summary refs log tree commit diff stats
Commit message (Collapse)AuthorAgeFilesLines
* Acceptance Tests: introduce CPU hotplug testCleber Rosa2021-06-011-0/+37
| | | | | | | | | | | | | | | | | Even though there are qtest based tests for hotplugging CPUs (from which this test took some inspiration from), this one adds checks from a Linux guest point of view. It should also serve as an example for tests that follow a similar pattern and need to interact with QEMU (via qmp) and with the Linux guest via SSH. Signed-off-by: Cleber Rosa <crosa@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-Id: <20210412044644.55083-11-crosa@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
* Acceptance Tests: add basic documentation on LinuxTest base classCleber Rosa2021-06-011-0/+26
| | | | | | | | | | Signed-off-by: Cleber Rosa <crosa@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Message-Id: <20210412044644.55083-10-crosa@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
* tests/acceptance/virtiofs_submounts.py: remove launch_vm()Cleber Rosa2021-06-011-8/+5
| | | | | | | | | | | | | The LinuxTest class' launch_and_wait() method now behaves the same way as this test's custom launch_vm(), so let's just use the upper layer (common) method. Signed-off-by: Cleber Rosa <crosa@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Message-Id: <20210412044644.55083-9-crosa@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
* Acceptance Tests: set up SSH connection by default after boot for LinuxTestCleber Rosa2021-06-013-11/+13
| | | | | | | | | | | | The LinuxTest specifically targets users that need to interact with Linux guests. So, it makes sense to give a connection by default, and avoid requiring it as boiler-plate code. Signed-off-by: Cleber Rosa <crosa@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Message-Id: <20210412044644.55083-8-crosa@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
* Acceptance Tests: make username/password configurableCleber Rosa2021-06-011-2/+4
| | | | | | | | | | | | | This makes the username/password used for authentication configurable, because some guest operating systems may have restrictions on accounts to be used for logins, and it just makes it better documented. Signed-off-by: Cleber Rosa <crosa@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Message-Id: <20210412044644.55083-7-crosa@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
* Acceptance Tests: add port redirection for ssh by defaultCleber Rosa2021-06-012-5/+4
| | | | | | | | | | | | | | | For users of the LinuxTest class, let's set up the VM with the port redirection for SSH, instead of requiring each test to set the same arguments. It also sets the network device, by default, to virtio-net. Signed-off-by: Cleber Rosa <crosa@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Message-Id: <20210412044644.55083-6-crosa@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
* Acceptance Tests: move useful ssh methods to base classCleber Rosa2021-06-013-75/+50
| | | | | | | | | | | | | | | | | | | Both the virtiofs submounts and the linux ssh mips malta tests contains useful methods related to ssh that deserve to be made available to other tests. Let's move them to an auxiliary, mix-in class that will be used on the base LinuxTest class. The method that helps with setting up an ssh connection will now support both key and password based authentication, defaulting to key based. Signed-off-by: Cleber Rosa <crosa@redhat.com> Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Cleber Rosa <crosa@redhat.com> Message-Id: <20210412044644.55083-5-crosa@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
* Python: add utility function for retrieving port redirectionCleber Rosa2021-06-015-32/+78
| | | | | | | | | | | | | | | | | | | | | Slightly different versions for the same utility code are currently present on different locations. This unifies them all, giving preference to the version from virtiofs_submounts.py, because of the last tweaks added to it. While at it, this adds a "qemu.utils" module to host the utility function and a test. Signed-off-by: Cleber Rosa <crosa@redhat.com> Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Message-Id: <20210412044644.55083-4-crosa@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> [Squashed in below fix. --js] Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Cleber Rosa <crosa@redhat.com> Message-Id: <20210601154546.130870-2-crosa@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
* tests/acceptance/virtiofs_submounts.py: evaluate string not lengthCleber Rosa2021-06-011-1/+1
| | | | | | | | | | | | | | | | If the vmlinuz variable is set to anything that evaluates to True, then the respective arguments should be set. If the variable contains an empty string, than it will evaluate to False, and the extra arguments will not be set. This keeps the same logic, but improves readability a bit. Signed-off-by: Cleber Rosa <crosa@redhat.com> Reviewed-by: Beraldo Leal <bleal@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Message-Id: <20210412044644.55083-3-crosa@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
* tests/acceptance/virtiofs_submounts.py: add missing accel tagCleber Rosa2021-06-011-0/+1
