew Melnychenko <andrew@daynix.com> Signed-off-by:
-
Peter Maydell authored
Block patches for 5.1: - Let LUKS images only be shared between VMs if the guest device was configured to allow that - Fix abort() from bdrv_aio_cancel() for guest devices without a BDS # gpg: Signature made Tue 21 Jul 2020 12:47:17 BST # gpg: using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40 # gpg: issuer "mreitz@redhat.com" # gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full] # Primary key fingerprint: 91BE B60A 30DB 3E88 57D1 1829 F407 DB00 61D5 CF40 * remotes/maxreitz/tags/pull-block-2020-07-21: block: fix bdrv_aio_cancel() for ENOMEDIUM requests qemu-iotests: add testcase for bz #1857490 block/crypto: disallow write sharing by default Signed-off-by: -
Markus Armbruster authored
To make deallocating partially constructed objects work, the visit_type_STRUCT() need to succeed without doing anything when passed a null object. Commit cdd2b228 "qapi: Smooth visitor error checking in generated code" broke that. To reproduce, run tests/test-qobject-input-visitor with AddressSanitizer: ==4353==ERROR: LeakSanitizer: detected memory leaks Direct leak of 16 byte(s) in 1 object(s) allocated from: #0 0x7f192d0c5d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f192cd21b10 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51b10) #2 0x556725f6bbee in visit_next_list qapi/qapi-visit-core.c:86 #3 0x556725f49e15 in visit_type_UserDefOneList tests/test-qapi-visit.c:474 #4 0x556725f4489b in test_visitor_in_fail_struct_in_list tests/test-qobject-input-visitor.c:1086 #5 0x7f192cd42f29 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x72f29) SUMMARY: AddressSanitizer: 16 byte(s) leaked in 1 allocation(s). Test case /visitor/input/fail/struct-in-list feeds a list with a bad element to the QObject input visitor. Visiting that element duly fails, and aborts the visit with the list only partially constructed: the faulty object is null. Cleaning up the partially constructed list visits that null object, fails, and aborts the visit before the list node gets freed. Fix the the generated visit_type_STRUCT() to succeed for null objects. Fixes: cdd2b228 Reported-by:
Li Qiang <liq3ea@163.com> Signed-off-by:
-
Stefan Hajnoczi authored
bdrv_aio_cancel() calls aio_poll() on the AioContext for the given I/O request until it has completed. ENOMEDIUM requests are special because there is no BlockDriverState when the drive has no medium! Define a .get_aio_context() function for BlkAioEmAIOCB requests so that bdrv_aio_cancel() can find the AioContext where the completion BH is pending. Without this function bdrv_aio_cancel() aborts on ENOMEDIUM requests! libFuzzer triggered the following assertion: cat << EOF | qemu-system-i386 -M pc-q35-5.0 \ -nographic -monitor none -serial none \ -qtest stdio -trace ide\* outl 0xcf8 0x8000fa24 outl 0xcfc 0xe106c000 outl 0xcf8 0x8000fa04 outw 0xcfc 0x7 outl 0xcf8 0x8000fb20 write 0x0 0x3 0x2780e7 write 0xe106c22c 0xd 0x1130c218021130c218021130c2 write 0xe106c218 0x15 0x110010110010110010110010110010110010110010 EOF ide_exec_cmd IDE exec cmd: bus 0x56170a77a2b8; state 0x56170a77a340; cmd 0xe7 ide_reset IDEstate 0x56170a77a340 Aborted (core dumped) (gdb) bt #1 0x00007ffff4f93895 in abort () at /lib64/libc.so.6 #2 0x0000555555dc6c00 in bdrv_aio_cancel (acb=0x555556765550) at block/io.c:2745 #3 0x0000555555dac202 in blk_aio_cancel (acb=0x555556765550) at block/block-backend.c:1546 #4 0x0000555555b1bd74 in ide_reset (s=0x555557213340) at hw/ide/core.c:1318 #5 0x0000555555b1e3a1 in ide_bus_reset (bus=0x5555572132b8) at