49 Commits

Author SHA1 Message Date
Ying Fang
cc6571bce3 CVE: fix CVE-2020-11869
backport from qemu upstream:
https://git.qemu.org/?p=qemu.git;a=commit;h=ac2071c3791b67fc7af78b8ceb320c01ca1b5df7

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
f645d20455 CVE: fix CVE-2019-20175
backport patch from upstream:
https://git.qemu.org/?p=qemu.git;a=commitdiff;h=ed78352a59ea7acf7520d4d47a96b9911bae7fc3

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
b7d6ad34b1 spec: Update release version
increase release version by one

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Keqian Zhu
3e55e426e1 arm/virt: Support CPU cold plug
This adds CPU cold plug support to arm virt machine board.
CPU cold plug means adding CPU by using "-device xx-arm-cpu"
when we bring up Qemu.

Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
d2dca0b095 spec: Update release version
increase release version by one

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Leo Fang
e215d8d12a migration: fix some memleaks
Fix some memleaks for migration.

Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
3e79a91147 spec: Update release version
increase release version number by one

Singed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
288d942a68 vtimer: compat cross version migration from v4.0.1
vtimer feature was added to qemu v4.0.1 to record timer tick when vcpu
is stopped. However this feature is discared and the new virtual time
adjustment is introduced.

This patch add the missing vtimer parameter to ARMCPUState in order
to compat cross version migration fromm v4.0.1 openEuler 2003 lts release.

Singed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
a7eab953ce spec: Update release version
Increase release version number by one

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
zhengchuan
36efc4445a migration: backport migration patches from upstream
This series patches backport migration patches from upstream.
2020-06-01 09:13:39 +00:00
Keqian Zhu
1c823f0431 arm/virt: Add ACPI CPU hotplug support
This series is an attempt to provide CPU hotplug support on ARM
virt platform. This is based on ACPI GED device.

We should enable ACPI support, and use vGICv3 and 64bit CPU to
support CPU hotplug.

Under KVM accel, the KVM vCPUs is pre-created. Besides, vGIC IRIs
is pre-created too. However, QEMU vCPU objects are defer-created.

Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
2020-06-01 09:13:39 +00:00
Keqian Zhu
d01be9927c ARM virt: ACPI memory hotplug support
This series is an attempt to provide device memory hotplug support
on ARM virt platform. This is based on Eric's recent works here[1]
and carries some of the pc-dimm related patches dropped from his
series.

The kernel support for arm64 memory hot add was added recently by
Robin and hence the guest kernel should be => 5.0-rc1.

NVDIM support is not included currently as we still have an unresolved
issue while hot adding NVDIMM[2]. However NVDIMM cold plug patches
can be included, but not done for now, for keeping it simple.

This makes use of GED device to sent hotplug ACPI events to the
Guest. GED code is based on Nemu. Thanks to the efforts of Samuel and
Sebastien to add the hardware-reduced support to Nemu using GED
device[3]. (Please shout if I got the author/signed-off wrong for
those patches or missed any names).

This is sanity tested on a HiSilicon ARM64 platform and appreciate
any further testing.

Note:
Attempted adding dimm_pxm test case to bios-tables-test for arm/virt.
But noticed the issue decribed here[5]. This is under investigation
now.

upstream url: https://patchwork.kernel.org/cover/11150345/

Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
0b93ee990c spec: Update release version
Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
976278e59b target/arm/kvm: Adjust virtual time
v3:
 - Added a target/arm/kvm_arm.h comment cleanup patch (1/6)
 - Minor refactoring of assert_has_feature_enabled/disabled in 4/6,
   kept Richard's r-b.
 - Rewrote kvm-no-adjvtime documentation in 6/6.
 - Reworked approach in 5/6 to properly deal with migration and to
   track running vs. !running, rather than running vs. paused states.

v2:
 - Reworked it enough that I brought back the RFC tag and retitled the
   series. Also had to drop r-b's from a couple of patches, and even
   drop patches.
 - Changed approach from writing the QEMU virtual time to the guest
   vtime counter to saving and restoring the guest vtime counter.
 - Changed the kvm-adjvtime property, which was off by default, to a
   kvm-no-adjvtime property, which is also off by default, meaning the
   effective "adjust vtime" property is now on by default (but only
   for 5.0 virt machine types and later)

v1:
 - move from RFC status to v1
 - put kvm_arm_vm_state_change() in kvm.c to share among kvm32.c and kvm64.c
 - add r-b's from Richard