| | | | | | | | | | | | The tag is useful to select tests that depend/use a particular feature. Signed-off-by: Cleber Rosa <crosa@redhat.com> Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-Id: <20210412044644.55083-2-crosa@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
* Python: expose QEMUMachine's temporary directoryCleber Rosa2021-06-013-12/+20
| | | | | | | | | | | | | | | | | | | | | Each instance of qemu.machine.QEMUMachine currently has a "test directory", which may not have any relation to a "test", and it's really a temporary directory. Users instantiating the QEMUMachine class will be able to set the location of the directory that will *contain* the QEMUMachine unique temporary directory, so that parameter name has been changed from test_dir to base_temp_dir. A property has been added to allow users to access it without using private attributes, and with that, the directory is created on first use of the property. Signed-off-by: Cleber Rosa <crosa@redhat.com> Message-Id: <20210211220146.2525771-3-crosa@redhat.com> Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Signed-off-by: Cleber Rosa <crosa@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
* Merge remote-tracking branch 'remotes/kraxel/tags/usb-20210528-pull-request' ↵Peter Maydell2021-05-305-11/+20
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging usb: bugfixes for hid and xhci. # gpg: Signature made Fri 28 May 2021 15:21:51 BST # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/usb-20210528-pull-request: hw/usb: hcd-xhci-pci: Fix spec violation of IP flag for MSI/MSI-X hw/usb: hcd-xhci-pci: Raise MSI/MSI-X interrupts only when told to hw/input/hid: Add support for keys of jp106 keyboard. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/usb: hcd-xhci-pci: Fix spec violation of IP flag for MSI/MSI-XRuimei Yan2021-05-284-7/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Per xHCI spec v1.2 chapter 4.17.5 page 296: If MSI or MSI-X interrupts are enabled, Interrupt Pending (IP) shall be cleared automatically when the PCI dword write generated by the interrupt assertion is complete. Currently QEMU does not clear the IP flag in the MSI / MSI-X mode. This causes subsequent spurious interrupt to be delivered to guests. To solve this, we change the xhci intr_raise() hook routine to have a bool return value that is passed to its caller (the xhci core), with true indicating that IP should be self-cleared. Fixes: 62c6ae04cf43 ("xhci: Initial xHCI implementation") Fixes: 4c47f800631a ("xhci: add msix support") Signed-off-by: Ruimei Yan <ruimei.yan@windriver.com> [bmeng: move IP clear codes from xhci pci to xhci core] Signed-off-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20210521024224.2277634-2-bmeng.cn@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * hw/usb: hcd-xhci-pci: Raise MSI/MSI-X interrupts only when told toRuimei Yan2021-05-281-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At present MSI / MSI-X interrupts are triggered regardless of the irq level. We should have checked the level to determine whether the interrupt needs to be delivered. The level check logic was present in early versions of the xhci model, but got dropped later by a rework of interrupt handling under commit 4c4abe7cc903 ("xhci: rework interrupt handling"). Fixes: 4c4abe7cc903 ("xhci: rework interrupt handling") Signed-off-by: Ruimei Yan <ruimei.yan@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20210521024224.2277634-1-bmeng.cn@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * hw/input/hid: Add support for keys of jp106 keyboard.Katsuhiro Ueno2021-05-281-2/+2
| | | | | | | | | | | | | | | | | | | | Add support for the following keys: KATAKANAHIRAGANA, HENKAN, MUHENKAN, RO, and YEN. Before this commit, these keys did not work as expected when a jp106 keyboard was connected to the guest as a usb-kbd device. Signed-off-by: Katsuhiro Ueno <uenobk@gmail.com> Message-Id: <CA+pCdY3iG+pKKQqEVknnWF-W0wK36S4U1jxPvxmGAPp6FFvz1Q@mail.gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | Merge remote-tracking branch 'remotes/kraxel/tags/vga-20210527-pull-request' ↵Peter Maydell2021-05-3022-117/+799
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging virtio-gpu: add blob resource support. vhost-user-gpu: security fixes. # gpg: Signature made Thu 27 May 2021 15:23:25 BST # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20210527-pull-request: (23 commits) virtio-gpu: Update cursor data using blob virtio-gpu: Add virtio_gpu_set_scanout_blob virtio-gpu: Factor out update scanout virtio-gpu: Add helpers to create and destroy dmabuf objects ui/pixman: Add qemu_pixman_to_drm_format() virtio-gpu: Add virtio_gpu_resource_create_blob virtio-gpu: Add initial definitions for blob resources virtio-gpu: Refactor virtio_gpu_create_mapping_iov virtio-gpu: Refactor virtio_gpu_set_scanout virtio-gpu: Add virtio_gpu_find_check_resource stubs: Add stubs for udmabuf helpers virtio-gpu: Add udmabuf helpers headers: Add udmabuf.h ui: Get the fd associated with udmabuf driver hw/display/qxl: Set pci rom address aligned with page size vhost-user-gpu: abstract vg_cleanup_mapping_iov vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546) vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' (CVE-2021-3544) vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544) vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' (CVE-2021-3544) ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | virtio-gpu: Update cursor data using blobVivek Kasireddy2021-05-271-5/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a blob is available for the cursor, copy the data from the blob. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-15-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Add virtio_gpu_set_scanout_blobVivek Kasireddy2021-05-273-7/+103
