Re: [Qemu-devel] [PATCH v3 13/22] memory-device: complete factoring out unplug handling

2018-09-25 Thread David Hildenbrand
On 24/09/2018 16:18, Igor Mammedov wrote: > On Thu, 20 Sep 2018 12:32:34 +0200 > David Hildenbrand wrote: > >> With the new memory device functions in place, we can factor out >> unplugging of memory devices completely. >> >> Signed-off-by: David Hildenbrand >> --- >> hw/mem/memory-device.c

Re: [Qemu-devel] Fuzzing

2018-09-25 Thread Alex Bennée
Catena cyber writes: > Hi qemu people, > > My name is Philippe Antoine. > I am writing here after Stefan has asked me to. > > I have been integrating some projects with oss-fuzz. > And The latest is unicorn-engine, which is based on some version of the code > from qemu. > > You can take a

[Qemu-devel] [PULL v2 0/5] Linux user for 3.1 patches

2018-09-25 Thread Laurent Vivier
The following changes since commit 19b599f7664b2ebfd0f405fb79c14dd241557452: Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2018-08-27-v2' into staging (2018-08-27 16:44:20 +0100) are available in the Git repository at: git://github.com/vivier/qemu.git

Re: [Qemu-devel] [PATCH 2/2] hw/pci-host/x86: extend the 64-bit PCI hole relative to the fw-assigned base

2018-09-25 Thread Michael S. Tsirkin
On Tue, Sep 25, 2018 at 09:07:45PM +0300, Marcel Apfelbaum wrote: > Hi Laszlo, > > On 9/25/18 1:13 AM, Laszlo Ersek wrote: > > In commit 9fa99d2519cb ("hw/pci-host: Fix x86 Host Bridges 64bit PCI > > hole", 2017-11-16), we meant to expose such a 64-bit PCI MMIO aperture in > > the ACPI DSDT that

Re: [Qemu-devel] [PATCH 2/2] hw/pci-host/x86: extend the 64-bit PCI hole relative to the fw-assigned base

2018-09-25 Thread Laszlo Ersek
On 09/25/18 22:36, Alex Williamson wrote: > On Tue, 25 Sep 2018 00:13:46 +0200 > Laszlo Ersek wrote: > >> In commit 9fa99d2519cb ("hw/pci-host: Fix x86 Host Bridges 64bit PCI >> hole", 2017-11-16), we meant to expose such a 64-bit PCI MMIO aperture in >> the ACPI DSDT that would be at least as

Re: [Qemu-devel] [PATCH v3 14/22] memory-device: trace when pre_assigning/assigning/unassigning addresses

2018-09-25 Thread David Hildenbrand
On 24/09/2018 15:54, Igor Mammedov wrote: > On Thu, 20 Sep 2018 12:32:35 +0200 > David Hildenbrand wrote: > >> Let's trace the address when pre_pluggin/plugging/unplugging a memory device. >> >> Trace it when pre_plugging as well as when plugging, so we really know >> when a specific address is

Re: [Qemu-devel] [PATCH] cpus: fix TCG timer leak

2018-09-25 Thread Alex Bennée
Marc-André Lureau writes: > Spotted by ASAN: > > QTEST_QEMU_BINARY=x86_64-softmmu/qemu-system-x86_64 tests/bios-tables-test > -p /x86_64/acpi/piix4/cpuhp > /x86_64/acpi/piix4/cpuhp: Could not access KVM kernel module: No such file or > directory > qemu-system-x86_64: failed to initialize

[Qemu-devel] [PULL v2 4/5] linux-user: write(fd, NULL, 0) parity with linux's treatment of same

2018-09-25 Thread Laurent Vivier
From: Tony Garnock-Jones Bring linux-user write(2) handling into line with linux for the case of a 0-byte write with a NULL buffer. Based on a patch originally written by Zhuowei Zhang. Addresses https://bugs.launchpad.net/qemu/+bug/1716292. >From Zhuowei Zhang's patch

[Qemu-devel] [PULL v2 1/5] linux-user: move TargetFdTrans functions to their own file

2018-09-25 Thread Laurent Vivier
This will ease to move out syscall functions from syscall.c Signed-off-by: Laurent Vivier Reviewed-by: Richard Henderson Message-Id: <2018082315.13781-1-laur...@vivier.eu> --- linux-user/Makefile.objs |2 +- linux-user/fd-trans.c| 1409 +

Re: [Qemu-devel] [PATCH 28/35] exec: access cpu->interrupt_request with atomics

2018-09-25 Thread Emilio G. Cota
On Wed, Sep 19, 2018 at 11:18:48 -0700, Richard Henderson wrote: > On 9/19/18 10:02 AM, Paolo Bonzini wrote: > > On 18/09/2018 23:07, Richard Henderson wrote: > >> On 9/17/18 9:30 AM, Emilio G. Cota wrote: > >>> From: Paolo Bonzini > >>> > >>> Cc: Peter Crosthwaite > >>> Cc: Richard Henderson >

Re: [Qemu-devel] [PATCH v3 16/22] memory-device: add optional function get_device_id()

2018-09-25 Thread David Hildenbrand
On 24/09/2018 16:40, Igor Mammedov wrote: > On Thu, 20 Sep 2018 12:32:37 +0200 > David Hildenbrand wrote: > >> When reporting the id of virtio-based memory devices, we always have to >> take the one of the proxy device (parent), not the one of the memory >> device directly. >> >> Let's

