Commit Graph

65168 Commits

Author SHA1 Message Date
Marc-André Lureau
03fee66fde vmstate: constify VMStateField
Because they are supposed to remain const.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20181114132931.22624-1-marcandre.lureau@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:35:15 +01:00
Paolo Bonzini
5aaac46793 migration: savevm: consult migration blockers
There is really no difference between live migration and savevm, except
that savevm does not require bdrv_invalidate_cache to be implemented
by all disks.  However, it is unlikely that savevm is used with anything
except qcow2 disks, so the penalty is small and worth the improvement
in catching bad usage of savevm.

Only one place was taking care of savevm when adding a migration blocker,
and it can be removed.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:06:14 +01:00
George Kennedy
56333e69ee lsi: Reselection needed to remove pending commands from queue
Under heavy IO (e.g. fio) the queue is not checked frequently enough for
pending commands. As a result some pending commands are timed out by the
linux sym53c8xx driver, which sends SCSI Abort messages for the timed out
commands. The SCSI Abort messages result in linux errors, which show up
on the console and in /var/log/messages.

e.g.
sd 0:0:3:0: [sdd] tag#33 ABORT operation started
scsi target0:0:3: control msgout:
80 20 47 d
sd 0:0:3:0: ABORT operation complete.
scsi target0:0:4: message d sent on bad reselection

Now following a WAIT DISCONNECT Script instruction, and if there is no
current command, check for a pending command on the queue and if one
exists call lsi_reselect().

Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Message-Id: <1541776692-12271-1-git-send-email-george.kennedy@oracle.com>
[For safety, add a s->current check in lsi_update_irq - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:06:14 +01:00
Paolo Bonzini
a8efa60633 cpus: run work items for all vCPUs if single-threaded
This avoids the following I/O thread deadlock:

1) the I/O thread calls run_on_cpu for CPU 3 from a timer.  single_tcg_halt_cond
is signaled

2) CPU 1 is running and exits.  It finds no work item and enters CPU 2

3) because the I/O thread is stuck in run_on_cpu, the round-robin kick
timer never triggers, and CPU 3 never runs the work item

4) run_on_cpu never completes

Reviewed-by: Emilio G. Cota <cota@braap.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:06:14 +01:00
Paolo Bonzini
d98f26073b target/i386: kvm: add VMX migration blocker
Nested VMX does not support live migration yet.  Add a blocker
until that is worked out.

Nested SVM only does not support it, but unfortunately it is
enabled by default for -cpu host so we cannot really disable it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:06:14 +01:00
Peter Maydell
4822f1ee9e various bugfixes for 3.1: fmops, ps2, cirrus, hda, usb-host, qapi
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJb/OjpAAoJEEy22O7T6HE44jYQAM3G/VpOnlfHjRP9FUNyW9rW
 tIKnRzabMirgGIR91Z9zgVA/WprI+v5XMZ6MzYasxF20c87I3apAwwh6ihFmaw2A
 h+X2379194VAcBBFdhKbkXm32M1b6eeIsUCp1atVbCxNmshbMTIcAt4E7/IkI+zr
 0V9lES3XEd7bvFyYmZtlQJj0ugaBa2H/GvPc9X6oIVxKQJbJ2z/Po3hGUTRFp6hN
 kWxWV/TcVXlQ0qhj9slVMUPr6dI9iZ6jlxNJ1OBbD8TMTIwVpyITvsuvUT+qEYuE
 kAg6J15ChtV2AnNLu1TfyCVvr+x2ExPvIJEgFvsKvaQCEMMRSB9xYd5whEQusnHY
 F39mSbOLNcrHDlyjm6AySH5FDrzhJun1ZmfRsvHe9xsojE0X1R+Ygkvch9vldTxO
 XEGqacaz6jdzHy19PSTlypsJG+yIzZXYntEwLCsI+xd/JzLwQXAkMSiu01WWr+hM
 iHOOdbYLUfv4iTIrOjBZB8l/2M0nSlP2LZz8UmWcmLxMkPTYh+fowgp7PqZWj7ws
 ayDAC8t4Qy0dEv96/zpsgpl7/GSCTSTSs2GY+2Ft9FFLHHDKlF6rgWKbfMyM2dCD
 zPlFl99ZdtvMBlwG+kt5J3UaS2JB0u6h1I6bgliIUz1i+Jf79Y1diMA8SPmf+PJ0
 U9xx4tiXzCGCbZIUdqGX
 =RmNv
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181127-pull-request' into staging

various bugfixes for 3.1: fmops, ps2, cirrus, hda, usb-host, qapi

# gpg: Signature made Tue 27 Nov 2018 06:49:13 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/fixes-31-20181127-pull-request:
  qapi: add query-display-options command
  usb-host: set ifs.detached as true if kernel driver is not active
  audio/hda: fix guest triggerable assert
  cirrus_vga/migration: update the bank offset before use
  ps2kbd: default to scan enabled after reset
  fmops: fix off-by-one in AR_TABLE and DR_TABLE array size

