[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-commits] [qemu/qemu] 9e6e3b: hostmem: don't use mbind() if host-no
|
From: |
Michael Roth |
|
Subject: |
[Qemu-commits] [qemu/qemu] 9e6e3b: hostmem: don't use mbind() if host-nodes is empty |
|
Date: |
Tue, 15 Sep 2020 14:30:36 -0700 |
Branch: refs/heads/stable-5.0
Home: https://github.com/qemu/qemu
Commit: 9e6e3ba30984267be4721022f579fb168d43c8a4
https://github.com/qemu/qemu/commit/9e6e3ba30984267be4721022f579fb168d43c8a4
Author: Igor Mammedov <imammedo@redhat.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M backends/hostmem.c
Log Message:
-----------
hostmem: don't use mbind() if host-nodes is empty
Since 5.0 QEMU uses hostmem backend for allocating main guest RAM.
The backend however calls mbind() which is typically NOP
in case of default policy/absent host-nodes bitmap.
However when runing in container with black-listed mbind()
syscall, QEMU fails to start with error
"cannot bind memory to host NUMA nodes: Operation not permitted"
even when user hasn't provided host-nodes to pin to explictly
(which is the case with -m option)
To fix issue, call mbind() only in case when user has provided
host-nodes explicitly (i.e. host_nodes bitmap is not empty).
That should allow to run QEMU in containers with black-listed
mbind() without memory pinning. If QEMU provided memory-pinning
is required user still has to white-list mbind() in container
configuration.
Reported-by: Manuel Hohmann <mhohmann@physnet.uni-hamburg.de>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20200430154606.6421-1-imammedo@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
(cherry picked from commit 70b6d525dfb51d5e523d568d1139fc051bc223c5)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 352259fef83f689b8a8c436a24093e6ede167288
https://github.com/qemu/qemu/commit/352259fef83f689b8a8c436a24093e6ede167288
Author: Richard Henderson <richard.henderson@linaro.org>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M target/arm/vec_helper.c
Log Message:
-----------
target/arm: Clear tail in gvec_fmul_idx_*, gvec_fmla_idx_*
Must clear the tail for AdvSIMD when SVE is enabled.
Fixes: ca40a6e6e39
Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200513163245.17915-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 525d9b6d42844e187211d25b69be8b378785bc24)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: bdac9aabd92bd8e6d070cbc83e46272e86f63dc5
https://github.com/qemu/qemu/commit/bdac9aabd92bd8e6d070cbc83e46272e86f63dc5
Author: Raphael Pour <raphael.pour@hetzner.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M qemu-nbd.c
Log Message:
-----------
qemu-nbd: Close inherited stderr
Close inherited stderr of the parent if fork_process is false.
Otherwise no one will close it. (introduced by e6df58a5)
This only affected 'qemu-nbd -c /dev/nbd0'.
Signed-off-by: Raphael Pour <raphael.pour@hetzner.com>
Message-Id: <d8ddc993-9816-836e-a3de-c6edab9d9c49@hetzner.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: Enhance commit message]
Signed-off-by: Eric Blake <eblake@redhat.com>
(cherry picked from commit 0eaf453ebf6788885fbb5d40426b154ef8805407)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 250322bfbdec098699b414422008aa8ae65f7d4d
https://github.com/qemu/qemu/commit/250322bfbdec098699b414422008aa8ae65f7d4d
Author: Greg Kurz <groug@kaod.org>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M hw/9pfs/9p.h
Log Message:
-----------
9p: Lock directory streams with a CoMutex
Locking was introduced in QEMU 2.7 to address the deprecation of
readdir_r(3) in glibc 2.24. It turns out that the frontend code is
the worst place to handle a critical section with a pthread mutex:
the code runs in a coroutine on behalf of the QEMU mainloop and then
yields control, waiting for the fsdev backend to process the request
in a worker thread. If the client resends another readdir request for
the same fid before the previous one finally unlocked the mutex, we're
deadlocked.
This never bit us because the linux client serializes readdir requests
for the same fid, but it is quite easy to demonstrate with a custom
client.
A good solution could be to narrow the critical section in the worker
thread code and to return a copy of the dirent to the frontend, but
this causes quite some changes in both 9p.c and codir.c. So, instead
of that, in order for people to easily backport the fix to older QEMU
versions, let's simply use a CoMutex since all the users for this
sit in coroutines.
Fixes: 7cde47d4a89d ("9p: add locking to V9fsDir")
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Message-Id: <158981894794.109297.3530035833368944254.stgit@bahia.lan>
Signed-off-by: Greg Kurz <groug@kaod.org>
(cherry picked from commit ed463454efd0ac3042ff772bfe1b1d846dc281a5)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: c6414cb18315e4d043b6756faf9766fb0d8488bb
https://github.com/qemu/qemu/commit/c6414cb18315e4d043b6756faf9766fb0d8488bb
Author: Thomas Huth <thuth@redhat.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M net/net.c
Log Message:
-----------
net: Do not include a newline in the id of -nic devices
The '\n' sneaked in by accident here, an "id" string should really
not contain a newline character at the end.
Fixes: 78cd6f7bf6b ('net: Add a new convenience option "--nic" ...')
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20200518074352.23125-1-thuth@redhat.com>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
(cherry picked from commit 0561dfac082becdd9e89110249a27b309b62aa9f)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: d48973dc26f9f852eb32b89ae33db717d192df5c
https://github.com/qemu/qemu/commit/d48973dc26f9f852eb32b89ae33db717d192df5c
Author: Eric Blake <eblake@redhat.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M nbd/server.c
M tests/qemu-iotests/143
M tests/qemu-iotests/143.out
Log Message:
-----------
nbd/server: Avoid long error message assertions CVE-2020-10761
Ever since commit 36683283 (v2.8), the server code asserts that error
strings sent to the client are well-formed per the protocol by not
exceeding the maximum string length of 4096. At the time the server
first started sending error messages, the assertion could not be
triggered, because messages were completely under our control.
However, over the years, we have added latent scenarios where a client
could trigger the server to attempt an error message that would
include the client's information if it passed other checks first:
- requesting NBD_OPT_INFO/GO on an export name that is not present
(commit 0cfae925 in v2.12 echoes the name)
- requesting NBD_OPT_LIST/SET_META_CONTEXT on an export name that is
not present (commit e7b1948d in v2.12 echoes the name)
At the time, those were still safe because we flagged names larger
than 256 bytes with a different message; but that changed in commit
93676c88 (v4.2) when we raised the name limit to 4096 to match the NBD
string limit. (That commit also failed to change the magic number
4096 in nbd_negotiate_send_rep_err to the just-introduced named
constant.) So with that commit, long client names appended to server
text can now trigger the assertion, and thus be used as a denial of
service attack against a server. As a mitigating factor, if the
server requires TLS, the client cannot trigger the problematic paths
unless it first supplies TLS credentials, and such trusted clients are
less likely to try to intentionally crash the server.
We may later want to further sanitize the user-supplied strings we
place into our error messages, such as scrubbing out control
characters, but that is less important to the CVE fix, so it can be a
later patch to the new nbd_sanitize_name.
Consideration was given to changing the assertion in
nbd_negotiate_send_rep_verr to instead merely log a server error and
truncate the message, to avoid leaving a latent path that could
trigger a future CVE DoS on any new error message. However, this
merely complicates the code for something that is already (correctly)
flagging coding errors, and now that we are aware of the long message
pitfall, we are less likely to introduce such errors in the future,
which would make such error handling dead code.
Reported-by: Xueqiang Wei <xuwei@redhat.com>
CC: qemu-stable@nongnu.org
Fixes: https://bugzilla.redhat.com/1843684 CVE-2020-10761
Fixes: 93676c88d7
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20200610163741.3745251-2-eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
(cherry picked from commit 5c4fe018c025740fef4a0a4421e8162db0c3eefd)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 99458fbb5649f16a8a5a61774d4e9b9bf13d2d50
https://github.com/qemu/qemu/commit/99458fbb5649f16a8a5a61774d4e9b9bf13d2d50
Author: David Hildenbrand <david@redhat.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M hw/virtio/virtio-balloon.c
Log Message:
-----------
virtio-balloon: fix free page hinting without an iothread
In case we don't have an iothread, we mark the feature as abscent but
still add the queue. 'free_page_bh' remains set to NULL.
qemu-system-i386 \
-M microvm \
-nographic \
-device virtio-balloon-device,free-page-hint=true \
-nographic \
-display none \
-monitor none \
-serial none \
-qtest stdio
Doing a "write 0xc0000e30 0x24
0x030000000300000003000000030000000300000003000000030000000300000003000000"
We will trigger a SEGFAULT. Let's move the check and bail out.
While at it, move the static initializations to instance_init().
free_page_report_status and block_iothread are implicitly set to the
right values (0/false) already, so drop the initialization.
Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Fixes: c13c4153f76d ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT")
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Cc: qemu-stable@nongnu.org
Cc: Wei Wang <wei.w.wang@intel.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
Cc: Alexander Duyck <alexander.duyck@gmail.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20200520100439.19872-2-david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 12fc8903a8ee09fb5f642de82699a0b211e1b5a7)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 945d9273c8234dcc2f301059fe294df5e722b055
https://github.com/qemu/qemu/commit/945d9273c8234dcc2f301059fe294df5e722b055
Author: David Hildenbrand <david@redhat.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M hw/virtio/virtio-balloon.c
Log Message:
-----------
virtio-balloon: fix free page hinting check on unrealize
Checking against guest features is wrong. We allocated data structures
based on host features. We can rely on "free_page_bh" as an indicator
whether to un-do stuff instead.
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Fixes: c13c4153f76d ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT")
Cc: qemu-stable@nongnu.org
Cc: Wei Wang <wei.w.wang@intel.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
Cc: Alexander Duyck <alexander.duyck@gmail.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20200520100439.19872-3-david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 49b01711b8eb3796c6904c7f85d2431572cfe54f)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: d1cba8ca6039a31c7b75e308cb0b1f3522050aa9
https://github.com/qemu/qemu/commit/d1cba8ca6039a31c7b75e308cb0b1f3522050aa9
Author: David Hildenbrand <david@redhat.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M hw/virtio/virtio-balloon.c
Log Message:
-----------
virtio-balloon: unref the iothread when unrealizing
We took a reference when realizing, so let's drop that reference when
unrealizing.
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Fixes: c13c4153f76d ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT")
Cc: qemu-stable@nongnu.org
Cc: Wei Wang <wei.w.wang@intel.com>
Cc: Alexander Duyck <alexander.duyck@gmail.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20200520100439.19872-4-david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 105aef9c9479786d27c1c45c9b0b1fa03dc46be3)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 4cc0a28a6ed7b7746ea074c4ef60e39212fe1f11
https://github.com/qemu/qemu/commit/4cc0a28a6ed7b7746ea074c4ef60e39212fe1f11
Author: Eric Blake <eblake@redhat.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M block.c
M block/nbd.c
Log Message:
-----------
block: Call attention to truncation of long NBD exports
Commit 93676c88 relaxed our NBD client code to request export names up
to the NBD protocol maximum of 4096 bytes without NUL terminator, even
though the block layer can't store anything longer than 4096 bytes
including NUL terminator for display to the user. Since this means
there are some export names where we have to truncate things, we can
at least try to make the truncation a bit more obvious for the user.