[Qemu-devel] Fuzzing

2018-09-25 Thread Catena cyber
Hi qemu people, My name is Philippe Antoine. I am writing here after Stefan has asked me to. I have been integrating some projects with oss-fuzz. And The latest is unicorn-engine, which is based on some version of the code from qemu. You can take a look at

[Qemu-devel] [PULL v2 2/5] linux-user: add SO_LINGER to {g, s}etsockopt

2018-09-25 Thread Laurent Vivier
From: Carlo Marcelo Arenas Belón Original implementation for setsockopt by Chen Gang[1]; all bugs mine, including removing assignment for optname which hopefully makes the logic easier to follow and moving some variables to make the code more selfcontained. [1]

[Qemu-devel] [PULL v2 5/5] linux-user: do setrlimit selectively

2018-09-25 Thread Laurent Vivier
From: Max Filippov setrlimit guest calls that affect memory resources (RLIMIT_{AS,DATA,STACK}) may interfere with QEMU internal memory management. They may result in QEMU lockup because mprotect call in page_unprotect would fail with ENOMEM error code, causing infinite loop of SIGSEGV. E.g. it

[Qemu-devel] [PULL v2 3/5] linux-user: elf: mmap all the target-pages of hostpage for data segment

2018-09-25 Thread Laurent Vivier
From: Shivaprasad G Bhat If the hostpage size is greater than the TARGET_PAGESIZE, the target-pages of size TARGET_PAGESIZE are marked valid only till the length requested during the elfload. The glibc attempts to consume unused space in the last page of data segment(__libc_memalign() in

Re: [Qemu-devel] [PATCH v3 15/22] hw/acpi-build: only indicate nvdimm and pc-dimm

2018-09-25 Thread David Hildenbrand
On 24/09/2018 16:22, Igor Mammedov wrote: > On Thu, 20 Sep 2018 12:32:36 +0200 > David Hildenbrand wrote: > >> Once we have other memory devices that are not ACPI devices (e.g. >> virtio based), we cannot indicate them via ACPI. So let's skip these >> devices. >> >> Signed-off-by: David

Re: [Qemu-devel] [PATCH 2/2] hw/pci-host/x86: extend the 64-bit PCI hole relative to the fw-assigned base

2018-09-25 Thread Alex Williamson
On Tue, 25 Sep 2018 00:13:46 +0200 Laszlo Ersek wrote: > In commit 9fa99d2519cb ("hw/pci-host: Fix x86 Host Bridges 64bit PCI > hole", 2017-11-16), we meant to expose such a 64-bit PCI MMIO aperture in > the ACPI DSDT that would be at least as large as the new "pci-hole64-size" > property (2GB

Re: [Qemu-devel] [PATCH 1/2] object: recommend a few type check macros

2018-09-25 Thread Eduardo Habkost
On Fri, Sep 21, 2018 at 03:13:31PM +0400, Marc-André Lureau wrote: > I sometime regret that we have to resort to long > object{_class}_dynamic_cast() calls instead of having a shorter and > more readable macros available, similar to the one recommended by > GObject

[Qemu-devel] [PULL 14/14] 40p: add fixed IRQ routing for LSI SCSI device

2018-09-25 Thread David Gibson
From: Mark Cave-Ayland Whilst the PReP specification describes how all PCI IRQs are routed via IRQ 15 on the interrupt controller, the real 40p machine has a routing quirk in that the LSI SCSI device is routed directly to IRQ 13. Enable the external IRQ for the LSI SCSI device by wiring up the

[Qemu-devel] [PULL 08/14] spapr_pci: add an extra 'nr_msis' argument to spapr_populate_pci_dt

2018-09-25 Thread David Gibson
From: Cédric Le Goater So that we don't have to call qdev_get_machine() to get the machine class and the sPAPRIrq backend holding the number of MSIs. Signed-off-by: Cédric Le Goater Reviewed-by: Greg Kurz Signed-off-by: David Gibson --- hw/ppc/spapr.c | 2 +- hw/ppc/spapr_pci.c

[Qemu-devel] [PULL 00/14] ppc-for-3.1 queue 20180925

2018-09-25 Thread David Gibson
-20180925 for you to fetch changes up to 0358687b16407670f09649dfdc079c04a3522493: 40p: add fixed IRQ routing for LSI SCSI device (2018-09-25 11:12:25 +1000) ppc patch queue 2018-09-25 Here are the accumulated ppc target patches

[Qemu-devel] [PULL 02/14] target/ppc/cpu-models: Re-group the 970 CPUs together again

2018-09-25 Thread David Gibson
From: Thomas Huth The addition of the POWER9 CPUs divided the entries for the 970 CPUs, which is a little bit confusing when you look at the code. So let's re-group the 970 CPUs together again, and since these chips have been based on the POWER4 processor, move them also in front of the POWER5

Re: [Qemu-devel] [PATCH v2 1/3] linux-user: Check for Linux USBFS in configure

2018-09-25 Thread Laurent Vivier
Le 25/09/2018 à 09:12, Cortland Tölva a écrit : > In preparation for adding user mode emulation support for the > Linux usbfs interface, check for its kernel header. > > Signed-off-by: Cortland Tölva > --- > > v2 patch uses check_include instead of doing things by hand. > > configure | 12

Re: [Qemu-devel] QEMU and Kconfig

2018-09-25 Thread Thomas Huth
On 2018-09-24 11:21, Samuel Ortiz wrote: > Hi All, > > It seems that back in 2013, Paolo tried to start a GSoC project [1] > aimed at integrating Kconfig into QEMU and use it as its main > configuration framework. > > I personally think that the rationale described in this GSoC project > is