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27 11:21:38 +00:00
Peter Maydell
d5d31c9a8a x86 fixes for -rc3
* Fix SynIC crash
 * Fix x86 crash on MSR code on AMD hosts
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABCAAGBQJb/F56AAoJECgHk2+YTcWmhTAP/1R0EPlFqfS4U3VIb43ac+dQ
 Q3lJg3ye23Jp9Cws32pZXTFZyCa76H8rSY0ky+2g4GL5JvAg/LRM3dGF8VceJY4O
 NgMps1hozxuqRfSqjn56uzqok/ewSql/WHQedUKAk34wImZkv0m/6rAgTK86xuW3
 hEnrfOFqowMIrbVw5D0E6b0dT7FshCsvP9cxWxczOdONcV3TZHut7vyTWmlwidlB
 OpfR4aURoNuOc8gOOeOwh763rqS4wVNLI80kbkrti4C9crrNmsRxq839M7G6l993
 7yFGYooVQvAGd1FDfTfAyqloDGpBjuGh+2apOjByFjaY3+CRMAk2pAgriTTiuPbU
 0yy8eyRue0CtIikS9S3/rkbwG2H82kFditx0WVVOceut3/NLljmRTS/YmL5bq4GK
 c2KLDbukflghTIsdpWeLVn9AbKPw80MOia/aTG93e3E/Q7AqKnXbq8nRY6lhayXq
 1sSrneEqiA1UNjR/shbCV/pHSZCoWWCfYO56jsrlkVsL19GlPljolj0Nct29FTAW
 J4So91K21Xcablzchn8rg9Q2aq9px9RRBVmdK/SJFZuLVAOxjSXKbGDNM+/YZ0Wa
 /vvXBrM1Xgf/8reWnFPEfRP6rHFlVVhA40Ho5oqNpI8+mrvqYnASTWcnVZ+V+gnW
 2prdaJ8h3bKseouxly85
 =ZzdR
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/ehabkost/tags/x86-for-3.1-pull-request' into staging

x86 fixes for -rc3

* Fix SynIC crash
* Fix x86 crash on MSR code on AMD hosts

# gpg: Signature made Mon 26 Nov 2018 20:58:34 GMT
# gpg:                using RSA key 2807936F984DC5A6
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* remotes/ehabkost/tags/x86-for-3.1-pull-request:
  hw/hyperv: fix NULL dereference with pure-kvm SynIC
  kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES support

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27 09:55:05 +00:00
Gerd Hoffmann
e1ca8f7e19 qapi: add query-display-options command
Add query-display-options command, which allows querying the qemu
display configuration.  This isn't particularly useful, except it
exposes QAPI type DisplayOptions in query-qmp-schema, so that libvirt
can discover recently added -display parameter rendernode (commit
d4dc4ab133).  Works around lack of sufficiently powerful command line
introspection.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Tested-by: Eric Blake <eblake@redhat.com>
Tested-by: Erik Skultety <eskultet@redhat.com>
Message-id: 20181122071613.2889-1-kraxel@redhat.com

[ kraxel: reworded commit message as suggested by armbru ]
2018-11-27 07:47:57 +01:00
linzhecheng
933d2d4bf2 usb-host: set ifs.detached as true if kernel driver is not active
If no kernel driver is active, we can already claim and perform I/O on
it without detaching it.

Signed-off-by: linzhecheng <linzhecheng@huawei.com>
Message-id: 20181120083419.17716-1-linzhecheng@huawei.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-27 07:47:57 +01:00
Gerd Hoffmann
7ec9106759 audio/hda: fix guest triggerable assert
Guest writes to a readonly register trigger the assert in
intel_hda_reg_write().  Add a check and just ignore them.

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1628433
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20181123063957.9515-1-kraxel@redhat.com
2018-11-27 07:47:57 +01:00
Wang Xin
b7ee9e4970 cirrus_vga/migration: update the bank offset before use
The cirrus bank0/1 offset should be updated before we update the vram's alias
offset.

Signed-off-by: Wang Xin <wangxinxin.wang@huawei.com>
Message-id: 20181123064646.23036-1-linzhecheng@huawei.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-27 07:47:57 +01:00
Hervé Poussineau
d2e550a828 ps2kbd: default to scan enabled after reset
A check for scan_enabled has been added to ps2_keyboard_event in commit
143c04c7e0 to prevent stream corruption.
This works well as long as operating system is resetting keyboard, or enabling it.

This fixes IBM 40p firmware, which doesn't bother sending KBD_CMD_RESET,
KBD_CMD_ENABLE or KBD_CMD_RESET_ENABLE before trying to use the keyboard.

Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20181021190721.2148-1-hpoussin@reactos.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-27 07:47:50 +01:00
Roman Kagan
30a759b61a hw/hyperv: fix NULL dereference with pure-kvm SynIC
When started in compat configuration of SynIC, e.g.

qemu-system-x86_64 -machine pc-i440fx-2.10,accel=kvm \
 -cpu host,-vmx,hv-relaxed,hv_spinlocks=0x1fff,hv-vpindex,hv-synic

or explicitly

qemu-system-x86_64 -enable-kvm -cpu host,hv-synic,x-hv-synic-kvm-only=on

QEMU crashes in hyperv_synic_reset() trying to access the non-present
qobject for SynIC.

Add the missing check for NULL.

Reported-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Reported-by: Igor Mammedov <imammedo@redhat.com>
Fixes: 9b4cf107b0
Fixes: 4a93722f9c
Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>
Message-Id: <20181126152836.25379-1-rkagan@virtuozzo.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-11-26 14:14:38 -02:00
Bandan Das
aec5e9c3a9 kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES support
When writing to guest's MSR_IA32_ARCH_CAPABILITIES, check whether it's
supported in the guest using the KVM_GET_MSR_INDEX_LIST ioctl.

