- 22 11月, 2018 6 次提交
-
-
由 Kevin Wolf 提交于
This reverts commit 5e3c0220. We have a better fix commited for this now. Signed-off-by: NKevin Wolf <kwolf@redhat.com>
-
由 Paolo Bonzini 提交于
Because the CMB BAR has a min_access_size of 2, if you read the last byte it will try to memcpy *2* bytes from n->cmbuf, causing an off-by-one error. This is CVE-2018-16847. Another way to fix this might be to register the CMB as a RAM memory region, which would also be more efficient. However, that might be a change for big-endian machines; I didn't think this through and I don't know how real hardware works. Add a basic testcase for the CMB in case somebody does this change later on. Cc: Keith Busch <keith.busch@intel.com> Cc: qemu-block@nongnu.org Reported-by: NLi Qiang <liq3ea@gmail.com> Reviewed-by: NLi Qiang <liq3ea@gmail.com> Tested-by: NLi Qiang <liq3ea@gmail.com> Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com> Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com> Tested-by: NPhilippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: NKevin Wolf <kwolf@redhat.com>
-
由 Igor Druzhinin 提交于
When blk_flush called in NVMe reset path S/C queues are already freed which means that re-entering AIO handling loop having some IO requests unfinished will lockup or crash as their SG structures being potentially reused. Call blk_drain before freeing the queues to avoid this nasty scenario. Signed-off-by: NIgor Druzhinin <igor.druzhinin@citrix.com> Acked-by: NPaolo Bonzini <pbonzini@redhat.com> Signed-off-by: NKevin Wolf <kwolf@redhat.com>
-
由 Daniel P. Berrangé 提交于
The first qemu-io command must honour the $IMGFMT that is set rather than hardcoding qcow2. The qemu-nbd commands should also set $IMGFMT to avoid the insecure format probe warning. Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com> Signed-off-by: NKevin Wolf <kwolf@redhat.com>
-
由 Alberto Garcia 提交于
Commit e35bdc12 added the auto-read-only option and the code to update its corresponding flag in update_flags_from_options(), but forgot to clear the flag if auto-read-only is false. Signed-off-by: NAlberto Garcia <berto@igalia.com> Reported-by: NMax Reitz <mreitz@redhat.com> Signed-off-by: NKevin Wolf <kwolf@redhat.com>
-
由 Richard W.M. Jones 提交于
Commit 40dce4ee "scsi-disk: fix rerror/werror=ignore" introduced a bug which causes qemu to crash with the assertion error below if the host file or disk returns an error: qemu-system-x86_64: hw/scsi/scsi-bus.c:1374: scsi_req_complete: Assertion `req->status == -1' failed. Kevin Wolf suggested this fix: < kwolf> Hm, should the final return false; in that patch actually be a return true? < kwolf> Because I think he didn't intend to change anything except BLOCK_ERROR_ACTION_IGNORE Buglink: https://bugs.launchpad.net/qemu/+bug/1804323 Fixes: 40dce4eeSigned-off-by: NRichard W.M. Jones <rjones@redhat.com> Signed-off-by: NKevin Wolf <kwolf@redhat.com>
-
- 21 11月, 2018 6 次提交
-
-
由 Max Reitz 提交于
create_opts was leaked here. This is not too bad since the process is about to exit anyway, but relying on that does not make the code nicer to read. Fixes: d402b6a2Reported-by: NKevin Wolf <kwolf@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: NMax Reitz <mreitz@redhat.com> Reviewed-by: NJohn Snow <jsnow@redhat.com> Signed-off-by: NKevin Wolf <kwolf@redhat.com>
-
由 Max Reitz 提交于
Fixes: d402b6a2Reported-by: NKevin Wolf <kwolf@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: NMax Reitz <mreitz@redhat.com> Reviewed-by: NJohn Snow <jsnow@redhat.com> Signed-off-by: NKevin Wolf <kwolf@redhat.com>
-
由 Eric Blake 提交于