[Qemu-devel] [PULL 5/5] linux-user: do setrlimit selectively

2018-09-25 Thread Laurent Vivier
From: Max Filippov setrlimit guest calls that affect memory resources (RLIMIT_{AS,DATA,STACK}) may interfere with QEMU internal memory management. They may result in QEMU lockup because mprotect call in page_unprotect would fail with ENOMEM error code, causing infinite loop of SIGSEGV. E.g. it

[Qemu-devel] [PULL 0/5] Linux user for 3.1 patches

2018-09-25 Thread Laurent Vivier
The following changes since commit 19b599f7664b2ebfd0f405fb79c14dd241557452: Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2018-08-27-v2' into staging (2018-08-27 16:44:20 +0100) are available in the Git repository at: git://github.com/vivier/qemu.git

[Qemu-devel] [PATCH] migration: fix the compression code

2018-09-25 Thread Fei Li
Add judgement in compress_threads_save_cleanup() to check whether the static CompressParam *comp_param has been allocated. If not, just return; or else segmentation fault will occur when using the NULL comp_param's parameters. One test case can reproduce this is: set the compression on and

Re: [Qemu-devel] [PATCH v3 8/9] x86_iommu/amd: Add interrupt remap support when VAPIC is enabled

2018-09-25 Thread Peter Xu
On Fri, Sep 21, 2018 at 02:25:42PM +, Singh, Brijesh wrote: [...] > +static int amdvi_int_remap_ga(AMDVIState *iommu, > + MSIMessage *origin, > + MSIMessage *translated, > + uint64_t *dte, > +

[Qemu-devel] [PULL 10/14] scsi: add lsi53c8xx_handle_legacy_cmdline() function

2018-09-25 Thread David Gibson
From: Mark Cave-Ayland This is the function that will soon be used to replace lsi53c895a_create() and lsi53c810_create(). Signed-off-by: Mark Cave-Ayland Reviewed-by: Thomas Huth Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: David Gibson --- hw/scsi/lsi53c895a.c | 7 +++

Re: [Qemu-devel] [PULL 0/5] Docker patches

2018-09-25 Thread Peter Maydell
On 10 September 2018 at 04:57, Fam Zheng wrote: > The following changes since commit 19b599f7664b2ebfd0f405fb79c14dd241557452: > > Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2018-08-27-v2' > into staging (2018-08-27 16:44:20 +0100) > > are available in the Git repository at:

[Qemu-devel] [PATCH v3 5/5] display/stdvga: add edid support.

2018-09-25 Thread Gerd Hoffmann
This patch adds edid support to the qemu stdvga. It is turned off by default and can be enabled with the new edid property. The patch also adds xres and yres properties to specify the video mode you want the guest use. Works only with edid enabled and updated guest driver. The mmio bar of the

[Qemu-devel] [PATCH v3 0/5] hw/display: add edid support to stdvga

2018-09-25 Thread Gerd Hoffmann
This series adds edid support to stdvga. The biggest chunk is the actual edid generator code (patch #1). Some helper functions follow, and the final patch implements edid support for stdvga. v3: - generate more complete EDID blob. - codestyle fixes. - add MAINTAINER entry. Gerd Hoffmann

Re: [Qemu-devel] [PULL 00/12] Migration queue

2018-09-25 Thread Peter Maydell
On 13 September 2018 at 13:53, Juan Quintela wrote: > The following changes since commit 19b599f7664b2ebfd0f405fb79c14dd241557452: > > Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2018-08-27-v2' > into staging (2018-08-27 16:44:20 +0100) > > are available in the Git repository

Re: [Qemu-devel] [PATCH] hw/arm/virt-acpi-build: Add a check for memory-less NUMA nodes

2018-09-25 Thread Peter Maydell
On 11 September 2018 at 12:26, Shannon Zhao wrote: > From: Shannon Zhao > > Like commit 16b4226(hw/acpi-build: Add a check for memory-less NUMA node > ), it also needs to check memory length for NUMA nodes on ARM. > > Signed-off-by: Shannon Zhao > --- > hw/arm/virt-acpi-build.c | 10 ++

Re: [Qemu-devel] [PATCH risu] ppc64.risu: Fix pattern for darn

2018-09-25 Thread Peter Maydell
On 6 September 2018 at 07:51, Sandipan Das wrote: > This fixes the pattern for the Deliver A Random Number (darn) > instruction to ensure that the value of the L field, which is > used to determine the type and length of the generated random > number, is never 3 which is currently reserved for

Re: [Qemu-devel] [PATCH v11 1/9] qcow2: Options' documentation fixes

2018-09-25 Thread Alberto Garcia
On Tue 25 Sep 2018 12:53:49 AM CEST, Leonid Bloch wrote: > Signed-off-by: Leonid Bloch Reviewed-by: Alberto Garcia Berto

[Qemu-devel] [PATCH v2 1/3] linux-user: Check for Linux USBFS in configure

2018-09-25 Thread Cortland Tölva
In preparation for adding user mode emulation support for the Linux usbfs interface, check for its kernel header. Signed-off-by: Cortland Tölva --- v2 patch uses check_include instead of doing things by hand. configure | 12 +++- 1 file changed, 11 insertions(+), 1 deletion(-) diff

[Qemu-devel] [PULL 12/14] scsi: remove unused lsi53c895a_create() and lsi53c810_create() functions

2018-09-25 Thread David Gibson
From: Mark Cave-Ayland Now that these functions are no longer required they can be removed. Signed-off-by: Mark Cave-Ayland Reviewed-by: Thomas Huth Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: David Gibson --- hw/scsi/lsi53c895a.c | 14 -- include/hw/pci/pci.h | 2 -- 2

[Qemu-devel] [PATCH v3 1/5] display/edid: add edid generator to qemu.

