aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2024-11-18usb-hub: Fix handling port power control messagesGuenter Roeck1-0/+1
The ClearPortFeature control message fails for PORT_POWER because there is no break; at the end of the case statement, causing it to fall through to the failure handler. Add the missing break; to solve the problem. Fixes: 1cc403eb21 ("usb-hub: emulate per port power switching") Signed-off-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20241112170152.217664-11-linux@roeck-us.net> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-18MAINTAINERS: Update my email address for COLOZhang Chen1-1/+1
Signed-off-by: Zhang Chen <chen.zhang@intel.com> Reviewed-by: Li Zhijian <lizhijian@fujitsu.com> Message-ID: <20241112084038.6352-1-chen.zhang@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-18hw/display: check frame buffer can hold blobAlex Bennée2-3/+2
Coverity reports (CID 1564769, 1564770) that we potentially overflow by doing some 32x32 multiplies for something that ends up in a 64 bit value. Fix this by first using stride for all lines and casting input to uint64_t to ensure a 64 bit multiply is used. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com> Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Tested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Message-ID: <20241111230040.68470-3-alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-18hw/display: factor out the scanout blob to fb conversionAlex Bennée3-44/+53
There are two identical sequences of a code doing the same thing that raise warnings with Coverity. Before fixing those issues lets factor out the common code into a helper function we can share. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com> Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Tested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Message-ID: <20241111230040.68470-2-alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-18hw/i386/elfboot: allocate "header" in heapSergio Lopez1-1/+3
In x86_load_linux(), we were using a stack-allocated array as data for fw_cfg_add_bytes(). Since the latter just takes a reference to the pointer instead of copying the data, it can happen that the contents have been overridden by the time the guest attempts to access them. Instead of using the stack-allocated array, allocate some memory from the heap, copy the contents of the array, and use it for fw_cfg. Signed-off-by: Sergio Lopez <slp@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20241109053748.13183-1-slp@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-18hw/misc/nrf51_rng: Don't use BIT_MASK() when we mean BIT()Peter Maydell1-5/+5
The BIT_MASK() macro from bitops.h provides the mask of a bit within a particular word of a multi-word bit array; it is intended to be used with its counterpart BIT_WORD() that gives the index of the word in the array. In nrf51_rng we are using it for cases where we have a bit number that we know is the index of a bit within a single word (in fact, it happens that all the bit numbers we pass to it are zero). This happens to give the right answer, but the macro that actually does the job we want here is BIT(). Use BIT() instead of BIT_MASK(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20241108135644.4007151-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-18vl: fix qemu_validate_options() indentionGerd Hoffmann1-9/+9
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240905141211.1253307-2-kraxel@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-11-18Merge tag 'pull-vfio-20241118' of https://github.com/legoater/qemu into stagingPeter Maydell2-2/+5