Note that in spite of the truncated display name, we can still
communicate with an NBD server using such a long export name; this was
deemed nicer than refusing to even connect to such a server (since the
server may not be under our control, and since determining our actual
length limits gets tricky when nbd://host:port/export and
nbd+unix:///export?socket=/path are themselves variable-length
expansions beyond the export name but count towards the block layer
name length).
Reported-by: Xueqiang Wei <xuwei@redhat.com>
Fixes: https://bugzilla.redhat.com/1843684
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200610163741.3745251-3-eblake@redhat.com>
(cherry picked from commit 5c86bdf1208916ece0b87e1151c9b48ee54faa3e)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: e37ba5c637cf55d2f25713f6bcf51052bb2089d6
https://github.com/qemu/qemu/commit/e37ba5c637cf55d2f25713f6bcf51052bb2089d6
Author: Omar Sandoval <osandov@fb.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M hw/9pfs/9p-util.h
Log Message:
-----------
9pfs: local: ignore O_NOATIME if we don't have permissions
QEMU's local 9pfs server passes through O_NOATIME from the client. If
the QEMU process doesn't have permissions to use O_NOATIME (namely, it
does not own the file nor have the CAP_FOWNER capability), the open will
fail. This causes issues when from the client's point of view, it
believes it has permissions to use O_NOATIME (e.g., a process running as
root in the virtual machine). Additionally, overlayfs on Linux opens
files on the lower layer using O_NOATIME, so in this case a 9pfs mount
can't be used as a lower layer for overlayfs (cf.
https://github.com/osandov/drgn/blob/dabfe1971951701da13863dbe6d8a1d172ad9650/vmtest/onoatimehack.c
and https://github.com/NixOS/nixpkgs/issues/54509).
Luckily, O_NOATIME is effectively a hint, and is often ignored by, e.g.,
network filesystems. open(2) notes that O_NOATIME "may not be effective
on all filesystems. One example is NFS, where the server maintains the
access time." This means that we can honor it when possible but fall
back to ignoring it.
Acked-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Signed-off-by: Omar Sandoval <osandov@fb.com>
Message-Id:
<e9bee604e8df528584693a4ec474ded6295ce8ad.1587149256.git.osandov@fb.com>
Signed-off-by: Greg Kurz <groug@kaod.org>
(cherry picked from commit a5804fcf7b22fc7d1f9ec794dd284c7d504bd16b)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 5bfdf41d7c12335fd44645cdfa2eb04eb0d15b5b
https://github.com/qemu/qemu/commit/5bfdf41d7c12335fd44645cdfa2eb04eb0d15b5b
Author: Dan Robertson <dan@dlrobertson.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M hw/9pfs/9p.c
Log Message:
-----------
9pfs: include linux/limits.h for XATTR_SIZE_MAX
linux/limits.h should be included for the XATTR_SIZE_MAX definition used
by v9fs_xattrcreate.
Fixes: 3b79ef2cf488 ("9pfs: limit xattr size in xattrcreate")
Signed-off-by: Dan Robertson <dan@dlrobertson.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Message-Id: <20200515203015.7090-2-dan@dlrobertson.com>
Signed-off-by: Greg Kurz <groug@kaod.org>
(cherry picked from commit 03556ea920b23c466ce7c1283199033de33ee671)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: f56a86ad8d5954f21e1f11634a9df1f3d2856152
https://github.com/qemu/qemu/commit/f56a86ad8d5954f21e1f11634a9df1f3d2856152
Author: Christian Schoenebeck <qemu_oss@crudebyte.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M hw/9pfs/xen-9p-backend.c
Log Message:
-----------
xen-9pfs: Fix log messages of reply errors
If delivery of some 9pfs response fails for some reason, log the
error message by mentioning the 9P protocol reply type, not by
client's request type. The latter could be misleading that the
error occurred already when handling the request input.
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Message-Id:
<ad0e5a9b6abde52502aa40b30661d29aebe1590a.1589132512.git.qemu_oss@crudebyte.com>
Signed-off-by: Greg Kurz <groug@kaod.org>
(cherry picked from commit 9bbb7e0fe081efff2e41f8517c256b72a284fe9b)
*prereq for cf45183b718
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: b38d9cada46ba6229ed6c87bf777cecb24af0c6b
https://github.com/qemu/qemu/commit/b38d9cada46ba6229ed6c87bf777cecb24af0c6b
Author: Stefano Stabellini <stefano.stabellini@xilinx.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M hw/9pfs/9p.c
M hw/9pfs/9p.h
M hw/9pfs/virtio-9p-device.c
M hw/9pfs/xen-9p-backend.c
Log Message:
-----------
Revert "9p: init_in_iov_from_pdu can truncate the size"
This reverts commit 16724a173049ac29c7b5ade741da93a0f46edff7.
It causes https://bugs.launchpad.net/bugs/1877688.
Signed-off-by: Stefano Stabellini <stefano.stabellini@xilinx.com>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Message-Id: <20200521192627.15259-1-sstabellini@kernel.org>
Signed-off-by: Greg Kurz <groug@kaod.org>
(cherry picked from commit cf45183b718f02b1369e18c795dc51bc1821245d)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: cb84d9d353d40dbcd02fd8ff2c83971ecac0e65b
https://github.com/qemu/qemu/commit/cb84d9d353d40dbcd02fd8ff2c83971ecac0e65b
Author: Stefano Stabellini <stefano.stabellini@xilinx.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M hw/9pfs/xen-9p-backend.c
Log Message:
-----------
xen/9pfs: yield when there isn't enough room on the ring
Instead of truncating replies, which is problematic, wait until the
client reads more data and frees bytes on the reply ring.
Do that by calling qemu_coroutine_yield(). The corresponding
qemu_coroutine_enter_if_inactive() is called from xen_9pfs_bh upon
receiving the next notification from the client.
We need to be careful to avoid races in case xen_9pfs_bh and the
coroutine are both active at the same time. In xen_9pfs_bh, wait until
either the critical section is over (ring->co == NULL) or until the
coroutine becomes inactive (qemu_coroutine_yield() was called) before
continuing. Then, simply wake up the coroutine if it is inactive.
Signed-off-by: Stefano Stabellini <stefano.stabellini@xilinx.com>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Message-Id: <20200521192627.15259-2-sstabellini@kernel.org>
Signed-off-by: Greg Kurz <groug@kaod.org>
(cherry picked from commit a4c4d462729466c4756bac8a0a8d77eb63b21ef7)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 387a3ac89d5cc821c4064295122dc3183b6aca69
https://github.com/qemu/qemu/commit/387a3ac89d5cc821c4064295122dc3183b6aca69
Author: Prasad J Pandit <pjp@fedoraproject.org>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M hw/display/ati.c
Log Message:
-----------
ati-vga: check mm_index before recursive call (CVE-2020-13800)
While accessing VGA registers via ati_mm_read/write routines,
a guest may set 's->regs.mm_index' such that it leads to infinite
recursion. Check mm_index value to avoid such recursion. Log an
error message for wrong values.
Reported-by: Ren Ding <rding@gatech.edu>
Reported-by: Hanqing Zhao <hanqing@gatech.edu>
Reported-by: Yi Ren <c4tren@gmail.com>
Message-id: 20200604090830.33885-1-ppandit@redhat.com
Suggested-by: BALATON Zoltan <balaton@eik.bme.hu>
Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit a98610c429d52db0937c1e48659428929835c455)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: dd506af071328eae57995eacc4aa4128c5f6d8c8
https://github.com/qemu/qemu/commit/dd506af071328eae57995eacc4aa4128c5f6d8c8
Author: Prasad J Pandit <pjp@fedoraproject.org>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M hw/audio/es1370.c
Log Message:
-----------
es1370: check total frame count against current frame
A guest user may set channel frame count via es1370_write()
such that, in es1370_transfer_audio(), total frame count
'size' is lesser than the number of frames that are processed
'cnt'.
int cnt = d->frame_cnt >> 16;
int size = d->frame_cnt & 0xffff;
if (size < cnt), it results in incorrect calculations leading
to OOB access issue(s). Add check to avoid it.
Reported-by: Ren Ding <rding@gatech.edu>
Reported-by: Hanqing Zhao <hanqing@gatech.edu>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20200514200608.1744203-1-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 369ff955a8497988d079c4e3fa1e93c2570c1c69)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: d723a57acd985cf5c9fdf8a2761d1ca53a3179c0
https://github.com/qemu/qemu/commit/d723a57acd985cf5c9fdf8a2761d1ca53a3179c0
Author: Helge Deller <deller@gmx.de>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M hw/net/tulip.c
Log Message:
-----------
Fix tulip breakage
The tulip network driver in a qemu-system-hppa emulation is broken in
the sense that bigger network packages aren't received any longer and
thus even running e.g. "apt update" inside the VM fails.
The breakage was introduced by commit 8ffb7265af ("check frame size and
r/w data length") which added checks to prevent accesses outside of the
rx/tx buffers.
But the new checks were implemented wrong. The variable rx_frame_len
counts backwards, from rx_frame_size down to zero, and the variable len
is never bigger than rx_frame_len, so accesses just can't happen and the
checks are unnecessary.
On the contrary the checks now prevented bigger packages to be moved
into the rx buffers.
This patch reverts the wrong checks and were sucessfully tested with a
qemu-system-hppa emulation.
Fixes: 8ffb7265af ("check frame size and r/w data length")
Buglink: https://bugs.launchpad.net/bugs/1874539
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit d9b69640391618045949f7c500b87fc129f862ed)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 73a01bc9b0351b45ba06c327d5c54025a9aaa0b7
https://github.com/qemu/qemu/commit/73a01bc9b0351b45ba06c327d5c54025a9aaa0b7
Author: Kevin Wolf <kwolf@redhat.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M tests/qemu-iotests/283
M tests/qemu-iotests/283.out
Log Message:
-----------
iotests/283: Use consistent size for source and target
The test case forgot to specify the null-co size for the target node.
When adding a check to backup that both sizes match, this would fail
because of the size mismatch and not the behaviour that the test really
wanted to test.
Fixes: a541fcc27c98b96da187c7d4573f3270f3ddd283
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20200430142755.315494-2-kwolf@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 813cc2545b82409fd504509f0ba2e96fab6edb9e)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: a637ea0c5298af9e10f5cfe659dc9093d4d7bc9c
https://github.com/qemu/qemu/commit/a637ea0c5298af9e10f5cfe659dc9093d4d7bc9c
Author: Stefan Hajnoczi <stefanha@redhat.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M tools/virtiofsd/fuse_lowlevel.h
M tools/virtiofsd/helper.c
M tools/virtiofsd/passthrough_ll.c
Log Message:
-----------
virtiofsd: add --rlimit-nofile=NUM option
Make it possible to specify the RLIMIT_NOFILE on the command-line.