This series is inspired by a series[1] posted by Bijan Mottahedeh over
a year ago and by the patch[2] posted by Heyi Guo almost a year ago.
The problem described in the cover letter of [1] is easily reproducible
and some users would like to have the option to avoid it. However the
solution, which is to adjust the virtual counter each time the VM
transitions to the running state, introduces a different problem, which
is that the virtual and physical counters diverge. As described in the
cover letter of [1] this divergence is easily observed when comparing
the output of `date` and `hwclock` after suspending the guest, waiting
a while, and then resuming it. Because this different problem may actually
be worse for some users, unlike [1], the series posted here makes the
virtual counter adjustment optional. Besides the adjustment being
optional, this series approaches the needed changes differently to apply
them in more appropriate locations.

Additional notes
----------------

Note 1
------

As described above, when running a guest with kvm-no-adjtime disabled
it will be less likely the guest OS and guest applications get surprise
time jumps when they use the virtual counter.  However the counter will
no longer reflect real time.  It will lag behind.  If this is a problem
then the guest can resynchronize its time from an external source or
even from its physical counter.  If the suspend/resume is done with
libvirt's virsh, and the guest is running the guest agent, then it's
also possible to use a sequence like this

 $ virsh suspend $GUEST
 $ virsh resume $GUEST
 $ virsh domtime --sync $GUEST

in order to resynchronize a guest right after the resume.  Of course
there will still be time when the clock is not right, possibly creating
confusing timestamps in logs, for example, and the guest must still be
tolerant to the time synchronizations.

Note 2
------

Userspace that wants to set KVM_REG_ARM_TIMER_CNT should beware that
the KVM register ID is not correct.  This cannot be fixed because it's
UAPI and if the UAPI headers are used then it can't be a problem.
However, if a userspace attempts to create the ID themselves from the
register's specification, then they will get KVM_REG_ARM_TIMER_CVAL
instead, as the _CNT and _CVAL definitions have their register
parameters swapped.

Note 3
------

I didn't test this with a 32-bit KVM host, but the changes to kvm32.c
are the same as kvm64.c. So what could go wrong? Test results would be
appreciated.

[1] https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg05713.html
[2] https://lists.gnu.org/archive/html/qemu-devel/2019-03/msg03695.html

upstream url:
https://patchwork.kernel.org/cover/11341629/
2020-06-01 09:13:39 +00:00
Ying Fang
5b01d214e0 spec: Add release number by one
Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
1e4b6553e3 Backport: backport form upstream stable v4.1.1
This patch backports bugfix patch series from qemu upstream v4.1.1

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
cbfda6760e Rebase qemu to 4.1.0 version
Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:38 +00:00
Pan Nengyuan
9750247ab0 nbd: backport nbd fix from qemu upstream
-nbd: Fix regression with multiple meta contexts

Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
2020-06-01 09:13:36 +00:00
Ying Fang
8f8df3ea84 slirp: Fix CVE-2020-1983
upstream url:
9bd6c59132

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:36 +00:00
Ying Fang
e21eae0df2 async: Fix qemu main thread hang on weak ordered platfrom
aio-wait: delegate polling of main AioContext if BQL not held
upstream_url: https://patchwork.kernel.org/patch/11482099/

async: use explicit memory barriers
upstream_url: https://patchwork.kernel.org/patch/11482103/