The use of TLS while building qemu is optional. While the 'certtool' binary should be available on every platform that supports building against TLS, that does not imply that the developer has installed it. Make the test gracefully skip in that case. Reported-by: NKevin Wolf <kwolf@redhat.com> Signed-off-by: NEric Blake <eblake@redhat.com> Reviewed-by: NJohn Snow <jsnow@redhat.com> Reviewed-by: NDaniel P. Berrangé <berrange@redhat.com> Reviewed-by: NWainer dos Santos Moschetta <wainersm@redhat.com> Signed-off-by: NKevin Wolf <kwolf@redhat.com>
-
由 Kevin Wolf 提交于
TestCase.assertEquals() is deprecated since Python 2.7. Recent Python versions print a warning when the function is called, which makes test cases fail. Replace it with the preferred spelling assertEqual(). Signed-off-by: NKevin Wolf <kwolf@redhat.com> Reviewed-by: NJohn Snow <jsnow@redhat.com> Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com>
-
由 Kevin Wolf 提交于
time.clock() is deprecated since Python 3.3. Current Python versions warn that the function will be removed in Python 3.8, and those warnings make the test case 118 fail. Replace it with the Timeout mechanism that is compatible with both Python 2 and 3, and makes the code even a little nicer. Signed-off-by: NKevin Wolf <kwolf@redhat.com> Reviewed-by: NJohn Snow <jsnow@redhat.com> Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com>
-
由 Peter Maydell 提交于
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
- 20 11月, 2018 23 次提交
-
-
由 Peter Maydell 提交于
pc-*-3.1 machine-types # gpg: Signature made Tue 20 Nov 2018 13:43:24 GMT # gpg: using RSA key 2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/x86-for-3.1-pull-request: hw/i386: add pc-i440fx-3.1 & pc-q35-3.1 Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 Marc-André Lureau 提交于
We have a couple of PC_COMPAT_3_0, so we should have 3.1 PC machines, and update the 3.0 machines to make use of those. Fixes a "Known issue" from https://wiki.qemu.org/Planning/3.1. Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Reviewed-by: NEduardo Habkost <ehabkost@redhat.com> Reviewed-by: NIgor Mammedov <imammedo@redhat.com> Message-Id: <20181120132604.22854-1-marcandre.lureau@redhat.com> Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
-
由 Peter Maydell 提交于
Fixes yet another use-after-free issue that could be triggered by a misbehaving guest. This is a follow-up to commit: commit 5b76ef50 Author: Greg Kurz <groug@kaod.org> Date: Wed Nov 7 01:00:04 2018 +0100 9p: write lock path in v9fs_co_open2() # gpg: Signature made Tue 20 Nov 2018 12:01:07 GMT # gpg: using RSA key 71D4D5E5822F73D6 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Gregory Kurz <gregory.kurz@free.fr>" # gpg: aka "[jpeg image of size 3330]" # Primary key fingerprint: B482 8BAF 9431 40CE F2A3 4910 71D4 D5E5 822F 73D6 * remotes/gkurz/tags/for-upstream: 9p: take write lock on fid path updates (CVE-2018-19364) Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 Greg Kurz 提交于
Recent commit 5b76ef50 fixed a race where v9fs_co_open2() could possibly overwrite a fid path with v9fs_path_copy() while it is being accessed by some other thread, ie, use-after-free that can be detected by ASAN with a custom 9p client. It turns out that the same can happen at several locations where v9fs_path_copy() is used to set the fid path. The fix is again to take the write lock. Fixes CVE-2018-19364. Cc: P J P <ppandit@redhat.com> Reported-by: Nzhibin hu <noirfate@gmail.com> Reviewed-by: NPrasad J Pandit <pjp@fedoraproject.org> Signed-off-by: NGreg Kurz <groug@kaod.org>
-
由 Peter Maydell 提交于
- One additional simple qmp-test - A fix for ide-test - Add logging of QEMU parameters in libqtest # gpg: Signature made Tue 20 Nov 2018 10:47:12 GMT # gpg: using RSA key 2ED9D774FE702DB5 # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" # gpg: aka "Thomas Huth <thuth@redhat.com>" # gpg: aka "Thomas Huth <huth@tuxfamily.org>" # gpg: aka "Thomas Huth <th.huth@posteo.de>" # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * remotes/huth-gitlab/tags/pull-request-2018-11-20: qtest: log QEMU command line tests/ide: Free pcibus when finishing a test tests: add qmp/missing-any-arg test Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 Peter Maydell 提交于