vfio queue: * Fixed IGD support * Fixed QEMU crash when passing through devices in SEV-SNP guests # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmc680AACgkQUaNDx8/7 # 7KGiFBAAx+V9FTkl6WNqNlQvhizu7C/TY7Ern5YoEbS6aJh96b0Hx+57vuxE4LAW # /45pNXJpcn8vXzzpxohy4gS12Gu8rBY1XxMcCMLoZSbGanp1mPsaCWr37hgadFsj # nNRwBVj2fpNxcskcEIuzKzmnTCzbxZjDkpAuNzbBVGNM9EGOH3NFfYasRONvSXap # u+akPFw8BpAfcxfSQea13v0NpGlgDtJedvJZp6kO6d5xc0GvelIhkz2wGqqLpfvP # 8J3I17yaDwHXFiBzl5pGE5K/tjFRoIlM3EVV1KcDfyqXrwEyOMmDl2pmJv+1K8Sz # tSgkedMeZCMWGM307+92IyuXlaV8s+meo4NZxxx1mxAF2jNBVDwTj8vhscG/zY6q # QZgZRhumyeL8S5WoRIMVHCKr3pjvZat/OeBxjVXiQ8GzNZSgNNwBE9EKuu4L4b2b # GOSGL2epwYTldh4R5GsuLOpNrSDnff9tGvpe2OICDs9KqHjeAPbHkYW0/QNzIYyf # 2rkFKEu3hRIu0FdFFi6w0r/KE70Wc0wUV11ycxgsYMJpkY68c2u13wnfq0u4Ja4N # eJERr+AsgQUHIb95ZRJr6CKFaEJxEMceP/986Fdw4YS2U5hOU1ln+Km6sTDcr/kt # DvjVcBjxQyJHM3m9y7X3WosqtmX7tMo6grWP7L6qIPhb7eLYFUY= # =JW0J # -----END PGP SIGNATURE----- # gpg: Signature made Mon 18 Nov 2024 07:56:48 GMT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [full] # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-vfio-20241118' of https://github.com/legoater/qemu: vfio/container: Fix container object destruction vfio/igd: fix calculation of graphics stolen memory vfio/igd: add pci id for Coffee Lake Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-18hw/s390x: Restrict "loadparm" property to devices that can be used for bootingThomas Huth5-3/+9
Commit bb185de423 ("s390x: Add individual loadparm assignment to CCW device") added a "loadparm" property to all CCW devices. This was a little bit unfortunate, since this property is only useful for devices that can be used for booting, but certainly it is not useful for devices like virtio-gpu or virtio-tablet. Thus let's restrict the property to CCW devices that we can boot from (i.e. virtio-block, virtio-net and vfio-ccw devices). Message-ID: <20241113114741.681096-1-thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Jared Rossi <jrossi@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-11-18docs/system/bootindex: Make it clear that s390x can also boot from virtio-netThomas Huth1-1/+1
Let's make it clear that s390x can also boot from virtio-net, to avoid that people think that s390x can only boot from disk devices. Reported-by: Boris Fiuczynski <fiuczy@linux.ibm.com> Message-ID: <20241111105506.264640-1-thuth@redhat.com> Reviewed-by: Prasad Pandit <pjp@fedoraproject.org> Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-11-18docs/system/s390x/bootdevices: Update loadparm documentationJared Rossi1-1/+23
Update documentation to include per-device loadparm support. Signed-off-by: Jared Rossi <jrossi@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20241115002742.3576842-1-jrossi@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-11-18tests/tcg/s390x: Add the floating-point multiply-and-add testIlya Leoshkevich4-145/+420
Add a test to prevent regressions. Share some useful pieces with the vfminmax test. Remove the duplicates from the floating point class values. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-ID: <20241023000147.34035-3-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-11-18target/s390x: Fix the floating-point multiply-and-add NaN rulesIlya Leoshkevich3-10/+29
Order the helper arguments to match the Principles of Operation. Implement the "Results: MULTIPLY AND ADD" table in pickNaNMulAdd(). Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-ID: <20241023000147.34035-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-11-18hw/usb: Use __attribute__((packed)) vs __packedRoque Arcudia Hernandez1-1/+1
__packed is non standard and is not present in clang-cl. __attribute__((packed)) has the same semantics. Signed-off-by: Erwin Jansen <jansene@google.com> Signed-off-by: Roque Arcudia Hernandez <roqueh@google.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20241101211720.3354111-1-roqueh@google.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-11-18vfio/container: Fix container object destructionCédric Le Goater1-1/+1
When commit 96b7af4388b3 intoduced a .instance_finalize() handler, it did not take into account that the container was not necessarily inserted into the container list of the address space. Hence, if the container object is destroyed, by calling object_unref() for example, before vfio_address_space_insert() is called, QEMU may crash when removing the container from the list as done in vfio_container_instance_finalize(). This was seen with an SEV-SNP guest for which discarding of RAM fails. To resolve this issue, use the safe version of QLIST_REMOVE(). Cc: Zhenzhong Duan <zhenzhong.duan@intel.com> Cc: Eric Auger <eric.auger@redhat.com> Fixes: 96b7af4388b3 ("vfio/container: Move vfio_container_destroy() to an instance_finalize() handler") Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-11-18vfio/igd: fix calculation of graphics stolen memoryCorvin Köhne1-1/+1
