summary refs log tree commit diff stats
path: root/scripts/qapi/common.py (unfollow)
Commit message (Collapse)AuthorFilesLines
2022-04-20target/i386: fix byte swap issue with XMM register accessAlex Bennée1-2/+2
During the conversion to the gdb_get_reg128 helpers the high and low parts of the XMM register where inadvertently swapped. This causes reads of the register to report the incorrect value to gdb. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/971 Fixes: b7b8756a9c (target/i386: use gdb_get_reg helpers) Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Cc: qemu-stable@nongnu.org Message-Id: <20220419091020.3008144-25-alex.bennee@linaro.org>
2022-04-20tests/tcg: add missing reference files for float_convsAlex Bennée2-0/+1496
We might as well include a reference file for i386/x86_64. I was going to include s390x as well but it's broken hence I raised: https://gitlab.com/qemu-project/qemu/-/issues/979. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20220419091020.3008144-24-alex.bennee@linaro.org>
2022-04-20tests/tcg: add float_convd testAlex Bennée5-0/+4058
This is a simple transliteration of the float_convs test but this time working with doubles. I'm used it to test the handling of vector registers in gdbstub but wasn't able to find a non-ugly way to automate it. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-23-alex.bennee@linaro.org>
2022-04-20tests/tcg: remove duplicate sha512-sse caseAlex Bennée1-7/+0
We already generate the sha512-sse case in the i386 makefile which works for both i386 and x86_64. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Fixes: f8a4c6d728 ("tests/tcg: add vectorised sha512 versions") Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-22-alex.bennee@linaro.org>
2022-04-20tests/tcg: fix non-static buildPaolo Bonzini1-1/+0
If linking with -static fails at configure time, -static should not be used at build time either. Do not include BUILD_STATIC in $config_target_mak. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20220401141326.1244422-18-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-21-alex.bennee@linaro.org>
2022-04-20tests/docker: remove SKIP_DOCKER_BUILDPaolo Bonzini2-68/+1
It is now unused. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20220401141326.1244422-17-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-20-alex.bennee@linaro.org>
2022-04-20tests/tcg: isolate from QEMU's config-host.makPaolo Bonzini3-4/+7
Do not include variables for the QEMU's own compiler, as they are not necessarily related to the cross compiler used for tests/tcg. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20220401141326.1244422-16-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-19-alex.bennee@linaro.org>
2022-04-20tests/tcg: invoke Makefile.target directly from QEMU's makefilePaolo Bonzini4-146/+35
Build the "docker.py cc" invocation directly in tests/tcg/configure.sh, and remove the Makefile.qemu wrapper around Makefile.target. The config-*.mak files now include the actual variables used when building the tests, rather than the CROSS_* variables that Makefile.qemu used to "translate". This is a first step towards generalizing the cross-compilation infrastructure so that it can be used for firmware as well. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20220401141326.1244422-15-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-18-alex.bennee@linaro.org>
2022-04-20tests/tcg: list test targets in Makefile.prereqsPaolo Bonzini3-23/+19
Omit the rules altogether for targets that do not have a compiler. Makefile.qemu now is only invoked if the tests are actually built/run. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20220401141326.1244422-14-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-17-alex.bennee@linaro.org>
2022-04-20tests/tcg: prepare Makefile.prereqs at configure timePaolo Bonzini3-23/+14
List the dependencies of the build-tcg-tests-* and run-tcg-tests-* targets in a Makefile fragment, without going through Makefile.prereqs's "parsing" of config-*.mak. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20220401141326.1244422-13-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-16-alex.bennee@linaro.org>
2022-04-20tests/tcg: remove CONFIG_USER_ONLY from config-target.makPaolo Bonzini2-13/+7
Just check the target name instead. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20220401141326.1244422-12-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-15-alex.bennee@linaro.org>
2022-04-20tests/tcg: remove CONFIG_LINUX_USER from config-target.makPaolo Bonzini3-4/+2
Just check the target name instead. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220401141326.1244422-11-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-14-alex.bennee@linaro.org>
2022-04-20tests/tcg: add compiler test variables when using containersPaolo Bonzini6-11/+28