Signed-off-by: Ying Fang <fanging1@huawei.com>
2020-06-01 09:13:36 +00:00
Ying Fang
c8a00f8f2a Revert "util/async: Add memory barrier to aio_ctx_prepare"
This reverts commit 6777b03eafa348f6075dd47aae4e9f4b8f568a26.
2020-06-01 09:12:52 +00:00
Ying Fang
7fe3d42afc Revert "Revert: "util/async: Add memory barrier to aio_ctx_prepare""
This reverts commit 5d7a2bee1d7ec33794b43d974b1435a7d8b6fdd8.
2020-06-01 09:12:28 +00:00
Ying Fang
7d5d99c2eb Revert "async: Fix qemu main thread hang on weak ordered platfrom"
This reverts commit 97ccfe792b24f1fd56ae051d6d1f7bef67f6b732.
2020-06-01 09:12:15 +00:00
Ying Fang
76977afd22 Revert "nbd: backport nbd fix from qemu upstream"
This reverts commit 5b079d4c976ab1108b38e4727db067193c722407.
2020-06-01 09:12:03 +00:00
Leo Fang
5b079d4c97 nbd: backport nbd fix from qemu upstream
-nbd: Fix regression with multiple meta contexts

Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
2020-04-15 14:53:39 +08:00
Ying Fang
97ccfe792b async: Fix qemu main thread hang on weak ordered platfrom
aio-wait: delegate polling of main AioContext if BQL not held
upstream_url: https://patchwork.kernel.org/patch/11482099/

async: use explicit memory barriers
upstream_url: https://patchwork.kernel.org/patch/11482103/

Signed-off-by: Ying Fang <fanging1@huawei.com>
2020-04-11 00:28:01 +08:00
Ying Fang
5d7a2bee1d Revert: "util/async: Add memory barrier to aio_ctx_prepare"
This reverts commit 6777b03eafa348f6075dd47aae4e9f4b8f568a26

This fix picked from https://lists.gnu.org/archive/html/qemu-devel/2020-04/msg00204.html
was incomplete to fix the qemu-img hang problem.

Let's revert it and use upstream patch picked from Paolo Bonzini
https://patchwork.kernel.org/patch/11482099/
https://patchwork.kernel.org/patch/11482103/

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-04-10 17:47:50 +08:00
Ying Fang
6777b03eaf util/async: Add memory barrier to aio_ctx_prepare
Qemu main thread is found to hang up in the mainloop when doing
image format convert on aarch64 platform and it is highly
reproduceable by executing test using:

qemu-img convert -f qcow2 -O qcow2 origin.qcow2 converted.qcow2

This mysterious hang can be explained by a race condition between
the main thread and an io worker thread. There can be a chance that
the last worker thread has called aio_bh_schedule_oneshot and it is
checking against notify_me to deliver a notfiy event. At the same
time, the main thread is calling aio_ctx_prepare however it first
calls qemu_timeout_ns_to_ms, thus the worker thread did not see
notify_me as true and did not send a notify event. The time line
can be shown in the following way:

 Main Thread
 ------------------------------------------------
 aio_ctx_prepare
    atomic_or(&ctx->notify_me, 1);
    /* out of order execution goes here */
    *timeout = qemu_timeout_ns_to_ms(aio_compute_timeout(ctx));

 Worker Thread
 -----------------------------------------------
 aio_bh_schedule_oneshot -> aio_bh_enqueue
    aio_notify
    	smp_mb();
       	if (ctx->notify_me) {   /* worker thread checks notify_me here */
            event_notifier_set(&ctx->notifier);
            atomic_mb_set(&ctx->notified, true);
       }

Normal VM runtime is not affected by this hang since there is always some
timer timeout or subsequent io worker come and notify the main thead.
To fix this problem, a memory barrier is added to aio_ctx_prepare and
it is proved to have the hang fixed in our test.

This hang is not observed on the x86 platform however it can be easily
reproduced on the aarch64 platform, thus it is architecture related.
Not sure if this is revelant to Commit eabc977973103527bbb8fed69c91cfaa6691f8ab

Signed-off-by: Ying Fang <fangying1@huawei.com>
Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
Reported-by: Euler Robot <euler.robot@huawei.com>
2020-04-02 16:13:58 +08:00
Leo Fang
b3ccd965a7 pcie: Add pcie-root-port deivce fast plug/unplug feature
If a device is plugged in the pcie-root-port when VM kernel is
booting, the kernel may wrongly disable the device.
This bug was brought in by two patches of the linux kernel:

https://patchwork.kernel.org/patch/10575355/
https://patchwork.kernel.org/patch/10766219/

VM runtime like kata uses this feature to boot microVM,
so we must fix it up. We hack into the pcie native hotplug
patch so that hotplug/unplug will work under this circumstance.