Fixes: d86f963694
Suggested-by: Eduardo Habkost <ehabkost@redhat.com>
Tested-by: balducci@units.it
Signed-off-by: Bandan Das <bsd@redhat.com>
Message-Id: <jpg4lc4iiav.fsf_-_@linux.bootlegged.copy>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-11-26 13:00:38 -02:00
Peter Maydell
d522fba244 target-arm queue:
* some updates to MAINTAINERS file entries
  * cadence_gem: Remove an incorrect assert()
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJb+/vOAAoJEDwlJe0UNgze5w8QAKdMMpkJYMyGDAmAcFnFpr7N
 nIZWTL6B8krJ9CBNlSbW8rsi3yqyNw+lmH//jSB8KJYYk/UGYkT5v7BdOZdm5W9J
 hsuW6LdVgWTPHiLvGEmBTFX4vSE6uuE4nrgEFG+EEf+SV7RZ7B9auYnCzOHTJDBv
 2Pc/pOJPttJ5nXnkIe7kzEYg3xBsKSIlGnHs6nCKllGh9kwgaTQ5MEqcP3C2OSY2
 W361UCkYogqslJ+rQXY5QBS9webGpUcumog9TnYF/wjf8VF9pFDE+OrbFTYzifsq
 lfGdgEL5NAws0M+9m/95u+SRdW7RtQaUNXqNK+jg6y7cKg6pRqw+lftbqgNnt10D
 FvQ4oyRLHhafMxJY04d8Q+OAxsWBE/8gXRfczsfqoOiDh9KFQG1x92U+vRGlHg6p
 /GXBf+CHgpLa/0lW2CEveTYWXmdifzQtD4EVnHsbmvphHQ4tn7L9EIGI1Ak96MR2
 L2r/mgtC6Uke3VWtKhhN3SUlj0mqlG+67tz7LUFWZa9BcIg/vWng9gRLC/VkZlyK
 jhYmia84gkwEP0vSNN1pC/4oYwXFc1NGIW87LNleTKgZJHdXZIa7m/92QOyZgfg7
 G10FLVCBJsi1VGgr9RYhE+XeLq02duWN7SNg1k9LWgbwfEW1hvZYUmi6SFStL4gR
 GgMUXYf1wvbNqLF7kCmY
 =fZXf
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20181126' into staging

target-arm queue:
 * some updates to MAINTAINERS file entries
 * cadence_gem: Remove an incorrect assert()

# gpg: Signature made Mon 26 Nov 2018 13:57:34 GMT
# gpg:                using RSA key 3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>"
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20181126:
  net: cadence_gem: Remove incorrect assert()
  MAINTAINERS: Add an ARM SMMU section
  MAINTAINERS: Assign some more files in the hw/arm/ directory

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26 13:58:46 +00:00
Edgar E. Iglesias
58102ce7fb net: cadence_gem: Remove incorrect assert()
Don't assert on RX descriptor settings when the receiver is
disabled. This fixes an issue with incoming packets on an
unused GEM.

Reported-by: mbilal <muhammad_bilal@mentor.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20181123135450.24829-2-edgar.iglesias@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26 13:41:42 +00:00
Eric Auger
49154ea0bf MAINTAINERS: Add an ARM SMMU section
Add a new ARM SMMU section and set Eric Auger as the maintainer
for ARM SMMU emulation sources.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20181122180143.14237-1-eric.auger@redhat.com
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26 13:40:48 +00:00
Thomas Huth
123a069ae6 MAINTAINERS: Assign some more files in the hw/arm/ directory
I apparently missed some more files and even a complete machine (the
"imx25-pdk") in my previous patch... but now we should hopefully have
a completely coverage for all available ARM boards.

Fixes: 95a5db3ae5
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 1542782568-20059-1-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26 13:39:23 +00:00
Peter Maydell
72138f9bf5 Fixes a QEMU crash triggerable by guest userspace (CVE-2018-19489).
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEtIKLr5QxQM7yo0kQcdTV5YIvc9YFAlv7n80ACgkQcdTV5YIv
 c9bfvQ//a2cmpKL5DxuhtZ8Z8HvK0LkhXz/Q12mnSRR2gwQzy5C2xY1ARTXqEUyu
 cASTvARljTJSWO/86+5S0oxS1rG8LBhfF5mCrGmn/kd6ntYpRTiGVREAarMPDU69
 hPXPNjPynnUXMiyxyssm4Xb73l9fW9HuKjlgpW/tFrLPCAY1CFy+cfS/5gSinhAh
 GRfxVhFVHA00AgFp5QCcfeAtjEaf1Xgqc/L4GF7BWi7cc9sPSD6M5YctkLzt75uH
 acaiQBWTV9gNmYyfek/kpssVbGma+H8APgeXeCw5uRcO6EYlomVaIIsX6hSdCt5x
 9LyIqob0xWOorRFx0U0KDmqu+rjsdXYJWVaTm/7KBxqiUNEHnliCQ7UH34pi4tsp
 q4vOpviiGz/VwWE3VdLgmO7pOegf16ofQ/RFM/flKFP712VwIKCUAT2CS+jqEY5p
 o3N1wNelUvQLp8qEAIIdqc29RDeJyqeiQUkxGNvyV3E2cyxwTLouBe78AhmOQ5iw
 oMwG2FPseOTPkrYmV5cMZQiKhZ0BD2ngoVtN7TVAmxRHkmKE91soi+WpJ2xA9ohm
 +E8yYFyqAt6CR+YMi39f+WUdya79PL7YbFDZq/IMHFDoujPdjBJWq4gUxMNS2FI5
 FWBfRWmYulEBriZvL8xVwJSbbHpubMvTSSz58OFu01fxKw9qF9o=
 =63qs
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging

Fixes a QEMU crash triggerable by guest userspace (CVE-2018-19489).

