aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-08-04esp: check dma length before reading scsi command(CVE-2016-4441)Prasad J Pandit
The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte FIFO buffer. It is used to handle command and data transfer. Routine get_cmd() uses DMA to read scsi commands into this buffer. Add check to validate DMA length against buffer size to avoid any overrun. Fixes CVE-2016-4441. Reported-by: Li Qiang <liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1463654371-11169-3-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 6c1fef6b59563cc415f21e03f81539ed4b33ad90) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04esp: check command buffer length before write(CVE-2016-4439)Prasad J Pandit
The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte FIFO buffer. It is used to handle command and data transfer. While writing to this command buffer 's->cmdbuf[TI_BUFSZ=16]', a check was missing to validate input length. Add check to avoid OOB write access. Fixes CVE-2016-4439. Reported-by: Li Qiang <liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1463654371-11169-2-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit c98c6c105f66f05aa0b7c1d2a4a3f716450907ef) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04json-streamer: fix double-free on exiting during a parsePaolo Bonzini
Now that json-streamer tries not to leak tokens on incomplete parse, the tokens can be freed twice if QEMU destroys the json-streamer object during the parser->emit call. To fix this, create the new empty GQueue earlier, so that it is already in place when the old one is passed to parser->emit. Reported-by: Changlong Xie <xiecl.fnst@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1467636059-12557-1-git-send-email-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit a942d8fa01f65279cdc135f4294db611bbc088ef) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04json-streamer: Don't leak tokens on incomplete parseEric Blake
Valgrind complained about a number of leaks in tests/check-qobject-json: ==12657== definitely lost: 17,247 bytes in 1,234 blocks All of which had the same root cause: on an incomplete parse, we were abandoning the token queue without cleaning up the allocated data within each queue element. Introduced in commit 95385fe, when we switched from QList (which recursively frees contents) to g_queue (which does not). We don't yet require glib 2.32 with its g_queue_free_full(), so open-code it instead. CC: qemu-stable@nongnu.org Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1463608012-12760-1-git-send-email-eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> (cherry picked from commit ba4dba54347d5062436a8553f527dbbed6dcf069) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04migration: regain control of images when migration fails to completeGreg Kurz
We currently have an error path during migration that can cause the source QEMU to abort: migration_thread() migration_completion() runstate_is_running() ----------------> true if guest is running bdrv_inactivate_all() ----------------> inactivate images qemu_savevm_state_complete_precopy() ... qemu_fflush() socket_writev_buffer() --------> error because destination fails qemu_fflush() -------------------> set error on migration stream migration_completion() -----------------> set migrate state to FAILED migration_thread() -----------------------> break migration loop vm_start() -----------------------------> restart guest with inactive images and you get: qemu-system-ppc64: socket_writev_buffer: Got err=104 for (32768/18446744073709551615) qemu-system-ppc64: /home/greg/Work/qemu/qemu-master/block/io.c:1342:bdrv_co_do_pwritev: Assertion `!(bs->open_flags & 0x0800)' failed. Aborted (core dumped) If we try postcopy with a similar scenario, we also get the writev error message but QEMU leaves the guest paused because entered_postcopy is true. We could possibly do the same with precopy and leave the guest paused. But since the historical default for migration errors is to restart the source, this patch adds a call to bdrv_invalidate_cache_all() instead. Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Message-Id: <146357896785.6003.11983081732454362715.stgit@bahia.huguette.org> Signed-off-by: Amit Shah <amit.shah@redhat.com> (cherry picked from commit fe904ea8242cbae2d7e69c052c754b8f5f1ba1d6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04configure: Allow builds with extra warningsStefan Weil
The clang compiler supports a useful compiler option -Weverything, and GCC also has other warnings not enabled by -Wall. If glib header files trigger a warning, however, testing glib with -Werror will always fail. A size mismatch is also detected without -Werror, so simply remove it. Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Weil <sw@weilnetz.de> Message-Id: <1461879221-13338-1-git-send-email-sw@weilnetz.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 5919e0328b7d6a08a661c3c747bae3e841d4e6f4) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04target-i386: key sfence availability on CPUID_SSE, not CPUID_SSE2Paolo Bonzini