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-03-18 17:27:28 +08:00
zhanghailiang
79d0c59389 spec: include linuxboot_dma.bin and pvh.bin in x86 package
linuxboot_dma.bin will be used by kata. Let's put it back
into x86 package.

Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
2020-03-17 16:48:40 +08:00
Ying Fang
db47ea85b4 qemu: backport some bug fixing patches from upstream
We backport some bug fixing patches form qemu-stable-4.1.1
branch of upstream.

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-03-16 22:39:17 +08:00
Chen Qun
f2082b3f2f fix some issue for monitor and iscsi
block/iscsi: use MIN() between mx_sb_len and sb_len_wr
monitor: fix memory leak in monitor_fdset_dup_fd_find_remove

Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
2020-03-16 15:59:10 +08:00
Ying Fang
9b341be807 slirp: Fix libslirp CVE-2020-8608
Picked from libslirp upstream:

tcp_emu: fix unsafe snprintf() usages
68ccb8021a

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-03-12 15:37:08 +08:00
Ying Fang
fb21ed7696 slirp: Fix libslirp CVE-2020-7039
Picked from libslirp upstream:

tcp_emu: Fix oob access
2655fffed7

slirp: use correct size while emulating IRC commands
ce131029d6

slirp: use correct size while emulating commands
82ebe9c370

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-03-12 15:34:32 +08:00
Ying Fang
046e9d4f2c spec: Fix patch number mismatch
Patch numbers are mismatched when QEMU is rebased from v4.0.0 to v4.0.1,
this patch is introduced to have it fixed.

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-03-10 10:35:50 +08:00
Ying Fang
b047726c50 iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711)
Pick patch from upstream to fix CVE-2020-1711
upstream url:
https://git.qemu.org/?p=qemu.git;a=commit;h=693fd2acdf14dd86c0bf852610f1c2cca80a74dc

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-03-10 10:28:53 +08:00
Ying Fang
23f09debc1 spec: Build qemu with python3 support
Python2 will reach the end of its life, it's time to build qemu
with python3 support.

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-02-26 11:00:38 +08:00
Ying Fang
e4766d9eee docs: Enable build and install of our rST docs
drop Revert-Enable-build-and-install-of-our-rST-docs.patch
to enable python-sphnix doc support.

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-02-21 18:34:23 +08:00
Ying Fang
87b139ea79 qemu: Rebase from qemu-4.0.0 to qemu-4.0.1
Rebase to qemu-4.0.1 and drop redunt patches.
Update release version info.

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-02-21 18:34:15 +08:00
Ying Fang
ac7cc5760b spec: remove patches that already been merge into 4.0.1 base line
Prepare for upgrading base package from 4.0.0 to 4.0.1.

Remove all the patches that have been contained in 4.0.1 base package.

Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
2020-02-21 18:34:08 +08:00
zhanghailiang
8116423248 spec: remove fno-inline option
fno-inline option is need by hot-patch, but we didn't support
hot-patch in this version, remove it.

Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
2020-02-06 10:08:20 +08:00
wsp1991
7374cb0f9c block: fix memleaks in bdrv_refresh_filename
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
2020-01-16 18:15:23 +08:00
xuding
ed0d368182 Fix some memory leak in qemu
Signed-off-by: Ying Fang <fangying1@huawei.com>
Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
2020-01-13 20:40:08 +08:00
Ying Fang
eb23f6e929 There is a possible memory leak while local_link return -1 without free odirpath and oname.
Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-01-13 16:38:01 +08:00
zhanghailiang
928b70e2d1 Arm: Backport patches from upstream to support more than 256 vcpus
Without this serial, we can't start VM with more than 256 vcpus,
this is limited by kvm API, backport this serial to fix the bug.

With this patches, it can supports up to 512 vcpus.

Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
2020-01-06 14:42:24 +08:00
dogsheng
5b4fe89268 Package init 2019-12-25 16:06:27 +08:00
dogsheng
42fef5c34b Package init 2019-12-13 16:06:06 +08:00
zhuchunyi
f0229b47e9 update code 2019-11-06 19:50:55 +08:00
overweight
9a683b2a29 Package init 2019-09-30 11:15:46 -04:00