seabios: update to 1.12-final # gpg: Signature made Tue 20 Nov 2018 06:01:21 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/seabios-1.12-20181120-pull-request: update seabios to 1.12 Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 Paolo Bonzini 提交于
Record the command line that was used to start QEMU. This can be useful for debugging. Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com> Reviewed-by: NLaurent Vivier <lvivier@redhat.com> [thuth: removed trailing \n from the message string] Signed-off-by: NThomas Huth <thuth@redhat.com>
-
由 Gerd Hoffmann 提交于
Seabios 1.12 has been released yesterday. Update our snapshot builds to the final release. git shortlog ============ Kevin O'Connor (2): shadow: Rework bios copy code to prevent gcc array-bounds warning docs: Note v1.12.0 release Shmuel Eiderman (1): pvscsi: Scan all 64 possible targets Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
由 Thomas Huth 提交于
Once a test has finished, the pcibus structure should be freed, to avoid leaking memory and to make sure that the structure is properly re-initialized when the next test starts. Reviewed-by: NEric Blake <eblake@redhat.com> Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: NJohn Snow <jsnow@redhat.com> Signed-off-by: NThomas Huth <thuth@redhat.com>
-
由 Marc-André Lureau 提交于
test_qmp_missing_any_arg() is about a bug in infrastructure used by the QMP core, fixed in commit c4897802. We covered the bug in infrastructure unit tests (commit bce3035a). Let's test it at the QMP level as well. Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: NThomas Huth <thuth@redhat.com> Reviewed-by: NMarkus Armbruster <armbru@redhat.com> [thuth: Tweaked the commit message according to Markus' suggestion] Signed-off-by: NThomas Huth <thuth@redhat.com>
-
由 Peter Maydell 提交于
nbd patches for 2018-11-19 Add iotest coverage for NBD connections using TLS, including a couple of code fixes that it pointed out - Mao Zhongyi: 0/3 Do some cleaning work in qemu-iotests - Daniel P. Berrangé: io: return 0 for EOF in TLS session read after shutdown - Daniel P. Berrangé: 0/6 Misc fixes to NBD - Eric Blake: iotests: Drop use of bash keyword 'function' # gpg: Signature made Mon 19 Nov 2018 17:43:32 GMT # gpg: using RSA key A7A16B4A2527436A # gpg: Good signature from "Eric Blake <eblake@redhat.com>" # gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" # gpg: aka "[jpeg image of size 6874]" # Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A * remotes/ericb/tags/pull-nbd-2018-11-19: iotests: Drop use of bash keyword 'function' iotests: Also test I/O over NBD TLS tests: exercise NBD server in TLS mode tests: add iotests helpers for dealing with TLS certificates tests: check if qemu-nbd is still alive before waiting tests: pull qemu-nbd iotest helpers into common.nbd file io: return 0 for EOF in TLS session read after shutdown nbd/server: Ignore write errors when replying to NBD_OPT_ABORT nbd: fix whitespace in server error message qemu-iotests: Modern shell scripting (use $() instead of ``) qemu-iotests: convert `pwd` and $(pwd) to $PWD qemu-iotests: remove unused variable 'here' Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 Eric Blake 提交于
Bash allows functions to be declared with or without the leading keyword 'function'; but including the keyword does not comply with POSIX syntax, and is confusing to ksh users where the use of the keyword changes the scoping rules for functions. Stick to the POSIX form through iotests. Done mechanically with: sed -i 's/^function //' $(git ls-files tests/qemu-iotests) Signed-off-by: NEric Blake <eblake@redhat.com> Message-Id: <20181116215002.2124581-1-eblake@redhat.com> Reviewed-by: NDaniel P. Berrangé <berrange@redhat.com> Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com>