hw/ide/core.c:2422 #6 0x0000555555b2aa27 in ahci_reset_port (s=0x55555720eb50, port=2) at hw/ide/ahci.c:650 #7 0x0000555555b29fd7 in ahci_port_write (s=0x55555720eb50, port=2, offset=44, val=16) at hw/ide/ahci.c:360 #8 0x0000555555b2a564 in ahci_mem_write (opaque=0x55555720eb50, addr=556, val=16, size=1) at hw/ide/ahci.c:513 #9 0x000055555598415b in memory_region_write_accessor (mr=0x55555720eb80, addr=556, value=0x7fffffffb838, size=1, shift=0, mask=255, attrs=...) at softmmu/memory.c:483 Looking at bdrv_aio_cancel: 2728 /* async I/Os */ 2729 2730 void bdrv_aio_cancel(BlockAIOCB *acb) 2731 { 2732 qemu_aio_ref(acb); 2733 bdrv_aio_cancel_async(acb); 2734 while (acb->refcnt > 1) { 2735 if (acb->aiocb_info->get_aio_context) { 2736 aio_poll(acb->aiocb_info->get_aio_context(acb), true); 2737 } else if (acb->bs) { 2738 /* qemu_aio_ref and qemu_aio_unref are not thread-safe, so 2739 * assert that we're not using an I/O thread. Thread-safe 2740 * code should use bdrv_aio_cancel_async exclusively. 2741 */ 2742 assert(bdrv_get_aio_context(acb->bs) == qemu_get_aio_context()); 2743 aio_poll(bdrv_get_aio_context(acb->bs), true); 2744 } else { 2745 abort(); <=============== 2746 } 2747 } 2748 qemu_aio_unref(acb); 2749 } Fixes: 02c50efe ("block: Add bdrv_aio_cancel_async") Reported-by:Alexander Bulekov <alxndr@bu.edu> Buglink: https://bugs.launchpad.net/qemu/+bug/1878255 Originally-by:
Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by:
Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20200720100141.129739-1-stefanha@redhat.com> Signed-off-by:
-
Peter Maydell authored
* Fix memory leak in fuzzer * Fuzzer documentation updates * Some other minor fuzzer updates * Fix "make check-qtest SPEED=slow" (bug in msf2 instance_init) # gpg: Signature made Tue 21 Jul 2020 07:48:10 BST # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * remotes/huth-gitlab/tags/pull-request-2020-07-21: hw: Mark nd_table[] misuse in realize methods FIXME msf2: Unbreak device-list-properties for "msf-soc" MAINTAINERS: Extend the device fuzzing section docs/fuzz: add instructions for generating a coverage report docs/fuzz: add information about useful libFuzzer flags docs/fuzz: describe building fuzzers with enable-sanitizers fuzz: build without AddressSanitizer, by default gitlab-ci.yml: Add oss-fuzz build tests fuzz: Fix leak when assembling datadir path string scripts/oss-fuzz: Limit target list to i386-softmmu Signed-off-by: -
Gerd Hoffmann authored
Just return in case module_load_qom_one(NULL) is called. vga_interface_available() can do that. Signed-off-by:Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20200720100352.2477-3-kraxel@redhat.com>
-
Gerd Hoffmann authored
Checking the enable/disable state of tracepoints via trace_event_get_state_backends() does not work for modules. qxl checks the state for a small optimization (avoid g_strndup call in case log_buf will not be used anyway), so we can just drop that check for modular builds. Signed-off-by: -
Laurent Vivier authored
QEMU XHCI advertises AC64 (64-bit addressing) but doesn't allow 64-bit mode access in "runtime" and "operational" MemoryRegionOps. Set the max_access_size based on sizeof(dma_addr_t) as AC64 is set. XHCI specs: "If the xHC supports 64-bit addressing (AC64 = ‘1’), then software should write 64-bit registers using only Qword accesses. If a system is incapable of issuing Qword accesses, then writes to the 64-bit address fields shall be performed using 2 Dword accesses; low Dword-first, high-Dword second. If the xHC supports 32-bit addressing (AC64 = ‘0’), then the high Dword of registers containing 64-bit address fields are unused and software should write addresses using only Dword accesses" The problem has been detected with SLOF, as linux kernel always accesses registers using 32-bit access even if AC64 is set and revealed by 5d971f9e ("memory: Revert "memory: accept mismatching sizes in memory_region_access_valid"") Suggested-by:
Alexey Kardashevskiy <aik@au1.ibm.com> Signed-off-by:
Laurent Vivier <lvivier@redhat.com> Message-id: 20200721083322.90651-1-lvivier@redhat.com Signed-off-by:
-
Maxim Levitsky authored
Test that we can't write-share raw luks images by default, but we still can with share-rw=on Signed-off-by:
Maxim Levitsky <mlevitsk@redhat.com> Message-Id: <20200719122059.59843-3-mlevitsk@redhat.com> Signed-off-by:
-
Maxim Levitsky authored
My commit 'block/crypto: implement the encryption key management' accidently allowed raw luks images to be shared between different qemu processes without share-rw=on explicit override. Fix that. Fixes: bbfdae91 ("block/crypto: implement the encryption key management") Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1857490 Signed-off-by:
-
Markus Armbruster authored
nd_table[] contains NIC configuration for boards to pick up. Device code has no business looking there. Several devices do it anyway. Two of them already have a suitable FIXME comment: "allwinner-a10" and "msf2-soc". Copy it to the others: "allwinner-h3", "xlnx-versal", "xlnx,zynqmp", "sparc32-ledma", "riscv.sifive.u.soc". Signed-off-by:
Alistair Francis <alistair.francis@wdc.com> Reviewed-by:
Niek Linnenbank <nieklinnenbank@gmail.com> Reviewed-by:
Thomas Huth <thuth@redhat.com> Signed-off-by:
-
Markus Armbruster authored
Watch this: $ qemu-system-aarch64 -M ast2600-evb -S -display none -qmp stdio {"QMP": {"version": {"qemu": {"micro": 50, "minor": 0, "major": 5}, "package": "v5.0.0-2464-g3a9163af4e"}, "capabilities": ["oob"]}} {"execute": "qmp_capabilities"} {"return": {}} {"execute": "device-list-properties", "arguments": {"typename": "msf2-soc"}} Unsupported NIC model: ftgmac100 armbru@dusky:~/work/images$ echo $? 1 This is what breaks "make check SPEED=slow". Root cause is m2sxxx_soc_initfn()'s messing with nd_table[] via qemu_check_nic_model(). That's wrong. We fixed the exact same bug for device "allwinner-a10" in commit 8aabc543 "hw/arm/allwinner-a10: Do not use nd_table in instance_init function". Fix this instance the same way: move the offending code to m2sxxx_soc_realize(), where it's less wrong, and add a FIXME comment. Fixes: 05b7374a ("msf2: Add EMAC block to SmartFusion2 SoC") Signed-off-by: -
Thomas Huth authored
The file docs/devel/fuzzing.txt should be in this section, too, and add myself as a reviewer (since I often take the fuzzer patches through the qtest-next tree, I should be notified on patches, too). Message-Id: <20200721053926.17197-1-thuth@redhat.com> Signed-off-by: -
Alexander Bulekov authored
Signed-off-by:
-
Alexander Bulekov authored
Signed-off-by:
-
Alexander Bulekov authored
Signed-off-by:
-
Alexander Bulekov authored
We already have a nice --enable-sanitizers option to enable AddressSanitizer. There is no reason to duplicate and force this functionality in --enable-fuzzing. In the future, if more sanitizers are added to --enable-sanitizers, it might be impossible to build with both --enable-sanitizers and --enable-fuzzing, since not all sanitizers are compatible with libFuzzer. In that case, we could enable ASAN with --extra-cflags="-fsanitize=address" Signed-off-by:
-
Alexander Bulekov authored