Users running multiple virtiofsd processes should allocate a certain
number to each process so that the system-wide limit can never be
exhausted.
When this option is set to 0 the rlimit is left at its current value.
This is useful when a management tool wants to configure the rlimit
itself.
The default behavior remains unchanged: try to set the limit to
1,000,000 file descriptors if the current rlimit is lower.
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20200501140644.220940-2-stefanha@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
(cherry picked from commit 6dbb716877728ce4eb51619885ef6ef4ada9565f)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: c1abbd0f047e81ea5441baa586c5e3e9901318aa
https://github.com/qemu/qemu/commit/c1abbd0f047e81ea5441baa586c5e3e9901318aa
Author: Stefan Hajnoczi <stefanha@redhat.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M tools/virtiofsd/helper.c
Log Message:
-----------
virtiofsd: stay below fs.file-max sysctl value (CVE-2020-10717)
The system-wide fs.file-max sysctl value determines how many files can
be open. It defaults to a value calculated based on the machine's RAM
size. Previously virtiofsd would try to set RLIMIT_NOFILE to 1,000,000
and this allowed the FUSE client to exhaust the number of open files
system-wide on Linux hosts with less than 10 GB of RAM!
Take fs.file-max into account when choosing the default RLIMIT_NOFILE
value.
Fixes: CVE-2020-10717
Reported-by: Yuval Avrahami <yavrahami@paloaltonetworks.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20200501140644.220940-3-stefanha@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
(cherry picked from commit 8c1d353d107b4fc344e27f2f08ea7fa25de2eea2)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 521898ac31a76c930bf8f213d8cdb0233da7a9ff
https://github.com/qemu/qemu/commit/521898ac31a76c930bf8f213d8cdb0233da7a9ff
Author: Jason Wang <jasowang@redhat.com>
Date: 2020-08-24 (Mon, 24 Aug 2020)
Changed paths:
M net/net.c
Log Message:
-----------
net: use peer when purging queue in qemu_flush_or_purge_queue_packets()
The sender of packet will be checked in the qemu_net_queue_purge() but
we use NetClientState not its peer when trying to purge the incoming
queue in qemu_flush_or_purge_packets(). This will trigger the assert
in virtio_net_reset since we can't pass the sender check:
hw/net/virtio-net.c:533: void virtio_net_reset(VirtIODevice *): Assertion
`!virtio_net_get_subqueue(nc)->async_tx.elem' failed.
#9 0x55a33fa31b78 in virtio_net_reset hw/net/virtio-net.c:533:13
#10 0x55a33fc88412 in virtio_reset hw/virtio/virtio.c:1919:9
#11 0x55a341d82764 in virtio_bus_reset hw/virtio/virtio-bus.c:95:9
#12 0x55a341dba2de in virtio_pci_reset hw/virtio/virtio-pci.c:1824:5
#13 0x55a341db3e02 in virtio_pci_common_write hw/virtio/virtio-pci.c:1252:13
#14 0x55a33f62117b in memory_region_write_accessor memory.c:496:5
#15 0x55a33f6205e4 in access_with_adjusted_size memory.c:557:18
#16 0x55a33f61e177 in memory_region_dispatch_write memory.c:1488:16
Reproducer:
https://www.mail-archive.com/qemu-devel@nongnu.org/msg701914.html
Fix by using the peer.
Reported-by: "Alexander Bulekov" <alxndr@bu.edu>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: ca77d85e1dbf9 ("net: complete all queued packets on VM stop")
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 5fe19fb81839ea42b592b409f725349cf3c73551)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 458ae56d22a78d84135fd5dfe8e837be83d74ce9
https://github.com/qemu/qemu/commit/458ae56d22a78d84135fd5dfe8e837be83d74ce9
Author: Paolo Bonzini <pbonzini@redhat.com>
Date: 2020-08-25 (Tue, 25 Aug 2020)
Changed paths:
M target/i386/cpu.c
M target/i386/kvm.c
M target/i386/kvm_i386.h
Log Message:
-----------
KVM: x86: believe what KVM says about WAITPKG
Currently, QEMU is overriding KVM_GET_SUPPORTED_CPUID's answer for
the WAITPKG bit depending on the "-overcommit cpu-pm" setting. This is a
bad idea because it does not even check if the host supports it, but it
can be done in x86_cpu_realizefn just like we do for the MONITOR bit.
This patch moves it there, while making it conditional on host
support for the related UMWAIT MSR.
Cc: qemu-stable@nongnu.org
Reported-by: Maxim Levitsky <mlevitsk@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit e1e43813e7908b063938a3d01f172f88f6190c80)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 5145f2471caa4ef58e200e151f736e633a5fb1ac
https://github.com/qemu/qemu/commit/5145f2471caa4ef58e200e151f736e633a5fb1ac
Author: Stefan Hajnoczi <stefanha@redhat.com>
Date: 2020-08-25 (Tue, 25 Aug 2020)
Changed paths:
M util/aio-posix.c
M util/fdmon-io_uring.c
Log Message:
-----------
aio-posix: don't duplicate fd handler deletion in fdmon_io_uring_destroy()
The io_uring file descriptor monitoring implementation has an internal
list of fd handlers that are pending submission to io_uring.
fdmon_io_uring_destroy() deletes all fd handlers on the list.
Don't delete fd handlers directly in fdmon_io_uring_destroy() for two
reasons:
1. This duplicates the aio-posix.c AioHandler deletion code and could
become outdated if the struct changes.
2. Only handlers with the FDMON_IO_URING_REMOVE flag set are safe to
remove. If the flag is not set then something still has a pointer to
the fd handler. Let aio-posix.c and its user worry about that. In
practice this isn't an issue because fdmon_io_uring_destroy() is only
called when shutting down so all users have removed their fd
handlers, but the next patch will need this!
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Tested-by: Oleksandr Natalenko <oleksandr@redhat.com>
Message-id: 20200511183630.279750-2-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit de137e44f75d9868f5b548638081850f6ac771f2)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: dcc935873b688a789744ec0a2d0d1b3570d18a6c
https://github.com/qemu/qemu/commit/dcc935873b688a789744ec0a2d0d1b3570d18a6c
Author: Stefan Hajnoczi <stefanha@redhat.com>
Date: 2020-08-25 (Tue, 25 Aug 2020)
Changed paths:
M include/block/aio.h
M util/aio-posix.c
M util/aio-win32.c
M util/async.c
Log Message:
-----------
aio-posix: disable fdmon-io_uring when GSource is used
The glib event loop does not call fdmon_io_uring_wait() so fd handlers
waiting to be submitted build up in the list. There is no benefit is
using io_uring when the glib GSource is being used, so disable it
instead of implementing a more complex fix.
This fixes a memory leak where AioHandlers would build up and increasing
amounts of CPU time were spent iterating them in aio_pending(). The
symptom is that guests become slow when QEMU is built with io_uring
support.
Buglink: https://bugs.launchpad.net/qemu/+bug/1877716
Fixes: 73fd282e7b6dd4e4ea1c3bbb3d302c8db51e4ccf ("aio-posix: add io_uring fd
monitoring implementation")
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Tested-by: Oleksandr Natalenko <oleksandr@redhat.com>
Message-id: 20200511183630.279750-3-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit ba607ca8bff4d2c2062902f8355657c865ac7c29)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 160546b81ec54a08153305e40db7e524723904ab
https://github.com/qemu/qemu/commit/160546b81ec54a08153305e40db7e524723904ab
Author: Sergei Trofimovich <slyfox@gentoo.org>
Date: 2020-08-25 (Tue, 25 Aug 2020)
Changed paths:
M linux-user/strace.list
Log Message:
-----------
linux-user/strace.list: fix epoll_create{,1} -strace output
Fix syscall name and parameters priinter.
Before the change:
```
$ alpha-linux-user/qemu-alpha -strace -L /usr/alpha-unknown-linux-gnu/ /tmp/a
...
1274697
%s(%d)(2097152,274903156744,274903156760,274905840712,274877908880,274903235616)
= 3
1274697 exit_group(0)
```
After the change:
```
$ alpha-linux-user/qemu-alpha -strace -L /usr/alpha-unknown-linux-gnu/ /tmp/a
...
1273719 epoll_create1(2097152) = 3
1273719 exit_group(0)
```
Fixes: 9cbc0578cb6 ("Improve output of various syscalls")
Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
CC: Riku Voipio <riku.voipio@iki.fi>
CC: Laurent Vivier <laurent@vivier.eu>
Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20200416175957.1274882-1-slyfox@gentoo.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
(cherry picked from commit fd568660b7ae9b9e45cbb616acc91ae4c065c32d)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: e399bb1bf1da5619087abd65e482995c4a8d15cd
https://github.com/qemu/qemu/commit/e399bb1bf1da5619087abd65e482995c4a8d15cd
Author: Paolo Bonzini <pbonzini@redhat.com>
Date: 2020-08-27 (Thu, 27 Aug 2020)
Changed paths:
M tests/qtest/usb-hcd-ehci-test.c
Log Message:
-----------
libqos: usb-hcd-ehci: use 32-bit write for config register
The memory region ops have min_access_size == 4 so obey it.
Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 89ed83d8b23c11d250c290593cad3ca839d5b053)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 68d84b133d3a3611f304a2e93f07690dd141dbd5
https://github.com/qemu/qemu/commit/68d84b133d3a3611f304a2e93f07690dd141dbd5
Author: Paolo Bonzini <pbonzini@redhat.com>
Date: 2020-08-27 (Thu, 27 Aug 2020)
Changed paths:
M tests/qtest/libqos/pci-pc.c
Log Message:
-----------
libqos: pci-pc: use 32-bit write for EJ register
The memory region ops have min_access_size == 4 so obey it.
Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 4b7c06837ae0b1ff56473202a42e7e386f53d6db)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: b14cd263ad87a4c3a83308f093841d247eb711f1
https://github.com/qemu/qemu/commit/b14cd263ad87a4c3a83308f093841d247eb711f1
Author: Michael S. Tsirkin <mst@redhat.com>
Date: 2020-08-27 (Thu, 27 Aug 2020)
Changed paths:
M memory.c
Log Message:
-----------
memory: Revert "memory: accept mismatching sizes in
memory_region_access_valid"
Memory API documentation documents valid .min_access_size and .max_access_size
fields and explains that any access outside these boundaries is blocked.
This is what devices seem to assume.
However this is not what the implementation does: it simply
ignores the boundaries unless there's an "accepts" callback.
Naturally, this breaks a bunch of devices.
Revert to the documented behaviour.
Devices that want to allow any access can just drop the valid field,
or add the impl field to have accesses converted to appropriate
length.
