Merge tag 'pull-request-2022-10-12' of https://gitlab.com/thuth/qemu into staging

* Rework of qtests to support hot plugging tests on q35
* New VNC qtest
* Fixes related to temporary file handling i

Merge tag 'pull-request-2022-10-12' of https://gitlab.com/thuth/qemu into staging

* Rework of qtests to support hot plugging tests on q35
* New VNC qtest
* Fixes related to temporary file handling in the tests
* Use signal() instead of sigaction() since the latter does not work on Windows
* Some other small clean-ups

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmNGz1URHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbXwxxAAoh9CeYKLyPFPe71XGsSWW4mQDkny+4CA
# AFBfcEchPSyOoTJwuSHS5cL27KkL1Wy7wTSlWdcQ2Z4LA8hexopfPtCVlizH8vQh
# hHVP5KLDY7WA7bsuRznrjUjXtjLL9mExuPm3QZ+YxH/3rNhISvq1GfC9Z5PQ/zNp
# GagCW+WiFyEYyhRHJnVVTJfZV0NCbJp9KCCJ6n/Rag80JRQiouGQsKLfRoRhvkGC
# 13dWq2NeDq9xE1k1ThUZdIpUxJO4cA+9bh6LzGOIcHX8akfkryh3NGCWuojX3XDF
# 2CRyyblfjMIp5HUcKNOrQzY1oGRn8y5537ycUkEsropSMdAccIqNwlcWO7whLEGn
# 7nbogrPt8Orezytl5ZM3WopWlge5KA2vxOUURx487LnZC2/g7l2unrCDv0c3PHDb
# U2fD5do7ZtPOl9Uz8QkYPo5CzEDnKPmPv1txOMBRcBZsvmXPZMxRWwsYavB/RloG
# nI9IvG3ZW6ivKwoPPceJberL8Ndq+pqn7y4CNNAAunHSjJ2H0YS1m1F/HfVWKJYJ
# uStXy3IZ5Qo8E+IRbPYyM68yBgrnaShuAvTSax8tWjhHOR8HetrzPABMrWylCrdo
# gaeSCEZmqf2zIYHQ2q8c7U/YrHgFNHlLz9yCyM6rZtU9dOAe52PG2TlRQomlGP76
# NKnti3RJWG4=
# =4f+b
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 12 Oct 2022 10:29:41 EDT
# gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg: issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg: aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2022-10-12' of https://gitlab.com/thuth/qemu:
tests/unit/test-image-locking: Fix handling of temporary files
tests/qtest: libqtest: Install signal handler via signal()
tests/qtest: migration-test: Avoid using hardcoded /tmp
qtest: start a VNC test
tests/avocado: Add missing require_netdev('user') checks
tests/x86: Add 'q35' machine type to ivshmem-test
tests/x86: Add 'q35' machine type to drive_del-test
tests/x86: replace snprint() by g_strdup_printf() in drive_del-test
tests/x86: Fix comment typo in drive_del-test
tests/x86: Add 'q35' machine type to hotplug hd-geo-test
tests/x86: Add 'q35' machine type to override-tests in hd-geo-test
tests/x86: Refactor hot unplug hd-geo-test
tests/x86: Add subtest with 'q35' machine type to device-plug-test
tests/x86: add helper qtest_qmp_device_del_send()
tests/migration: remove the unused local variable
qtest: "-display none" is set in qtest_init()

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

show more ...

qtest: "-display none" is set in qtest_init()

So we don't need to set anywhere else.

Signed-off-by: Juan Quintela <quintela@redhat.com>
[thuth: Drop changes in tests/qtest/fuzz/ since the fuzzers s

qtest: "-display none" is set in qtest_init()

So we don't need to set anywhere else.

Signed-off-by: Juan Quintela <quintela@redhat.com>
[thuth: Drop changes in tests/qtest/fuzz/ since the fuzzers still need this]
Message-Id: <20220902165126.1482-2-quintela@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

show more ...

Merge tag 'misc-pull-request' of gitlab.com:marcandre.lureau/qemu into staging

Misc cleanups

# -----BEGIN PGP SIGNATURE-----
#
# iQJQBAABCAA6FiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmJxKjQcHG1hcmNhbmRy
# Z

Merge tag 'misc-pull-request' of gitlab.com:marcandre.lureau/qemu into staging

Misc cleanups

# -----BEGIN PGP SIGNATURE-----
#
# iQJQBAABCAA6FiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmJxKjQcHG1hcmNhbmRy
# ZS5sdXJlYXVAcmVkaGF0LmNvbQAKCRDa6OEJdZac5ZD5D/9f5CGbNsrl7kB1t6iS
# 1ABr5AeW0g9sidMCsQAe9xhWl6+R2SO/z0bBue+mv1ltG0RSZ1ZXS4FyJFBAhFfR
# fZ6J7bvdnawIKOxu5T9NY/UvthdRV0eC8CTo0q6GAJo9MHyIGvo1TOoM2Ld9QpfB
# 2uup+9fw3Clh0HSHwV9LSL7v2nucFef4A5P1CJ6d1KHnnej0hfug5o+Aiy+wDLA2
# 5RnTm44dqm9lzTgt/x4MqE6Us7WWQukjlLny8/gyurNTR+6fxLqjsHZG+6woQETu
# Gg6angsOoAFyciFZ564rjGv80qQuccMVMjtrKvBZz/cmwUUz+Lb4tU3tUPBqomGX
# wiofVtL4qcXs94OHWX654UX/iXgkRqC3r+aC0xT37cL4svC8N69BhilxI5+gIGxZ
# ZjaQhHx/0e+Ut3c+xrjYHbywQMd9L9AhRyYSMz5BNeLg9+yUiMR+hvGVR/SubLN1
# iiLS07CRgdOKdP6ts7CC7txAgDw4h3cPN5Hz+gqXMJTcnBKpXpnF1lL+Zd/J5++N
# 8qMVQH5O4REQRISsbKaOPW8PCiPESsUaHb/mWkre7iYLgkEdNMVQvRcnfx14ejbk
# /KKXolrG1huJXGQGnYvgJArHMBBL+ieIYiT6alKFNRNECLdioL46FuSOlirHVCGe
# StU22Vsl61M8ifDOPdolK55X5Q==
# =npwd
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 03 May 2022 06:12:20 AM PDT
# gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg: issuer "marcandre.lureau@redhat.com"
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full]
# gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full]