-
由 Eric Blake 提交于
Enhance test 233 to also perform I/O beyond the initial handshake. Signed-off-by: NEric Blake <eblake@redhat.com> Message-Id: <20181118022403.2211483-1-eblake@redhat.com> Reviewed-by: NDaniel P. Berrangé <berrange@redhat.com>
-
由 Daniel P. Berrangé 提交于
Add tests that validate it is possible to connect to an NBD server running TLS mode. Also test mis-matched TLS vs non-TLS connections correctly fail. Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-7-berrange@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com> Tested-by: NEric Blake <eblake@redhat.com> [eblake: rebase to iotests shell cleanups, use ss instead of socat for port probing, sanitize port number in expected output] Signed-off-by: NEric Blake <eblake@redhat.com>
-
由 Daniel P. Berrangé 提交于
Add helpers to common.tls for creating TLS certificates for a CA, server and client. Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-6-berrange@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com> [eblake: spelling and quoting touchups] Signed-off-by: NEric Blake <eblake@redhat.com>
-
由 Daniel P. Berrangé 提交于
If the qemu-nbd UNIX socket has not shown up, the tests will sleep a bit and then check again repeatedly for up to 30 seconds. This is pointless if the qemu-nbd process has quit due to an error, so check whether the pid is still alive before waiting and retrying. Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-5-berrange@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com> Signed-off-by: NEric Blake <eblake@redhat.com>
-
由 Daniel P. Berrangé 提交于
The helpers for starting/stopping qemu-nbd in 058 will be useful in other test cases, so move them into a common.nbd file. Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-4-berrange@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com> [eblake: fix shell quoting] Signed-off-by: NEric Blake <eblake@redhat.com>
-
由 Daniel P. Berrangé 提交于
GNUTLS takes a paranoid approach when seeing 0 bytes returned by the underlying OS read() function. It will consider this an error and return GNUTLS_E_PREMATURE_TERMINATION instead of propagating the 0 return value. It expects apps to arrange for clean termination at the protocol level and not rely on seeing EOF from a read call to detect shutdown. This is to harden apps against a malicious 3rd party causing termination of the sockets layer. This is unhelpful for the QEMU NBD code which does have a clean protocol level shutdown, but still relies on seeing 0 from the I/O channel read in the coroutine handling incoming replies. The upshot is that when using a plain NBD connection shutdown is silent, but when using TLS, the client spams the console with Cannot read from TLS channel: Broken pipe The NBD connection has, however, called qio_channel_shutdown() at this point to indicate that it is done with I/O. This gives the opportunity to optimize the code such that when the channel has been shutdown in the read direction, the error code GNUTLS_E_PREMATURE_TERMINATION gets turned into a '0' return instead of an error. Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com> Message-Id: <20181119134228.11031-1-berrange@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com> Signed-off-by: NEric Blake <eblake@redhat.com>
-
由 Eric Blake 提交于