# gpg: Signature made Mon 26 Nov 2018 07:25:01 GMT
# gpg:                using RSA key 71D4D5E5822F73D6
# gpg: Good signature from "Greg Kurz <groug@kaod.org>"
# gpg:                 aka "Gregory Kurz <gregory.kurz@free.fr>"
# gpg:                 aka "[jpeg image of size 3330]"
# Primary key fingerprint: B482 8BAF 9431 40CE F2A3  4910 71D4 D5E5 822F 73D6

* remotes/gkurz/tags/for-upstream:
  9p: fix QEMU crash when renaming files

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26 11:46:04 +00:00
Peter Maydell
b05730a876 xtensa fixes for 3.1:
- fix register counting logic for linux-user gdbserver;
 - provide default memory sizes for XTFPGA boards;
 - add missing xtensa patterns to MAINTAINTERS.
 -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCAAxFiEEK2eFS5jlMn3N6xfYUfnMkfg/oEQFAlv7K0oTHGpjbXZia2Jj
 QGdtYWlsLmNvbQAKCRBR+cyR+D+gRDWrD/4yPoHniOxe/1tnldviJVChJsE7YjGD
 S1J/JOIxSqH/fdHm7t3n4lQU8VvdKu7O8XEgscFRa2tnSKnERrlOsjJJCQMVPk7x
 gkSBgdmfxJtfVVK3uktU+nNVuecx6jPEOZhNgWPFv5WZKUUvmdaAJ4DRHQx1PjoO
 PGPjqcDJ0nQMteqDDdrnL3Q/Hu0lMDSXU4fBdaVw4fWTETOwQdf6nMma9iGP2/Eq
 ZqTigrHX617JspqVXvTLwJ5C4hg2UEKpS8QG8p5t91cD2QBT3j5Curylku2MWeLS
 eFKKZs/9sxskydlLs3RJM1xslWihYz1UDg2Gz7o3MbceacYuVAH7wcWeXx0GiNQ6
 enU3IVG8lOBy6LNZZVSwwFtUdbaFMG1ZzGOh5yAdH15SyKsxHqxyV4iy2MxfU7a8
 Ipc+AjgPHaOLwpRe/19MdOULRkMAyUWhd6nfK+D3VaLX3paB+FKNhXMpR9g5wr+8
 q6jwCuz0ncS4gHKTekCaYceJJ5XV3ie6oDQrr0SLRZZpddEjiWybHS/5w+EZzeUE
 xankg3zqpLTPQrIPusOlmtRPYHKcYQuU3lzcRt7emvIKj5ofTxw0hFfX7X3a+UPp
 ENO89RNBA473XV6ovl6OzK84rKeGSVOVIdBouRxWROV55OcWPHamFgaT2BuSXr7z
 tZwM6v6xMsTAyw==
 =P9x7
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/xtensa/tags/20181125-xtensa' into staging

xtensa fixes for 3.1:

- fix register counting logic for linux-user gdbserver;
- provide default memory sizes for XTFPGA boards;
- add missing xtensa patterns to MAINTAINTERS.

# gpg: Signature made Sun 25 Nov 2018 23:07:54 GMT
# gpg:                using RSA key 51F9CC91F83FA044
# gpg: Good signature from "Max Filippov <filippov@cadence.com>"
# gpg:                 aka "Max Filippov <max.filippov@cogentembedded.com>"
# gpg:                 aka "Max Filippov <jcmvbkbc@gmail.com>"
# Primary key fingerprint: 2B67 854B 98E5 327D CDEB  17D8 51F9 CC91 F83F A044

* remotes/xtensa/tags/20181125-xtensa:
  MAINTAINERS: add missing xtensa patterns
  target/xtensa: xtfpga: provide default memory sizes
  target/xtensa: drop num_[core_]regs from dc232b/dc233c configs
  target/xtensa: gdbstub fix register counting

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26 11:07:35 +00:00
Gerd Hoffmann
57ac4a7a28 fmops: fix off-by-one in AR_TABLE and DR_TABLE array size
Cc: P J P <ppandit@redhat.com>
Reported-by: Wangjunqing <wangjunqing@huawei.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20181030082340.17170-1-kraxel@redhat.com
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-26 11:15:32 +01:00
Greg Kurz
1d20398694 9p: fix QEMU crash when renaming files
When using the 9P2000.u version of the protocol, the following shell
command line in the guest can cause QEMU to crash:

    while true; do rm -rf aa; mkdir -p a/b & touch a/b/c & mv a aa; done

With 9P2000.u, file renaming is handled by the WSTAT command. The
v9fs_wstat() function calls v9fs_complete_rename(), which calls
v9fs_fix_path() for every fid whose path is affected by the change.
The involved calls to v9fs_path_copy() may race with any other access
to the fid path performed by some worker thread, causing a crash like
shown below:

Thread 12 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8, path=0x0,
 flags=65536, mode=0) at hw/9pfs/9p-local.c:59
59          while (*path && fd != -1) {
(gdb) bt
#0  0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8,
 path=0x0, flags=65536, mode=0) at hw/9pfs/9p-local.c:59
#1  0x0000555555a25e0c in local_opendir_nofollow (fs_ctx=0x555557d958b8,
 path=0x0) at hw/9pfs/9p-local.c:92
#2  0x0000555555a261b8 in local_lstat (fs_ctx=0x555557d958b8,
 fs_path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/9p-local.c:185
#3  0x0000555555a2b367 in v9fs_co_lstat (pdu=0x555557d97498,
 path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/cofile.c:53
#4  0x0000555555a1e9e2 in v9fs_stat (opaque=0x555557d97498)
 at hw/9pfs/9p.c:1083
#5  0x0000555555e060a2 in coroutine_trampoline (i0=-669165424, i1=32767)
 at util/coroutine-ucontext.c:116
#6  0x00007fffef4f5600 in __start_context () at /lib64/libc.so.6
#7  0x0000000000000000 in  ()
(gdb)

The fix is to take the path write lock when calling v9fs_complete_rename(),
like in v9fs_rename().

Impact:  DoS triggered by unprivileged guest users.