sfence was introduced before lfence and mfence. This fixes Linux 2.4's measurement of checksumming speeds for the pIII_sse algorithm: md: linear personality registered as nr 1 md: raid0 personality registered as nr 2 md: raid1 personality registered as nr 3 md: raid5 personality registered as nr 4 raid5: measuring checksumming speed 8regs : 384.400 MB/sec 32regs : 259.200 MB/sec invalid operand: 0000 CPU: 0 EIP: 0010:[<c0240b2a>] Not tainted EFLAGS: 00000246 eax: c15d8000 ebx: 00000000 ecx: 00000000 edx: c15d5000 esi: 8005003b edi: 00000004 ebp: 00000000 esp: c15bdf50 ds: 0018 es: 0018 ss: 0018 Process swapper (pid: 1, stackpage=c15bd000) Stack: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000206 c0241c6c 00001000 c15d4000 c15d7000 c15d4000 c15d4000 Call Trace: [<c0241c6c>] [<c0105000>] [<c0241db4>] [<c010503b>] [<c0105000>] [<c0107416>] [<c0105030>] Code: 0f ae f8 0f 10 04 24 0f 10 4c 24 10 0f 10 54 24 20 0f 10 5c <0>Kernel panic: Attempted to kill init! Reported-by: Stefan Weil <sw@weilnetz.de> Fixes: 121f3157887f92268a3d6169e2d4601f9292020b Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 14cb949a3e2efd64ea3271b919b33b452ce7b180) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04target-mips: fix call to memset in soft reset codeAurelien Jarno
Recent versions of GCC report the following error when compiling target-mips/helper.c: qemu/target-mips/helper.c:542:9: warning: ‘memset’ used with length equal to number of elements without multiplication by element size [-Wmemset-elt-size] This is indeed correct and due to a wrong usage of sizeof(). Fix that. Cc: Stefan Weil <sw@weilnetz.de> Cc: Leon Alrae <leon.alrae@imgtec.com> Cc: qemu-stable@nongnu.org LP: https://bugs.launchpad.net/qemu/+bug/1577841 Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Leon Alrae <leon.alrae@imgtec.com> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com> (cherry picked from commit 9d989c732b153fe1576adbddb9879313a24d3cd2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04usb:xhci: no DMA on HC resetRoman Kagan
This patch is a rough fix to a memory corruption we are observing when running VMs with xhci USB controller and OVMF firmware. Specifically, on the following call chain xhci_reset xhci_disable_slot xhci_disable_ep xhci_set_ep_state QEMU overwrites guest memory using stale guest addresses. This doesn't happen when the guest (firmware) driver sets up xhci for the first time as there are no slots configured yet. However when the firmware hands over the control to the OS some slots and endpoints are already set up with their context in the guest RAM. Now the OS' driver resets the controller again and xhci_set_ep_state then reads and writes that memory which is now owned by the OS. As a quick fix, skip calling xhci_set_ep_state in xhci_disable_ep if the device context base address array pointer is zero (indicating we're in the HC reset and no DMA is possible). Cc: qemu-stable@nongnu.org Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Message-id: 1462384435-1034-1-git-send-email-rkagan@virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 491d68d9382dbb588f2ff5132ee3d87ce2f1b230) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04exec.c: Ensure right alignment also for file backed ramDominik Dingel
While in the anonymous ram case we already take care of the right alignment such an alignment gurantee does not exist for file backed ram allocation. Instead, pagesize is used for alignment. On s390 this is not enough for gmap, as we need to satisfy an alignment up to segments. Reported-by: Halil Pasic <pasic@linux.vnet.ibm.com> Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com> Message-Id: <1461585338-45863-1-git-send-email-dingel@linux.vnet.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit d2f39add725e2be849f5fb014a72368f711056fc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04tools: kvm_stat: Powerpc related fixesHemant Kumar
kvm_stat script is failing to execute on powerpc : # ./kvm_stat Traceback (most recent call last): File "./kvm_stat", line 825, in <module> main() File "./kvm_stat", line 813, in main providers = get_providers(options) File "./kvm_stat", line 778, in get_providers providers.append(TracepointProvider()) File "./kvm_stat", line 416, in __init__ self.filters = get_filters() File "./kvm_stat", line 315, in get_filters if ARCH.exit_reasons: AttributeError: 'ArchPPC' object has no attribute 'exit_reasons' This is because, its trying to access a non-defined attribute. Also, the IOCTL number of RESET is incorrect for powerpc. The correct number has been added. Signed-off-by: Hemant Kumar <hemant@linux.vnet.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> * cherry-picked from linux commit c7d4fb5a Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04vl: change runstate only if new state is different from current stateLi Zhijian
Previously, qemu will abort at following scenario: (qemu) stop (qemu) system_reset (qemu) system_reset (qemu) 2016-04-13T20:54:38.979158Z qemu-system-x86_64: invalid runstate transition: 'prelaunch' -> 'prelaunch' Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1460604352-18630-1-git-send-email-lizhijian@cn.fujitsu.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit e92a2d9cb3d8f589c9fe5d2eacc83d8dddea0e16) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04spice/gl: add & use qemu_spice_gl_monitor_configGerd Hoffmann
Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> (cherry picked from commit 39414ef4e93db9041e463a097084a407d0d374f0) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04i386: kvmvapic: initialise imm32 variablePrasad J Pandit
When processing Task Priorty Register(TPR) access, it could leak automatic stack variable 'imm32' in patch_instruction(). Initialise the variable to avoid it. Reported by: Donghai Zdh <donghai.zdh@alibaba-inc.com> Cc: qemu-stable@nongnu.org Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1460013608-16670-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 691a02e2ce0c413236a78dee6f2651c937b09fb0) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-05-11Update version for v2.6.0 releasev2.6.0Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-09Update version for v2.6.0-rc5 releasev2.6.0-rc5Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-09Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20160509-1' into ↵Peter Maydell
staging vga security fixes (CVE-2016-3710, CVE-2016-3712) # gpg: Signature made Mon 09 May 2016 13:39:30 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-vga-20160509-1: vga: make sure vga register setup for vbe stays intact (CVE-2016-3712). vga: update vga register setup on vbe changes vga: factor out vga register setup vga: add vbe_enabled() helper vga: fix banked access bounds checking (CVE-2016-3710) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-02Update version for v2.6.0-rc4 releasev2.6.0-rc4Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-02Revert "acpi: mark PMTIMER as unlocked"Gerd Hoffmann
This reverts commit 7070e085d490c396f9237c8f10bf8b6e69cd0066. Commit message claims locking is not needed, but that appears to not be true, seabios ehci driver runs into timekeeping problems with this, see https://bugzilla.redhat.com/show_bug.cgi?id=1322713 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1460702609-25971-1-git-send-email-kraxel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-02vga: make sure vga register setup for vbe stays intact (CVE-2016-3712).Gerd Hoffmann
Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT registers, to make sure the vga registers will always have the values needed by vbe mode. This makes sure the sanity checks applied by vbe_fixup_regs() are effective. Without this guests can muck with shift_control, can turn on planar vga modes or text mode emulation while VBE is active, making qemu take code paths meant for CGA compatibility, but with the very large display widths and heigts settable using VBE registers. Which is good for one or another buffer overflow. Not that critical as they typically read overflows happening somewhere in the display code. So guests can DoS by crashing qemu with a segfault, but it is probably not possible to break out of the VM. Fixes: CVE-2016-3712 Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com> Reported-by: P J P <ppandit@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-02vga: update vga register setup on vbe changesGerd Hoffmann
Call the new vbe_update_vgaregs() function on vbe configuration changes, to make sure vga registers are up-to-date. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-02vga: factor out vga register setupGerd Hoffmann
When enabling vbe mode qemu will setup a bunch of vga registers to make sure the vga emulation operates in correct mode for a linear framebuffer. Move that code to a separate function so we can call it from other places too. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-02vga: add vbe_enabled() helperGerd Hoffmann
Makes code a bit easier to read. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-02vga: fix banked access bounds checking (CVE-2016-3710)Gerd Hoffmann
vga allows banked access to video memory using the window at 0xa00000 and it supports a different access modes with different address calculations. The VBE bochs extentions support banked access too, using the VBE_DISPI_INDEX_BANK register. The code tries to take the different address calculations into account and applies different limits to VBE_DISPI_INDEX_BANK depending on the current access mode. Which is probably effective in stopping misprogramming by accident. But from a security point of view completely useless as an attacker can easily change access modes after setting the bank register. Drop the bogus check, add range checks to vga_mem_{readb,writeb} instead. Fixes: CVE-2016-3710 Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-02configure: Check if struct fsxattr is available from linux headerJan Vesely
Fixes build failure with --enable-xfsctl and new linux headers (>=4.5) and older xfsprogs(<4.5): In file included from /usr/include/xfs/xfs.h:38:0, from /var/tmp/portage/app-emulation/qemu-2.5.0-r1/work/qemu-2.5.0/block/raw-posix.c:97: /usr/include/xfs/xfs_fs.h:42:8: error: redefinition of ‘struct fsxattr’ struct fsxattr { ^ In file included from /var/tmp/portage/app-emulation/qemu-2.5.0-r1/work/qemu-2.5.0/block/raw-posix.c:60:0: /usr/include/linux/fs.h:155:8: note: originally defined here struct fsxattr { This is really a bug in the system headers, but we can work around it by defining HAVE_FSXATTR in the QEMU headers if linux/fs.h provides the struct, so that xfs_fs.h doesn't try to define it as well. CC: qemu-trivial@nongnu.org CC: Markus Armbruster <armbru@redhat.com> CC: Peter Maydell <peter.maydell@linaro.org> CC: Stefan Weil <sw@weilnetz.de> Tested-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Jan Vesely <jano.vesely@gmail.com> [PMM: adjusted commit message, comments] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-01Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