When copying the calculation of the stolen memory size for Intels integrated graphics device of gen 9 and later from the Linux kernel [1], we missed subtracting 0xf0 from the graphics mode select value for values above 0xf0. This leads to QEMU reporting a very large size of the graphics stolen memory area. That's just a waste of memory. Additionally the guest firmware might be unable to allocate such a large buffer. [1] https://github.com/torvalds/linux/blob/7c626ce4bae1ac14f60076d00eafe71af30450ba/arch/x86/kernel/early-quirks.c#L455-L460 Signed-off-by: Corvin Köhne <c.koehne@beckhoff.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Fixes: 871922416683 ("vfio/igd: correctly calculate stolen memory size for gen 9 and later") Reviewed-by: Alex Williamson <alex.williamson@redhat.com> [ clg: Changed commit subject ] Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-11-18vfio/igd: add pci id for Coffee LakeCorvin Köhne1-0/+3
I've tested and verified that Coffee Lake devices are working properly. Signed-off-by: Corvin Köhne <c.koehne@beckhoff.com> Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
2024-11-16Merge tag 'pull-tcg-20241116' of https://gitlab.com/rth7680/qemu into stagingPeter Maydell24-39/+174
cpu: ensure we don't call start_exclusive from cpu_exec tcg: Allow top bit of SIMD_DATA_BITS to be set in simd_desc() accel/tcg: Fix user-only probe_access_internal plugin check linux-user: Fix setreuid and setregid to use direct syscalls linux-user: Tolerate CONFIG_LSM_MMAP_MIN_ADDR linux-user: Honor elf alignment when placing images linux-user/*: Reduce vdso alignment to 4k linux-user/arm: Select vdso for be8 and be32 modes # -----BEGIN PGP SIGNATURE----- # # iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmc4z/8dHHJpY2hhcmQu # aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV/vWgf5Af8105enuWEdJ9c+ # KiyTsOWQEOKXTUSlSUxPs9FEeEr2l/mccvqUhiD7ptZq7P5/40+3tB18KXc5YuiE # 45CZGRAr/tjALGT5LidSYzm6RgljWXYlvWVShqKlQpOD2L0GP5k8a7KEKsT3SLtS # 9l+SVvjNOE+Jv23FWSOVYq0K0e5dPKzS1gtviCg+obA56dsiSKiEwwg+a5ca6oRe # 9SUKoRnudpUv3fiYo8yZaHPW0ADhsITAB20ncN+cI9t4li9q5AWUbPZ+ADP113+2 # pWlco1VqR4pONK2UgbSmxDtjQf1GBi7E2MBFBjBMxTaiw/jXAZcZGIK4geZYKdHT # NJj/0Q== # =oKCm # -----END PGP SIGNATURE----- # gpg: Signature made Sat 16 Nov 2024 17:01:51 GMT # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * tag 'pull-tcg-20241116' of https://gitlab.com/rth7680/qemu: tcg: Allow top bit of SIMD_DATA_BITS to be set in simd_desc() linux-user/arm: Select vdso for be8 and be32 modes linux-user/ppc: Reduce vdso alignment to 4k linux-user/loongarch64: Reduce vdso alignment to 4k linux-user/arm: Reduce vdso alignment to 4k linux-user/aarch64: Reduce vdso alignment to 4k linux-user: Drop image_info.alignment linux-user: Honor elf alignment when placing images cpu: ensure we don't call start_exclusive from cpu_exec target/i386: fix hang when using slow path for ptw_setl tests/tcg: Test that sigreturn() does not corrupt the signal mask linux-user: Tolerate CONFIG_LSM_MMAP_MIN_ADDR accel/tcg: Fix user-only probe_access_internal plugin check target/arm: Drop user-only special case in sve_stN_r linux-user: Fix setreuid and setregid to use direct syscalls Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-16tcg: Allow top bit of SIMD_DATA_BITS to be set in simd_desc()Peter Maydell1-1/+14
In simd_desc() we create a SIMD descriptor from various pieces including an arbitrary data value from the caller. We try to sanitize these to make sure everything will fit: the 'data' value needs to fit in the SIMD_DATA_BITS (== 22) sized field. However we do that sanitizing with: tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS)); This works for the case where the data is supposed to be considered as a signed integer (which can then be returned via simd_data()). However, some callers want to treat the data value as unsigned. Specifically, for the Arm SVE operations, make_svemte_desc() assembles a data value as a collection of fields, and it needs to use all 22 bits. Currently if MTE is enabled then its MTEDESC SIZEM1 field may have the most significant bit set, and then it will trip this assertion. Loosen the assertion so that we only check that the data value will fit into the field in some way, either as a signed or as an unsigned value. This means we will fail to detect some kinds of bug in the callers, but we won't spuriously assert for intentional use of the data field as unsigned. Cc: qemu-stable@nongnu.org Fixes: db432672dc50e ("tcg: Add generic vector expanders") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2601 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-ID: <20241115172515.1229393-1-peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-11-16linux-user/arm: Select vdso for be8 and be32 modesRichard Henderson5-12/+41