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This API allows Qemu to set the blob allocated by the Guest as the scanout buffer. If Opengl support is available, then the scanout buffer would be submitted as a dmabuf to the UI; if not, a pixman image is created from the scanout buffer and is submitted to the UI via the display surface. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-14-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Factor out update scanoutVivek Kasireddy2021-05-271-12/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Creating a small helper function for updating the scanout will be useful in the next patch where this needs to be done early in do_set_scanout before returning. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-13-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Add helpers to create and destroy dmabuf objectsVivek Kasireddy2021-05-273-0/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These helpers can be useful for creating dmabuf objects from blobs and submitting them to the UI. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-12-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | ui/pixman: Add qemu_pixman_to_drm_format()Vivek Kasireddy2021-05-272-11/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new function to get the drm_format associated with a pixman format will be useful while creating a dmabuf. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-11-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Add virtio_gpu_resource_create_blobVivek Kasireddy2021-05-273-3/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This API allows Qemu to register the blob allocated by the Guest as a new resource and map its backing storage. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-10-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Add initial definitions for blob resourcesVivek Kasireddy2021-05-273-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the property bit, configuration flag and other relevant macros and definitions associated with this feature. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-9-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Refactor virtio_gpu_create_mapping_iovVivek Kasireddy2021-05-273-12/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of passing the attach_backing object to extract nr_entries and offset, explicitly pass these as arguments to this function. This will be helpful when adding create_blob API. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-8-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Refactor virtio_gpu_set_scanoutVivek Kasireddy2021-05-272-64/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Store the meta-data associated with a FB in a new object (struct virtio_gpu_framebuffer) and pass the object to set_scanout. Also move code in set_scanout into a do_set_scanout function. This will be helpful when adding set_scanout_blob API. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-7-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Add virtio_gpu_find_check_resourceVivek Kasireddy2021-05-271-19/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move finding the resource and validating its backing storage into one function. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-6-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | stubs: Add stubs for udmabuf helpersVivek Kasireddy2021-05-273-1/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is needed to ensure that virtio-gpu device works for non-linux builds. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-5-vivek.kasireddy@intel.com> [ kraxel: add virtio-gpu-udmabuf.c stubs only when building system emulation ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Add udmabuf helpersVivek Kasireddy2021-05-273-0/+170
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add helper functions to create a dmabuf for a resource and mmap it. Also, introduce the fields blob and blob_size so that these helpers can start to use them but the full picture will emerge only after adding create_blob API in patch 8 of this series. To be able to create a dmabuf using the udmabuf driver, Qemu needs to be lauched with the memfd memory backend like this: qemu-system-x86_64 -m 8192m -object memory-backend-memfd,id=mem1,size=8192M -machine memory-backend=mem1 Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-4-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | headers: Add udmabuf.hVivek Kasireddy2021-05-272-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds udmabuf header to standard headers so that the relevant udmabuf objects can be accessed in subsequent patches. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-3-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | ui: Get the fd associated with udmabuf driverVivek Kasireddy2021-05-273-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Try to open the udmabuf dev node for the first time or return the fd if the device was previously opened. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-2-vivek.kasireddy@intel.com> [ kraxel: fixup fcntl.h include ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | hw/display/qxl: Set pci rom address aligned with page sizemaobibo2021-05-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On some MIPS system, page size is 16K, and qxl vga device can be used for VM in kvm mode. Qxl pci rom size is set 8K fixed, smaller than 16K page size on host system, it fails to be added into memslots in kvm mode where memory_size and GPA are required to align with page size. This patch fixes this issue. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Message-Id: <1621340448-31617-1-git-send-email-maobibo@loongson.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: abstract vg_cleanup_mapping_iovLi Qiang2021-05-273-9/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently in vhost-user-gpu, we free resource directly in the cleanup case of resource. If we change the cleanup logic we need to change several places, also abstruct a 'vg_create_mapping_iov' can be symmetry with the 'vg_create_mapping_iov'. This is like what virtio-gpu does, no function changed. Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-9-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546)Li Qiang2021-05-271-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If 'virgl_cmd_get_capset' set 'max_size' to 0, the 'virgl_renderer_fill_caps' will write the data after the 'resp'. This patch avoid this by checking the returned 'max_size'. virtio-gpu fix: abd7f08b23 ("display: virtio-gpu-3d: check virgl capabilities max_size") Fixes: CVE-2021-3546 Reported-by: Li Qiang <liq3ea@163.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-8-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' ↵Li Qiang2021-05-271-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (CVE-2021-3544) If 'virgl_renderer_resource_attach_iov' failed, the 'res_iovs' will be leaked. Fixes: CVE-2021-3544 Reported-by: Li Qiang <liq3ea@163.com> virtio-gpu fix: 33243031da ("virtio-gpu-3d: fix memory leak in resource attach backing") Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-7-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544)Li Qiang2021-05-271-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 'res->iov' will be leaked if the guest trigger following sequences: virgl_cmd_create_resource_2d virgl_resource_attach_backing virgl_cmd_resource_unref This patch fixes this. Fixes: CVE-2021-3544 Reported-by: Li Qiang <liq3ea@163.com> virtio-gpu fix: 5e8e3c4c75 ("virtio-gpu: fix resource leak in virgl_cmd_resource_unref" Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-6-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' ↵Li Qiang2021-05-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (CVE-2021-3544) If the guest trigger following sequences, the attach_backing will be leaked: vg_resource_create_2d vg_resource_attach_backing vg_resource_unref This patch fix this by freeing 'res->iov' in vg_resource_destroy. Fixes: CVE-2021-3544 Reported-by: Li Qiang <liq3ea@163.com> virtio-gpu fix: 5e8e3c4c75 ("virtio-gpu: fix resource leak in virgl_cmd_resource_unref") Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-5-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix memory leak in vg_resource_attach_backing (CVE-2021-3544)Li Qiang2021-05-271-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Check whether the 'res' has already been attach_backing to avoid memory leak. Fixes: CVE-2021-3544 Reported-by: Li Qiang <liq3ea@163.com> virtio-gpu fix: 204f01b309 ("virtio-gpu: fix memory leak in resource attach backing") Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-4-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix resource leak in 'vg_resource_create_2d' (CVE-2021-3544)Li Qiang2021-05-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Call 'vugbm_buffer_destroy' in error path to avoid resource leak. Fixes: CVE-2021-3544 Reported-by: Li Qiang <liq3ea@163.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-3-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info ↵Li Qiang2021-05-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (CVE-2021-3545) Otherwise some of the 'resp' will be leaked to guest. Fixes: CVE-2021-3545 Reported-by: Li Qiang <liq3ea@163.com> virtio-gpu fix: 42a8dadc74 ("virtio-gpu: fix information leak in getting capset info dispatch") Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-2-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | | Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell2021-05-284-13/+6