acpi: last minute fix for 2.6 Minor, obvious fix only affecting BE hosts. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Sun 01 May 2016 13:43:28 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: acpi: fix bios linker loadder COMMAND_ALLOCATE on bigendian host Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-01acpi: fix bios linker loadder COMMAND_ALLOCATE on bigendian hostIgor Mammedov
'make check' fails with: ERROR:tests/bios-tables-test.c:493:load_expected_aml: assertion failed: (g_file_test(aml_file, G_FILE_TEST_EXISTS)) since commit: caf50c7166a6ed96c462ab5db4b495e1234e4cc6 tests: pc: acpi: drop not needed 'expected SSDT' blobs Assert happens because qemu-system-x86_64 generates SSDT table and test looks for a corresponding expected table to compare with. However there is no expected SSDT blob anymore, since QEMU souldn't generate one. As it happens BIOS is not able to read ACPI tables from QEMU and fallbacks to embeded legacy ACPI codepath, which generates SSDT. That happens due to wrongly sized endiannes conversion which makes uint8_t BiosLinkerLoaderEntry.alloc.zone end up with 0 due to truncation of 32 bit integer which on host is 1 or 2. Fix it by dropping invalid cpu_to_le32() as uint8_t doesn't require any conversion. RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1330174 Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
2016-04-29Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
vvfat fixes for 2.6.0-rc4 # gpg: Signature made Fri 29 Apr 2016 10:52:13 BST using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: vvfat: Fix default volume label vvfat: Fix volume name assertion Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-29Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2016-04-29' into ↵Peter Maydell
staging QAPI patches for 2016-04-29 # gpg: Signature made Fri 29 Apr 2016 10:13:08 BST using RSA key ID EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" * remotes/armbru/tags/pull-qapi-2016-04-29: qapi: Don't pass NULL to printf in string input visitor Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-29vvfat: Fix default volume labelKevin Wolf
Commit d5941dd documented that it leaves the default volume name as it was ("QEMU VVFAT"), but it doesn't actually implement this. You get an empty name (eleven space characters) instead. This fixes the implementation to apply the advertised default. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-04-29vvfat: Fix volume name assertionKevin Wolf
Commit d5941dd made the volume name configurable, but it didn't consider that the rw code compares the volume name string to assert that the first directory entry is the volume name. This made vvfat crash in rw mode. This fixes the assertion to compare with the configured volume name instead of a literal string. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-04-29qapi: Don't pass NULL to printf in string input visitorEric Blake
Make sure the error message for visit_type_uint64() gracefully handles a NULL 'name' when called from the top level or a list context, as not all the world behaves like glibc in allowing NULL through a printf-family %s. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1461879932-9020-21-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-04-28slirp: fix guest network access with darwin hostSamuel Thibault
On Darwin, connect, sendto and friends want the exact size of the sockaddr, not more (and in particular, not sizeof(struct sockaddr_storaget)) This commit adds the sockaddr_size helper to be used when passing a sockaddr size to such function, and makes use of it int sendto and connect calls. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: John Arbuckle <programmingkidx@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-28Merge remote-tracking branch 'remotes/lalrae/tags/mips-20160428' into stagingPeter Maydell
MIPS patches 2016-04-28 Changes: * fixed RDHWR exception host PC # gpg: Signature made Thu 28 Apr 2016 10:11:18 BST using RSA key ID 0B29DA6B # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>" * remotes/lalrae/tags/mips-20160428: target-mips: Fix RDHWR exception host PC Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-28Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2016-04-28' ↵Peter Maydell
into staging Fix dangling pointers and error message regressions # gpg: Signature made Thu 28 Apr 2016 07:25:51 BST using RSA key ID EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" * remotes/armbru/tags/pull-error-2016-04-28: qom: -object error messages lost location, restore it replay: Fix dangling location bug in replay_configure() QemuOpts: Fix qemu_opts_foreach() dangling location regression Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-28Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.6-20160426' ↵Peter Maydell
