qemu/include, branch master

docs: Fix some typos (found by typos) and grammar issues

2024-08-16T13:12:59Z

Fix the misspellings of "overriden" also in code comments. Signed-off-by: Stefan Weil Reviewed-by: Peter Maydell Message-Id: <20240813125638.395461-1-sw@weilnetz.de> Reviewed-by: Peter Xu Reviewed-by: Eric Auger Signed-off-by: Alex Bennée Message-Id: <20240813202329.1237572-20-alex.bennee@linaro.org>

Revert "replay: stop us hanging in rr_wait_io_event"

2024-08-16T13:04:19Z

This reverts commit 1f881ea4a444ef36a8b6907b0b82be4b3af253a2. That commit causes reverse_debugging.py test failures, and does not seem to solve the root cause of the problem x86-64 still hangs in record/replay tests. The problem with short-cutting the iowait that was taken during record phase is that related events will not get consumed at the same points (e.g., reading the clock). A hang with zero icount always seems to be a symptom of an earlier problem that has caused the recording to become out of synch with the execution and consumption of events by replay. Acked-by: Alex Bennée Signed-off-by: Nicholas Piggin Message-Id: <20240813050638.446172-6-npiggin@gmail.com> Signed-off-by: Alex Bennée Message-Id: <20240813202329.1237572-14-alex.bennee@linaro.org>

replay: allow runstate shutdown->running when replaying trace

2024-08-16T13:04:19Z

When replaying a trace, it is possible to go from shutdown to running with a reverse-debugging step. This can be useful if the problem being debugged triggers a reset or shutdown. This can be tested by making a recording of a machine that shuts down, then using -action shutdown=pause when replaying it. Continuing to the end of the trace then reverse-stepping in gdb crashes due to invalid runstate transition. Just permitting the transition seems to be all that's necessary for reverse-debugging to work well in such a state. Reviewed-by: Alex Bennée Reviewed-by: Pavel Dovgalyuk Signed-off-by: Nicholas Piggin Message-Id: <20240813050638.446172-5-npiggin@gmail.com> Signed-off-by: Alex Bennée Message-Id: <20240813202329.1237572-13-alex.bennee@linaro.org>

arm/virt: place power button pin number on a define

2024-08-12T10:40:16Z

Having magic numbers inside the code is not a good idea, as it is error-prone. So, instead, create a macro with the number definition. Link: https://lore.kernel.org/qemu-devel/CAFEAcA-PYnZ-32MRX+PgvzhnoAV80zBKMYg61j2f=oHaGfwSsg@mail.gmail.com/ Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Jonathan Cameron Reviewed-by: Igor Mammedov Message-id: ef0e7f5fca6cd94eda415ecee670c3028c671b74.1723121692.git.mchehab+huawei@kernel.org Suggested-by: Peter Maydell Reviewed-by: Jonathan Cameron Reviewed-by: Igor Mammedov Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell

include: Fix typo in name of MAKE_IDENTFIER macro

2024-08-09T16:37:54Z

In commit bb71846325e23 we added some macro magic to avoid variable-shadowing when using some of our more complicated macros. One of the internal components of this is a macro named MAKE_IDENTFIER. Fix the typo in its name: it should be MAKE_IDENTIFIER. Commit created with sed -i -e 's/MAKE_IDENTFIER/MAKE_IDENTIFIER/g' include/qemu/*.h include/qapi/qmp/qobject.h Signed-off-by: Peter Maydell Reviewed-by: Markus Armbruster Reviewed-by: Philippe Mathieu-Daudé Message-id: 20240801102516.3843780-1-peter.maydell@linaro.org

