aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2011-05-04Version 0.14.1v0.14.1Justin M. Forbes
2011-05-03virtio-blk: fail unaligned requestsChristoph Hellwig
Like all block drivers virtio-blk should not allow small than block size granularity access. But given that the protocol specifies a byte unit length field we currently accept such requests, which cause qemu to abort() in lower layers. Add checks to the main read and write handlers to catch them early. Reported-by: Conor Murphy <conor_murphy_virt@hotmail.com> Tested-by: Conor Murphy <conor_murphy_virt@hotmail.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2011-05-03qed: Fix consistency check on 32-bit hostsStefan Hajnoczi
The qed_bytes_to_clusters() function is normally used with size_t lengths. Consistency check used it with file size length and therefore failed on 32-bit hosts when the image file is 4 GB or more. Make qed_bytes_to_clusters() explicitly 64-bit and update consistency check to keep 64-bit cluster counts. Reported-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2011-05-03exit if -drive specified is invalid instead of ignoring the "wrong" -driveMichael Tokarev
This fixes the problem when qemu continues even if -drive specification is somehow invalid, resulting in a mess. Applicable for both current master and for stable-0.14 (and the same issue exist 0.13 and 0.12 too). The prob can actually be seriuos: when you start guest with two drives and make an error in the specification of one of them, and the guest has something like a raid array on the two drives, guest may start failing that array or kick "missing" drives which may result in a mess - this is what actually happened to me, I did't want a resync at all, and a resync resulted in re-writing (and allocating) a 4TB virtual drive I used for testing, which in turn resulted in my filesystem filling up and whole thing failing badly. Yes it was just testing VM, I experimented with larger raid arrays, but the end result was quite, well, unexpected. Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Acked-by: Jes Sorensen <Jes.Sorensen@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2011-05-03vhost: fix dirty page handlingMichael S. Tsirkin
vhost was passing a physical address to cpu_physical_memory_set_dirty, which is wrong: we need to translate to ram address first. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Note: this lead to crashes during migration, so the patch is needed on the stable branch too.
2011-05-03Do not delete BlockDriverState when deleting the driveRyan Harper
When removing a drive from the host-side via drive_del we currently have the following path: drive_del qemu_aio_flush() bdrv_close() // zaps bs->drv, which makes any subsequent I/O get // dropped. Works as designed drive_uninit() bdrv_delete() // frees the bs. Since the device is still connected to // bs, any subsequent I/O is a use-after-free. The value of bs->drv becomes unpredictable on free. As long as it remains null, I/O still gets dropped, however it could become non-null at any point after the free resulting SEGVs or other QEMU state corruption. To resolve this issue as simply as possible, we can chose to not actually delete the BlockDriverState pointer. Since bdrv_close() handles setting the drv pointer to NULL, we just need to remove the BlockDriverState from the QLIST that is used to enumerate the block devices. This is currently handled within bdrv_delete, so move this into its own function, bdrv_make_anon(). The result is that we can now invoke drive_del, this closes the file descriptors and sets BlockDriverState->drv to NULL which prevents futher IO to the device, and since we do not free BlockDriverState, we don't have to worry about the copy retained in the block devices. We also don't attempt to remove the qdev property since we are no longer deleting the BlockDriverState on drives with associated drives. This also allows for removing Drives with no devices associated either. Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Ryan Harper <ryanh@us.ibm.com> Acked-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2011-04-10vnc: tight: Fix crash after 2GB of outputMichael Tokarev