Fixes: CVE-2018-19489
Cc: P J P <ppandit@redhat.com>
Reported-by: zhibin hu <noirfate@gmail.com>
Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Greg Kurz <groug@kaod.org>
2018-11-23 13:28:03 +01:00
Peter Maydell
5298f4d67a Block layer patches:
- block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options()
 - block: Fix option inheritance after stream/commit job graph changes
 - qemu-img: Fix memory leak and typo in error message
 - nvme: Fixes for lockups and crashes
 - scsi-disk: Fix crash if underlying host file or disk returns error
 - Several qemu-iotests fixes and improvements
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJb9vemAAoJEH8JsnLIjy/WWJQQAKiW7/Ku1i4DgZz6n97+HumE
 CryEgO/Hx9YnQPJPcEWNQVNtdO311rJSprLkmt83tOwQ1ew9lvqdcq9ptEUb4dW9
 9bV31nP2nRkR3/cyLgWuYALH3Y6eSMwLQiYb0DaWKL2sxiMdghvK3gALXb3r+AtI
 F2uuQC6N6xNKj5srrTcxMman22QYIqkeuONWY9La9mQWG44WI5Gc+mF1LKMNk7x9
 bBsvP5+ukm3O4+vvGylZjOXYpCgwQngSLvGG/rsHwBTBrDQiy3m1JoxxXzqr+Z4K
 p2b5wU2vFgfJ6cDGZJQWHQ/XAH3njmuPJEg+DOe7SUuGio2gQZCHlHU0xtp0GrQh
 BkYMfRUfb+rJ/t/mamX1y45XSBdvR0hJkgdgZYeHbFfV80Do63GqfqzOCDkKBocg
 /cbcDAvLiztoQpSa3aLMCHobs2X4Jn41ODUEidRbWsn3W099R2vIAUnxht/RI8Dm
 A5a7zfzXgMyEeXywxdCGM2k2oQsDnZoZLqNYJjkVmn3eqSIt3aLaSWtX0U7EVbEC
 PwNXAhz0Gl1YFhkgzEd8qkNH60lUb7Lone+3471iKACY0gjEeN5Ljsv/+HhaTQi/
 a5HTAf+eUUO9OJt3DNE4pbUORDH0XMZBb3vTqfqf9a0iKWxXnuX25xm5YfVyagDi
 54ZVHTqL+4zskS7uHD1O
 =dCUx
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches:

- block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options()
- block: Fix option inheritance after stream/commit job graph changes
- qemu-img: Fix memory leak and typo in error message
- nvme: Fixes for lockups and crashes
- scsi-disk: Fix crash if underlying host file or disk returns error
- Several qemu-iotests fixes and improvements

# gpg: Signature made Thu 22 Nov 2018 18:38:30 GMT
# gpg:                using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream:
  block: Update BlockDriverState.inherits_from on bdrv_drop_intermediate()
  block: Update BlockDriverState.inherits_from on bdrv_set_backing_hd()
  iotests: Enhance 223 to cover multiple bitmap granularities
  nvme: fix bug with PCI IRQ pins on teardown
  nvme: fix CMB endianness confusion
  Revert "nvme: fix oob access issue(CVE-2018-16847)"
  nvme: fix out-of-bounds access to the CMB
  nvme: call blk_drain in NVMe reset code to avoid lockups
  iotests: fix nbd test 233 to work correctly with raw images
  block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options()
  scsi-disk: Fix crash if underlying host file or disk returns error
  qemu-img: Fix leak
  qemu-img: Fix typo
  iotests: Skip 233 if certtool not installed
  iotests: Replace assertEquals() with assertEqual()
  iotests: Replace time.clock() with Timeout

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-23 08:54:52 +00:00
Max Filippov
895e4897e2 MAINTAINERS: add missing xtensa patterns
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-22 21:16:43 -08:00
Alberto Garcia
6bd858b311 block: Update BlockDriverState.inherits_from on bdrv_drop_intermediate()
The previous patch fixed the inherits_from pointer after block-stream,
and this one does the same for block-commit.

When block-commit finishes and the 'top' node is not the topmost one
from the backing chain then all nodes above 'base' up to and including
'top' are removed from the chain.

The bdrv_drop_intermediate() call converts a chain like this one:

    base <- intermediate <- top <- active

into this one:

    base <- active

In a simple scenario each backing file from the first chain has the
inherits_from attribute pointing to its parent. This means that
reopening 'active' will recursively reopen all its children, whose
options can be changed in the process.

However after the 'block-commit' call base.inherits_from is NULL and
the chain is broken, so 'base' does not inherit from 'active' and will
not be reopened automatically:

   $ qemu-img create -f qcow2 hd0.qcow2 1M
   $ qemu-img create -f qcow2 -b hd0.qcow2 hd1.qcow2
   $ qemu-img create -f qcow2 -b hd1.qcow2 hd2.qcow2
   $ $QEMU -drive if=none,file=hd2.qcow2

   { 'execute': 'block-commit',
     'arguments': {
       'device': 'none0',
       'top': 'hd1.qcow2' } }

   { 'execute': 'human-monitor-command',
     'arguments': {
        'command-line':
          'qemu-io none0 "reopen -o backing.l2-cache-size=2M"' } }

   { "return": "Cannot change the option 'backing.l2-cache-size'\r\n"}

This patch updates base.inherits_from in this scenario, and adds a
test case.

Signed-off-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22 19:37:31 +01:00
Alberto Garcia
0065c455f9 block: Update BlockDriverState.inherits_from on bdrv_set_backing_hd()
When a BlockDriverState's child is opened (be it a backing file, the
protocol layer, or any other) inherits_from is set to point to the
parent node. Children opened separately and then attached to a parent
don't have this pointer set.

bdrv_reopen_queue_child() uses this to determine whether a node's
children must also be reopened inheriting the options from the parent
or not. If inherits_from points to the parent then the child is
reopened and its options can be changed, like in this example:

   $ qemu-img create -f qcow2 hd0.qcow2 1M
   $ qemu-img create -f qcow2 hd1.qcow2 1M
   $ $QEMU -drive if=none,node-name=hd0,file=hd0.qcow2,\
                  backing.driver=qcow2,backing.file.filename=hd1.qcow2
   (qemu) qemu-io hd0 "reopen -o backing.l2-cache-size=2M"

If the child does not inherit from the parent then it does not get
reopened and its options cannot be changed:

   $ $QEMU -drive if=none,node-name=hd1,file=hd1.qcow2
           -drive if=none,node-name=hd0,file=hd0.qcow2,backing=hd1
   (qemu) qemu-io hd0 "reopen -o backing.l2-cache-size=2M"
   Cannot change the option 'backing.l2-cache-size'

If a disk image has a chain of backing files then all of them are also
connected through their inherits_from pointers (i.e. it's possible to
walk the chain in reverse order from base to top).