Even for container-based cross compilation use $(CROSS_CC_HAS_*) variables. This makes the TCG test makefiles oblivious of whether the compiler is invoked through a container or not. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20220401141326.1244422-10-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-13-alex.bennee@linaro.org>
2022-04-20tests/docker: do not duplicate rules for hexagon-crossPaolo Bonzini2-22/+4
The commands for docker-image-debian-hexagon-cross are the same as those in debian-toolchain-run, just with a nonstandard path to build-toolchain.sh. Reuse the definition by renaming the debian-hexagon-cross.docker.d directory. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20220401141326.1244422-9-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-12-alex.bennee@linaro.org>
2022-04-20tests/docker: simplify docker-TEST@IMAGE targetsPaolo Bonzini1-10/+2
No need to go through the shell when we already have the test and images at the point where the targets are declared. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20220401141326.1244422-8-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-11-alex.bennee@linaro.org>
2022-04-20tests/docker: remove unnecessary filtering of $(DOCKER_IMAGES)Paolo Bonzini1-1/+1
Now that DOCKER_IMAGES is only defined after DOCKER_VIRTUAL_IMAGES is complete, there is no need to re-filter DOCKER_IMAGES against it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20220401141326.1244422-7-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-10-alex.bennee@linaro.org>
2022-04-20tests/docker: inline variable definitions or move close to usePaolo Bonzini1-16/+16
Variables that are defined with ":=" are handled imperatively, so moving them closer to the first use ensures that all the assignments prior to the first use are taken into account. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20220401141326.1244422-6-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-9-alex.bennee@linaro.org>
2022-04-20tests/docker: remove unnecessary default definitionsPaolo Bonzini1-5/+0
The definition of DOCKER_IMAGES and DOCKER_TESTS copes already with an empty value of $(IMAGES) and $(TESTS), no need to force them to "%" if undefined. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20220401141326.1244422-5-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-8-alex.bennee@linaro.org>
2022-04-20tests/docker: remove dead variablePaolo Bonzini1-1/+0
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20220401141326.1244422-4-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-7-alex.bennee@linaro.org>
2022-04-20tests/docker: remove test targetsPaolo Bonzini2-27/+1
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20220401141326.1244422-3-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-6-alex.bennee@linaro.org>
2022-04-20tests/docker: remove dead code for linux-user containersPaolo Bonzini1-11/+0
debian-powerpc-user-cross was the only linux-user powered cross builder and it was removed in commit 80394ccf21 ("tests/docker: remove debian-powerpc-user-cross", 2019-09-26). Remove all the infrastructure around it since it is now unused. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20220401141326.1244422-2-pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-5-alex.bennee@linaro.org>
2022-04-20docs/devel: drop :hidden: and :includehidden: tagsAlex Bennée7-9/+1
This was confusing and in the case of qtest was hiding the details of the qgraph sub-document in the qtest pages. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-4-alex.bennee@linaro.org>
2022-04-20docs/devel: add some notes on the binfmt-image-debian targetsAlex Bennée1-0/+38
We document some of this on the wiki but lets move it into our official developer notes documentation. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-3-alex.bennee@linaro.org>
2022-04-20tests/avocado: update aarch64_virt test to exercise -cpu maxAlex Bennée3-25/+52
The Fedora 29 kernel is quite old and importantly fails when running in LPA2 scenarios. As it's not really exercising much of the CPU space replace it with a custom 5.16.12 kernel with all the architecture options turned on. There is a minimal buildroot initramfs included in the kernel which has a few tools for stress testing the memory subsystem. The userspace also targets the Neoverse N1 processor so would fail with a v8.0 cpu like cortex-a53. While we are at it move the test into its own file so it can have an assigned maintainer. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220419091020.3008144-2-alex.bennee@linaro.org>
2022-04-20qcow2: Add errp to rebuild_refcount_structure()Hanna Reitz1-14/+19
Instead of fprint()-ing error messages in rebuild_refcount_structure() and its rebuild_refcounts_write_refblocks() helper, pass them through an Error object to qcow2_check_refcounts() (which will then print it). Suggested-by: Eric Blake <eblake@redhat.com> Signed-off-by: Hanna Reitz <hreitz@redhat.com> Message-Id: <20220405134652.19278-4-hreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2022-04-20iotests/108: Test new refcount rebuild algorithmHanna Reitz2-1/+339