Commit 37ec36f6 intentionally ignores errors when trying to reply to an NBD_OPT_ABORT request for plaintext clients, but did not make the same change for a TLS server. Since NBD_OPT_ABORT is documented as being a potential for an EPIPE when the client hangs up without waiting for our reply, we don't need to pollute the server's output with that failure. Signed-off-by: NEric Blake <eblake@redhat.com> Message-Id: <20181117223221.2198751-1-eblake@redhat.com> Reviewed-by: NDaniel P. Berrangé <berrange@redhat.com>
-
由 Daniel P. Berrangé 提交于
A space was missing after the option number was printed: Option 0x8not permitted before TLS becomes Option 0x8 not permitted before TLS This fixes commit 36683283 Author: Eric Blake <eblake@redhat.com> Date: Fri Oct 14 13:33:09 2016 -0500 nbd: Send message along with server NBD_REP_ERR errors Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com> Message-Id: <20181116155325.22428-2-berrange@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com> [eblake: move lone space to next line] Signed-off-by: NEric Blake <eblake@redhat.com>
-
由 Mao Zhongyi 提交于
Various shell files contain a mix between obsolete `` and modern $(); It would be nice to convert to using $() everywhere. For now, just do the qemu-iotests directory. Cc: kwolf@redhat.com Cc: mreitz@redhat.com Cc: eblake@redhat.com Suggested-by: NEric Blake <eblake@redhat.com> Signed-off-by: NMao Zhongyi <maozhongyi@cmss.chinamobile.com> Message-Id: <20181024094051.4470-4-maozhongyi@cmss.chinamobile.com> Reviewed-by: NEric Blake <eblake@redhat.com> [eblake: tweak commit message] Signed-off-by: NEric Blake <eblake@redhat.com>
-
由 Mao Zhongyi 提交于
POSIX requires $PWD to be reliable, and we expect all shells used by qemu scripts to be relatively close to POSIX. Thus, it is smarter to avoid forking the pwd executable for something that is already available in the environment. So replace it with the following: sed -i 's/\(`pwd`\|\$(pwd)\)/$PWD/g' $(git grep -l pwd) Then delete a pointless line assigning PWD to itself. Cc: kwolf@redhat.com Cc: mreitz@redhat.com Cc: eblake@redhat.com Suggested-by: NEric Blake <eblake@redhat.com> Signed-off-by: NMao Zhongyi <maozhongyi@cmss.chinamobile.com> Message-Id: <20181024094051.4470-2-maozhongyi@cmss.chinamobile.com> Reviewed-by: NEric Blake <eblake@redhat.com> [eblake: touch up commit message, reorder series, tweak a couple more files] Signed-off-by: NEric Blake <eblake@redhat.com>
-
由 Mao Zhongyi 提交于
Running git grep '\$here' tests/qemu-iotests has 0 hits, which means we are setting a variable that has no use. It appears that commit e8f8624d removed the last use. So execute the following cmd to remove all of the 'here=...' lines as dead code. sed -i '/^here=/d' $(git grep -l '^here=' tests/qemu-iotests) Cc: kwolf@redhat.com Cc: mreitz@redhat.com Cc: eblake@redhat.com Suggested-by: NEric Blake <eblake@redhat.com> Signed-off-by: NMao Zhongyi <maozhongyi@cmss.chinamobile.com> Message-Id: <20181024094051.4470-3-maozhongyi@cmss.chinamobile.com> Reviewed-by: NEric Blake <eblake@redhat.com> [eblake: touch up commit message, reorder series, rebase to master] Signed-off-by: NEric Blake <eblake@redhat.com>
-
- 19 11月, 2018 5 次提交
-
-
由 Peter Maydell 提交于
target-arm queue: * various MAINTAINERS file updates * hw/block/onenand: use qemu_log_mask() for reporting * hw/block/onenand: Fix off-by-one error allowing out-of-bounds read on the n800 and n810 machine models * target/arm: fix smc incorrectly trapping to EL3 when secure is off * hw/arm/stm32f205: Fix the UART and Timer region size * target/arm: read ID registers for KVM guests so they can be used to gate "is feature X present" checks # gpg: Signature made Mon 19 Nov 2018 15:56:44 GMT # gpg: using RSA key 3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20181119: MAINTAINERS: list myself as maintainer for various Arm boards hw/block/onenand: use qemu_log_mask() for reporting hw/block/onenand: Fix off-by-one error allowing out-of-bounds read target/arm: fix smc incorrectly trapping to EL3 when secure is off hw/arm/stm32f205: Fix the UART and Timer region size MAINTAINERS: Add entries for missing ARM boards target/arm: Fill in ARMISARegisters for kvm32 target/arm: Introduce read_sys_reg32 for kvm32 target/arm: Fill in ARMISARegisters for kvm64 target/arm: Install ARMISARegisters from kvm host Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 Peter Maydell 提交于