fix 2Gb integer overflow in in VNC tight and zlib encodings As found by Roland Dreier <roland@purestorage.com> (excellent catch!), when amount of VNC compressed data produced by zlib and sent to client exceeds 2Gb, integer overflow occurs because currently, we calculate amount of data produced at each step by comparing saved total_out with new total_out, and total_out is something which grows without bounds. Compare it with previous avail_out instead of total_out, and leave total_out alone. The same code is used in vnc-enc-tight.c and vnc-enc-zlib.c, so fix both cases. There, there's no actual need to save previous_out value, since capacity-offset (which is how that value is calculated) stays the same so it can be recalculated again after call to deflate(), but whole thing becomes less readable this way. Reported-by: Roland Dreier <roland@purestorage.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Corentin Chary <corentin.chary@gmail.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2011-04-09lan9118: Ignore write to MAC_VLAN1 registerAtsushi Nemoto
On Mon, 4 Apr 2011 20:15:30 +0200, Aurelien Jarno <aurelien@aurel32.net> wrote: > Is it really safe ignoring write to this register? If yes, it's probably > a good idea to explain why in a comment. In any case, if supporting this > register is easy to do, it would be the best option. I think it is safe. Please see an updated comment below. And though implementing this register might be possible, I suppose it is not worth to supporting FrameTooLong detection, for now at least. Thank you for comments. >8--------------------------------------------------------------------- From: Atsushi Nemoto <anemo@mba.ocn.ne.jp> Date: Tue, 5 Apr 2011 23:12:07 +0900 Subject: [PATCH] lan9118: Ignore write to MAC_VLAN1 register Since linux 2.6.38, smsc911x driver writes to VLAN1 registger. Since this register only affects FrameTooLong detection, ignoring write to this register should be safe. Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit a0313c00fcd26530a025ff93edee32959917be8d)
2011-04-04Don't allow multiwrites against a block device without underlying mediumRyan Harper
If the block device has been closed, we no longer have a medium to submit IO against, check for this before submitting io. This prevents a segfault further in the code where we dereference elements of the block driver. Signed-off-by: Ryan Harper <ryanh@us.ibm.com> Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2011-04-01lsi53c895a: add support for ABORT messagesBernhard Kohl
If these messages are not handled correctly the guest driver may hang. Always mandatory: - ABORT - BUS DEVICE RESET Mandatory if tagged queuing is implemented (which disks usually do): - ABORT TAG - CLEAR QUEUE Signed-off-by: Bernhard Kohl <bernhard.kohl@nsn.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 508240c0daecdd62ab46727f37145f2dbb029ff7)
2011-03-29virtio-pci: fix bus master work around on loadMichael S. Tsirkin
Commit c81131db15dd1844d0db1d51f3cd7a105cfd2cf3 detects old guests by comparing virtio and PCI status. It attempts to do this on load, as well, but load_config callback in a binding is invoked too early and so the virtio status isn't set yet. We could add yet another callback to the binding, to invoke after load, but it seems easier to reuse the existing vmstate callback. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Cc: Alexander Graf <agraf@suse.de> (cherry picked from commit 89c473fd82daf7dddad8162a683bcd0ef671ecda)
2011-03-29fix applesmc REV keyRené Rebe
Fix applesmc REV key string literal hex encoding. Signed-off-by: René Rebe <rene@exactcode.de> Acked-by: Alexander Graf <agraf@suse.de> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 7f90fa77b8f0dbe2e9d221953b8f9a6af6a3128a)
2011-03-29rbd: don't link with -lcryptoAurelien Jarno
rbd support tries to both link with -lrados and -lcrypto. While the first one is of course necessary, the second is not necessary (only librados ifself needs to link with libcrypto). This fixes a licensing issue: qemu as a whole is GPL v2, and thus can't be linked with OpenSSL without an exception in the license, which seems difficult to get given the number of persons involved. Cc: Christian Brunner <chb@muc.de> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit cc4e8741ccdaa905017f3c7c59e14c685a239c2d)