2018-09-25 Thread Gerd Hoffmann
EDID is a metadata format to describe monitors. On physical hardware the monitor has an eeprom with that data block which can be read over i2c bus. On a linux system you can usually find the EDID data block in /sys/class/drm/$card/$connector/edid. xorg ships a edid-decode utility which you can

[Qemu-devel] [PATCH v3 3/5] display/edid: add region helper.

2018-09-25 Thread Gerd Hoffmann
Create a io region for an EDID data block. Signed-off-by: Gerd Hoffmann Reviewed-by: Philippe Mathieu-Daudé --- include/hw/display/edid.h | 4 hw/display/edid-region.c | 33 + hw/display/Makefile.objs | 1 + 3 files changed, 38 insertions(+) create

[Qemu-devel] [PATCH v3 2/5] display/edid: add qemu_edid_size()

2018-09-25 Thread Gerd Hoffmann
Helper function to figure the size of a edid blob, by checking how many extensions are present. Both the base edid blob and the extensions are 128 bytes in size. Signed-off-by: Gerd Hoffmann --- include/hw/display/edid.h | 1 + hw/display/edid-generate.c | 14 ++ 2 files changed,

Re: [Qemu-devel] [PATCH v6 10/25] replay: introduce breakpoint at the specified step

2018-09-25 Thread Kashyap Chamarthy
On Mon, Sep 24, 2018 at 08:44:07PM +0200, Markus Armbruster wrote: [...] > Remind me, why would rST be an improvement? Relatively easy on the eye, more maintainable, active community around the Sphinx tooling / extensions, not extremely arcane syntax (besides some weird quirks), etc. Take a

[Qemu-devel] [PATCH rebased 1/2] monitor: guard iothread access by mon->use_io_thread

2018-09-25 Thread Wolfgang Bumiller
monitor_resume() and monitor_suspend() both want to "kick" the I/O thread if it is there, but in monitor_suspend() lacked the use_io_thread flag condition. This is required when we later only spawn the thread on first use. Signed-off-by: Wolfgang Bumiller Reviewed-by: Eric Blake Reviewed-by:

[Qemu-devel] [PATCH rebased 0/2] delay monitor iothread creation

2018-09-25 Thread Wolfgang Bumiller
The early monitor iothread creation conflicts with the -daemonize option causing crashes at shutdown of a daemonized qemu instance. These patches will delay the creation to when a monitor using it is actually spawned, which AFAICT only happens after the os_daemonize() call. While the second patch

[Qemu-devel] [PATCH rebased 2/2] monitor: delay monitor iothread creation

2018-09-25 Thread Wolfgang Bumiller
Commit d32749deb615 moved the call to monitor_init_globals() to before os_daemonize(), making it an unsuitable place to spawn the monitor iothread as it won't be inherited over the fork() in os_daemonize(). We now spawn the thread the first time we instantiate a monitor which actually has

Re: [Qemu-devel] [PATCH v5 6/8] target/mips: Define the R5900 CPU

2018-09-25 Thread Maciej W. Rozycki
On Mon, 24 Sep 2018, Philippe Mathieu-Daudé wrote: > >> >From the DS: > >> > >> The C790 core has the following features: > >>- Large on-chip caches > >> • Instruction cache: 32KB, 2-way set associative > >> • Data cache: 32KB, 2-way set-associative (with write-back protocol) > >> >

[Qemu-devel] [PULL 4/5] linux-user: write(fd, NULL, 0) parity with linux's treatment of same

2018-09-25 Thread Laurent Vivier
From: Tony Garnock-Jones Bring linux-user write(2) handling into line with linux for the case of a 0-byte write with a NULL buffer. Based on a patch originally written by Zhuowei Zhang. Addresses https://bugs.launchpad.net/qemu/+bug/1716292. >From Zhuowei Zhang's patch

Re: [Qemu-devel] [PATCH v3 3/9] x86_iommu/amd: remove V=1 check from amdvi_validate_dte()

2018-09-25 Thread Peter Xu
On Fri, Sep 21, 2018 at 02:25:37PM +, Singh, Brijesh wrote: > Currently, the amdvi_validate_dte() assumes that a valid DTE will > always have V=1. This is not true. The V=1 means that bit[127:1] are > valid. A valid DTE can have IV=1 and V=0 (i.e address translation > disabled and interrupt

Re: [Qemu-devel] [PATCH v3 6/9] x86_iommu/amd: Add interrupt remap support when VAPIC is not enabled

2018-09-25 Thread Peter Xu
On Fri, Sep 21, 2018 at 02:25:40PM +, Singh, Brijesh wrote: > Emulate the interrupt remapping support when guest virtual APIC is > not enabled. > > For more info Refer: AMD IOMMU spec Rev 3.0 - section 2.2.5.1 > > When VAPIC is not enabled, it uses interrupt remapping as defined in > Table

[Qemu-devel] [PULL 05/14] 40p: use OR gate to wire up raven PCI interrupts

2018-09-25 Thread David Gibson
From: Mark Cave-Ayland According to the PReP specification section 6.1.6 "System Interrupt Assignments", all PCI interrupts are routed via IRQ 15. Instead of mapping each PCI IRQ separately, we introduce an OR gate within the raven PCI host bridge and then wire the single output of the OR gate

[Qemu-devel] [PULL 03/14] hw/ppc: on 40p machine, change default firmware to OpenBIOS