One clear problem with how qcow2's refcount structure rebuild algorithm used to be before "qcow2: Improve refcount structure rebuilding" was that it is prone to failure for qcow2 images on block devices: There is generally unused space after the actual image, and if that exceeds what one refblock covers, the old algorithm would invariably write the reftable past the block device's end, which cannot work. The new algorithm does not have this problem. Test it with three tests: (1) Create an image with more empty space at the end than what one refblock covers, see whether rebuilding the refcount structures results in a change in the image file length. (It should not.) (2) Leave precisely enough space somewhere at the beginning of the image for the new reftable (and the refblock for that place), see whether the new algorithm puts the reftable there. (It should.) (3) Test the original problem: Create (something like) a block device with a fixed size, then create a qcow2 image in there, write some data, and then have qemu-img check rebuild the refcount structures. Before HEAD^, the reftable would have been written past the image file end, i.e. outside of what the block device provides, which cannot work. HEAD^ should have fixed that. ("Something like a block device" means a loop device if we can use one ("sudo -n losetup" works), or a FUSE block export with growable=false otherwise.) Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Hanna Reitz <hreitz@redhat.com> Message-Id: <20220405134652.19278-3-hreitz@redhat.com>
2022-04-20qcow2: Improve refcount structure rebuildingHanna Reitz1-97/+235
When rebuilding the refcount structures (when qemu-img check -r found errors with refcount = 0, but reference count > 0), the new refcount table defaults to being put at the image file end[1]. There is no good reason for that except that it means we will not have to rewrite any refblocks we already wrote to disk. Changing the code to rewrite those refblocks is not too difficult, though, so let us do that. That is beneficial for images on block devices, where we cannot really write beyond the end of the image file. Use this opportunity to add extensive comments to the code, and refactor it a bit, getting rid of the backwards-jumping goto. [1] Unless there is something allocated in the area pointed to by the last refblock, so we have to write that refblock. In that case, we try to put the reftable in there. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1519071 Closes: https://gitlab.com/qemu-project/qemu/-/issues/941 Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Hanna Reitz <hreitz@redhat.com> Message-Id: <20220405134652.19278-2-hreitz@redhat.com>
2022-04-20iotests/303: Check for zstd supportHanna Reitz1-1/+3
303 runs two test cases, one of which requires zstd support. Unfortunately, given that this is not a unittest-style test, we cannot easily skip that single case, and instead can only skip the whole test. (Alternatively, we could split this test into a zlib and a zstd part, but that seems excessive, given that this test is not in auto and thus likely only run by developers who have zstd support compiled in.) Fixes: 677e0bae686e7c670a71d1f ("iotest 303: explicit compression type") Signed-off-by: Hanna Reitz <hreitz@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <v.sementsov-og@mail.ru> Message-Id: <20220323105522.53660-4-hreitz@redhat.com>
2022-04-20iotests/065: Check for zstd supportHanna Reitz1-6/+18
Some test cases run in iotest 065 want to run with zstd compression just for added coverage. Run them with zlib if there is no zstd support compiled in. Reported-by: Thomas Huth <thuth@redhat.com> Fixes: 12a936171d71f839dc907ff ("iotest 065: explicit compression type") Signed-off-by: Hanna Reitz <hreitz@redhat.com> Message-Id: <20220323105522.53660-3-hreitz@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <v.sementsov-og@mail.ru>
2022-04-20iotests.py: Add supports_qcow2_zstd_compression()Hanna Reitz1-0/+20
Suggested-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Hanna Reitz <hreitz@redhat.com> Message-Id: <20220323105522.53660-2-hreitz@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <v.sementsov-og@mail.ru>
2022-04-20tests/qemu-iotests: Move the bash and sanitizer checks to meson.buildThomas Huth2-26/+14
We want to get rid of check-block.sh in the long run, so let's move the checks for the bash version and sanitizers from check-block.sh into the meson.build file instead. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20220223093840.2515281-4-thuth@redhat.com> Signed-off-by: Hanna Reitz <hreitz@redhat.com>
2022-04-20tests/qemu-iotests/meson.build: Improve the indentationThomas Huth1-29/+32
By using subdir_done(), we can get rid of one level of indentation in this file. This will make it easier to add more conditions to skip the iotests in future patches. Reviewed-by: Hanna Reitz <hreitz@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20220223093840.2515281-3-thuth@redhat.com> Signed-off-by: Hanna Reitz <hreitz@redhat.com>