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <rth@twiddle.net>
Fixes: CVE-2020-13754
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1842363
Fixes: a014ed07bd5a ("memory: accept mismatching sizes in
memory_region_access_valid")
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20200610134731.1514409-1-mst@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 5d971f9e672507210e77d020d89e0e89165c8fc9)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 182be029628068dc7739b496df63f073f2aa8ae3
https://github.com/qemu/qemu/commit/182be029628068dc7739b496df63f073f2aa8ae3
Author: Alistair Francis <alistair.francis@wdc.com>
Date: 2020-08-27 (Thu, 27 Aug 2020)
Changed paths:
M hw/riscv/sifive_clint.c
Log Message:
-----------
hw/riscv: Allow 64 bit access to SiFive CLINT
Commit 5d971f9e672507210e77d020d89e0e89165c8fc9
"memory: Revert "memory: accept mismatching sizes in
memory_region_access_valid"" broke most RISC-V boards as they do 64 bit
accesses to the CLINT and QEMU would trigger a fault. Fix this failure
by allowing 8 byte accesses.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei<zhiwei_liu@c-sky.com>
Message-Id:
<122b78825b077e4dfd39b444d3a46fe894a7804c.1593547870.git.alistair.francis@wdc.com>
(cherry picked from commit 70b78d4e71494c90d2ccb40381336bc9b9a22f79)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 782e94132aa7a3672fa5138837d91b48d6aee5dd
https://github.com/qemu/qemu/commit/782e94132aa7a3672fa5138837d91b48d6aee5dd
Author: Laurent Vivier <lvivier@redhat.com>
Date: 2020-08-27 (Thu, 27 Aug 2020)
Changed paths:
M hw/usb/hcd-xhci.c
Log Message:
-----------
xhci: fix valid.max_access_size to access address registers
QEMU XHCI advertises AC64 (64-bit addressing) but doesn't allow
64-bit mode access in "runtime" and "operational" MemoryRegionOps.
Set the max_access_size based on sizeof(dma_addr_t) as AC64 is set.
XHCI specs:
"If the xHC supports 64-bit addressing (AC64 = ‘1’), then software
should write 64-bit registers using only Qword accesses. If a
system is incapable of issuing Qword accesses, then writes to the
64-bit address fields shall be performed using 2 Dword accesses;
low Dword-first, high-Dword second. If the xHC supports 32-bit
addressing (AC64 = ‘0’), then the high Dword of registers containing
64-bit address fields are unused and software should write addresses
using only Dword accesses"
The problem has been detected with SLOF, as linux kernel always accesses
registers using 32-bit access even if AC64 is set and revealed by
5d971f9e6725 ("memory: Revert "memory: accept mismatching sizes in
memory_region_access_valid"")
Suggested-by: Alexey Kardashevskiy <aik@au1.ibm.com>
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Message-id: 20200721083322.90651-1-lvivier@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 8e67fda2dd6202ccec093fda561107ba14830a17)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 974b857df6e9dd69c709b20159f07b09f3f6254e
https://github.com/qemu/qemu/commit/974b857df6e9dd69c709b20159f07b09f3f6254e
Author: Michael Tokarev <mjt@tls.msk.ru>
Date: 2020-08-27 (Thu, 27 Aug 2020)
Changed paths:
M hw/acpi/core.c
Log Message:
-----------
acpi: accept byte and word access to core ACPI registers
All ISA registers should be accessible as bytes, words or dwords
(if wide enough). Fix the access constraints for acpi-pm-evt,
acpi-pm-tmr & acpi-cnt registers.
Fixes: 5d971f9e67 (memory: Revert "memory: accept mismatching sizes in
memory_region_access_valid")
Fixes: afafe4bbe0 (apci: switch cnt to memory api)
Fixes: 77d58b1e47 (apci: switch timer to memory api)
Fixes: b5a7c024d2 (apci: switch evt to memory api)
Buglink:
https://lore.kernel.org/xen-devel/20200630170913.123646-1-anthony.perard@citrix.com/T/
Buglink: https://bugs.debian.org/964793
BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964247
BugLink: https://bugs.launchpad.net/bugs/1886318
Reported-By: Simon John <git@the-jedi.co.uk>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-Id: <20200720160627.15491-1-mjt@msgid.tls.msk.ru>
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit dba04c3488c4699f5afe96f66e448b1d447cf3fb)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 045849b0785d5cf3359ea03f3445a55836b0d7a8
https://github.com/qemu/qemu/commit/045849b0785d5cf3359ea03f3445a55836b0d7a8
Author: Helge Deller <deller@gmx.de>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/display/artist.c
Log Message:
-----------
hw/display/artist: Unbreak size mismatch memory accesses
Commit 5d971f9e6725 ("memory: Revert "memory: accept mismatching sizes
in memory_region_access_valid") broke the artist driver in a way that
the dtwm window manager on HP-UX rendered wrong.
Fixes: 5d971f9e6725 ("memory: Revert "memory: accept mismatching sizes in
memory_region_access_valid")
Signed-off-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Helge Deller <deller@gmx.de>
(cherry picked from commit e0cf02ce680f11893aca9642e76d6ae68b9375af)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 0fd3972e1cd424b750b3eeb2baf5686cbaa20d8a
https://github.com/qemu/qemu/commit/0fd3972e1cd424b750b3eeb2baf5686cbaa20d8a
Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/net/e1000e_core.c
Log Message:
-----------
hw/net/e1000e: Do not abort() on invalid PSRCTL register value
libFuzzer found using 'qemu-system-i386 -M q35':
qemu: hardware error: e1000e: PSRCTL.BSIZE0 cannot be zero
CPU #0:
EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000663
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 00009300
CS =f000 ffff0000 0000ffff 00009b00
SS =0000 00000000 0000ffff 00009300
DS =0000 00000000 0000ffff 00009300
FS =0000 00000000 0000ffff 00009300
GS =0000 00000000 0000ffff 00009300
LDT=0000 00000000 0000ffff 00008200
TR =0000 00000000 0000ffff 00008b00
GDT= 00000000 0000ffff
IDT= 00000000 0000ffff
CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000
DR6=ffff0ff0 DR7=00000400
EFER=0000000000000000
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000
XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
==1988== ERROR: libFuzzer: deadly signal
#6 0x7fae4d3ea894 in __GI_abort (/lib64/libc.so.6+0x22894)
#7 0x563f4cc59a1d in hw_error (qemu-fuzz-i386+0xe8ca1d)
#8 0x563f4d7c93f2 in e1000e_set_psrctl (qemu-fuzz-i386+0x19fc3f2)
#9 0x563f4d7b798f in e1000e_core_write (qemu-fuzz-i386+0x19ea98f)
#10 0x563f4d7afc46 in e1000e_mmio_write (qemu-fuzz-i386+0x19e2c46)
#11 0x563f4cc9a0a7 in memory_region_write_accessor (qemu-fuzz-i386+0xecd0a7)
#12 0x563f4cc99c13 in access_with_adjusted_size (qemu-fuzz-i386+0xeccc13)
#13 0x563f4cc987b4 in memory_region_dispatch_write (qemu-fuzz-i386+0xecb7b4)
It simply sent the following 2 I/O command to the e1000e
PCI BAR #2 I/O region:
writew 0x0100 0x0c00 # RCTL = E1000_RCTL_DTYP_MASK
writeb 0x2170 0x00 # PSRCTL = 0
2813 static void
2814 e1000e_set_psrctl(E1000ECore *core, int index, uint32_t val)
2815 {
2816 if (core->mac[RCTL] & E1000_RCTL_DTYP_MASK) {
2817
2818 if ((val & E1000_PSRCTL_BSIZE0_MASK) == 0) {
2819 hw_error("e1000e: PSRCTL.BSIZE0 cannot be zero");
2820 }
Instead of calling hw_error() which abort the process (it is
meant for CPU fatal error condition, not for device logging),
log the invalid request with qemu_log_mask(LOG_GUEST_ERROR)
and return, ignoring the request.
Cc: qemu-stable@nongnu.org
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit fda43b1204aecd1db158b3255c591d227fbdd629)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 0aad2a52555643126970b2cb1bef37e7a2d5d7ac
https://github.com/qemu/qemu/commit/0aad2a52555643126970b2cb1bef37e7a2d5d7ac
Author: Max Reitz <mreitz@redhat.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M tools/virtiofsd/seccomp.c
Log Message:
-----------
virtiofsd: Whitelist fchmod
lo_setattr() invokes fchmod() in a rarely used code path, so it should
be whitelisted or virtiofsd will crash with EBADSYS.
Said code path can be triggered for example as follows:
On the host, in the shared directory, create a file with the sticky bit
set and a security.capability xattr:
(1) # touch foo
(2) # chmod u+s foo
(3) # setcap '' foo
Then in the guest let some process truncate that file after it has
dropped all of its capabilities (at least CAP_FSETID):
int main(int argc, char *argv[])
{
capng_setpid(getpid());
capng_clear(CAPNG_SELECT_BOTH);
capng_updatev(CAPNG_ADD, CAPNG_PERMITTED | CAPNG_EFFECTIVE, 0);
capng_apply(CAPNG_SELECT_BOTH);
ftruncate(open(argv[1], O_RDWR), 0);
}
This will cause the guest kernel to drop the sticky bit (i.e. perform a
mode change) as part of the truncate (where FATTR_FH is set), and that
will cause virtiofsd to invoke fchmod() instead of fchmodat().
(A similar configuration exists further below with futimens() vs.
utimensat(), but the former is not a syscall but just a wrapper for the
latter, so no further whitelisting is required.)
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1842667
Reported-by: Qian Cai <caiqian@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200608093111.14942-1-mreitz@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
(cherry picked from commit 63659fe74e76f5c5285466f0c5cfbdca65b3688e)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 7a1f17a51e091507f7a645db6720fc8d832d7c3c
https://github.com/qemu/qemu/commit/7a1f17a51e091507f7a645db6720fc8d832d7c3c
Author: Allan Peramaki <aperamak@pp1.inet.fi>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/audio/gusemu_hal.c
M hw/audio/gusemu_mixer.c
Log Message:
-----------
hw/audio/gus: Fix registers 32-bit access
Fix audio on software that accesses DRAM above 64k via register
peek/poke and some cases when more than 16 voices are used.
Cc: qemu-stable@nongnu.org
Fixes: 135f5ae1974c ("audio: GUSsample is int16_t")
Signed-off-by: Allan Peramaki <aperamak@pp1.inet.fi>
Tested-by: Volker Rümelin <vr_qemu@t-online.de>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200618103623.6031-1-philmd@redhat.com
Message-Id: <20200615201757.16868-1-aperamak@pp1.inet.fi>
[PMD: Removed unrelated style changes]
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 586803455b3fa44d949ecd42cd9c87e5a6287aef)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: b17b3c209b182c00a93e1987e4c1078275d162ce
https://github.com/qemu/qemu/commit/b17b3c209b182c00a93e1987e4c1078275d162ce
Author: Markus Armbruster <armbru@redhat.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/net/virtio-net.c
Log Message:
-----------
net/virtio: Fix failover_replug_primary() return value regression
Commit 150ab54aa6 "net/virtio: fix re-plugging of primary device"
fixed failover_replug_primary() to return false on failure. Commit
5a0948d36c "net/virtio: Fix failover error handling crash bugs" broke
it again for hotplug_handler_plug() failure. Unbreak it.