In be8 mode, instructions are little-endian. In be32 mode, instructions are big-endian. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2333 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-11-16linux-user/ppc: Reduce vdso alignment to 4kRichard Henderson4-2/+4
Reduce vdso alignment to minimum page size. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-11-16linux-user/loongarch64: Reduce vdso alignment to 4kRichard Henderson2-1/+2
Reduce vdso alignment to minimum page size. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-11-16linux-user/arm: Reduce vdso alignment to 4kRichard Henderson3-1/+1
Reduce vdso alignment to minimum page size. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-11-16linux-user/aarch64: Reduce vdso alignment to 4kRichard Henderson3-2/+3
Reduce vdso alignment to minimum page size. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-11-16linux-user: Drop image_info.alignmentRichard Henderson2-5/+3
This field is write-only. Use only the function-local variable within load_elf_image. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-11-16linux-user: Honor elf alignment when placing imagesRichard Henderson1-7/+28
Most binaries don't actually depend on more than page alignment, but any binary can request it. Not honoring this was a bug. This became obvious when gdb reported Failed to read a valid object file image from memory when examining some vdso which are marked as needing more than page alignment. Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-11-16cpu: ensure we don't call start_exclusive from cpu_execPierrick Bouvier1-0/+3
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20241025175857.2554252-3-pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-11-16target/i386: fix hang when using slow path for ptw_setlPierrick Bouvier1-0/+5
When instrumenting memory accesses for plugin, we force memory accesses to use the slow path for mmu [1]. This create a situation where we end up calling ptw_setl_slow. This was fixed recently in [2] but the issue still could appear out of plugins use case. Since this function gets called during a cpu_exec, start_exclusive then hangs. This exclusive section was introduced initially for security reasons [3]. I suspect this code path was never triggered, because ptw_setl_slow would always be called transitively from cpu_exec, resulting in a hang. [1] https://gitlab.com/qemu-project/qemu/-/commit/6d03226b42247b68ab2f0b3663e0f624335a4055 [2] https://gitlab.com/qemu-project/qemu/-/commit/115ade42d50144c15b74368d32dc734ea277d853 [3] https://gitlab.com/qemu-project/qemu/-/issues/279 Fixes: https://gitlab.com/qemu-project/qemu/-/issues/2566 Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20241025175857.2554252-2-pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-11-16tests/tcg: Test that sigreturn() does not corrupt the signal maskIlya Leoshkevich2-0/+54
Add a small test to prevent regressions. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-ID: <20241108145237.37377-2-iii@linux.ibm.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-11-16linux-user: Tolerate CONFIG_LSM_MMAP_MIN_ADDRIlya Leoshkevich1-1/+1