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging # gpg: Signature made Thu 27 May 2021 04:06:17 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: tap-bsd: Remove special casing for older OpenBSD releases virtio-net: failover: add missing remove_migration_state_change_notifier() hw/net/imx_fec: return 0xffff when accessing non-existing PHY Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | tap-bsd: Remove special casing for older OpenBSD releasesBrad Smith2021-05-271-8/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenBSD added support for tap(4) 10 releases ago. Remove the special casing for older releases. Signed-off-by: Brad Smith <brad@comstyle.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * | | virtio-net: failover: add missing remove_migration_state_change_notifier()Laurent Vivier2021-05-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the failover case configuration, virtio_net_device_realize() uses an add_migration_state_change_notifier() to add a state notifier, but this notifier is not removed by the unrealize function when the virtio-net card is unplugged. If the card is unplugged and a migration is started, the notifier is called and as it is not valid anymore QEMU crashes. This patch fixes the problem by adding the remove_migration_state_change_notifier() in virtio_net_device_unrealize(). The problem can be reproduced with: $ qemu-system-x86_64 -enable-kvm -m 1g -M q35 \ -device pcie-root-port,slot=4,id=root1 \ -device pcie-root-port,slot=5,id=root2 \ -device virtio-net-pci,id=net1,mac=52:54:00:6f:55:cc,failover=on,bus=root1 \ -monitor stdio disk.qcow2 (qemu) device_del net1 (qemu) migrate "exec:gzip -c > STATEFILE.gz" Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x0000000000000000 in ?? () (gdb) bt #0 0x0000000000000000 in () #1 0x0000555555d726d7 in notifier_list_notify (...) at .../util/notify.c:39 #2 0x0000555555842c1a in migrate_fd_connect (...) at .../migration/migration.c:3975 #3 0x0000555555950f7d in migration_channel_connect (...) error@entry=0x0) at .../migration/channel.c:107 #4 0x0000555555910922 in exec_start_outgoing_migration (...) at .../migration/exec.c:42 Reported-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * | | hw/net/imx_fec: return 0xffff when accessing non-existing PHYGuenter Roeck2021-05-272-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a PHY does not exist, attempts to read from it should return 0xffff. Otherwise the Linux kernel will believe that a PHY is there and select the non-existing PHY. This in turn will result in network errors later on since the real PHY is not selected or configured. Since reading from or writing to a non-existing PHY is not an emulation error, replace guest error messages with traces. Fixes: 461c51ad4275 ("Add a phy-num property to the i.MX FEC emulator") Cc: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Tested-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | | | Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210526' ↵Peter Maydell2021-05-2853-404/+600
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging Adjust types for some memory access functions. Reduce inclusion of tcg headers. Fix watchpoints vs replay. Fix tcg/aarch64 roli expansion. Introduce SysemuCPUOps structure. # gpg: Signature made Thu 27 May 2021 00:43:54 BST # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth-gitlab/tags/pull-tcg-20210526: (31 commits) hw/core: Constify TCGCPUOps target/mips: Fold jazz behaviour into mips_cpu_do_transaction_failed cpu: Move CPUClass::get_paging_enabled to SysemuCPUOps cpu: Move CPUClass::get_memory_mapping to SysemuCPUOps cpu: Move CPUClass::get_phys_page_debug to SysemuCPUOps cpu: Move CPUClass::asidx_from_attrs to SysemuCPUOps cpu: Move CPUClass::write_elf* to SysemuCPUOps cpu: Move CPUClass::get_crash_info to SysemuCPUOps cpu: Move CPUClass::virtio_is_big_endian to SysemuCPUOps cpu: Move CPUClass::vmsd to SysemuCPUOps cpu: Introduce SysemuCPUOps structure cpu: Move AVR target vmsd field from CPUClass to DeviceClass cpu: Rename CPUClass vmsd -> legacy_vmsd cpu: Assert DeviceClass::vmsd is NULL on user emulation cpu: Directly use get_memory_mapping() fallback handlers in place cpu: Directly use get_paging_enabled() fallback handlers in place cpu: Directly use cpu_write_elf*() fallback handlers in place cpu: Introduce cpu_virtio_is_big_endian() cpu: Un-inline cpu_get_phys_page_debug and cpu_asidx_from_attrs cpu: Split as cpu-common / cpu-sysemu ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | | hw/core: Constify TCGCPUOpsRichard Henderson2021-05-2622-23/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We no longer have any runtime modifications to this struct, so declare them all const. Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20210227232519.222663-3-richard.henderson@linaro.org>
| * | | | target/mips: Fold jazz behaviour into mips_cpu_do_transaction_failedRichard Henderson2021-05-263-33/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a flag to MIPSCPUClass in order to avoid needing to replace mips_tcg_ops.do_transaction_failed. Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20210227232519.222663-2-richard.henderson@linaro.org>
| * | | | cpu: Move CPUClass::get_paging_enabled to SysemuCPUOpsPhilippe Mathieu-Daudé2021-05-264-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-23-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Move CPUClass::get_memory_mapping to SysemuCPUOpsPhilippe Mathieu-Daudé2021-05-264-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-22-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Move CPUClass::get_phys_page_debug to SysemuCPUOpsPhilippe Mathieu-Daudé2021-05-2622-30/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-21-f4bug@amsat.org> [rth: Drop declaration movement from target/*/cpu.h] Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Move CPUClass::asidx_from_attrs to SysemuCPUOpsPhilippe Mathieu-Daudé2021-05-265-7/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-20-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>