This tries to build and run the fuzzers with the same build-script used by oss-fuzz. This doesn't guarantee that the builds on oss-fuzz will also succeed, since oss-fuzz provides its own compiler and fuzzer vars, but it can catch changes that are not compatible with the the ./scripts/oss-fuzz/build.sh script. The strange way of finding fuzzer binaries stems from the method used by oss-fuzz: https://github.com/google/oss-fuzz/blob/master/infra/base-images/base-runner/targets_list Signed-off-by:
-
Alexander Bulekov authored
We freed the string containing the final datadir path, but did not free the path to the executable's directory that we get from g_path_get_dirname(). Fix that. Reported-by:
-
Thomas Huth authored
The build.sh script only copies qemu-fuzz-i386 to the destination folder, so we can speed up the compilation step quite a bit by not compiling the other targets here. Signed-off-by:
-
- Jul 20, 2020
-
-
Peter Maydell authored
target-arm queue: * virt: Don't enable MTE emulation by default * virt: Diagnose attempts to use MTE with memory-hotplug or KVM (rather than silently not working correctly) * util: Implement qemu_get_thread_id() for OpenBSD * qdev: Add doc comments for qdev_unrealize and GPIO functions, and standardize on doc-comments-in-header-file * hw/arm/armsse: Assert info->num_cpus is in-bounds in armsse_realize() * docs/system: Document canon-a1100, collie, gumstix, virt boards # gpg: Signature made Mon 20 Jul 2020 13:55:36 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20200720: docs/system: Document the arm virt board docs/system: Briefly document gumstix boards docs/system: Briefly document collie board docs/system: Briefly document canon-a1100 board hw/arm/armsse: Assert info->num_cpus is in-bounds in armsse_realize() qdev: Document GPIO related functions qdev: Document qdev_unrealize() qdev: Move doc comments from qdev.c to qdev-core.h util: Implement qemu_get_thread_id() for OpenBSD hw/arm/virt: Disable memory hotplug when MTE is enabled hw/arm/virt: Error for MTE enabled with KVM hw/arm/virt: Enable MTE via a machine property Signed-off-by: -
Peter Maydell authored
Document the arm 'virt' board, which has been undocumented for far too long given that it is the main recommended board type for arm guests. Signed-off-by:
Alex Bennée <alex.bennee@linaro.org> Message-id: 20200713175746.5936-5-peter.maydell@linaro.org
-
Peter Maydell authored
Add skeletal documentation of the gumstix boards ('connex' and 'verdex'). Signed-off-by: -
Peter Maydell authored
Add skeletal documentation of the collie board. Signed-off-by:
-
Peter Maydell authored
Add skeletal documentation of the canon-a1100 board. Signed-off-by:
-
Peter Maydell authored
In armsse_realize() we have a loop over [0, info->num_cpus), which indexes into various fixed-size arrays in the ARMSSE struct. This confuses Coverity, which warns that we might overrun those arrays (CID 1430326, 1430337, 1430371, 1430414, 1430430). This can't actually happen, because the info struct is always one of the entries in the armsse_variants[] array and num_cpus is either 1 or 2; we also already assert in armsse_init() that num_cpus is not too large. However, adding an assert to armsse_realize() like the one in armsse_init() should help Coverity figure out that these code paths aren't possible. Signed-off-by:
-
Peter Maydell authored
Add documentation comments for the various qdev functions related to creating and connecting GPIO lines. Signed-off-by:
Richard Henderson <richard.henderson@linaro.org> Message-id: 20200711142425.16283-4-peter.maydell@linaro.org
-