Running qemu-i386 on a system running with SELinux in enforcing mode (more precisely: s390x trixie container on Fedora 40) fails with: qemu-i386: tests/tcg/i386-linux-user/sigreturn-sigmask: Unable to find a guest_base to satisfy all guest address mapping requirements 00000000-ffffffff The reason is that main() determines mmap_min_addr from /proc/sys/vm/mmap_min_addr, but SELinux additionally defines CONFIG_LSM_MMAP_MIN_ADDR, which is normally larger: 32K or 64K, but, in general, can be anything. There is no portable way to query its value: /boot/config, /proc/config and /proc/config.gz are distro- and environment-specific. Once the identity map fails, the magnitude of guest_base does not matter, so fix by starting the search from 1M or 1G. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2598 Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-ID: <20241023002558.34589-1-iii@linux.ibm.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-11-16accel/tcg: Fix user-only probe_access_internal plugin checkRichard Henderson1-1/+1
The acc_flag check for write should have been against PAGE_WRITE_ORG, not PAGE_WRITE. But it is better to combine two acc_flag checks to a single check against access_type. This matches the system code in cputlb.c. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2647 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: 20241111145002.144995-1-richard.henderson@linaro.org Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2024-11-16target/arm: Drop user-only special case in sve_stN_rRichard Henderson1-4/+0
This path is reachable with plugins enabled, and provoked with run-plugin-catch-syscalls-with-libinline.so. Cc: qemu-stable@nongnu.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20241112141232.321354-1-richard.henderson@linaro.org>
2024-11-16linux-user: Fix setreuid and setregid to use direct syscallsHelge Deller1-4/+16
The commit fd6f7798ac30 ("linux-user: Use direct syscalls for setuid(), etc") added direct syscall wrappers for setuid(), setgid(), etc since the system calls have different semantics than the libc functions. Add and use the corresponding wrappers for setreuid and setregid which were missed in that commit. This fixes the build of the debian package of the uid_wrapper library (https://cwrap.org/uid_wrapper.html) when running linux-user. Cc: qemu-stable@nongnu.org Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-ID: <Zyo2jMKqq8hG8Pkz@p100> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-11-15Merge tag 'migration-20241113-pull-request' of ↵Peter Maydell2-1/+5
https://gitlab.com/peterx/qemu into staging Migration pull request for 9.2-rc1 - Dmitry's small patch to quiesce a warning in possible uint32_t overflow - Peter's fix on a recent regression to iotests (and potentially elsewhere) # -----BEGIN PGP SIGNATURE----- # # iIgEABYKADAWIQS5GE3CDMRX2s990ak7X8zN86vXBgUCZzUJDxIccGV0ZXJ4QHJl # ZGhhdC5jb20ACgkQO1/MzfOr1wbuEQEAoRiMlHo4cfRTuViRoGHwFkqboLdyqsC9 # ZtDcZ2efgMQBAMR65KSgEAakbm3h4fuj0lUTkg564Wi9XkBleo/w3tAD # =uIeB # -----END PGP SIGNATURE----- # gpg: Signature made Wed 13 Nov 2024 20:16:15 GMT # gpg: using EDDSA key B9184DC20CC457DACF7DD1A93B5FCCCDF3ABD706 # gpg: issuer "peterx@redhat.com" # gpg: Good signature from "Peter Xu <xzpeter@gmail.com>" [marginal] # gpg: aka "Peter Xu <peterx@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: B918 4DC2 0CC4 57DA CF7D D1A9 3B5F CCCD F3AB D706 * tag 'migration-20241113-pull-request' of https://gitlab.com/peterx/qemu: migration: fix-possible-int-overflow migration: Check current_migration in migration_is_running() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-13Update version for v9.2.0-rc0 releasev9.2.0-rc0Peter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-13migration: fix-possible-int-overflowDmitry Frolov1-1/+1
stat64_add() takes uint64_t as 2nd argument, but both "p->next_packet_size" and "p->packet_len" are uint32_t. Thus, theyr sum may overflow uint32_t. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Frolov <frolov@swemel.ru> Link: https://lore.kernel.org/r/20241113140509.325732-2-frolov@swemel.ru Signed-off-by: Peter Xu <peterx@redhat.com>
2024-11-13migration: Check current_migration in migration_is_running()Peter Xu1-0/+4