Commit 5a0948d36c4cbc1c5534afac6fee99de55245d12
Fixes: 5a0948d36c4cbc1c5534afac6fee99de55245d12
Cc: Jens Freimann <jfreimann@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Jens Freimann <jfreimann@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20200630090351.1247703-2-armbru@redhat.com>
(cherry picked from commit ca72efccbe33373810341a0d8a10f5698b8fbc87)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 558905635b5fedc96c0c3ea9c5ec9bd7d5faf1c9
https://github.com/qemu/qemu/commit/558905635b5fedc96c0c3ea9c5ec9bd7d5faf1c9
Author: Markus Armbruster <armbru@redhat.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M chardev/char-socket.c
M hw/sd/pxa2xx_mmci.c
M hw/sd/sd.c
M hw/usb/dev-mtp.c
M qemu-nbd.c
M scsi/qemu-pr-helper.c
Log Message:
-----------
error: Use error_reportf_err() where appropriate
Replace
error_report("...: %s", ..., error_get_pretty(err));
by
error_reportf_err(err, "...: ", ...);
One of the replaced messages lacked a colon. Add it.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20200505101908.6207-6-armbru@redhat.com>
(cherry picked from commit 5217f1887a8041c51495fbd5d3f767d96a242000)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: b3e49baa79908d7e1c35df3814435dda72d85267
https://github.com/qemu/qemu/commit/b3e49baa79908d7e1c35df3814435dda72d85267
Author: Markus Armbruster <armbru@redhat.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/usb/dev-mtp.c
Log Message:
-----------
usb/dev-mtp: Fix Error double free after inotify failure
error_report_err() frees its first argument. Freeing it again is
wrong. Don't.
Fixes: 47287c27d0c367a89f7b2851e23a7f8b2d499dd6
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Daniel P. Berrangé <berrange@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20200630090351.1247703-7-armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit 562a558647be6fe43e60f8bf3601e5b6122c0599)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 9380cb9de20b1554162eea9eb0e80209464ace50
https://github.com/qemu/qemu/commit/9380cb9de20b1554162eea9eb0e80209464ace50
Author: Eric Blake <eblake@redhat.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M block/nbd.c
Log Message:
-----------
nbd: Avoid off-by-one in long export name truncation
When snprintf returns the same value as the buffer size, the final
byte was truncated to ensure a NUL terminator. Fortunately, such long
export names are unusual enough, with no real impact other than what
is displayed to the user.
Fixes: 5c86bdf12089
Reported-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20200622210355.414941-1-eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
(cherry picked from commit 00d69986da83a74f6f5731c80f8dd09fde95d19a)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 54e74a45a58912dd7705d53e965e9092a0631aa5
https://github.com/qemu/qemu/commit/54e74a45a58912dd7705d53e965e9092a0631aa5
Author: lichun <lichun@ruijie.com.cn>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M chardev/char-socket.c
Log Message:
-----------
chardev/tcp: Fix error message double free error
Errors are already freed by error_report_err, so we only need to call
error_free when that function is not called.
Cc: qemu-stable@nongnu.org
Signed-off-by: lichun <lichun@ruijie.com.cn>
Message-Id: <20200621213017.17978-1-lichun@ruijie.com.cn>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Commit message improved, cc: qemu-stable]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
(cherry picked from commit ed4e0d2ef140aef255d67eec30767e5fcd949f58)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: a799013e71b56cee2d375fa34893dd9f4e8c3248
https://github.com/qemu/qemu/commit/a799013e71b56cee2d375fa34893dd9f4e8c3248
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M qga/main.c
Log Message:
-----------
qga: fix assert regression on guest-shutdown
Since commit 781f2b3d1e ("qga: process_event() simplification"),
send_response() is called unconditionally, but will assert when "rsp" is
NULL. This may happen with QCO_NO_SUCCESS_RESP commands, such as
"guest-shutdown".
Fixes: 781f2b3d1e5ef389b44016a897fd55e7a780bf35
Cc: Michael Roth <mdroth@linux.vnet.ibm.com>
Reported-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Tested-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
(cherry picked from commit 844bd70b5652f30bbace89499f513e3fbbb6457a)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: ad1169e23ce05aee2304eb737a1b4d51f3ea9e7e
https://github.com/qemu/qemu/commit/ad1169e23ce05aee2304eb737a1b4d51f3ea9e7e
Author: Michal Privoznik <mprivozn@redhat.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M include/qemu/osdep.h
M util/oslib-posix.c
M util/oslib-win32.c
Log Message:
-----------
util: Introduce qemu_get_host_name()
This function offers operating system agnostic way to fetch host
name. It is implemented for both POSIX-like and Windows systems.
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
(cherry picked from commit e47f4765afcab2b78dfa5b0115abf64d1d49a5d3)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 3ddb01cd149f9d2064f8ce2dff6a75b2e18b3cd2
https://github.com/qemu/qemu/commit/3ddb01cd149f9d2064f8ce2dff6a75b2e18b3cd2
Author: Michal Privoznik <mprivozn@redhat.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M qga/commands.c
Log Message:
-----------
qga: Use qemu_get_host_name() instead of g_get_host_name()
Problem with g_get_host_name() is that on the first call it saves
the hostname into a global variable and from then on, every
subsequent call returns the saved hostname. Even if the hostname
changes. This doesn't play nicely with guest agent, because if
the hostname is acquired before the guest is set up (e.g. on the
first boot, or before DHCP) we will report old, invalid hostname.
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1845127
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
(cherry picked from commit 0d3a8f32b1e0eca279da1b0cc793efc7250c3daf)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: acb988e20cf1ae07f7926dea557bb27080a418d4
https://github.com/qemu/qemu/commit/acb988e20cf1ae07f7926dea557bb27080a418d4
Author: Niek Linnenbank <nieklinnenbank@gmail.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M docs/system/arm/orangepi.rst
Log Message:
-----------
docs/orangepi: Add instructions for resizing SD image to power of two
SD cards need to have a size of a power of two.
Update the Orange Pi machine documentation to include
instructions for resizing downloaded images using the
qemu-img command.
Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20200712183708.15450-1-nieklinnenbank@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
(cherry picked from commit 1c2329b5d644bad16e888d095e2021ad682201d9)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 7b41093d14a02770af49cf472088e8a9d9ff9001
https://github.com/qemu/qemu/commit/7b41093d14a02770af49cf472088e8a9d9ff9001
Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M tests/acceptance/boot_linux_console.py
Log Message:
-----------
tests/acceptance/boot_linux: Tag tests using a SD card with 'device:sd'
Avocado tags are handy to automatically select tests matching
the tags. Since these tests use a SD card, tag them.
We can run all the tests using a SD card at once with:
$ avocado --show=app run -t u-boot tests/acceptance/
$ AVOCADO_ALLOW_LARGE_STORAGE=ok \
avocado --show=app \
run -t device:sd tests/acceptance/
Fetching asset from
tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_orangepi_sd
Fetching asset from
tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_orangepi_bionic
Fetching asset from
tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_orangepi_uboot_netbsd9
(1/3)
tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_orangepi_sd:
PASS (19.56 s)
(2/3)
tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_orangepi_bionic:
PASS (49.97 s)
(3/3)
tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_orangepi_uboot_netbsd9:
PASS (20.06 s)
RESULTS : PASS 3 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 |
CANCEL 0
JOB TIME : 90.02 s
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Cleber Rosa <crosa@redhat.com>
Tested-by: Cleber Rosa <crosa@redhat.com>
Message-Id: <20200713183209.26308-4-f4bug@amsat.org>
(cherry picked from commit b7dcbf1395da960ec3c313300dc0030674de8cd1)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: f756254e0aca5e29bb3216ab052cd28e6ee46c2b
https://github.com/qemu/qemu/commit/f756254e0aca5e29bb3216ab052cd28e6ee46c2b
Author: Pavel Dovgalyuk <Pavel.Dovgaluk@gmail.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M tests/acceptance/avocado_qemu/__init__.py
Log Message:
-----------
tests/acceptance: allow console interaction with specific VMs
Console interaction in avocado scripts was possible only with single
default VM.
This patch modifies the function parameters to allow passing a specific
VM as a parameter to interact with it.
Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
Reviewed-by: Willian Rampazzo <willianr@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <159073587933.20809.5122618715976660635.stgit@pasha-ThinkPad-X280>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
(cherry picked from commit a5ba86d423c2b071894d86c60487f2317c7ffb60)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 5bdcc0f3ed96effbff61b08ea55699c2cebae5e5
https://github.com/qemu/qemu/commit/5bdcc0f3ed96effbff61b08ea55699c2cebae5e5
Author: Pavel Dovgalyuk <Pavel.Dovgaluk@gmail.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M tests/acceptance/boot_linux.py
Log Message:
-----------
tests/acceptance: refactor boot_linux to allow code reuse
This patch moves image downloading functions to the separate class to allow
reusing them from record/replay tests.
Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <159073593167.20809.17582679291556188984.stgit@pasha-ThinkPad-X280>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
(cherry picked from commit 1c80c87c8c2489e4318c93c844aa29bc1d014146)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: bc67d011c3a6a60fdaf790a72ab51bab263c7e9e
https://github.com/qemu/qemu/commit/bc67d011c3a6a60fdaf790a72ab51bab263c7e9e
Author: Pavel Dovgalyuk <Pavel.Dovgaluk@gmail.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M tests/acceptance/boot_linux_console.py
Log Message:
-----------
tests/acceptance: refactor boot_linux_console test to allow code reuse
This patch splits code in BootLinuxConsole class into two different
classes to allow reusing it by record/replay tests.
Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <159073588490.20809.13942096070255577558.stgit@pasha-ThinkPad-X280>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
(cherry picked from commit 12121c496fcc609e23033c4a36399b54f98bcd56)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: b6f4d5bf209542ee9521d36bd891ad630e7c80b4
https://github.com/qemu/qemu/commit/b6f4d5bf209542ee9521d36bd891ad630e7c80b4
Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M tests/acceptance/boot_linux_console.py
Log Message:
-----------
tests/acceptance/boot_linux: Expand SD card image to power of 2
In few commits we won't allow SD card images with invalid size
(not aligned to a power of 2). Prepare the tests: add the
pow2ceil() and image_pow2ceil_expand() methods and resize the
images (expanding) of the tests using SD cards.
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Cleber Rosa <crosa@redhat.com>
Message-Id: <20200713183209.26308-5-f4bug@amsat.org>
(cherry picked from commit 6a289a5ba3383e17fb47029720425bef42e424d7)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 557980ba70dba65bde208b03b902f419921b307a
https://github.com/qemu/qemu/commit/557980ba70dba65bde208b03b902f419921b307a
Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/sd/sd.c
Log Message:
-----------
hw/sd/sdcard: Restrict Class 6 commands to SCSD cards
Only SCSD cards support Class 6 (Block Oriented Write Protection)
commands.
"SD Specifications Part 1 Physical Layer Simplified Spec. v3.01"
4.3.14 Command Functional Difference in Card Capacity Types
* Write Protected Group
SDHC and SDXC do not support write-protected groups. Issuing
CMD28, CMD29 and CMD30 generates the ILLEGAL_COMMAND error.
Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20200630133912.9428-7-f4bug@amsat.org>
(cherry picked from commit 9157dd597d293ab7f599f4d96c3fe8a6e07c633d)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 6a34f7752f05efbd0f26ea87f9e022469b4ac0d2
https://github.com/qemu/qemu/commit/6a34f7752f05efbd0f26ea87f9e022469b4ac0d2
Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/sd/sd.c
Log Message:
-----------
hw/sd/sdcard: Simplify realize() a bit
We don't need to check if sd->blk is set twice.
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20200630133912.9428-18-f4bug@amsat.org>
(cherry picked from commit 6dd3a164f5b31c703c7d8372841ad3bd6a57de6d)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: e569ca39faf9dcd34fb7f0911ab1a3f7c3ffc0df
https://github.com/qemu/qemu/commit/e569ca39faf9dcd34fb7f0911ab1a3f7c3ffc0df
Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/sd/sd.c
Log Message:
-----------
hw/sd/sdcard: Do not allow invalid SD card sizes
QEMU allows to create SD card with unrealistic sizes. This could
work, but some guests (at least Linux) consider sizes that are not
a power of 2 as a firmware bug and fix the card size to the next
power of 2.
While the possibility to use small SD card images has been seen as
a feature, it became a bug with CVE-2020-13253, where the guest is
able to do OOB read/write accesses past the image size end.
In a pair of commits we will fix CVE-2020-13253 as:
Read command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR
occurred and no data transfer is performed.
Write command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR
occurred and no data transfer is performed.
WP_VIOLATION errors are not modified: the error bit is set, we
stay in receive-data state, wait for a stop command. All further
data transfer is ignored. See the check on sd->card_status at the
beginning of sd_read_data() and sd_write_data().
While this is the correct behavior, in case QEMU create smaller SD
cards, guests still try to access past the image size end, and QEMU
considers this is an invalid address, thus "all further data transfer
is ignored". This is wrong and make the guest looping until
eventually timeouts.
Fix by not allowing invalid SD card sizes (suggesting the expected
size as a hint):
$ qemu-system-arm -M orangepi-pc -drive file=rootfs.ext2,if=sd,format=raw
qemu-system-arm: Invalid SD card size: 60 MiB
SD card size has to be a power of 2, e.g. 64 MiB.
You can resize disk images with 'qemu-img resize <imagefile> <new-size>'
(note that this will lose data if you make the image smaller than it
currently is).
Cc: qemu-stable@nongnu.org
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20200713183209.26308-8-f4bug@amsat.org>
(cherry picked from commit a9bcedd15a5834ca9ae6c3a97933e85ac7edbd36)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: c8966bff5f45a09bc335686bef7b1aa4722c3e4f
https://github.com/qemu/qemu/commit/c8966bff5f45a09bc335686bef7b1aa4722c3e4f
Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/sd/sd.c
Log Message:
-----------
hw/sd/sdcard: Update coding style to make checkpatch.pl happy
To make the next commit easier to review, clean this code first.
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20200630133912.9428-3-f4bug@amsat.org>
(cherry picked from commit 794d68de2f021a6d3874df41d6bbe8590ec05207)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: d7fab184e98bc0d482b0203fd3333da972b7ca5f
https://github.com/qemu/qemu/commit/d7fab184e98bc0d482b0203fd3333da972b7ca5f
Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/sd/sd.c
Log Message:
-----------
hw/sd/sdcard: Do not switch to ReceivingData if address is invalid
Only move the state machine to ReceivingData if there is no
pending error. This avoids later OOB access while processing
commands queued.
"SD Specifications Part 1 Physical Layer Simplified Spec. v3.01"
4.3.3 Data Read
Read command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR
occurred and no data transfer is performed.
4.3.4 Data Write
Write command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR
occurred and no data transfer is performed.
WP_VIOLATION errors are not modified: the error bit is set, we
stay in receive-data state, wait for a stop command. All further
data transfer is ignored. See the check on sd->card_status at the
beginning of sd_read_data() and sd_write_data().
Fixes: CVE-2020-13253
Cc: qemu-stable@nongnu.org
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Buglink: https://bugs.launchpad.net/qemu/+bug/1880822
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20200630133912.9428-6-f4bug@amsat.org>
(cherry picked from commit 790762e5487114341cccc5bffcec4cb3c022c3cd)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 2f783fb4591fa244447547d226daed643820e2ef
https://github.com/qemu/qemu/commit/2f783fb4591fa244447547d226daed643820e2ef
Author: Richard Henderson <richard.henderson@linaro.org>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M target/hppa/translate.c
Log Message:
-----------
target/hppa: Free some temps in do_sub
Two temps allocated but not freed. Do enough subtractions
within a single TB and one can run out of temps entirely.
Fixes: b2167459ae ("target-hppa: Implement basic arithmetic")
Buglink: https://bugs.launchpad.net/qemu/+bug/1880287
Tested-by: Sven Schnelle <svens@stackframe.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200720174039.517902-1-richard.henderson@linaro.org>
(cherry picked from commit 79826f99feb7222b7804058f0b4ace9ee0546361)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 42e9a42083bdb253f32766038fa64063d6351b5e
https://github.com/qemu/qemu/commit/42e9a42083bdb253f32766038fa64063d6351b5e
Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/tpm/tpm_spapr.c
Log Message:
-----------
tpm: tpm_spapr: Exit on TPM backend failures
Exit on TPM backend failures in the same way as the TPM CRB and TIS device
models do. With this change we now get an error report when the backend
did not start up properly:
error: internal error: qemu unexpectedly closed the monitor:
2020-07-07T12:49:28.333928Z qemu-system-ppc64: tpm-emulator: \
TPM result for CMD_INIT: 0x101 operation failed
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20200707201625.4177419-2-stefanb@linux.vnet.ibm.com
(cherry picked from commit f8b332a1ff107dc014a52eaf9bf547995205f18a)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: d2581f25ec28666b5c6e6ffa4adbffde33181387
https://github.com/qemu/qemu/commit/d2581f25ec28666b5c6e6ffa4adbffde33181387
Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M tests/qtest/tpm-util.c
Log Message:
-----------
tests: tpm: Skip over pcrUpdateCounter byte in result comparison
The TPM 2 code in libtpms was fixed to handle the PCR 'TCB group' according
to the PCClient profile. The change of the PCRs belonging to the 'TCB group'
now affects the pcrUpdateCounter in the TPM2_PCRRead() responses where its
value is now different (typically lower by '1') than what it was before. To
not fail the tests, we skip the comparison of the 14th byte, which
represents the pcrUpdateCounter.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20200707201625.4177419-3-stefanb@linux.vnet.ibm.com
(cherry picked from commit df8a7568932e4c3c930fdfeb228dd72b4bb71a1f)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: c16fd8a2bbf54a1d4fc599f6e88f69b8bbeecc28
https://github.com/qemu/qemu/commit/c16fd8a2bbf54a1d4fc599f6e88f69b8bbeecc28
Author: Markus Armbruster <armbru@redhat.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M qdev-monitor.c
Log Message:
-----------
qdev: Fix device_add DRIVER,help to print to monitor
Help on device properties gets printed to stdout instead of the
monitor. If you have the monitor anywhere else, no help for you.
Broken when commit e1043d674d "qdev: use object_property_help()"
accidentally switched from qemu_printf() to printf(). Switch right
back.
Fixes: e1043d674d792ff64aebae1a3eafc08b38a8a085
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20200714160202.3121879-2-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
(cherry picked from commit 029afc4e76041e1a320530d97f99122a1b3d5da2)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 67808fda375e3a795ae84f3fb19b540f954fa96a
https://github.com/qemu/qemu/commit/67808fda375e3a795ae84f3fb19b540f954fa96a
Author: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/virtio/virtio-balloon.c
Log Message:
-----------
virtio-balloon: Prevent guest from starting a report when we didn't request
one
Based on code review it appears possible for the driver to force the device
out of a stopped state when hinting by repeating the last ID it was
provided.
Prevent this by only allowing a transition to the start state when we are
in the requested state. This way the driver is only allowed to send one
descriptor that will transition the device into the start state. All others
will leave it in the stop state once it has finished.
Fixes: c13c4153f76d ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT")
Acked-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Message-Id: <20200720175115.21935.99563.stgit@localhost.localdomain>
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 20a4da0f23078deeff5ea6d1e12f47d968d7c3c9)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 7eb63fccf4cc533249bde484daba6e40264d74f9
https://github.com/qemu/qemu/commit/7eb63fccf4cc533249bde484daba6e40264d74f9
Author: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/virtio/virtio-balloon.c
Log Message:
-----------
virtio-balloon: Add locking to prevent possible race when starting hinting
There is already locking in place when we are stopping free page hinting
but there is not similar protections in place when we start. I can only
assume this was overlooked as in most cases the page hinting should not be
occurring when we are starting the hinting, however there is still a chance
we could be processing hints by the time we get back around to restarting
the hinting so we are better off making sure to protect the state with the
mutex lock rather than just updating the value with no protections.
Based on feedback from Peter Maydell this issue had also been spotted by
Coverity: CID 1430269
Acked-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Message-Id: <20200720175122.21935.78013.stgit@localhost.localdomain>
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 1a83e0b9c492a0eaeacd6fbb858fc81d04ab9c3e)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 6261aa4ff5e705a0f5ddd15c53d7b7051bace46d
https://github.com/qemu/qemu/commit/6261aa4ff5e705a0f5ddd15c53d7b7051bace46d
Author: David Hildenbrand <david@redhat.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/virtio/virtio-balloon.c
Log Message:
-----------
virtio-balloon: always indicate S_DONE when migration fails
If something goes wrong during precopy, before stopping the VM, we will
never send a S_DONE indication to the VM, resulting in the hinted pages
not getting released to be used by the guest OS (e.g., Linux).
Easy to reproduce:
1. Start migration (e.g., HMP "migrate -d 'exec:gzip -c > STATEFILE.gz'")
2. Cancel migration (e.g., HMP "migrate_cancel")
3. Oberve in the guest (e.g., cat /proc/meminfo) that there is basically
no free memory left.
While at it, add similar locking to virtio_balloon_free_page_done() as
done in virtio_balloon_free_page_stop. Locking is still weird, but that
has to be sorted out separately.
There is nothing to do in the PRECOPY_NOTIFY_COMPLETE case. Add some
comments regarding S_DONE handling.