However this is broken if the intermediate nodes are removed using
e.g. block-stream because the inherits_from pointer from the base node
becomes NULL:

   $ qemu-img create -f qcow2 hd0.qcow2 1M
   $ qemu-img create -f qcow2 -b hd0.qcow2 hd1.qcow2
   $ qemu-img create -f qcow2 -b hd1.qcow2 hd2.qcow2
   $ $QEMU -drive if=none,file=hd2.qcow2
   (qemu) qemu-io none0 "reopen -o backing.l2-cache-size=2M"
   (qemu) block_stream none0 0 hd0.qcow2
   (qemu) qemu-io none0 "reopen -o backing.l2-cache-size=2M"
   Cannot change the option 'backing.l2-cache-size'

This patch updates the inherits_from pointer if the intermediate nodes
of a backing chain are removed using bdrv_set_backing_hd(), and adds a
test case for this scenario.

Signed-off-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22 19:37:31 +01:00
Eric Blake
a237dea330 iotests: Enhance 223 to cover multiple bitmap granularities
Testing granularity at the same size as the cluster isn't quite
as fun as what happens when it is larger or smaller.  This
enhancement also shows that qemu's nbd server can serve the
same disk over multiple exports simultaneously.

Signed-off-by: Eric Blake <eblake@redhat.com>
Tested-by: John Snow <jsnow@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22 19:37:31 +01:00
Logan Gunthorpe
ad3a7e4555 nvme: fix bug with PCI IRQ pins on teardown
When the submission and completion queues are being torn down
the IRQ will be asserted for the completion queue when the
submsission queue is deleted. Then when the completion queue
is deleted it stays asserted. Thus, on systems that do
not use MSI, no further interrupts can be triggered on the host.

Linux sees this as a long delay when unbinding the nvme device.
Eventually the interrupt timeout occurs and it continues.

To fix this we ensure we deassert the IRQ for a CQ when it is
deleted.

Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22 19:37:31 +01:00
Paolo Bonzini
71a86ddece nvme: fix CMB endianness confusion
The CMB is marked as DEVICE_LITTLE_ENDIAN, so the data must be
read/written as if it was little-endian output (in the case of
big endian, we get two swaps, one in the memory core and one
in nvme.c).

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22 19:37:31 +01:00
Kevin Wolf
2067d39e5e Revert "nvme: fix oob access issue(CVE-2018-16847)"
This reverts commit 5e3c0220d7.
We have a better fix commited for this now.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22 16:43:52 +01:00
Paolo Bonzini
87ad860c62 nvme: fix out-of-bounds access to the CMB
Because the CMB BAR has a min_access_size of 2, if you read the last
byte it will try to memcpy *2* bytes from n->cmbuf, causing an off-by-one
error.  This is CVE-2018-16847.

Another way to fix this might be to register the CMB as a RAM memory
region, which would also be more efficient.  However, that might be a
change for big-endian machines; I didn't think this through and I don't
know how real hardware works.  Add a basic testcase for the CMB in case
somebody does this change later on.

Cc: Keith Busch <keith.busch@intel.com>
Cc: qemu-block@nongnu.org
Reported-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Tested-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22 16:43:52 +01:00
Igor Druzhinin
6bf7463615 nvme: call blk_drain in NVMe reset code to avoid lockups
When blk_flush called in NVMe reset path S/C queues are already freed
which means that re-entering AIO handling loop having some IO requests
unfinished will lockup or crash as their SG structures being potentially
reused. Call blk_drain before freeing the queues to avoid this nasty
scenario.

Signed-off-by: Igor Druzhinin <igor.druzhinin@citrix.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22 16:43:52 +01:00
Daniel P. Berrangé
e4c8f2925d iotests: fix nbd test 233 to work correctly with raw images
The first qemu-io command must honour the $IMGFMT that is set rather
than hardcoding qcow2. The qemu-nbd commands should also set $IMGFMT
to avoid the insecure format probe warning.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22 16:43:52 +01:00
Alberto Garcia
2a3d4331fa block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options()
Commit e35bdc123a added the auto-read-only option and the
code to update its corresponding flag in update_flags_from_options(),
but forgot to clear the flag if auto-read-only is false.

Signed-off-by: Alberto Garcia <berto@igalia.com>
Reported-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22 16:43:52 +01:00
Richard W.M. Jones
1c7f618f68 scsi-disk: Fix crash if underlying host file or disk returns error
Commit 40dce4ee6 "scsi-disk: fix rerror/werror=ignore" introduced a
bug which causes qemu to crash with the assertion error below if the
host file or disk returns an error:

  qemu-system-x86_64: hw/scsi/scsi-bus.c:1374: scsi_req_complete:
  Assertion `req->status == -1' failed.