Report shows that commit 34a8892dec broke iotest 055: https://lore.kernel.org/r/b8806360-a2b6-4608-83a3-db67e264c733@linaro.org Denis Rastyogin reported more such issue: https://lore.kernel.org/r/20241107114256.106831-1-gerben@altlinux.org In this merge, the migration_is_idle() function was replaced with migrate_is_running(). However, the null pointer check for `s` was removed, leading to a dereference of `s` when using qemu-system-x86_64 -hda *.vdi. When replacing migration_is_idle() with "!migration_is_running()", it was overlooked that the idle helper also checks for current_migration being available first. Sample stack dump: migration_is_running is_busy migrate_add_blocker_modes migrate_add_blocker_normal vmdk_open bdrv_open_driver bdrv_open_common bdrv_open_inherit bdrv_open blk_new_open blockdev_init drive_new drive_init_func qemu_opts_foreach configure_blockdev qemu_create_early_backends qemu_init main The check would be there if the whole series was applied, but since the last patches in the previous series rely on some other patches to land first, we need to recover the behavior of migration_is_idle() first before that whole set will be merged. I left migration_is_active / migration_is_device alone, as I don't think it's possible for them to hit uninitialized current_migration. Also they're prone to removal soon from VFIO side. Cc: Peter Maydell <peter.maydell@linaro.org> Fixes: 34a8892dec ("migration: Drop migration_is_idle()") Reported-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reported-by: Denis Rastyogin <gerben@altlinux.org> Tested-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Tested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Fabiano Rosas <farosas@suse.de> Link: https://lore.kernel.org/r/20241105182725.2393425-1-peterx@redhat.com [peterx: enhance commit msg] Signed-off-by: Peter Xu <peterx@redhat.com>
2024-11-13edk2: update submodule to edk2-stable202408.01Gerd Hoffmann1-0/+0
Updates the subhook submodule to point to a edk2 mirror repo. Fixes recursive cloning of the edk2 submodule. Cc: Peter Maydell <peter.maydell@linaro.org> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2660 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20241111100701.2620020-1-kraxel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-09Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingPeter Maydell22-21/+118
* i386: fix -M isapc with ubsan * i386: add sha512, sm3, sm4 feature bits * eif: fix Coverity issues * i386/hvf: x2APIC support * i386/hvf: fixes * i386/tcg: fix 2-stage page walk * eif: fix coverity issues * rust: fix subproject warnings with new rust, avoid useless cmake fallback # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmcvEHYUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroNn4AgAl+GaD/fHHU+9TCyKRg1Ux/iTSkqh # PBs76H2w879TDeuPkKZlnYqc7n85rlh1cJwQz01X79OFEeXP6oHiI9Q6qyflSxF0 # V+DrJhZc1CtZBChx9ZUMWUAWjYJFFjNwYA7/LLuLl6RfOm8bIJUWIhDjliJ4Bcea # 5VI13OtTvYvVurRLUBXWU0inh9KLHIw4RlNgi8Pmb2wNXkPxENpWjsGqWH0jlKS5 # ZUNgTPx/eY5MDwKoAyif2gsdfJlxGxgkpz3Mic4EGE9cw1cRASI3tKb3KH61hNTE # K21UI0+/+kv27cPnpZzYMDSkrJs7PEgVJ/70NRmAJySA76IG3XSsb5+xZg== # =pI4/ # -----END PGP SIGNATURE----- # gpg: Signature made Sat 09 Nov 2024 07:34:14 GMT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: hw/i386/pc: Don't try to init PCI NICs if there is no PCI bus rust: qemu-api-macros: always process subprojects before dependencies i386/hvf: Removes duplicate/shadowed variables in hvf_vcpu_exec i386/hvf: Raise exception on error setting APICBASE i386/hvf: Fixes startup memory leak (vmcs caps) i386/hvf: Fix for UB in handling CPUID function 0xD i386/hvf: Integrates x2APIC support with hvf accel eif: cope with huge section sizes eif: cope with huge section offsets target/i386: Fix legacy page table walk rust: add meson_version to all subprojects target/i386/hvf: fix clang compilation warning target/i386: add sha512, sm3, sm4 feature bits Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-09hw/i386/pc: Don't try to init PCI NICs if there is no PCI busPeter Maydell1-1/+3
The 'isapc' machine type has no PCI bus, but pc_nic_init() still calls pci_init_nic_devices() passing it a NULL bus pointer. This causes the clang sanitizer to complain: $ ./build/clang/qemu-system-i386 -M isapc ../../hw/pci/pci.c:1866:39: runtime error: member access within null pointer of type 'PCIBus' (aka 'struct PCIBus') SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../hw/pci/pci.c:1866:39 in This is because pci_init_nic_devices() does &bus->qbus which is undefined behaviour on a NULL pointer even though we're not actually dereferencing the pointer. (We don't actually crash as a result, so if you aren't running a sanitizer build then there are no user-visible effects.) Make pc_nic_init() avoid trying to initialize PCI NICs on a non-PCI system. Cc: qemu-stable@nongnu.org Fixes: 8d39f9ba14d64 ("hw/i386/pc: use qemu_get_nic_info() and pci_init_nic_devices()") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Link: https://lore.kernel.org/r/20241105171813.3031969-1-peter.maydell@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-11-09rust: qemu-api-macros: always process subprojects before dependenciesPaolo Bonzini1-0/+4