Fixes: c13c4153f76d ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT")
Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Cc: Wei Wang <wei.w.wang@intel.com>
Cc: Alexander Duyck <alexander.duyck@gmail.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20200629080615.26022-1-david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit dd8eeb9671fc881e613008bd20035b85fe45383d)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 595c40575bf500ff20d508d90fa69caf27e3454d
https://github.com/qemu/qemu/commit/595c40575bf500ff20d508d90fa69caf27e3454d
Author: Cornelia Huck <cohuck@redhat.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M include/standard-headers/linux/ethtool.h
M include/standard-headers/linux/input-event-codes.h
M include/standard-headers/linux/pci_regs.h
M include/standard-headers/linux/vhost_types.h
M include/standard-headers/linux/virtio_balloon.h
M include/standard-headers/linux/virtio_ids.h
M include/standard-headers/linux/virtio_net.h
M linux-headers/COPYING
M linux-headers/asm-x86/kvm.h
M linux-headers/asm-x86/unistd_32.h
M linux-headers/asm-x86/unistd_64.h
M linux-headers/asm-x86/unistd_x32.h
M linux-headers/linux/kvm.h
M linux-headers/linux/mman.h
M linux-headers/linux/userfaultfd.h
M linux-headers/linux/vfio.h
M linux-headers/linux/vhost.h
Log Message:
-----------
linux-headers: update against Linux 5.7-rc3
commit 6a8b55ed4056ea5559ebe4f6a4b247f627870d4c
Reviewed-by: Michael S. Tsirkin <mst@redhat.com> # virtio/vhost parts
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-Id: <20200427102415.10915-3-cohuck@redhat.com>
(cherry picked from commit dc6f8d458a4ccc360723993f31d310d06469f55f)
*dep for 3219b42f02
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 7c4c30e764e2e177fefe241a0f8559b02def9089
https://github.com/qemu/qemu/commit/7c4c30e764e2e177fefe241a0f8559b02def9089
Author: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Date: 2020-09-02 (Wed, 02 Sep 2020)
Changed paths:
M hw/virtio/virtio-balloon.c
M include/hw/virtio/virtio-balloon.h
Log Message:
-----------
virtio-balloon: Replace free page hinting references to 'report' with 'hint'
Recently a feature named Free Page Reporting was added to the virtio
balloon. In order to avoid any confusion we should drop the use of the word
'report' when referring to Free Page Hinting. So what this patch does is go
through and replace all instances of 'report' with 'hint" when we are
referring to free page hinting.
Acked-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Message-Id: <20200720175128.21935.93927.stgit@localhost.localdomain>
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 3219b42f025d4d7a9c463235e9f937ab38067de3)
Conflicts:
hw/virtio/virtio-balloon.c
include/hw/virtio/virtio-balloon.h
*drop context deps on 91b867191d and 7483cbbaf8
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 58c523563dc3146ca4326e20af924abf0b90e9c3
https://github.com/qemu/qemu/commit/58c523563dc3146ca4326e20af924abf0b90e9c3
Author: Liu Yi L <yi.l.liu@intel.com>
Date: 2020-09-09 (Wed, 09 Sep 2020)
Changed paths:
M hw/i386/intel_iommu.c
M hw/i386/intel_iommu_internal.h
Log Message:
-----------
intel_iommu: Use correct shift for 256 bits qi descriptor
In chapter 10.4.23 of VT-d spec 3.0, Descriptor Width bit was introduced
in VTD_IQA_REG. Software could set this bit to tell VT-d the QI descriptor
from software would be 256 bits. Accordingly, the VTD_IQH_QH_SHIFT should
be 5 when descriptor size is 256 bits.
This patch adds the DW bit check when deciding the shift used to update
VTD_IQH_REG.
Signed-off-by: Liu Yi L <yi.l.liu@intel.com>
Message-Id: <1593850035-35483-1-git-send-email-yi.l.liu@intel.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit a4544c45e109ceee87ee8c19baff28be3890d788)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: d8f0b2bbf4a1ab473c658a56ef5bf3ea57c3c384
https://github.com/qemu/qemu/commit/d8f0b2bbf4a1ab473c658a56ef5bf3ea57c3c384
Author: Andrew Melnychenko <andrew@daynix.com>
Date: 2020-09-09 (Wed, 09 Sep 2020)
Changed paths:
M hw/virtio/virtio-pci.c
Log Message:
-----------
virtio-pci: Changed vdev to proxy for VirtIO PCI BAR callbacks.
There is an issue when callback may be called with invalid vdev.
It happens on unplug when vdev already deleted and VirtIOPciProxy is not.
So now, callbacks accept proxy device, and vdev retrieved from it.
Technically memio callbacks should be removed during the flatview update,
but memoryregions remain til PCI device(and it's address space) completely
deleted.
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1716352
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Message-Id: <20200706112123.971087-1-andrew@daynix.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit ccec7e9603f446fe75c6c563ba335c00cfda6a06)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: eca194d43ca4524d0f3552d7b91b15c145649b33
https://github.com/qemu/qemu/commit/eca194d43ca4524d0f3552d7b91b15c145649b33
Author: Philippe Mathieu-Daudé <philmd@redhat.com>
Date: 2020-09-09 (Wed, 09 Sep 2020)
Changed paths:
M contrib/libvhost-user/libvhost-user.c
Log Message:
-----------
libvhost-user: Report descriptor index on panic
We want to report the index of the descriptor,
not its pointer.
Fixes: 7b2e5c65f4 ("contrib: add libvhost-user")
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20200723171935.18535-1-philmd@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 8fe9805c73c277dc2feeaa83de73d6a58bf23f39)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: b52a91816ea6a277fca83e8881fb0c5475f19156
https://github.com/qemu/qemu/commit/b52a91816ea6a277fca83e8881fb0c5475f19156
Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: 2020-09-09 (Wed, 09 Sep 2020)
Changed paths:
M pc-bios/openbios-ppc
M pc-bios/openbios-sparc32
M pc-bios/openbios-sparc64
M roms/openbios
Log Message:
-----------
Update OpenBIOS images to 7f28286f built from submodule.
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Cc: qemu-stable@nongnu.org
(cherry picked from commit 54414d0fb11314ede939ec80238787c5b2079f4e)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 08550a9940fc9b07a8f7ff7e2c7b47eb825b87d3
https://github.com/qemu/qemu/commit/08550a9940fc9b07a8f7ff7e2c7b47eb825b87d3
Author: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Date: 2020-09-09 (Wed, 09 Sep 2020)
Changed paths:
M migration/block-dirty-bitmap.c
Log Message:
-----------
migration/block-dirty-bitmap: fix dirty_bitmap_mig_before_vm_start
Using the _locked version of bdrv_enable_dirty_bitmap to bypass locking
is wrong as we do not already own the mutex. Moreover, the adjacent
call to bdrv_dirty_bitmap_enable_successor grabs the mutex.
Fixes: 58f72b965e9e1q
Cc: qemu-stable@nongnu.org # v3.0
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <20200727194236.19551-8-vsementsov@virtuozzo.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
(cherry picked from commit e6ce5e92248be5547daaee3eb6cd226e9820cf7b)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: dcf682dd135e41150b8f1918d7902e2305d19e1a
https://github.com/qemu/qemu/commit/dcf682dd135e41150b8f1918d7902e2305d19e1a
Author: Max Reitz <mreitz@redhat.com>
Date: 2020-09-09 (Wed, 09 Sep 2020)
Changed paths:
M block/io.c
Log Message:
-----------
block: Fix bdrv_aligned_p*v() for qiov_offset != 0
Since these functions take a @qiov_offset, they must always take it into
account when working with @qiov. There are a couple of places where
they do not, but they should.
Fixes: 65cd4424b9df03bb5195351c33e04cbbecc0705c
("block/io: bdrv_aligned_preadv: use and support qiov_offset")
Fixes: 28c4da28695bdbe04b336b2c9c463876cc3aaa6d
("block/io: bdrv_aligned_pwritev: use and support qiov_offset")
Reported-by: Claudio Fontana <cfontana@suse.de>
Reported-by: Bruce Rogers <brogers@suse.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200728120806.265916-2-mreitz@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Tested-by: Claudio Fontana <cfontana@suse.de>
Tested-by: Bruce Rogers <brogers@suse.com>
(cherry picked from commit 134b7dec6ec2d90616d7986afb3b3b7ca7a4c383)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 921352867bc67b2e6bc6fa2e5538b04aadd78caf
https://github.com/qemu/qemu/commit/921352867bc67b2e6bc6fa2e5538b04aadd78caf
Author: Max Reitz <mreitz@redhat.com>
Date: 2020-09-09 (Wed, 09 Sep 2020)
Changed paths:
M tests/qemu-iotests/028
M tests/qemu-iotests/028.out
Log Message:
-----------
iotests/028: Add test for cross-base-EOF reads
Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200728120806.265916-3-mreitz@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Tested-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Tested-by: Claudio Fontana <cfontana@suse.de>
(cherry picked from commit ae159450e161b3e1e2c5b815d19632abbbbcd1a1)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: b57df52546762549aec6591f5f38523111702fa9
https://github.com/qemu/qemu/commit/b57df52546762549aec6591f5f38523111702fa9
Author: Eric Blake <eblake@redhat.com>
Date: 2020-09-09 (Wed, 09 Sep 2020)
Changed paths:
M nbd/server.c
Log Message:
-----------
nbd: Fix large trim/zero requests
Although qemu as NBD client limits requests to <2G, the NBD protocol
allows clients to send requests almost all the way up to 4G. But
because our block layer is not yet 64-bit clean, we accidentally wrap
such requests into a negative size, and fail with EIO instead of
performing the intended operation.
The bug is visible in modern systems with something as simple as:
$ qemu-img create -f qcow2 /tmp/image.img 5G
$ sudo qemu-nbd --connect=/dev/nbd0 /tmp/image.img
$ sudo blkdiscard /dev/nbd0
or with user-space only:
$ truncate --size=3G file
$ qemu-nbd -f raw file
$ nbdsh -u nbd://localhost:10809 -c 'h.trim(3*1024*1024*1024,0)'
Although both blk_co_pdiscard and blk_pwrite_zeroes currently return 0
on success, this is also a good time to fix our code to a more robust
paradigm that treats all non-negative values as success.
Alas, our iotests do not currently make it easy to add external
dependencies on blkdiscard or nbdsh, so we have to rely on manual
testing for now.
This patch can be reverted when we later improve the overall block
layer to be 64-bit clean, but for now, a minimal fix was deemed less
risky prior to release.
CC: qemu-stable@nongnu.org
Fixes: 1f4d6d18ed
Fixes: 1c6c4bb7f0
Fixes: https://github.com/systemd/systemd/issues/16242
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20200722212231.535072-1-eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
[eblake: rework success tests to use >=0]
(cherry picked from commit 890cbccb089db9e646cc1baea3be9dc060e3917b)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 5e817ece11e8fff09f1635dc9667175ef2234c28
https://github.com/qemu/qemu/commit/5e817ece11e8fff09f1635dc9667175ef2234c28
Author: Yuri Benditovich <yuri.benditovich@daynix.com>
Date: 2020-09-09 (Wed, 09 Sep 2020)
Changed paths:
M hw/net/virtio-net.c
Log Message:
-----------
virtio-net: align RSC fields with updated virtio-net header
Removal of duplicated RSC definitions. Changing names of the
fields to ones defined in the Linux header.
Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit dd3d85e89123c907be7628957457af3d03e3b85b)
Conflicts:
hw/net/virtio-net.c
*drop context dep. on 590790297c0
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: a575af07b8009bc51a311274c15846697b7d5f7c
https://github.com/qemu/qemu/commit/a575af07b8009bc51a311274c15846697b7d5f7c
Author: Graeme Gregory <graeme@nuviainc.com>
Date: 2020-09-09 (Wed, 09 Sep 2020)
Changed paths:
M hw/arm/sbsa-ref.c
Log Message:
-----------
hw/arm/sbsa-ref: fix typo breaking PCIe IRQs
Fixing a typo in a previous patch that translated an "i" to a 1
and therefore breaking the allocation of PCIe interrupts. This was
discovered when virtio-net-pci devices ceased to function correctly.