2018-09-25 Thread David Gibson
From: Hervé Poussineau OpenBIOS gained 40p support in 5b20e4cacecb62fb2bdc6867c11d44cddd77c4ff Use it, instead of relying on an unmaintained and very limited firmware. Signed-off-by: Hervé Poussineau Signed-off-by: David Gibson --- hw/ppc/prep.c| 2 +- tests/boot-serial-test.c |

[Qemu-devel] [PULL 06/14] spapr: introduce a spapr_irq class 'nr_msis' attribute

2018-09-25 Thread David Gibson
From: Cédric Le Goater The number of MSI interrupts a sPAPR machine can allocate is in direct relation with the number of interrupts of the sPAPRIrq backend. Define statically this value at the sPAPRIrq class level and use it for the "ibm,pe-total-#msi" property of the sPAPR PHB. According to

[Qemu-devel] [PULL 07/14] spapr: increase the size of the IRQ number space

2018-09-25 Thread David Gibson
From: Cédric Le Goater The new layout using static IRQ number does not leave much space to the dynamic MSI range, only 0x100 IRQ numbers. Increase the total number of IRQS for newer machines and introduce a legacy XICS backend for pre-3.1 machines to maintain compatibility. For the old backend,

[Qemu-devel] [PULL 04/14] raven: some minor IRQ-related tidy-ups

2018-09-25 Thread David Gibson
From: Mark Cave-Ayland This really lays the groundwork for the upcoming patches: it renames the irqs PREPPCIState struct member to pci_irqs (as soon there will be a distinction) and then changes the raven IRQ opaque to use PREPPCIState instead of just irqs array. Signed-off-by: Mark Cave-Ayland

[Qemu-devel] [PULL 09/14] sm501: Adjust endianness of pixel value in rectangle fill

2018-09-25 Thread David Gibson
From: Marcus Comstedt The value from twoD_foreground (which is in host endian format) must be converted to the endianness of the framebuffer (currently always little endian) before it can be used to perform the fill operation. Signed-off-by: Marcus Comstedt Reviewed-by: BALATON Zoltan

[Qemu-devel] [PATCH v2 2/3] linux-user: Define ordinary usbfs ioctls.

2018-09-25 Thread Cortland Tölva
Provide ioctl definitions for the generic thunk mechanism to convert most usbfs calls. Signed-off-by: Cortland Tölva --- v2 patch lacks some types that are not used until patch 3/3 linux-user/ioctls.h| 38 linux-user/syscall.c | 3 +++

Re: [Qemu-devel] [PULL 0/7] pci, pc, virtio: fixes, features

2018-09-25 Thread Peter Maydell
On 7 September 2018 at 22:51, Michael S. Tsirkin wrote: > The following changes since commit 19b599f7664b2ebfd0f405fb79c14dd241557452: > > Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2018-08-27-v2' > into staging (2018-08-27 16:44:20 +0100) > > are available in the Git

[Qemu-devel] [PATCH 1/4] ne2000: fix possible out of bound access in ne2000_receive

2018-09-25 Thread Jason Wang
In ne2000_receive(), we try to assign size_ to size which converts from size_t to integer. This will cause troubles when size_ is greater INT_MAX, this will lead a negative value in size and it can then pass the check of size < MIN_BUF_SIZE which may lead out of bound access of for both buf and

[Qemu-devel] [PATCH 0/4] Fix buffer overflow for packet greater than INT_MAX

2018-09-25 Thread Jason Wang
Hi: This series tries to address the buffer overflow caused by converting from size_t to int in several nic model and net core. This is CVE-2018-10839. Please review. Thanks Jason Wang (4): ne2000: fix possible out of bound access in ne2000_receive rtl8139: fix possible out of bound access

[Qemu-devel] [PATCH 2/4] rtl8139: fix possible out of bound access

2018-09-25 Thread Jason Wang
In rtl8139_do_receive(), we try to assign size_ to size which converts from size_t to integer. This will cause troubles when size_ is greater INT_MAX, this will lead a negative value in size and it can then pass the check of size < MIN_BUF_SIZE which may lead out of bound access of for both buf

[Qemu-devel] [PATCH 3/4] pcnet: fix possible buffer overflow

2018-09-25 Thread Jason Wang
In pcnet_receive(), we try to assign size_ to size which converts from size_t to integer. This will cause troubles when size_ is greater INT_MAX, this will lead a negative value in size and it can then pass the check of size < MIN_BUF_SIZE which may lead out of bound access for both buf and buf1.

[Qemu-devel] [PATCH v3 4/5] display/edid: add DEFINE_EDID_PROPERTIES

2018-09-25 Thread Gerd Hoffmann
Add a define for edid monitor properties. Signed-off-by: Gerd Hoffmann --- include/hw/display/edid.h | 4 1 file changed, 4 insertions(+) diff --git a/include/hw/display/edid.h b/include/hw/display/edid.h index b7fe56a958..bd51d26916 100644 --- a/include/hw/display/edid.h +++

[Qemu-devel] [PULL 2/5] linux-user: add SO_LINGER to {g, s}etsockopt

2018-09-25 Thread Laurent Vivier
From: Carlo Marcelo Arenas Belón Original implementation for setsockopt by Chen Gang[1]; all bugs mine, including removing assignment for optname which hopefully makes the logic easier to follow and moving some variables to make the code more selfcontained. [1]

Re: [Qemu-devel] [PULL 0/6] Usb 20180917 patches

2018-09-25 Thread Peter Maydell
On 17 September 2018 at 10:56, Gerd Hoffmann wrote: > The following changes since commit 19b599f7664b2ebfd0f405fb79c14dd241557452: > > Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2018-08-27-v2' > into staging (2018-08-27 16:44:20 +0100) > > are available in the git repository