nbd/server: CVE-2024-7409: Cap default max-connections to 100

2024-08-08T21:02:23Z

Allowing an unlimited number of clients to any web service is a recipe for a rudimentary denial of service attack: the client merely needs to open lots of sockets without closing them, until qemu no longer has any more fds available to allocate. For qemu-nbd, we default to allowing only 1 connection unless more are explicitly asked for (-e or --shared); this was historically picked as a nice default (without an explicit -t, a non-persistent qemu-nbd goes away after a client disconnects, without needing any additional follow-up commands), and we are not going to change that interface now (besides, someday we want to point people towards qemu-storage-daemon instead of qemu-nbd). But for qemu proper, and the newer qemu-storage-daemon, the QMP nbd-server-start command has historically had a default of unlimited number of connections, in part because unlike qemu-nbd it is inherently persistent until nbd-server-stop. Allowing multiple client sockets is particularly useful for clients that can take advantage of MULTI_CONN (creating parallel sockets to increase throughput), although known clients that do so (such as libnbd's nbdcopy) typically use only 8 or 16 connections (the benefits of scaling diminish once more sockets are competing for kernel attention). Picking a number large enough for typical use cases, but not unlimited, makes it slightly harder for a malicious client to perform a denial of service merely by opening lots of connections withot progressing through the handshake. This change does not eliminate CVE-2024-7409 on its own, but reduces the chance for fd exhaustion or unlimited memory usage as an attack surface. On the other hand, by itself, it makes it more obvious that with a finite limit, we have the problem of an unauthenticated client holding 100 fds opened as a way to block out a legitimate client from being able to connect; thus, later patches will further add timeouts to reject clients that are not making progress. This is an INTENTIONAL change in behavior, and will break any client of nbd-server-start that was not passing an explicit max-connections parameter, yet expects more than 100 simultaneous connections. We are not aware of any such client (as stated above, most clients aware of MULTI_CONN get by just fine on 8 or 16 connections, and probably cope with later connections failing by relying on the earlier connections; libvirt has not yet been passing max-connections, but generally creates NBD servers with the intent for a single client for the sake of live storage migration; meanwhile, the KubeSAN project anticipates a large cluster sharing multiple clients [up to 8 per node, and up to 100 nodes in a cluster], but it currently uses qemu-nbd with an explicit --shared=0 rather than qemu-storage-daemon with nbd-server-start). We considered using a deprecation period (declare that omitting max-parameters is deprecated, and make it mandatory in 3 releases - then we don't need to pick an arbitrary default); that has zero risk of breaking any apps that accidentally depended on more than 100 connections, and where such breakage might not be noticed under unit testing but only under the larger loads of production usage. But it does not close the denial-of-service hole until far into the future, and requires all apps to change to add the parameter even if 100 was good enough. It also has a drawback that any app (like libvirt) that is accidentally relying on an unlimited default should seriously consider their own CVE now, at which point they are going to change to pass explicit max-connections sooner than waiting for 3 qemu releases. Finally, if our changed default breaks an app, that app can always pass in an explicit max-parameters with a larger value. It is also intentional that the HMP interface to nbd-server-start is not changed to expose max-connections (any client needing to fine-tune things should be using QMP). Suggested-by: Daniel P. Berrangé Signed-off-by: Eric Blake Message-ID: <20240807174943.771624-12-eblake@redhat.com> Reviewed-by: Daniel P. Berrangé [ericb: Expand commit message to summarize Dan's argument for why we break corner-case back-compat behavior without a deprecation period] Signed-off-by: Eric Blake

nbd/server: Plumb in new args to nbd_client_add()

2024-08-08T20:05:27Z

Upcoming patches to fix a CVE need to track an opaque pointer passed in by the owner of a client object, as well as request for a time limit on how fast negotiation must complete. Prepare for that by changing the signature of nbd_client_new() and adding an accessor to get at the opaque pointer, although for now the two servers (qemu-nbd.c and blockdev-nbd.c) do not change behavior even though they pass in a new default timeout value. Suggested-by: Vladimir Sementsov-Ogievskiy Signed-off-by: Eric Blake Message-ID: <20240807174943.771624-11-eblake@redhat.com> Reviewed-by: Daniel P. Berrangé [eblake: s/LIMIT/MAX_SECS/ as suggested by Dan] Signed-off-by: Eric Blake

Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into staging

2024-08-06T21:09:37Z

Block layer patches - scsi-block: Fix error handling with r/werror=stop - Depend on newer clang for TSA, make WITH_GRAPH_RDLOCK_GUARD() fully checked, fix block-copy to add missing lock - vvfat: Fix write bugs for large files and add iotests - Clean up blockdev-snapshot-internal-sync doc - Fix iotests 024 for qed # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmayag4RHGt3b2xmQHJl # ZGhhdC5jb20ACgkQfwmycsiPL9Y0yhAArDpKYNsOmJerL/abIetchJ84suuR2MHZ # iziAsTXk1iiSNYrAfXyiGhMsovvApluW1bojB80XLjaWFeN76zCRq0bnYVhv/xeX # bQddC4JyWkcYGmdASiFpvQ7+p37jBh+OebmxsF557s4uM6b0/QN1xnOyyjBpyJbB # aBTNgUYaTXmD6RD8h9SscnroNqhckuv6+zm0SX2Z4wRTF2uEmVWdL2yz2I3P8G7W # dhVfgOCYQmW0cSfTueBQJClaUoHyJeibd4TzHR12hFAKIYobXMGfcE3AhfpBvO3t # 0SEQ5MUx3zasGVENSJA6UnzVnpHl8HRtdDIFhSWb6yZJJ6RPPGynj7UVvFOK1SXM # iXzj1kcYzFO/AFO3JxkSr6IHZdzZr4e5wtuFbw8Je6Ai0P5prc53jBDovtbAT0Wt # +dAP7cnntYLDcAIsJqGUdr2FJfSOh9gApH/I3kF3scDwLRpb6OlWJ60T5b98VcR4 # +J67AXuGN7OXtYEU6GupZpWTQ/nZQ63egrCfJlqL67QduuF1YvcgOo2+TdAwDYkf # 8nU7AEUgzWox8EcTkof/BXYYabOjn0D6/1+aLc7J7vGGlnKVyQMK9Kn5MRBzkyb3 # iWOtuv8aoNfnxtuMnpwe/Uf2hhOGi8IldnoP2+Yb9urWnFQ3Jbbmnv8Ga7mDQmRs # ue4gDS51MCc= # =ouBM # -----END PGP SIGNATURE----- # gpg: Signature made Wed 07 Aug 2024 04:23:10 AM AEST # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf " [full] * tag 'for-upstream' of https://repo.or.cz/qemu/kevin: iotests/024: exclude 'backing file format' field from the output iotests: Add `vvfat` tests vvfat: Fix reading files with non-continuous clusters vvfat: Fix wrong checks for cluster mappings invariant vvfat: Fix usage of `info.file.offset` vvfat: Fix bug in writing to middle of file scsi-disk: Always report RESERVATION_CONFLICT to guest scsi-disk: Add warning comments that host_status errors take a shortcut scsi-block: Don't skip callback for sgio error status/driver_status scsi-disk: Use positive return value for status in dma_readv/writev block/graph-lock: Make WITH_GRAPH_RDLOCK_GUARD() fully checked block-copy: Fix missing graph lock qapi-block-core: Clean up blockdev-snapshot-internal-sync doc Signed-off-by: Richard Henderson

block/graph-lock: Make WITH_GRAPH_RDLOCK_GUARD() fully checked

2024-08-06T18:12:39Z

Upstream clang 18 (and backports to clang 17 in Fedora and RHEL) implemented support for __attribute__((cleanup())) in its Thread Safety Analysis, so we can now actually have a proper implementation of WITH_GRAPH_RDLOCK_GUARD() that understands when we acquire and when we release the lock. -Wthread-safety is now only enabled if the compiler is new enough to understand this pattern. In theory, we could have used some #ifdefs to keep the existing basic checks on old compilers, but as long as someone runs a newer compiler (and our CI does), we will catch locking problems, so it's probably not worth keeping multiple implementations for this. The implementation can't use g_autoptr any more because the glib macros define wrapper functions that don't have the right TSA attributes, so the compiler would complain about them. Just use the cleanup attribute directly instead. Signed-off-by: Kevin Wolf Message-ID: <20240627181245.281403-3-kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi Reviewed-by: Manos Pitsidianakis Signed-off-by: Kevin Wolf

hw/loongarch/virt: Replace Loongson IPI with LoongArch IPI

2024-08-06T08:22:52Z

Loongarch IPI inherits from class LoongsonIPICommonClass, and it only contains Loongarch 3A5000 virt machine specific interfaces, rather than mix different machine implementations together. Signed-off-by: Bibo Mao [PMD: Rebased] Co-Developed-by: Philippe Mathieu-Daudé Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Bibo Mao Tested-by: Bibo Mao Acked-by: Song Gao Reviewed-by: Richard Henderson Reviewed-by: Jiaxun Yang Tested-by: Jiaxun Yang Message-Id: <20240805180622.21001-14-philmd@linaro.org>