Cc: qemu-stable@nongnu.org
Fixes: 48ba18e6d3f3 ("hw/arm/sbsa-ref: Simplify by moving the gic in the
machine state")
Signed-off-by: Graeme Gregory <graeme@nuviainc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200821083853.356490-1-graeme@nuviainc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 870f0051b4ada9a361f7454f833432ae8c06c095)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: f243bb4b0d6dab7da3ae8490e0f46054bae93816
https://github.com/qemu/qemu/commit/f243bb4b0d6dab7da3ae8490e0f46054bae93816
Author: Gerd Hoffmann <kraxel@redhat.com>
Date: 2020-09-09 (Wed, 09 Sep 2020)
Changed paths:
M hw/usb/core.c
Log Message:
-----------
usb: fix setup_len init (CVE-2020-14364)
Store calculated setup_len in a local variable, verify it, and only
write it to the struct (USBDevice->setup_len) in case it passed the
sanity checks.
This prevents other code (do_token_{in,out} functions specifically)
from working with invalid USBDevice->setup_len values and overrunning
the USBDevice->setup_buf[] buffer.
Fixes: CVE-2020-14364
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Tested-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Message-id: 20200825053636.29648-1-kraxel@redhat.com
(cherry picked from commit b946434f2659a182afc17e155be6791ebfb302eb)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: f2fd6555c71e0c67c907e2c3d808a4f52acd972f
https://github.com/qemu/qemu/commit/f2fd6555c71e0c67c907e2c3d808a4f52acd972f
Author: Prasad J Pandit <pjp@fedoraproject.org>
Date: 2020-09-09 (Wed, 09 Sep 2020)
Changed paths:
M fsdev/qemu-fsdev.c
Log Message:
-----------
9p: null terminate fs driver options list
NULL terminate fs driver options' list, validate_opt() looks for
a null entry to terminate the loop.
Fixes: aee7f3ecd8b7 ("fsdev: Error out when unsupported option is passed")
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Message-Id: <20200709175848.650400-1-ppandit@redhat.com>
Signed-off-by: Greg Kurz <groug@kaod.org>
(cherry picked from commit 353b5a91ccf2789b85967d19a8795816b8865562)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: ebf5b3946e49bc10eef1234753f3fac3ac14d3e5
https://github.com/qemu/qemu/commit/ebf5b3946e49bc10eef1234753f3fac3ac14d3e5
Author: Greg Kurz <groug@kaod.org>
Date: 2020-09-10 (Thu, 10 Sep 2020)
Changed paths:
M hw/nvram/chrp_nvram.c
M hw/nvram/mac_nvram.c
M hw/nvram/spapr_nvram.c
M hw/sparc/sun4m.c
M hw/sparc64/sun4u.c
M include/hw/nvram/chrp_nvram.h
Log Message:
-----------
nvram: Exit QEMU if NVRAM cannot contain all -prom-env data
Since commit 61f20b9dc5b7 ("spapr_nvram: Pre-initialize the NVRAM to
support the -prom-env parameter"), pseries machines can pre-initialize
the "system" partition in the NVRAM with the data passed to all -prom-env
parameters on the QEMU command line.
In this case it is assumed that all the data fits in 64 KiB, but the user
can easily pass more and crash QEMU:
$ qemu-system-ppc64 -M pseries $(for ((x=0;x<128;x++)); do \
echo -n " -prom-env " ; printf "%0.sx" {1..1024}; \
done) # this requires ~128 Kib
malloc(): corrupted top size
Aborted (core dumped)
This happens because we don't check if all the prom-env data fits in
the NVRAM and chrp_nvram_set_var() happily memcpy() it passed the
buffer.
This crash affects basically all ppc/ppc64 machine types that use -prom-env:
- pseries (all versions)
- g3beige
- mac99
and also sparc/sparc64 machine types:
- LX
- SPARCClassic
- SPARCbook
- SS-10
- SS-20
- SS-4
- SS-5
- SS-600MP
- Voyager
- sun4u
- sun4v
Add a max_len argument to chrp_nvram_create_system_partition() so that
it can check the available size before writing to memory.
Since NVRAM is populated at machine init, it seems reasonable to consider
this error as fatal. So, instead of reporting an error when we detect that
the NVRAM is too small and adapt all machine types to handle it, we simply
exit QEMU in all cases. This is still better than crashing. If someone
wants another behavior, I guess this can be reworked later.
Tested with:
$ yes q | \
(for arch in ppc ppc64 sparc sparc64; do \
echo == $arch ==; \
qemu=${arch}-softmmu/qemu-system-$arch; \
for mach in $($qemu -M help | awk '! /^Supported/ { print $1 }'); do \
echo $mach; \
$qemu -M $mach -monitor stdio -nodefaults -nographic \
$(for ((x=0;x<128;x++)); do \
echo -n " -prom-env " ; printf "%0.sx" {1..1024}; \
done) >/dev/null; \
done; echo; \
done)
Without the patch, affected machine types cause QEMU to report some
memory corruption and crash:
malloc(): corrupted top size
free(): invalid size
*** stack smashing detected ***: terminated
With the patch, QEMU prints the following message and exits:
NVRAM is too small. Try to pass less data to -prom-env
It seems that the conditions for the crash have always existed, but it
affects pseries, the machine type I care for, since commit 61f20b9dc5b7
only.
Fixes: 61f20b9dc5b7 ("spapr_nvram: Pre-initialize the NVRAM to support the
-prom-env parameter")
RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1867739
Reported-by: John Snow <jsnow@redhat.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <159736033937.350502.12402444542194031035.stgit@bahia.lan>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
(cherry picked from commit 37035df51eaabb8d26b71da75b88a1c6727de8fa)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: b8fdfa9d6388823d66b22039b9dfb61fc7a8f401
https://github.com/qemu/qemu/commit/b8fdfa9d6388823d66b22039b9dfb61fc7a8f401
Author: Halil Pasic <pasic@linux.ibm.com>
Date: 2020-09-10 (Thu, 10 Sep 2020)
Changed paths:
M hw/s390x/virtio-ccw.c
Log Message:
-----------
virtio-ccw: fix virtio_set_ind_atomic
The atomic_cmpxchg() loop is broken because we occasionally end up with
old and _old having different values (a legit compiler can generate code
that accessed *ind_addr again to pick up a value for _old instead of
using the value of old that was already fetched according to the
rules of the abstract machine). This means the underlying CS instruction
may use a different old (_old) than the one we intended to use if
atomic_cmpxchg() performed the xchg part.
Let us use volatile to force the rules of the abstract machine for
accesses to *ind_addr. Let us also rewrite the loop so, we that the
new old is used to compute the new desired value if the xchg part
is not performed.
Fixes: 7e7494627f ("s390x/virtio-ccw: Adapter interrupt support.")
Reported-by: Andre Wild <Andre.Wild1@ibm.com>
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Message-Id: <20200616045035.51641-2-pasic@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
(cherry picked from commit 1a8242f7c3f53341dd66253b142ecd06ce1d2a97)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 5c49f7ee3b98316850de6a33952a4ac47701c118
https://github.com/qemu/qemu/commit/5c49f7ee3b98316850de6a33952a4ac47701c118
Author: Nathan Chancellor <natechancellor@gmail.com>
Date: 2020-09-14 (Mon, 14 Sep 2020)
Changed paths:
M hw/riscv/sifive_test.c
Log Message:
-----------
riscv: sifive_test: Allow 16-bit writes to memory region
When shutting down the machine running a mainline Linux kernel, the
following error happens:
$ build/riscv64-softmmu/qemu-system-riscv64 -bios default -M virt \
-display none -initrd rootfs.cpio -kernel Image -m 512m \
-nodefaults -serial mon:stdio
...
Requesting system poweroff
[ 4.999630] reboot: Power down
sbi_trap_error: hart0: trap handler failed (error -2)
sbi_trap_error: hart0: mcause=0x0000000000000007 mtval=0x0000000000100000
sbi_trap_error: hart0: mepc=0x000000008000d4cc mstatus=0x0000000000001822
sbi_trap_error: hart0: ra=0x000000008000999e sp=0x0000000080015c78
sbi_trap_error: hart0: gp=0xffffffe000e76610 tp=0xffffffe0081b89c0
sbi_trap_error: hart0: s0=0x0000000080015c88 s1=0x0000000000000040
sbi_trap_error: hart0: a0=0x0000000000000000 a1=0x0000000080004024
sbi_trap_error: hart0: a2=0x0000000080004024 a3=0x0000000080004024
sbi_trap_error: hart0: a4=0x0000000000100000 a5=0x0000000000005555
sbi_trap_error: hart0: a6=0x0000000000004024 a7=0x0000000080011158
sbi_trap_error: hart0: s2=0x0000000000000000 s3=0x0000000080016000
sbi_trap_error: hart0: s4=0x0000000000000000 s5=0x0000000000000000
sbi_trap_error: hart0: s6=0x0000000000000001 s7=0x0000000000000000
sbi_trap_error: hart0: s8=0x0000000000000000 s9=0x0000000000000000
sbi_trap_error: hart0: s10=0x0000000000000000 s11=0x0000000000000008
sbi_trap_error: hart0: t0=0x0000000000000000 t1=0x0000000000000000
sbi_trap_error: hart0: t2=0x0000000000000000 t3=0x0000000000000000
sbi_trap_error: hart0: t4=0x0000000000000000 t5=0x0000000000000000
sbi_trap_error: hart0: t6=0x0000000000000000
The kernel does a 16-bit write when powering off the machine, which
was allowed before commit 5d971f9e67 ("memory: Revert "memory: accept
mismatching sizes in memory_region_access_valid""). Make min_access_size
match reality so that the machine can shut down properly now.
Cc: qemu-stable@nongnu.org
Fixes: 88a07990fa ("SiFive RISC-V Test Finisher")
Fixes: 5d971f9e67 ("memory: Revert "memory: accept mismatching sizes in
memory_region_access_valid"")
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20200901055822.2721209-1-natechancellor@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
(cherry picked from commit ab3d207fe89bc0c63739db19e177af49179aa457)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit: 386b2a5767f7642521cd07930c681ec8a6057e60
https://github.com/qemu/qemu/commit/386b2a5767f7642521cd07930c681ec8a6057e60
Author: Michael Roth <mdroth@linux.vnet.ibm.com>
Date: 2020-09-15 (Tue, 15 Sep 2020)
Changed paths:
M VERSION
Log Message:
-----------
Update version for 5.0.1 release
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Compare: https://github.com/qemu/qemu/compare/9e6e3ba30984%5E...386b2a5767f7
| [Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-commits] [qemu/qemu] 9e6e3b: hostmem: don't use mbind() if host-nodes is empty,
Michael Roth <=