Re: [Qemu-devel] [Bug 1791947] Re: isochronous usb device forwarding with windows 10 and xhci freezes

2018-09-25 Thread Sameeh Jubran
How exactly do you use USB redirection: via virt-manager or via spice client (like remote viewer)? If via spice-client, on which OS the client runs? In this case running it with --spice-debug and collecting logs from stdio and stderr could be helpful. Can you also provide a usbpcap capture of the

Re: [Qemu-devel] [Qemu-block] [PATCH 2/2] MAINTAINERS: Remove myself as block maintainer

2018-09-25 Thread Niels de Vos
On Tue, Sep 25, 2018 at 01:32:04PM +0800, Fam Zheng wrote: > On Tue, 09/25 07:00, Markus Armbruster wrote: > > Jeff Cody writes: > > > > > I'll not be involved in day-to-day qemu development. Remove > > > myself as maintainer from the remainder of the network block drivers > > > (and vhdx), and

Re: [Qemu-devel] [PULL 00/12] Migration queue

2018-09-25 Thread Thomas Huth
On 2018-09-25 10:26, Peter Maydell wrote: > On 13 September 2018 at 13:53, Juan Quintela wrote: >> The following changes since commit 19b599f7664b2ebfd0f405fb79c14dd241557452: >> >> Merge remote-tracking branch >> 'remotes/armbru/tags/pull-error-2018-08-27-v2' into staging (2018-08-27 >>

Re: [Qemu-devel] [PATCH] migration: fix QEMUFile leak

2018-09-25 Thread Dr. David Alan Gilbert
* Marc-André Lureau (marcandre.lur...@redhat.com) wrote: > Spotted by ASAN while running: > > $ tests/migration-test -p /x86_64/migration/postcopy/recovery > > = > ==18034==ERROR: LeakSanitizer: detected memory leaks > > Direct

Re: [Qemu-devel] [PATCH v6 10/25] replay: introduce breakpoint at the specified step

2018-09-25 Thread Peter Maydell
On 25 September 2018 at 10:40, Paolo Bonzini wrote: > However, we currently have the worst of both worlds. We have a manual > in Texinfo that almost nobody updates (except for the small parts that > are generated from .hx files in the code) and sparse documentation > written in a mix of rST,

[Qemu-devel] [PULL 11/14] scsi: move lsi53c8xx_create() callers to lsi53c8xx_handle_legacy_cmdline()

2018-09-25 Thread David Gibson
From: Mark Cave-Ayland As part of commits a64aa5785d "hw: Deprecate -drive if=scsi with non-onboard HBAs" and b891538e81 "hw/ppc/prep: Fix implicit creation of "-drive if=scsi" devices" the lsi53c895a_create() and lsi53c810_create() functions were added to wrap pci_create_simple() and

[Qemu-devel] [PULL 01/14] Record history of ppcemb target in common.json

2018-09-25 Thread David Gibson
From: Thomas Huth We recently removed the long deprecated "ppcemb" target. This adds a comment in common.json about the SysEmuTarget type, recording when it was removed. Suggested-by: Eric Blake Signed-off-by: David Gibson --- qapi/common.json | 2 ++ 1 file changed, 2 insertions(+) diff

Re: [Qemu-devel] [PATCH v2 2/3] linux-user: Define ordinary usbfs ioctls.

2018-09-25 Thread Laurent Vivier
Le 25/09/2018 à 09:12, Cortland Tölva a écrit : > Provide ioctl definitions for the generic thunk mechanism to > convert most usbfs calls. > > Signed-off-by: Cortland Tölva > --- > > v2 patch lacks some types that are not used until patch 3/3 > > linux-user/ioctls.h| 38

[Qemu-devel] [PATCH 4/4] net: ignore packet size greater than INT_MAX

2018-09-25 Thread Jason Wang
There should not be a reason for passing a packet size greater than INT_MAX. It's usually a hint of bug somewhere, so ignore packet size greater than INT_MAX in qemu_deliver_packet_iov() CC: qemu-sta...@nongnu.org Reported-by: Daniel Shapira Signed-off-by: Jason Wang --- net/net.c | 7 ++-

Re: [Qemu-devel] [PATCH 2/2] MAINTAINERS: Remove myself as block maintainer

2018-09-25 Thread Markus Armbruster
Fam Zheng writes: > On Tue, 09/25 07:00, Markus Armbruster wrote: >> Jeff Cody writes: >> >> > I'll not be involved in day-to-day qemu development. Remove >> > myself as maintainer from the remainder of the network block drivers >> > (and vhdx), and revert them to the general block layer

Re: [Qemu-devel] [PATCH 2/2] MAINTAINERS: Remove myself as block maintainer

2018-09-25 Thread Fam Zheng
On Tue, 09/25 09:37, Markus Armbruster wrote: > Do we want to have a dedicated VHDX driver submaintainer again? Fam, > you're maintaining VMDK, could you cover VHDX as well? I don't know a lot VHDX internals. Considering my capacity at the moment I'd rather not take this one. Fam

Re: [Qemu-devel] [PATCH] target/arm: Fix cpu_get_tb_cpu_flags vs !sve

2018-09-25 Thread Peter Maydell
On 24 August 2018 at 15:45, Peter Maydell wrote: > On 24 August 2018 at 15:14, Richard Henderson > wrote: >> Not only are the sve-related tb_flags fields unused when SVE is >> disabled, but not all of the cpu registers are initialized properly >> for computing same. This can corrupt other