Kevin Wolf suggested this fix:

  < kwolf> Hm, should the final return false; in that patch
           actually be a return true?
  < kwolf> Because I think he didn't intend to change anything
           except BLOCK_ERROR_ACTION_IGNORE

Buglink: https://bugs.launchpad.net/qemu/+bug/1804323
Fixes: 40dce4ee61
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-22 16:43:48 +01:00
Peter Maydell
ebfd6216ec Migration fixes 2018-11-21
Notably the fix for building with --disable-replication
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJb9VeYAAoJEAUWMx68W/3nbxUP/iLwvBqTI1NvWTsdKaVWERAW
 VSwuJXtSzWeBYO7MNZB+OeLQbQtMzSnJo75LfbR7pliyqXWjm4EI3aID7pfoYt19
 oP8U+VOMdiHFfGTShX+IZufnK89fmwH3F4RWGpMeYsPG2yWVPWefseANdESwOgGC
 VnEUfIvFioQv67atK4DNVHKwchaAkHQVpXIxoTZ45ZDFxGdipRitRgJjLC2CsYP4
 bUdzOpLh2ySdA2v4ecJ2eGgLAosrVL6H1vtrAUUzAln9sA5f6RubgtNZKnp+repM
 y+9+tR0kW7vszM9tCRjvlHd4ESBmsh+F6cvwdO1TVDv4BNtkyJNfHV0qpUkohE0r
 QCx/QJJrrbrDFUxTLkkW6nFpWhduI43kbw1ZkSaMV75HynOYEcWzoM3Dg3XCOwYM
 UpNr7SLnLajjmPf+IWMKwyxLVO/ACccnGHwTT2lJ0N3Et8s+IB18lBU4WkROC4AK
 DAE47yuK/725aiWzt/LSQU3hEJjoY+VjdgxNm2q0wSp0Q4yF6dOKHQK8t6QKRtbt
 DG1YxwS2zuc1Fd6tSVeXvSe1xsVZtP8siCANXnOLh1BwIMyh2NfDS7KeZhwNr4M2
 oF8/HanVDIudaqbu1/XEuOqXtUCNptXuFZp7ZaS0kbN/WAU/dpoAowWh3sjzqNok
 a0uY3pN7Zjsg+WxQ/md6
 =kWeI
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20181121a' into staging

Migration fixes 2018-11-21

Notably the fix for building with --disable-replication

# gpg: Signature made Wed 21 Nov 2018 13:03:20 GMT
# gpg:                using RSA key 0516331EBC5BFDE7
# gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>"
# Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A  9FA9 0516 331E BC5B FDE7

* remotes/dgilbert/tags/pull-migration-20181121a:
  migration/migration.c: Add COLO dependency checks
  migration/colo.c: Fix compilation issue when disable replication

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-22 13:45:06 +00:00
Max Filippov
59b5e9bbea target/xtensa: xtfpga: provide default memory sizes
Provide default RAM sizes for all XTFPGA boards, so that when started
without -m option they do the right thing.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-21 10:53:21 -08:00
Max Reitz
3ecd5a4f19 qemu-img: Fix leak
create_opts was leaked here.  This is not too bad since the process is
about to exit anyway, but relying on that does not make the code nicer
to read.

Fixes: d402b6a21a
Reported-by: Kevin Wolf <kwolf@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-21 15:17:46 +01:00
Max Reitz
f0998879e0 qemu-img: Fix typo
Fixes: d402b6a21a
Reported-by: Kevin Wolf <kwolf@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-21 15:17:46 +01:00
Eric Blake
155af09d44 iotests: Skip 233 if certtool not installed
The use of TLS while building qemu is optional. While the
'certtool' binary should be available on every platform that
supports building against TLS, that does not imply that the
developer has installed it.  Make the test gracefully skip
in that case.

Reported-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-21 15:17:37 +01:00
Zhang Chen
7e934f5b27 migration/migration.c: Add COLO dependency checks
Current COLO mode(independent disk mode) need replication module work
together. Suggested by Dr. David Alan Gilbert <dgilbert@redhat.com>.

Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Message-Id: <20181114190912.7242-1-chen.zhang@intel.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2018-11-21 11:38:12 +00:00
Zhang Chen
3ebb9c4f52 migration/colo.c: Fix compilation issue when disable replication
This compilation issue will occur when user use --disable-replication
to config Qemu.

Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Zhang Chen <zhangckid@gmail.com>
Message-Id: <20181101021226.6353-1-zhangckid@gmail.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2018-11-21 11:20:14 +00:00
Kevin Wolf
fa1cfb4026 iotests: Replace assertEquals() with assertEqual()
TestCase.assertEquals() is deprecated since Python 2.7. Recent Python
versions print a warning when the function is called, which makes test
cases fail.

Replace it with the preferred spelling assertEqual().

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-21 10:30:05 +01:00
Kevin Wolf
d8336c6b28 iotests: Replace time.clock() with Timeout
time.clock() is deprecated since Python 3.3. Current Python versions
warn that the function will be removed in Python 3.8, and those warnings
make the test case 118 fail.

Replace it with the Timeout mechanism that is compatible with both
Python 2 and 3, and makes the code even a little nicer.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2018-11-21 10:30:05 +01:00
Max Filippov
7da9111e77 target/xtensa: drop num_[core_]regs from dc232b/dc233c configs
Now that xtensa_count_regs does the right thing, remove manual
initialization of these fields from the affected configurations and let
xtensa_finalize_config initialize them. Add XTREG_END to terminate
register lists.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2018-11-20 12:20:41 -08:00
Max Filippov
4614f0f8bd target/xtensa: gdbstub fix register counting
In order to communicate correctly with gdb xtensa gdbstub must provide
expected number of registers in 'g' packet response. xtensa-elf-gdb
expects both nonprivileged and privileged registers. xtensa-linux-gdb
only expects nonprivileged registers. gdb only counts one contiguous
stretch of registers, do the same for the core registers in the
xtensa_count_regs.