2022-04-20tests/avocado: Allow overwrite smp and memory size command line optionsAhmed Abouzied1-2/+4
Removes the hard-coded values in setUp(). Class inheriting from avocado_qemu.LinuxTest can overwrite the default smp and memory instead. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/453 Signed-off-by: Ahmed Abouzied <email@aabouzied.com> Message-Id: <20210802222257.50946-1-email@aabouzied.com> Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-04-20hw: Add compat machines for 7.1Cornelia Huck10-7/+79
Add 7.1 machine types for arm/i440fx/m68k/q35/s390x/spapr. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20220316145521.1224083-1-cohuck@redhat.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Acked-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Yanan Wang <wangyanan55@huawei.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-04-20docs/ccid: convert to restructuredTextLucas Ramage3-182/+172
Buglink: https://gitlab.com/qemu-project/qemu/-/issues/527 Signed-off-by: Lucas Ramage <lucas.ramage@infinite-omicron.com> Message-Id: <20220405142906.21382-1-oxr463@gmx.us> Reviewed-by: Damien Hedde <damien.hedde@greensocs.com> [thuth: Added some cosmetic fixes] Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-04-20tests/qtest: properly initialise the vring used idxAlex Bennée1-0/+2
Eric noticed while attempting to enable the vhost-user-blk-test for Aarch64 that that things didn't work unless he put in a dummy guest_malloc() at the start of the test. Without it qvirtio_wait_used_elem() would assert when it reads a junk value for idx resulting in: qvirtqueue_get_buf: idx:2401 last_idx:0 qvirtqueue_get_buf: 0x7ffcb6d3fe74, (nil) qvirtio_wait_used_elem: 3000000/0 ERROR:../../tests/qtest/libqos/virtio.c:226:qvirtio_wait_used_elem: assertion failed (got_desc_idx == desc_idx): (50331648 == 0) Bail out! ERROR:../../tests/qtest/libqos/virtio.c:226:qvirtio_wait_used_elem: assertion failed (got_desc_idx == desc_idx): (50331648 == 0) What was actually happening is the guest_malloc() effectively pushed the allocation of the vring into the next page which just happened to have clear memory. After much tedious tracing of the code I could see that qvring_init() does attempt initialise a bunch of the vring structures but skips the vring->used.idx value. It is probably not wise to assume guest memory is zeroed anyway. Once the ring is properly initialised the hack is no longer needed to get things working. Thanks-to: John Snow <jsnow@redhat.com> for helping debug Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20220406173356.1891500-1-alex.bennee@linaro.org> Tested-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-04-20tests/qtest: Move the fuzz tests to x86 onlyThomas Huth6-43/+22
The fuzz tests are currently scheduled for all targets, but their setup code limits the run to "i386", so that these tests always show "SKIP" on other targets. Move it to the right x86 list in meson.build, then we can drop the architecture check during runtime, too. Message-Id: <20220414130127.719528-1-thuth@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-04-20tests/qtest: Enable more tests for the "mipsel" targetThomas Huth2-11/+4
Allow the same set of tests for all MIPS targets, so that "mipsel" now gets some additional test coverage, too. While we're at it, simplify the definitions for qtests_mips64 and qtests_mips64el. Message-Id: <20220414114655.604391-1-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-04-20tests: Drop perl-Test-Harness from the CI containers / VMsThomas Huth18-20/+6
The perl test harness is not necessary anymore since commit 3d2f73ef75 ("build: use "meson test" as the test harness"). Thus remove it from tests/lcitool/projects/qemu.yml, run "make lcitool-refresh" and manually clean the remaining docker / vm files that are not managed by lcitool yet. Message-Id: <20220329102808.423681-1-thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-04-19Open 7.1 development treeRichard Henderson1-1/+1
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-04-19Update version for v7.0.0 releasePeter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-13target/i386: Remove unused XMMReg, YMMReg types and CPUState fieldsPeter Maydell1-18/+0
In commit b7711471f5 in 2014 we refactored the handling of the x86 vector registers so that instead of separate structs XMMReg, YMMReg and ZMMReg for representing the 16-byte, 32-byte and 64-byte width vector registers and multiple fields in the CPU state, we have a single type (XMMReg, later renamed to ZMMReg) and a single struct field (xmm_regs). However, in 2017 in commit c97d6d2cdf97ed some of the old struct types and CPU state fields got added back, when we merged in the hvf support (which had developed in a separate fork that had presumably not had the refactoring of b7711471f5), as part of code handling xsave. Commit f585195ec07 then almost immediately dropped that xsave code again in favour of sharing the xsave handling with KVM, but forgot to remove the now unused CPU state fields and struct types. Delete the unused types and CPUState fields. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20220412110047.1497190-1-peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-04-13target/i386: do not access beyond the low 128 bits of SSE registersPaolo Bonzini1-28/+47