2011-03-06net: Add the missing option declaration of "vhostforce"Jason Wang
Signed-off-by: Jason Wang <jasowang@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 96c94b298f99d6edf4e49d03cc8458f5b6e9d5f0)
2011-03-06lsi53c895a: Update dnad when skipping MSGOUT bytesStefan Hajnoczi
Update not only dbc but also dnad when skipping bytes during the MSGOUT phase. Previously only dbc was updated which is probably wrong and could lead to bogus message codes being read. Tested on Linux and Windows Server 2003. Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 444dd39b5f226926e8b8a950821e6f48a5da3ccd)
2011-03-04Revert "prep: Disable second IDE channel, as long as ISA IDE emulation ↵Aurelien Jarno
doesn't support same irq for both channels" This reverts commit 491e2a338fdf8310c84f6ebaed1683a871a0700e. (cherry picked from commit 81aa06471a5c0ae45537b15f5b44e3f82488cdf5)
2011-03-03isa-bus: Remove bogus IRQ sharing checkJan Kiszka
Nothing prevented IRQ sharing on the ISA bus in principle. Not all boards supported this, neither each and every card nor driver and OS. Still, there existed valid IRQ sharing scenarios, (at least) two of them can also be found in QEMU: >2 PC UARTs and the PREP IDE buses. So remove this artificial restriction from our ISA model. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit ee951a37d8873bff7aa58e23222dfd984111b6cb)
2011-03-03virtio-net: Fix lduw_p() pointer argument of wrong sizeStefan Hajnoczi
A pointer to a size_t variable was passed as the void * pointer to lduw_p() in virtio_net_receive(). Instead of acting on the 16-bit value this caused failure on big-endian hosts. Avoid this issue in the future by using stw_p() instead. In general we should use ld*_p() for loading from target memory and st*_p() for storing to target memory anyway, not the other way around. Also tighten up a correct use of lduw_p() when stw_p() should be used instead in virtio_net_get_config(). Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit b46d97f2d2fd7c099b11e610de630918dfd11fa1)
2011-02-25hw/sd.c: Add missing state change for SD_STATUS, SEND_NUM_WR_BLOCKSPeter Maydell
The SD_STATUS and SEND_NUM_WR_BLOCKS commands are supposed to cause the card to send data back to the host. However sd.c was missing the state change to sd_sendingdata_state for these commands, with the effect that the Linux driver would either hang indefinitely waiting for nonexistent data (pl181) or read zeroes and provoke a qemu warning message (omap). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2011-02-25vnc: Fix fatal crash with vnc reverse modeStefan Weil
Reverse mode is unusable: qemu -vnc localhost:5500,reverse crashes in vnc_refresh_server_surface because some pointers are NULL. Fix this by calling vnc_dpy_resize (which initializes these pointers) before calling vnc_refresh. Cc: Anthony Liguori <aliguori@us.ibm.com> Signed-off-by: Stefan Weil <weil@mail.berlios.de> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-02-20qemu-char: Check for missing backend nameStefan Hajnoczi
Check if the backend option is missing before searching the backend table. This fixes a NULL pointer dereference when QEMU is invoked with the following invalid command-line: $ qemu -chardev id=foo,path=/tmp/socket Previously QEMU would segfault, now it produces this error message: chardev: "foo" missing backend Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2011-02-16Update version for 0.14.0v0.14.0Anthony Liguori
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-02-14Update version for 0.14.0-rc2v0.14.0-rc2Anthony Liguori
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-02-14Fix build from previous commitAnthony Liguori
I unfortunately got on an unnamed branch and pushed the wrong bits Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-02-14PATCH] slirp: fix buffer overrunBruce Rogers