Re: [Qemu-devel] [PATCH] hw/arm/exynos4210: fix Exynos4210 UART support

2018-09-25 Thread Peter Maydell
On 31 August 2018 at 11:23, Bartlomiej Zolnierkiewicz wrote: > commit 97274d0c05d4 ("hw/char/exynos4210_uart.c: Remove unneeded > handling of NULL chardev") broke Exynos4210 support as it removed > NULL 'Chardev *chr' handling from exynos4210_uart_create() and > currently exynos4210_init() always

[Qemu-devel] [PULL 3/5] linux-user: elf: mmap all the target-pages of hostpage for data segment

2018-09-25 Thread Laurent Vivier
From: Shivaprasad G Bhat If the hostpage size is greater than the TARGET_PAGESIZE, the target-pages of size TARGET_PAGESIZE are marked valid only till the length requested during the elfload. The glibc attempts to consume unused space in the last page of data segment(__libc_memalign() in

Re: [Qemu-devel] [PULL 0/2] qemu-sparc.for-upstream queue 20180914

2018-09-25 Thread Peter Maydell
On 14 September 2018 at 09:22, Mark Cave-Ayland wrote: > The following changes since commit 19b599f7664b2ebfd0f405fb79c14dd241557452: > > Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2018-08-27-v2' > into staging (2018-08-27 16:44:20 +0100) > > are available in the git

[Qemu-devel] [PATCH] migration: fix QEMUFile leak

2018-09-25 Thread Marc-André Lureau
Spotted by ASAN while running: $ tests/migration-test -p /x86_64/migration/postcopy/recovery = ==18034==ERROR: LeakSanitizer: detected memory leaks Direct leak of 33864 byte(s) in 1 object(s) allocated from: #0 0x7f3da7f31e50

Re: [Qemu-devel] [PATCH 01/13] target/arm: Add ARM_FEATURE_SWP

2018-09-25 Thread Peter Maydell
On 16 September 2018 at 16:53, Richard Henderson wrote: > Ah, I did not know about SWP_EMULATE. It appears to be > specific to armv7+ (though we don't support the pre-v4 > cpus for which it might otherwise be relevant). > > It does appear that HWCAP_SWP is advertised anyway: > > mm/proc-v7.S:

Re: [Qemu-devel] [PATCH v6 10/25] replay: introduce breakpoint at the specified step

2018-09-25 Thread Paolo Bonzini
On 24/09/2018 20:44, Markus Armbruster wrote: > Paolo Bonzini writes: > >> On 24/09/2018 15:12, Peter Maydell wrote: >>> It got bumped by more important things >>> and also because somebody else said they were going to look at it, >>> and then it got bumped off *their* todo list by more

Re: [Qemu-devel] [PATCH v6 10/25] replay: introduce breakpoint at the specified step

2018-09-25 Thread Peter Maydell
On 25 September 2018 at 09:58, Kashyap Chamarthy wrote: > Currently what I have is the 10 documents from the docs/ directory that > are convereted to rST (some of them are already in QEMU Git); the below > rendering is built from QEMU 3.0): >

Re: [Qemu-devel] [PATCH v2] monitor: print message when using 'help' with an unknown command

2018-09-25 Thread Dr. David Alan Gilbert
* Collin Walling (wall...@linux.ibm.com) wrote: > When typing 'help' followed by an unknown command, QEMU will > not print anything to the command line to let the user know > they typed a bad command. Let's fix this by printing a message > to the monitor when this happens. For example: > >

Re: [Qemu-devel] [PATCH 0/2] hw/net/pcnet-pci: Convert away from old_mmio accessors

2018-09-25 Thread Peter Maydell
On 4 August 2018 at 02:20, Richard Henderson wrote: > On 08/02/2018 10:40 AM, Peter Maydell wrote: >> Peter Maydell (2): >> hw/net/pcnet-pci: Convert away from old_mmio accessors >> hw/net/pcnet-pci: Unify pcnet_ioport_read/write and >> pcnet_mmio_read/write > > Reviewed-by: Richard

Re: [Qemu-devel] [PATCH 1/3] aspeed/i2c: interrupts should be cleared by software only

2018-09-25 Thread Cédric Le Goater
On 09/25/2018 12:15 PM, Peter Maydell wrote: > On 25 September 2018 at 10:12, Cédric Le Goater wrote: >> On 09/25/2018 11:02 AM, Peter Maydell wrote: >>> On 14 September 2018 at 07:35, Cédric Le Goater wrote: and the bus interrupt should be lowered when all interrupts have been

Re: [Qemu-devel] [PATCH v6 10/25] replay: introduce breakpoint at the specified step

2018-09-25 Thread Kashyap Chamarthy
On Tue, Sep 25, 2018 at 11:15:05AM +0100, Peter Maydell wrote: > On 25 September 2018 at 09:58, Kashyap Chamarthy wrote: > > > Currently what I have is the 10 documents from the docs/ directory that > > are convereted to rST (some of them are already in QEMU Git); the below > > rendering is

Re: [Qemu-devel] [Qemu-arm] [PATCH] target/arm: Start AArch32 CPUs with EL2 but not EL3 in Hyp mode

2018-09-25 Thread Philippe Mathieu-Daudé
On 8/23/18 3:50 PM, Peter Maydell wrote: > The ARMv8 architecture defines that an AArch32 CPU starts > in SVC mode, unless EL2 is the highest available EL, in > which case it starts in Hyp mode. (In ARMv7 a CPU with EL2 > but not EL3 was not a valid configuration, but we don't > specifically