* tag 'misc-pull-request' of gitlab.com:marcandre.lureau/qemu: (23 commits)
util: rename qemu_*block() socket functions
tests: replace qemu_set_nonblock()
net: replace qemu_set_nonblock()
ui: replace qemu_set_nonblock()
hw: replace qemu_set_nonblock()
qga: replace qemu_set_nonblock()
io: replace qemu_set{_non}block()
chardev: replace qemu_set_nonblock()
io: make qio_channel_command_new_pid() static
Replace fcntl(O_NONBLOCK) with g_unix_set_fd_nonblocking()
io: replace pipe() with g_unix_open_pipe(CLOEXEC)
virtiofsd: replace pipe() with g_unix_open_pipe(CLOEXEC)
os-posix: replace pipe()+cloexec with g_unix_open_pipe(CLOEXEC)
tests: replace pipe() with g_unix_open_pipe(CLOEXEC)
qga: replace pipe() with g_unix_open_pipe(CLOEXEC)
util: replace pipe()+cloexec with g_unix_open_pipe()
Replace qemu_pipe() with g_unix_open_pipe()
block: move fcntl_setfl()
Use g_unix_set_fd_nonblocking()
libqtest: split QMP part in libqmp
...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

show more ...

tests: move libqtest.h back under qtest/

Since commit a2ce7dbd917 ("meson: convert tests/qtest to meson"),
libqtest.h is under libqos/ directory, while libqtest.c is still in
qtest/. Move back to it

tests: move libqtest.h back under qtest/

Since commit a2ce7dbd917 ("meson: convert tests/qtest to meson"),
libqtest.h is under libqos/ directory, while libqtest.c is still in
qtest/. Move back to its original location to avoid mixing with libqos/.

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>

show more ...

Merge remote-tracking branch 'remotes/kraxel/tags/vga-20210901-pull-request' into staging

vga: misc fixes and cleanups.

# gpg: Signature made Wed 01 Sep 2021 05:18:46 BST
# gpg: usin

Merge remote-tracking branch 'remotes/kraxel/tags/vga-20210901-pull-request' into staging

vga: misc fixes and cleanups.

# gpg: Signature made Wed 01 Sep 2021 05:18:46 BST
# gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/vga-20210901-pull-request:
hw/display/artist: Fix bug in coordinate extraction in artist_vram_read() and artist_vram_write()
hw/display/xlnx_dp: fix an out-of-bounds read in xlnx_dp_read
vga: don't abort when adding a duplicate isa-vga device
ui/console: Restrict udmabuf_fd() to Linux
hw/display: Restrict virtio-gpu-udmabuf stubs to !Linux
virtio-gpu: no point of checking res->iov

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw/display/xlnx_dp: fix an out-of-bounds read in xlnx_dp_read

xlnx_dp_read allows an out-of-bounds read at its default branch because
of an improper index.

According to
https://www.xilinx.com/html_

hw/display/xlnx_dp: fix an out-of-bounds read in xlnx_dp_read

xlnx_dp_read allows an out-of-bounds read at its default branch because
of an improper index.

According to
https://www.xilinx.com/html_docs/registers/ug1087/ug1087-zynq-ultrascale-registers.html
(DP Module), registers 0x3A4/0x3A4/0x3AC are allowed.

DP_INT_MASK 0x000003A4 32 mixed 0xFFFFF03F Interrupt Mask Register for intrN.
DP_INT_EN 0x000003A8 32 mixed 0x00000000 Interrupt Enable Register.
DP_INT_DS 0x000003AC 32 mixed 0x00000000 Interrupt Disable Register.

In xlnx_dp_write, when the offset is 0x3A8 and 0x3AC, the virtual device
will write s->core_registers[0x3A4
>> 2]. That is to say, the maxize of s->core_registers could be ((0x3A4
>> 2) + 1). However, the current size of s->core_registers is (0x3AF >>
>> 2), that is ((0x3A4 >> 2) + 2), which is out of the range.
In xlxn_dp_read, the access to offset 0x3A8 or 0x3AC will be directed to
the offset 0x3A8 (incorrect functionality) or 0x3AC (out-of-bounds read)
rather than 0x3A4.

This patch enforces the read access to offset 0x3A8 and 0x3AC to 0x3A4,
but does not adjust the size of s->core_registers to avoid breaking
migration.

Fixes: 58ac482a66de ("introduce xlnx-dp")
Signed-off-by: Qiang Liu <cyruscyliu@gmail.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <1628059910-12060-1-git-send-email-cyruscyliu@gmail.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

show more ...