Since the addition of the slirp member to struct mbuf, the value of SLIRP_MSIZE and the initialization of m_size have not been correct, resulting in overrunning the end of the malloc'd buffer in some cases. Signed-off-by: Bruce Rogers <brogers@novell.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-02-14correctly check ppr priority during interrupt injection]Gleb Natapov
TPR blocks all interrupts in a priority class, so simple "less or equal" check is not enough. Signed-off-by: Gleb Natapov <gleb@redhat.com> Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-02-14Merge branch 'linux-user-for-0.14' of git://gitorious.org/qemu-maemo/qemuJustin M. Forbes
2011-02-11qcow2: Fix order in L2 table COWKevin Wolf
When copying L2 tables (this happens only with internal snapshots), the order wasn't completely safe, so that after a crash you could end up with a L2 table that has too low refcount, possibly leading to corruption in the long run. This patch puts the operations in the right order: First allocate the new L2 table and replace the reference, and only then decrease the refcount of the old table. Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 16fde5f2c2788232b16c06d34d0459a5c1ec1f6c)
2011-02-11qemu-img: Improve error messages for failed bdrv_openKevin Wolf
Output the error message string of the bdrv_open return code. Also set a non-empty device name for the images because the unknown feature error message includes it. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit b9eaf9ecb15a9c69a592f386159163d5efc3b919)
2011-02-11qed: Report error for unsupported featuresKevin Wolf
Instead of just returning -ENOTSUP, generate a more detailed error. Unfortunately we don't have a helpful text for features that we don't know yet, so just print the feature mask. It might be useful at least if someone asks for help. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Anthony Liguori <aliguori@us.ibm.com> Acked-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> (cherry picked from commit 10b758e85c9b38b4b370cff81435f6ed26024a26)
2011-02-11qcow2: Report error for version > 2Kevin Wolf
The qcow2 driver is now declared responsible for any QCOW image that has version 2 or greater (before this, version 3 would be detected as raw). For everything newer than version 2, an error is reported. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit e8cdcec123facf0ed273d941caeeeb9b08f14955)
2011-02-11qerror: Add QERR_UNKNOWN_BLOCK_FORMAT_FEATUREKevin Wolf
Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit f54e3641122e51c6343d587805422642f307462e)
2011-02-11qcow2: Fix error handling for reading compressed clustersKevin Wolf
When reading a compressed cluster failed, qcow2 falsely returned success. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> (cherry picked from commit 8af364884355b3f0c5d60a2d2f427927739658ea)
2011-02-11qcow2: Fix error handling for immediate backing file read failureKevin Wolf
Requests could return success even though they failed when bdrv_aio_readv returned NULL for a backing file read. Reported-by: Chunqiang Tang <ctang@us.ibm.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 3ab4c7e92d39d40e6dc0bdb1c2320889543691cb)
2011-02-11QCOW2: bug fix - read base image beyond its sizeChunqiang Tang
This patch fixes the following bug in QCOW2. For a QCOW2 image that is larger than its base image, when handling a read request straddling over the end of the base image, the QCOW2 driver attempts to read beyond the end of the base image and the request would fail. This bug was found by Fast Virtual Disk (FVD)'s fully automated testing tool. The following test triggered the bug. dd if=/dev/zero of=/var/ramdisk/truth.raw count=0 bs=1 seek=1098561536 dd if=/dev/zero of=/var/ramdisk/zero-500M.raw count=0 bs=1 seek=593099264 ./qemu-img create -f qcow2 -ocluster_size=65536,backing_fmt=blksim -b /var/ramdisk/zero-500M.raw /var/ramdisk/test.qcow2 1098561536 ./qemu-io --auto --seed=30477694 --truth=/var/ramdisk/truth.raw --format=qcow2 --test=blksim:/var/ramdisk/test.qcow2 --verify_write=true --compare_before=false --compare_after=true --round=100000 --parallel=100 --io_size=10485760 --fail_prob=0 --cancel_prob=0 --instant_qemubh=true Signed-off-by: Chunqiang Tang <ctang@us.ibm.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit e0d9c6f93729c9bfc98fcafcd73098bb8e131aeb)