Avoid looking for Rust dependencies via cmake. Reviewed-by: Junjie Mao <junjie.mao@hotmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-11-09i386/hvf: Removes duplicate/shadowed variables in hvf_vcpu_execPhil Dennis-Jordan1-3/+0
Pointers to the x86 CPU state already exist at the function scope, no need to re-obtain them in individual exit reason cases. Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Link: https://lore.kernel.org/r/20241105155800.5461-6-phil@philjordan.eu Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-11-09i386/hvf: Raise exception on error setting APICBASEPhil Dennis-Jordan1-2/+9
When setting the APICBASE MSR to an illegal value, the APIC implementation will return an error. This change forwards that report to the guest as an exception rather than ignoring it when using the hvf accelerator. Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Link: https://lore.kernel.org/r/20241105155800.5461-5-phil@philjordan.eu Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-11-09i386/hvf: Fixes startup memory leak (vmcs caps)Phil Dennis-Jordan1-1/+3
The hvf_caps data structure only exists once as part of the hvf accelerator state, but it is initialised during vCPU initialisation. This change therefore adds a check to ensure memory for it is only allocated once. Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Link: https://lore.kernel.org/r/20241105155800.5461-4-phil@philjordan.eu Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-11-09i386/hvf: Fix for UB in handling CPUID function 0xDPhil Dennis-Jordan1-2/+2
The handling for CPUID function 0xD (supported XSAVE features) was improved in a recent patch. Unfortunately, this appears to have introduced undefined behaviour for cases where ecx > 30, as the result of (1 << idx) is undefined if idx > 30. Per Intel SDM section 13.2, the behaviour for ecx values up to and including 62 are specified. This change therefore specifically sets all registers returned by the CPUID instruction to 0 for 63 and higher. Furthermore, the bit shift uses uint64_t, where behaviour for the entire range of 2..62 is safe and correct. Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Link: https://lore.kernel.org/r/20241105155800.5461-3-phil@philjordan.eu Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-11-09i386/hvf: Integrates x2APIC support with hvf accelPhil Dennis-Jordan2-1/+32
Support for x2APIC mode was recently introduced in the software emulated APIC implementation for TCG. Enabling it when using macOS’s hvf accelerator is useful and significantly helps performance, as Qemu currently uses the emulated APIC when running on hvf as well. This change wires up the read & write operations for the MSR VM exits and allow-lists the CPUID flag in the x86 hvf runtime. Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Link: https://lore.kernel.org/r/20241105155800.5461-2-phil@philjordan.eu Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-11-09eif: cope with huge section sizesPaolo Bonzini1-7/+41
Check for overflow as well as allocation failure. Resolves Coverity CID 1564859. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Dorjoy Chowdhury <dorjoychy111@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-11-08Merge tag 'pull-request-2024-11-08' of https://gitlab.com/thuth/qemu into ↵Peter Maydell28-340/+391