The i386 target consolidates all vector registers so that instead of XMMReg, YMMReg and ZMMReg structs there is a single ZMMReg that can fit all of SSE, AVX and AVX512. When TCG copies data from and to the SSE registers, it uses the full 64-byte width. This is not a correctness issue because TCG never lets guest code see beyond the first 128 bits of the ZMM registers, however it causes uninitialized stack memory to make it to the CPU's migration stream. Fix it by only copying the low 16 bytes of the ZMMReg union into the destination register. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-04-12Update version for v7.0.0-rc4 releasePeter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-08virtio-iommu: use-after-free fixWentao Liang1-0/+1
A potential Use-after-free was reported in virtio_iommu_handle_command when using virtio-iommu: > I find a potential Use-after-free in QEMU 6.2.0, which is in > virtio_iommu_handle_command() (./hw/virtio/virtio-iommu.c). > > > Specifically, in the loop body, the variable 'buf' allocated at line 639 can be > freed by g_free() at line 659. However, if the execution path enters the loop > body again and the if branch takes true at line 616, the control will directly > jump to 'out' at line 651. At this time, 'buf' is a freed pointer, which is not > assigned with an allocated memory but used at line 653. As a result, a UAF bug > is triggered. > > > > 599 for (;;) { > ... > 615 sz = iov_to_buf(iov, iov_cnt, 0, &head, sizeof(head)); > 616 if (unlikely(sz != sizeof(head))) { > 617 tail.status = VIRTIO_IOMMU_S_DEVERR; > 618 goto out; > 619 } > ... > 639 buf = g_malloc0(output_size); > ... > 651 out: > 652 sz = iov_from_buf(elem->in_sg, elem->in_num, 0, > 653 buf ? buf : &tail, output_size); > ... > 659 g_free(buf); > > We can fix it by set ‘buf‘ to NULL after freeing it: > > > 651 out: > 652 sz = iov_from_buf(elem->in_sg, elem->in_num, 0, > 653 buf ? buf : &tail, output_size); > ... > 659 g_free(buf); > +++ buf = NULL; > 660 } Fix as suggested by the reporter. Signed-off-by: Wentao Liang <Wentao_Liang_g@163.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20220407095047.50371-1-mst@redhat.com Message-ID: <20220406040445-mutt-send-email-mst@kernel.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-07ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)Mauro Matteo Cascella3-1/+16
Prevent potential integer overflow by limiting 'width' and 'height' to 512x512. Also change 'datasize' type to size_t. Refer to security advisory https://starlabs.sg/advisories/22-4206/ for more information. Fixes: CVE-2021-4206 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220407081712.345609-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-04-07display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207)Mauro Matteo Cascella1-1/+1
Avoid fetching 'width' and 'height' a second time to prevent possible race condition. Refer to security advisory https://starlabs.sg/advisories/22-4207/ for more information. Fixes: CVE-2021-4207 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220407081106.343235-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-04-06Update version for v7.0.0-rc3 releasePeter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-06acpi: fix acpi_index migrationDr. David Alan Gilbert5-14/+17
vmstate_acpi_pcihp_use_acpi_index() was expecting AcpiPciHpState as state but it actually received PIIX4PMState, because VMSTATE_PCI_HOTPLUG is a macro and not another struct. So it ended up accessing random pointer, which resulted in 'false' return value and acpi_index field wasn't ever sent. However in 7.0 that pointer de-references to value > 0, and destination QEMU starts to expect the field which isn't sent in migratioon stream from older QEMU (6.2 and older). As result migration fails with: qemu-system-x86_64: Missing section footer for 0000:00:01.3/piix4_pm qemu-system-x86_64: load of migration failed: Invalid argument In addition with QEMU-6.2, destination due to not expected state, also never expects the acpi_index field in migration stream. Q35 is not affected as it always sends/expects the field as long as acpi based PCI hotplug is enabled. Fix issue by introducing compat knob to never send/expect acpi_index in migration stream for 6.2 and older PC machine types and always send it for 7.0 and newer PC machine types. Diagnosed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Fixes: b32bd76 ("pci: introduce acpi-index property for PCI device") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/932 Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-06virtio-ccw: do not include headers for all virtio devicesPaolo Bonzini4-16/+6
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>