With this change qemu-system-xtensa is able to communicate with all
xtensa-elf-gdb versions (versions prior to 8.2 require overlay fixup),
and qemu-xtensa is able to communicate with all xtensa-linux-gdb
versions, except 8.2.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2018-11-20 12:20:41 -08:00
Peter Maydell
47c1cc30e4 Update version for v3.1.0-rc2 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-20 18:10:26 +00:00
Peter Maydell
53744e0a18 pc-*-3.1 machine-types
-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABCAAGBQJb9A98AAoJECgHk2+YTcWm884QALnJcRk3t72KdSmYFbcpPYy6
 1EgW4v0mNWGtSyvuSfD9gXYIJEFOLkPzSvphJ8GAb0ybGTBRfTXfuOuOmKNTsvZ7
 f9kKFH9LGXSJqGfrkE18W0vCT0oC33X7zmFUKGAZXBSbrUv7d2MQ9XlMtDIMm6Zj
 WGXEksZImF8E/FugsKmOAyty8TOY175nP1xhPvpMeyrNsJaFqjzWSUt/KctUObvq
 bwwoBBKqJOKikMsifQ1LarCY94SWufoupABSDxnkQ+Ib6dQ2/wpxhd2LoGkm3ji0
 2ZnGvs+uGTesH9i+Wa80CMNXsH/Q3/P2re55JfImfMSRzrSvs82cnwQ+W0Bz6kx+
 bTKpLHyTz2LFIN6QpPvkelq7Qi6vjSVVNQwmmUc9+kMByfk7Parq2Tlv3qQfro9I
 IxsVFVxMo4piNxPlCuUZ0/7KbDKxBDQZ3bmGTHvFuFb3IGC1ZlVhYZmzk1CgPjZr
 /7eDhIIBjl9LIko178NUSjeHYl/Z+7/BAwht2vJwjV9ojASL5UnCkiTNN6Rhrr5k
 E0AIclHUA9bCjr90AfIqfl/WQrr2GcxaIl/g8WS0saxNqTj66xYosDIge9D5e1Jg
 6O2/HsoJADUtlQbBgU8mB/CKs2CDJ+oC/82ZUeetb0MfctR0W44RR8XFZ1Xp9TTn
 OwSuexRu7axAQUnU3707
 =OYoU
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/ehabkost/tags/x86-for-3.1-pull-request' into staging

pc-*-3.1 machine-types

# gpg: Signature made Tue 20 Nov 2018 13:43:24 GMT
# gpg:                using RSA key 2807936F984DC5A6
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* remotes/ehabkost/tags/x86-for-3.1-pull-request:
  hw/i386: add pc-i440fx-3.1 & pc-q35-3.1

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-20 14:11:00 +00:00
Marc-André Lureau
4a93722f9c hw/i386: add pc-i440fx-3.1 & pc-q35-3.1
We have a couple of PC_COMPAT_3_0, so we should have 3.1 PC machines,
and update the 3.0 machines to make use of those.

Fixes a "Known issue" from https://wiki.qemu.org/Planning/3.1.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20181120132604.22854-1-marcandre.lureau@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-11-20 11:42:32 -02:00
Peter Maydell
46cabfb41e Fixes yet another use-after-free issue that could be triggered by a
misbehaving guest. This is a follow-up to commit:
 
 commit 5b76ef50f6
 Author: Greg Kurz <groug@kaod.org>
 Date:   Wed Nov 7 01:00:04 2018 +0100
 
     9p: write lock path in v9fs_co_open2()
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEtIKLr5QxQM7yo0kQcdTV5YIvc9YFAlvz94MACgkQcdTV5YIv
 c9ai5A//ZP7ZIQhTzfsuux7VWx3YZFxX7o8ZWwHLIar4kBa8Phv9ovp4ZxhHvZMi
 Y98yLQ+/8lL2blQLqAfjBHF5foXULxKm29RiLp+gqx8lOaiEiJ13OMtADtMCeijk
 //nCJV+MyxsmKj1ZoMPn0CpcqfCPP0UWk5Q1Yq06irLhg88q1+BAJn7DsnnQ6vUJ
 wvIINIplr7oJ0RIZChnvoaaKDw5CnRnBjFgGtXT5bOAITi1YUmRISIHpKMo0aIoZ
 /U08+q9IZeBok1VTsVUeZL6VP1btAAHwF5709UqI53OmWsMq/6Rgo7fQx+vr+tIZ
 8I0XQHHvx8jYV/ORNifqQuA2fY3HMqX3oaDEj0oUaj+UR9ObTybxqrhG6wKFSbUq
 eGT8H7wZZenuWUPntrzEHgFTXIvAFNp6pCLxFFn4D+U2wHSmZAX6SEIGDLQf/TEi
 Ado4Tv+wvnSAKwMIakUR0PIO15io9aEOLpAjKzueLFiBkH5nhx7LATWlmVkx3kTD
 tTIkFWjsAEYgaDuC7NLH1uBe5z4mZlXT4SAarxDnVZricuR+Pz58tXFz2sHmfVCE
 FXaI3dhicZOtPGrzDCgg8wCQBrNUJPb/hmEbZyKkg6IO1RhZOyqScTxriqlti5BY
 Ns1pkI64EyVRcEqIWZSj5Tu/fTZz1CE2pEscTLQq++eLOXotHSw=
 =Lt1w
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging

Fixes yet another use-after-free issue that could be triggered by a
misbehaving guest. This is a follow-up to commit:

commit 5b76ef50f6
Author: Greg Kurz <groug@kaod.org>
Date:   Wed Nov 7 01:00:04 2018 +0100

    9p: write lock path in v9fs_co_open2()

# gpg: Signature made Tue 20 Nov 2018 12:01:07 GMT
# gpg:                using RSA key 71D4D5E5822F73D6
# gpg: Good signature from "Greg Kurz <groug@kaod.org>"
# gpg:                 aka "Gregory Kurz <gregory.kurz@free.fr>"
# gpg:                 aka "[jpeg image of size 3330]"
# Primary key fingerprint: B482 8BAF 9431 40CE F2A3  4910 71D4 D5E5 822F 73D6

* remotes/gkurz/tags/for-upstream:
  9p: take write lock on fid path updates (CVE-2018-19364)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-20 12:24:09 +00:00