2011-02-11Change snapshot_blkdev hmp to use correct argument type for deviceJes Sorensen
Pointed out by Markus Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 982aa95532a3a7b549695d5b3e18442975eecfb5)
2011-02-09linux-user: Fix possible realloc memory leakStefan Weil
Extract from "man realloc": "If realloc() fails the original block is left untouched; it is not freed or moved." Fix a possible memory leak (reported by cppcheck). Cc: Riku Voipio <riku.voipio@iki.fi> Signed-off-by: Stefan Weil <weil@mail.berlios.de> Signed-off-by: Riku Voipio <riku.voipio@nokia.com> (cherry picked from commit 8d79de6e42947a4a11ad7c7bb87e8f745a4f8321)
2011-02-09linux-user: Fix possible realloc memory leakStefan Weil
Extract from "man realloc": "If realloc() fails the original block is left untouched; it is not freed or moved." Fix a possible memory leak (reported by cppcheck). Cc: Riku Voipio <riku.voipio@iki.fi> Signed-off-by: Stefan Weil <weil@mail.berlios.de> Signed-off-by: Riku Voipio <riku.voipio@nokia.com>
2011-02-09linux-user: fix for loopmount ioctlMartin Mohring
In case a chrooted build uses XEN or KVM, a looped mount needs to be done to setup the chroot. The ioctl for loop mount works correctly for arm, mips, ppc32 and sh4, so its now activated. Signed-off-by: Riku Voipio <riku.voipio@nokia.com>
2011-02-08Merge branch 'master' of git+ssh://git.qemu.org/pub/git/qemu-stable-0.14Justin M. Forbes
2011-02-08blockdev: Plug memory leak in drive_init() error pathsMarkus Armbruster
Should have spotted this when doing commit 319ae529. Signed-off-by: Markus Armbruster <armbru@redhat.com>
2011-02-08blockdev: Plug memory leak in drive_uninit()Markus Armbruster
Started leaking in commit 1dae12e6. Signed-off-by: Markus Armbruster <armbru@redhat.com>
2011-02-08x86: Fix MCA broadcast parameters for TCG caseJan Kiszka
When broadcasting MCEs, we need to set MCIP and RIPV in mcg_status like it is done for KVM. Use the symbolic constants at this chance. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 29057492871e63caeab8ee7cdf1062c0270f19d8)
2011-02-08qemu-timer: Fix compilation of new timer code for w32, w64Stefan Weil
qemu_next_alarm_deadline() is needed by MinGW, too. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Anthony Liguori <aliguori@us.ibm.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Weil <weil@mail.berlios.de> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit f26e5a54f0554798a2e6f7a074b809b13635d007)
2011-02-07Update version for 0.14.0-rc1v0.14.0-rc1Anthony Liguori
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2011-02-07block: enable in_use flagMarcelo Tosatti
Set block device in use during block migration, disallow drive_del and bdrv_truncate for in use devices. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 8591675f44929a9e4b5d3a5fd702a4b6d41c7903)
2011-02-07Add flag to indicate external users to block deviceMarcelo Tosatti
Certain operations such as drive_del or resize cannot be performed while external users (eg. block migration) reference the block device. Add a flag to indicate that. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit db593f2565dc12442d6bac9e8eaefa027dfcada9)
2011-02-07block-migration: add reference to target DriveInfoMarcelo Tosatti
So that ejection of attached device by guest does not free data in use by block migration instance. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> CC: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit f48905d44f670cd83227b3a8d06ae1406f0c771c)
2011-02-07blockdev: add refcount to DriveInfoMarcelo Tosatti
The host part of a block device can be deleted with in progress block migration. To fix this, add a reference count to DriveInfo, freeing resources on last reference. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> CC: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 84fb392526479d54602a3830326d50d44657f630)
2011-02-07block-migration: actually disable dirty tracking on cleanupMarcelo Tosatti
Call to set_dirty_tracking() is misplaced. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 8f794c557c4b51c7a957d47ef6a2230114bb9e79)
generated by cgit v1.2.3 (git 2.26.2) at 2024-11-29 12:26:37 +0000