staging * Various fixes and improvements for the functional tests * Refresh CI container files with the latest changes from libvirt-ci * Clean up keyboard code of the next-cube machine to get rid of a legacy API # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmct48QRHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbUAzw//fOgAe+rNX10KIEWaHzTlw6EPRUHbKEo+ # yvy9mZ4CYiK3PfojuW6u9Mt32RIGFjLRUPC+ljZggjbxY2DUjzAUGx/kSwf0bzwE # 8eRKRvd+l3ZFKklwDd7YQh+/O38P/uAq+T0AZQv/9h7rr0wPD6O+sVpKjVN4akuh # 66Ekz974bDFaVJi8iIix0WCPCUFMZwWQqxaQrnoBH3wN8Ibc6Ermchs7aa1e6KNh # DoX519JVNofXbugONNnqEjp43tbx/hzPZFyWf9tyX8ehp6+8po0zcZZwqdRkWhuv # BkESKPz8rHuQOGMjm8rAnjmDEsbpJ+vOfn/ShdyAERv78mTNWwSvYVwq5zfpcTCt # 9gpCNhhFzFLKlbDeIfgy9ky4R8Gzrww3icLzCsLlat6YCK547YkSr57BsYXJzLX4 # /NUYsaJ1RPdutwgNnmSzhBhObtUik3rFYH5aD0ETWZBdVY8ig5OqGpJ29P5zo860 # ROVFn4RX/XpmODOpYez4dwKVetR5SLHNG1aqduWKOwhAxPzLxK5OghjYkGf0bsel # gA9t7A1TafgneYxJARKi7esD39xeUzhfzdzCOIOLXJga5kD2/bvZnQ4tkoLPl8QR # iQEp1z758XmSFTYfzGUDA7SgIOzi9JG5dqtzcqJklr9wYurxwMYmqicJqA4ImoQt # fZV/axe8Em0= # =YRCB # -----END PGP SIGNATURE----- # gpg: Signature made Fri 08 Nov 2024 10:11:16 GMT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2024-11-08' of https://gitlab.com/thuth/qemu: ui/input-legacy.c: remove unused legacy qemu_add_kbd_event_handler() function next-kbd: convert to use qemu_input_handler_register() tests: refresh package lists with latest libvirt-ci tests/functional: Split the test_aarch64_sbsaref test tests/functional: Bump timeouts of functional tests tests/functional: Provide the user with hints where to find more log files tests/functional: Fix the ppc64_hv and the ppc_40p test for read-only assets test/functional: Fix Aspeed buildroot tests tests/functional: Convert the riscv_opensbi avocado test into a standalone test scripts/checkpatch.pl: Ignore ObjC #import lines for operator spacing Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-08Merge tag 'pull-9p-20241108' of https://github.com/cschoenebeck/qemu into ↵Peter Maydell1-0/+5
staging * Fix crash with a bad 9p client. # -----BEGIN PGP SIGNATURE----- # # iQJLBAABCgA1FiEEltjREM96+AhPiFkBNMK1h2Wkc5UFAmct4E4XHHFlbXVfb3Nz # QGNydWRlYnl0ZS5jb20ACgkQNMK1h2Wkc5Wm2RAAjNvQ/0AHrsq8uHc4bsnLsyJH # 5ighwtc3yyjcx+UDEyVR1Jd2fZ9ChFL+KlGcm21JtVlykum2nfzMToZY907M7MdS # GDG+NKmF2+VsVjyfqsWvyqBAPZkdPcfjgImxNZ2lGl6X2NUCstO4vluW9SWUbQI5 # A9zcA+2XO/P4ufTkjh1L7Kvl2r3Q1qZNbBMdHI/aaiYW/V3W0lsb+xyEhfQ/q5MW # wqUReTnBf5LdySpd5MlpkB6hdaBoqzKlA5Yw54xv49WH4IsvWVoCwvVWecOUFPhJ # Vnr5zyHRySbTCIswNGkN6ujrr5Had2zLFwbwoc9SvRx/DnWe5nmnyrsGHXF6+qhe # xwVd0Nv41ZYUhbfbQS4BbeSOQ1sMCoo7g/QDxUt7JEabBcwJtZXcIfVAkpIgpaOD # DKCVZiUg9Y30sm6xJOZ9pxoFSwqk17mxwU3GmJyFgAA96zgSMQ9IOsY5n96LOvOo # XaCFhV3i8OS0CCfncLGITcKo+CId5i02g4pjdhitqQSFqNOCZouPrBkKfuHTakw0 # uviJG2wLHOH1a6E0RHM48zqDKe47/I13xn3OQfpdHRjCwwmKgmrnMuz/AcyTCn/r # V+ELrXT4TRgrRtNnxW1HCnxnqUKOe3ftMFiGHJXed+ioBXp4zNxqc6PDHNPgCOcZ # +jGMcGyq7v7VM2MDj/Y= # =20CO # -----END PGP SIGNATURE----- # gpg: Signature made Fri 08 Nov 2024 09:56:30 GMT # gpg: using RSA key 96D8D110CF7AF8084F88590134C2B58765A47395 # gpg: issuer "qemu_oss@crudebyte.com" # gpg: Good signature from "Christian Schoenebeck <qemu_oss@crudebyte.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: ECAB 1A45 4014 1413 BA38 4926 30DB 47C3 A012 D5F4 # Subkey fingerprint: 96D8 D110 CF7A F808 4F88 5901 34C2 B587 65A4 7395 * tag 'pull-9p-20241108' of https://github.com/cschoenebeck/qemu: 9pfs: fix crash on 'Treaddir' request Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-11-08Merge tag 'pull-nvme-20241108' of https://gitlab.com/birkelund/qemu into stagingPeter Maydell1-9/+12
nvme queue # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmctyJoACgkQTeGvMW1P # DelYBgf+OofWBMas7WJykSpPkhmAUPhUZ50XmeuJqPntb7JLTv7Ne7eoe5/ddG/G # ul3M3B4oaErx6j6gbAVwRO7EwnLXhI3YL8Ar5ykqXQD9ZqIhXdhKqO7JxSKgBMuN # 0Jtaarviqrn9BO+ZTiMmtJIwh1/tztmmzv97m7r3SwEaoVCK6xK1iIE/dPNIO/ad # UxWkuSCBWIy9iKuN61q9tBYUMhfhvUggobtU7a9zjrtfSWV1rzboDIgKi8T1DToS # ahKLsztFg3X4PhBD8O//u0WZSdr/Fh+/3Ya1Dfxsh/wWinuO1kRCEbCCsW+TqDC2 # 0vLHlVCtGEmibz8Fhk06c+0QdbHMPQ== # =dsX0 # -----END PGP SIGNATURE----- # gpg: Signature made Fri 08 Nov 2024 08:15:22 GMT # gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9 # gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [full] # gpg: aka "Klaus Jensen <k.jensen@samsung.com>" [full] # Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838 # Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9 * tag 'pull-nvme-20241108' of https://gitlab.com/birkelund/qemu: hw/nvme: fix handling of over-committed queues Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.1 at 2025-09-20 13:09:59 +0000