Re: [Qemu-devel] [PATCH 2/2] hw/arm/smmuv3: fix eventq recording and IRQ triggerring

2018-09-25 Thread Auger Eric
Hi Peter, On 9/25/18 12:25 PM, Peter Maydell wrote: > On 21 September 2018 at 08:01, Eric Auger wrote: >> The event queue management is broken today. Event records >> are not properly written as EVT_SET_* macro was not updating >> the actual event record. Also the event queue interrupt >> is not

Re: [Qemu-devel] [PATCH 1/3] aspeed/i2c: interrupts should be cleared by software only

2018-09-25 Thread Peter Maydell
On 25 September 2018 at 10:12, Cédric Le Goater wrote: > On 09/25/2018 11:02 AM, Peter Maydell wrote: >> On 14 September 2018 at 07:35, Cédric Le Goater wrote: >>> and the bus interrupt should be lowered when all interrupts have been >>> cleared. Also, the model does not implement correctly the

Re: [Qemu-devel] [PATCH rebased 2/2] monitor: delay monitor iothread creation

2018-09-25 Thread Peter Xu
On Tue, Sep 25, 2018 at 01:09:57PM +0200, Wolfgang Bumiller wrote: > > > On September 25, 2018 at 12:31 PM Peter Xu wrote: > > > > > > On Tue, Sep 25, 2018 at 10:15:07AM +0200, Wolfgang Bumiller wrote: > > > Commit d32749deb615 moved the call to monitor_init_globals() > > > to before

Re: [Qemu-devel] [PATCH v3 1/3] softfloat: remove float64_trunc_to_int

2018-09-25 Thread Alex Bennée
Emilio G. Cota writes: > It has not had users since f83311e476 ("target-m68k: use floatx80 > internally", 2017-06-21). > > Note that no other bit-width has floatX_trunc_to_int. > > Signed-off-by: Emilio G. Cota Reviewed-by: Alex Bennée > --- > include/fpu/softfloat.h | 1 - >

Re: [Qemu-devel] [PATCH v11 5/9] qcow2: Assign the L2 cache relatively to the image size

2018-09-25 Thread Alberto Garcia
On Tue 25 Sep 2018 12:53:53 AM CEST, Leonid Bloch wrote: > Now, the L2 cache assignment is aware of the virtual size of the > image, and will cover the entire image, unless the cache size needed > for that is larger than a certain maximum. This maximum is set to 1 MB > by default (enough to cover

Re: [Qemu-devel] [PATCH v2 06/11] aspeed/smc: fix default read value

2018-09-25 Thread Peter Maydell
On 21 September 2018 at 17:19, Cédric Le Goater wrote: > 0x should be returned for non implemented registers. > > Also, Use of "Also" in a commit message often indicates that it would be better to split the commit. The two changes here don't seem to me to have much to do with each other.

Re: [Qemu-devel] [PATCH 0/2] ARM SMMUv3: Fix event queue handling and memory region names

2018-09-25 Thread Peter Maydell
On 21 September 2018 at 08:01, Eric Auger wrote: > This series fixes the event queue handling: the events were incorrectly > recorded and the interrupt was not sent as expected. > > Also we fix the IOMMU memory region names. This last issue is minor as > names only are used for debug/tracing.

Re: [Qemu-devel] [PATCH] migration: fix the compression code

2018-09-25 Thread Peter Xu
On Tue, Sep 25, 2018 at 05:14:40PM +0800, Fei Li wrote: > Add judgement in compress_threads_save_cleanup() to check whether the > static CompressParam *comp_param has been allocated. If not, just > return; or else segmentation fault will occur when using the NULL > comp_param's parameters. One

Re: [Qemu-devel] [PATCH] migration: fix QEMUFile leak

2018-09-25 Thread Peter Xu
On Tue, Sep 25, 2018 at 10:37:38AM +0100, Dr. David Alan Gilbert wrote: > * Marc-André Lureau (marcandre.lur...@redhat.com) wrote: > > Spotted by ASAN while running: > > > > $ tests/migration-test -p /x86_64/migration/postcopy/recovery > > > >

Re: [Qemu-devel] [PATCH rebased 2/2] monitor: delay monitor iothread creation

2018-09-25 Thread Wolfgang Bumiller
> On September 25, 2018 at 12:31 PM Peter Xu wrote: > > > On Tue, Sep 25, 2018 at 10:15:07AM +0200, Wolfgang Bumiller wrote: > > Commit d32749deb615 moved the call to monitor_init_globals() > > to before os_daemonize(), making it an unsuitable place to > > spawn the monitor iothread as it

Re: [Qemu-devel] [PATCH v5 6/8] target/mips: Define the R5900 CPU

2018-09-25 Thread Maciej W. Rozycki
On Tue, 25 Sep 2018, Philippe Mathieu-Daudé wrote: > >From the DS: > > The C790 core has the following features: > - Large on-chip caches > • Instruction cache: 32KB, 2-way set associative > • Data cache: 32KB, 2-way set-associative (with write-back

Re: [Qemu-devel] [PATCH v4 05/10] docs/clocks: add device's clock documentation

2018-09-25 Thread Damien Hedde
On 9/25/18 11:36 AM, Peter Maydell wrote: > On 17 September 2018 at 09:40, wrote: >> From: Damien Hedde >> >> Add the documentation about the clock inputs and outputs in devices. >> >> This is based on the original work of Frederic Konrad. >> >> Signed-off-by: Damien Hedde > > I thought I

  1   2   3   4   >