Skip to content
Snippets Groups Projects
Select Git revision
  • feature/libtcg-rebase default protected
1 result
Search by author
  • Any Author
  • Anton Anton anjo
1 author
  1. Jul 23, 2019
  3. Jul 22, 2019
  5. Jul 19, 2019
    • Jiri Slaby's avatar
      target/i386: sev: fix failed message typos · d4b976c0
      Jiri Slaby authored 
      
In these multiline messages, there were typos. Fix them -- add a missing
space and remove a superfluous apostrophe.

Inspired by Tom's patch.

Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Eduardo Habkost <ehabkost@redhat.com>
Cc: qemu-trivial@nongnu.org
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Message-Id: <20190719104118.17735-1-jslaby@suse.cz>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      d4b976c0
    • Denis V. Lunev's avatar
      i386: indicate that 'pconfig' feature was removed intentionally · 2924ab02
      Denis V. Lunev authored 
      
pconfig feature was added in 5131dc43 and removed in 712f807e.
This patch mark this feature as known to QEMU and removed by
intentinally. This follows the convention of 9ccb9784 and f1a23522
dealing with 'osxsave' and 'ospke'.

Signed-off-by: default avatarDenis V. Lunev <den@openvz.org>
CC: Paolo Bonzini <pbonzini@redhat.com>
CC: Richard Henderson <rth@twiddle.net>
CC: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <20190719111222.14943-1-den@openvz.org>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      2924ab02
    • Eric Blake's avatar
      nbd: Initialize reply on failure · 5cf42b1c
      Eric Blake authored 
      
We've had two separate reports of different callers running into use
of uninitialized data if s->quit is set (one detected by gcc -O3,
another by valgrind), due to checking 'nbd_reply_is_simple(reply) ||
s->quit' in the wrong order. Rather than chasing down which callers
need to pre-initialize reply, and whether there are any other
uninitialized uses, it's easier to guarantee that reply will always be
set by nbd_co_receive_one_chunk() even on failure.

The uninitialized use happens to be harmless (the only time the
variable is uninitialized is if s->quit is set, so the conditional
results in the same action regardless of what was read from reply),
and was introduced in commit 65e01d47.

In fixing the problem, it can also be seen that all (one) callers pass
in a non-NULL reply, so there is a dead conditional to also be cleaned
up.

Reported-by: default avatarThomas Huth <thuth@redhat.com>
Reported-by: default avatarAndrey Shinkevich <andrey.shinkevich@virtuozzo.com>
Signed-off-by: default avatarEric Blake <eblake@redhat.com>
Message-Id: <20190719172001.19770-1-eblake@redhat.com>
Reviewed-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
      5cf42b1c
    • Marc-André Lureau's avatar
      build-sys: do no support modules on Windows · 21e709aa
      Marc-André Lureau authored 
      Our module system does not support Windows, because it relies on
resolving symbols from the main executable.

If there is enough interest in supporting modules on Windows, we could
generate an import library for the executable and link with it:
https://stackoverflow.com/questions/15454968/dll-plugin-that-uses-functions-defined-in-the-main-executable



However, there is a small chicken egg problem, since the executable
link and exports extra symbols needed by the library...

Signed-off-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20190718120413.27678-1-marcandre.lureau@redhat.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      21e709aa
    • Nicholas Piggin's avatar
      qmp: don't emit the RESET event on wakeup · 3bf5de52
      Nicholas Piggin authored 
      
Commit 14058196 ("qmp: don't emit the RESET event on wakeup from
S3") changed system wakeup to avoid calling qapi_event_send_reset.
Commit 76ed4b18 ("s390/ipl: fix ipl with -no-reboot") appears to
have inadvertently broken that logic.

Acked-by: default avatarCornelia Huck <cohuck@redhat.com>
Signed-off-by: default avatarNicholas Piggin <npiggin@gmail.com>
Message-Id: <20190718103951.10027-2-npiggin@gmail.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      3bf5de52
    • Alexey Kardashevskiy's avatar
      hmp: Print if memory section is registered with an accelerator · 8072aae3
      Alexey Kardashevskiy authored 
      
This adds an accelerator name to the "into mtree -f" to tell the user if
a particular memory section is registered with the accelerator;
the primary user for this is KVM and such information is useful
for debugging purposes.

This adds a has_memory() callback to the accelerator class allowing any
accelerator to have a label in that memory tree dump.

Since memory sections are passed to memory listeners and get registered
in accelerators (rather than memory regions), this only prints new labels
for flatviews attached to the system address space.