In practice for most of the more-or-less orphan Arm board models, I will review patches and put them in via the target-arm tree. So list myself as an "Odd Fixes" status maintainer for them. This commit downgrades these boards to "Odd Fixes": * Allwinner-A10 * Exynos * Calxeda Highbank * Canon DIGIC * Musicpal * nSeries * Palm * PXA2xx These boards were already "Odd Fixes": * Gumstix * i.MX31 (kzm) Philippe Mathieu-Daudé has requested to be moved to R: status for Gumstix now that I am listed as the M: contact. Some boards are maintained, but their patches still go via the target-arm tree, so add myself as a secondary maintainer contact for those: * Xilinx Zynq * Xilinx ZynqMP * STM32F205 * Netduino 2 * SmartFusion2 * Mecraft M2S-FG484 * ASPEED BMCs * NRF51 Signed-off-by: NPeter Maydell <peter.maydell@linaro.org> Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: NThomas Huth <thuth@redhat.com> Message-id: 20181108134139.31666-1-peter.maydell@linaro.org
-
由 Peter Maydell 提交于
Update the onenand device to use qemu_log_mask() for reporting guest errors and unimplemented features, rather than plain fprintf() and hw_error(). (We leave the hw_error() in onenand_reset(), as that is triggered by a failure to read the underlying block device for the bootRAM, not by guest action.) Signed-off-by: NPeter Maydell <peter.maydell@linaro.org> Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: NRichard Henderson <richard.henderson@linaro.org> Reviewed-by: NThomas Huth <thuth@redhat.com> Tested-by: NPhilippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181115143535.5885-3-peter.maydell@linaro.org
-
由 Peter Maydell 提交于
An off-by-one error in a switch case in onenand_read() allowed a misbehaving guest to read off the end of a block of memory. NB: the onenand device is used only by the "n800" and "n810" machines, which are usable only with TCG, not KVM, so this is not a security issue. Reported-by: NThomas Huth <thuth@redhat.com> Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: NRichard Henderson <richard.henderson@linaro.org> Signed-off-by: NPeter Maydell <peter.maydell@linaro.org> Message-id: 20181115143535.5885-2-peter.maydell@linaro.org Suggested-by: NRichard Henderson <richard.henderson@linaro.org> Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 Luc Michel 提交于
This commit fixes a case where the CPU would try to go to EL3 when executing an smc instruction, even though ARM_FEATURE_EL3 is false. This case is raised when the PSCI conduit is set to smc, but the smc instruction does not lead to a valid PSCI call. QEMU crashes with an assertion failure latter on because of incoherent mmu_idx. This commit refactors the pre_smc helper by enumerating all the possible way of handling an scm instruction, and covering the previously missing case leading to the crash. The following minimal test would crash before this commit: .global _start .text _start: ldr x0, =0xdeadbeef ; invalid PSCI call smc #0 run with the following command line: aarch64-linux-gnu-gcc -nostdinc -nostdlib -Wl,-Ttext=40000000 \ -o test test.s qemu-system-aarch64 -M virt,virtualization=on,secure=off \ -cpu cortex-a57 -kernel test Signed-off-by: NLuc Michel <luc.michel@greensocs.com> Message-id: 20181117160213.18995-1-luc.michel@greensocs.com Reviewed-by: NPeter Maydell <peter.maydell@linaro.org> Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-