An example:
 Root memory region: system
  0000000000000000-0000002fffffffff (prio 0, ram): /objects/mem0 kvm
  0000003000000000-0000005fffffffff (prio 0, ram): /objects/mem1 kvm
  0000200000000020-000020000000003f (prio 1, i/o): virtio-pci
  0000200080000000-000020008000003f (prio 0, i/o): capabilities

Signed-off-by: default avatarAlexey Kardashevskiy <aik@ozlabs.ru>
Message-Id: <20190614015237.82463-1-aik@ozlabs.ru>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      8072aae3
    • Wei Yang's avatar
      test-bitmap: add test for bitmap_set · 2f950b1e
      Wei Yang authored 
      
Add a test for bitmap_set. There are three cases:

  * Both start and end is BITS_PER_LONG aligned
  * Only start is BITS_PER_LONG aligned
  * Only end is BITS_PER_LONG aligned

Signed-off-by: default avatarWei Yang <richardw.yang@linux.intel.com>
Message-Id: <20190718010456.4234-3-richardw.yang@linux.intel.com>
Reviewed-by: default avatarPeter Xu <peterx@redhat.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      2f950b1e
    • Shin'ichiro Kawasaki's avatar
      scsi-generic: Check sense key before request snooping and patching · 1849f297
      Shin'ichiro Kawasaki authored 
      
When READ CAPACITY command completes, scsi_read_complete() function
snoops the command result and updates SCSIDevice members blocksize and
max_lba . However, this update is executed even when READ CAPACITY
command indicates an error in sense data. This causes unexpected
blocksize update with zero value for SCSI devices without
READ CAPACITY(10) command support and eventually results in a divide
by zero. An emulated device by TCMU-runner is an example of a device
that doesn't support READ CAPACITY(10) command.

To avoid the unexpected update, add sense key check in
scsi_read_complete() function. The function already checks the sense key
for VPD Block Limits emulation. Do the scsi_parse_sense_buf() call for
all requests rather than just for VPD Block Limits emulation, so that
blocksize and max_lba are only updated if READ CAPACITY returns zero
sense key.

Signed-off-by: default avatarShin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
[Extend the check to all requests, not just READ CAPACITY]
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      1849f297
    • Xie Yongji's avatar
      vhost-user-scsi: Call virtio_scsi_common_unrealize() when device realize failed · 68fa7ca0
      Xie Yongji authored 
      
This avoids memory leak when device hotplug is failed.

Signed-off-by: default avatarXie Yongji <xieyongji@baidu.com>
Message-Id: <20190717004606.12444-2-xieyongji@baidu.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      68fa7ca0
    • Xie Yongji's avatar
      vhost-scsi: Call virtio_scsi_common_unrealize() when device realize failed · 934443c3
      Xie Yongji authored 
      
This avoids memory leak when device hotplug is failed.

Signed-off-by: default avatarXie Yongji <xieyongji@baidu.com>
Message-Id: <20190717004606.12444-1-xieyongji@baidu.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      934443c3
    • Paolo Bonzini's avatar
      virtio-scsi: remove unused argument to virtio_scsi_common_realize · 12e1dc49
      Paolo Bonzini authored 
      
The argument is not used and passing it clutters error propagation in the
callers.  So, get rid of it.

Reviewed-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      12e1dc49
    • Paolo Bonzini's avatar
      target/i386: skip KVM_GET/SET_NESTED_STATE if VMX disabled, or for SVM · 1e44f3ab
      Paolo Bonzini authored 
      
Do not allocate env->nested_state unless we later need to migrate the
nested virtualization state.

With this change, nested_state_needed() will return false if the
VMX flag is not included in the virtual machine.  KVM_GET/SET_NESTED_STATE
is also disabled for SVM which is safer (we know that at least the NPT
root and paging mode have to be saved/loaded), and thus the corresponding
subsection can go away as well.

Inspired by a patch from Liran Alon.

Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      1e44f3ab
    • Liran Alon's avatar
      target/i386: kvm: Demand nested migration kernel capabilities only when vCPU may have enabled VMX · 79a197ab
      Liran Alon authored 
      
Previous to this change, a vCPU exposed with VMX running on a kernel
without KVM_CAP_NESTED_STATE or KVM_CAP_EXCEPTION_PAYLOAD resulted in
adding a migration blocker. This was because when the code was written
it was thought there is no way to reliably know if a vCPU is utilising
VMX or not at runtime. However, it turns out that this can be known to
some extent:

In order for a vCPU to enter VMX operation it must have CR4.VMXE set.
Since it was set, CR4.VMXE must remain set as long as the vCPU is in
VMX operation. This is because CR4.VMXE is one of the bits set
in MSR_IA32_VMX_CR4_FIXED1.
There is one exception to the above statement when vCPU enters SMM mode.
When a vCPU enters SMM mode, it temporarily exits VMX operation and
may also reset CR4.VMXE during execution in SMM mode.
When the vCPU exits SMM mode, vCPU state is restored to be in VMX operation
and CR4.VMXE is restored to its original state of being set.
Therefore, when the vCPU is not in SMM mode, we can infer whether
VMX is being used by examining CR4.VMXE. Otherwise, we cannot
know for certain but assume the worse that vCPU may utilise VMX.

Summaring all the above, a vCPU may have enabled VMX in case
CR4.VMXE is set or vCPU is in SMM mode.

Therefore, remove migration blocker and check before migration
(cpu_pre_save()) if the vCPU may have enabled VMX. If true, only then
require relevant kernel capabilities.

While at it, demand KVM_CAP_EXCEPTION_PAYLOAD only when the vCPU is in
guest-mode and there is a pending/injected exception. Otherwise, this
kernel capability is not required for proper migration.

Reviewed-by: default avatarJoao Martins <joao.m.martins@oracle.com>
Signed-off-by: default avatarLiran Alon <liran.alon@oracle.com>
Reviewed-by: default avatarMaran Wilson <maran.wilson@oracle.com>
Tested-by: default avatarMaran Wilson <maran.wilson@oracle.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      79a197ab
    • Peter Maydell's avatar
      Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging · 4a10982c
      Peter Maydell authored 
      
Block layer patches:

- block: Fix forbidden use of polling in drained_end
- block: Don't wait for I/O throttling while exiting QEMU
- iotests: Use read-zeroes for the null driver to be Valgrind-friendly

# gpg: Signature made Fri 19 Jul 2019 14:30:14 BST
# gpg:                using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full]
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream:
  iotests: Test quitting with job on throttled node
  vl: Drain before (block) job cancel when quitting
  iotests: Test commit with a filter on the chain
  iotests: Add @has_quit to vm.shutdown()
  block: Loop unsafely in bdrv*drained_end()
  tests: Extend commit by drained_end test
  block: Do not poll in bdrv_do_drained_end()
  tests: Lock AioContexts in test-block-iothread
  block: Make bdrv_parent_drained_[^_]*() static
  block: Add @drained_end_counter
  tests: Add job commit by drained_end test
  block: Introduce BdrvChild.parent_quiesce_counter
  iotests: Set read-zeroes on in null block driver for Valgrind

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      4a10982c
    • Peter Maydell's avatar
      Merge remote-tracking branch 'remotes/berrange/tags/misc-next-pull-request' into staging · e2b47666
      Peter Maydell authored 
      
Merge misc fixes

A collection of patches I have fixing crypto code and other pieces
without an assigned maintainer

 * Fixes crypto function signatures to be compatible with
   both old and new versions of nettle
 * Fixes deprecation warnings on new nettle
 * Fixes GPL license header typos
 * Documents security implications of monitor usage
 * Optimize linking of capstone to avoid it in tools

# gpg: Signature made Fri 19 Jul 2019 14:24:37 BST
# gpg:                using RSA key DAF3A6FDB26B62912D0E8E3FBE86EBB415104FDF
# gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>" [full]
# gpg:                 aka "Daniel P. Berrange <berrange@redhat.com>" [full]
# Primary key fingerprint: DAF3 A6FD B26B 6291 2D0E  8E3F BE86 EBB4 1510 4FDF

* remotes/berrange/tags/misc-next-pull-request:
  crypto: Fix LGPL information in the file headers
  doc: document that the monitor console is a privileged control interface
  configure: only link capstone to emulation targets
  crypto: fix function signatures for nettle 2.7 vs 3
  crypto: switch to modern nettle AES APIs

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      e2b47666
    • Thomas Huth's avatar
      crypto: Fix LGPL information in the file headers · b7cbb874
      Thomas Huth authored 
      
It's either "GNU *Library* General Public License version 2" or "GNU
Lesser General Public License version *2.1*", but there was no "version
2.0" of the "Lesser" license. So assume that version 2.1 is meant here.

Signed-off-by: default avatarThomas Huth <thuth@redhat.com>
Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
      b7cbb874
    • Daniel P. Berrangé's avatar
      doc: document that the monitor console is a privileged control interface · 4f244308
      Daniel P. Berrangé authored 
      
A supposed exploit of QEMU was recently announced as CVE-2019-12928
claiming that the monitor console was insecure because the "migrate"
command enabled arbitrary command execution for a remote attacker.

To be a security risk the user launching QEMU must have configured
the monitor in a way that allows for other users to access it. The
exploit report quoted use of the "tcp" character device backend for
QMP.

This would indeed allow any network user to connect to QEMU and
execute arbitrary commands, however, this is not a flaw in QEMU.
It is the normal expected behaviour of the monitor console and the
commands it supports. Given a monitor connection, there are many
ways to access host file system content besides the migrate command.

The reality is that the monitor console (whether QMP or HMP) is
considered a privileged interface to QEMU and as such must only
be made available to trusted users. IOW, making it available with
no authentication over TCP is simply a, very serious, user
configuration error not a security flaw in QEMU itself.

The one thing this bogus security report highlights though is that
we have not clearly documented the security implications around the
use of the monitor. Add a few paragraphs of text to the security
docs explaining why the monitor is a privileged interface and making
a recommendation to only use the UNIX socket character device backend.

Reviewed-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: default avatarAlex Bennée <alex.bennee@linaro.org>
Reviewed-by: default avatarMarkus Armbruster <armbru@redhat.com>
Reviewed-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
      4f244308
    • Hanna Reitz's avatar
      iotests: Test quitting with job on throttled node · 49278ec0
      Hanna Reitz authored 
      
When qemu quits, all throttling should be ignored.  That means, if there
is a mirror job running from a throttled node, it should be cancelled
immediately and qemu close without blocking.

Signed-off-by: default avatarMax Reitz <mreitz@redhat.com>
Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
      49278ec0