into staging ppc patch queue for 2016-04-26 (last minute qemu-2.6 fix) This just has one, last-minute, fix for a serious regression of memory hotplug. Patch author's comment: Really sorry for the way last-minute fix, but without this memory hotplug is totally broken :( Hoping to get this in for Wednesday's RC4, which I think will be the final before release. # gpg: Signature made Tue 26 Apr 2016 03:52:20 BST using RSA key ID 20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.6-20160426: spapr_drc: fix aborts during DRC-count based hotplug Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-28target-mips: Fix RDHWR exception host PCJames Hogan
Commit b00c72180c36 ("target-mips: add PC, XNP reg numbers to RDHWR") changed the rdhwr helpers to use check_hwrena() to check the register being accessed is enabled in CP0_HWREna when used from user mode. If that check fails an EXCP_RI exception is raised at the host PC calculated with GETPC(). However check_hwrena() may not be fully inlined as the do_raise_exception() part of it is common regardless of the arguments. This causes GETPC() to calculate the address in the call in the helper instead of the generated code calling the helper. No TB will be found and the EPC reported with the resulting guest RI exception points to the beginning of the TB instead of the RDHWR instruction. We can't reliably force check_hwrena() to be inlined, and converting it to a macro would be ugly, so instead pass the host PC in as an argument, with each rdhwr helper passing GETPC(). This should avoid any dependence on compiler behaviour, and in practice seems to ensure the full inlining of check_hwrena() on x86_64. This issue causes failures when running a MIPS KVM (trap & emulate) guest in a MIPS QEMU TCG guest, as the inner guest kernel will do a RDHWR of counter, which is disabled in the outer guest's CP0_HWREna by KVM so it can emulate the inner guest's counter. The emulation fails and the RI exception is passed to the inner guest. Fixes: b00c72180c36 ("target-mips: add PC, XNP reg numbers to RDHWR") Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: Leon Alrae <leon.alrae@imgtec.com> Cc: Yongbok Kim <yongbok.kim@imgtec.com> Cc: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Leon Alrae <leon.alrae@imgtec.com> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
2016-04-28qom: -object error messages lost location, restore itMarkus Armbruster
qemu_opts_foreach() runs its callback with the error location set to the option's location. Any errors the callback reports use the option's location automatically. Commit 90998d5 moved the actual error reporting from "inside" qemu_opts_foreach() to after it. Here's a typical hunk: if (qemu_opts_foreach(qemu_find_opts("object"), - object_create, - object_create_initial, NULL)) { + user_creatable_add_opts_foreach, + object_create_initial, &err)) { + error_report_err(err); exit(1); } Before, object_create() reports from within qemu_opts_foreach(), using the option's location. Afterwards, we do it after qemu_opts_foreach(), using whatever location happens to be current there. Commonly a "none" location. This is because Error objects don't have location information. Problematic. Reproducer: $ qemu-system-x86_64 -nodefaults -display none -object secret,id=foo,foo=bar qemu-system-x86_64: Property '.foo' not found Note no location. This commit restores it: qemu-system-x86_64: -object secret,id=foo,foo=bar: Property '.foo' not found Note that the qemu_opts_foreach() bug just fixed could mask the bug here: if the location it leaves dangling hasn't been clobbered, yet, it's the correct one. Reported-by: Eric Blake <eblake@redhat.com> Cc: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1461767349-15329-4-git-send-email-armbru@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> [Paragraph on Error added to commit message]
2016-04-28replay: Fix dangling location bug in replay_configure()Markus Armbruster
replay_configure() pushes and pops a Location with automatic storage duration. Except it fails to pop when -icount parameter "rr" isn't given. cur_loc then points to unused stack space, and will most likely get clobbered in short order. Clobbered cur_loc can make loc_pop() and error_print_loc() crash or report bogus locations. Broken in commit 890ad55. I didn't take the time to find a reproducer. Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1461767349-15329-3-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
2016-04-28QemuOpts: Fix qemu_opts_foreach() dangling location regressionMarkus Armbruster
qemu_opts_foreach() pushes and pops a Location with automatic storage duration. Except it fails to pop when @func() returns non-zero. cur_loc then points to unused stack space, and will most likely get clobbered in short order. Clobbered cur_loc can make loc_pop() and error_print_loc() crash or report bogus locations. Affects several qemu command line options as well as qemu-img, qemu-io, qemu-nbd -object, and blkdebug's configuration file. Broken in commit a4c7367, v2.4.0. Reproducer: $ qemu-system-x86_64 -nodefaults -display none -object secret,id=foo,foo=bar main() reports "Property '.foo' not found" like this: if (qemu_opts_foreach(qemu_find_opts("object"), user_creatable_add_opts_foreach, object_create_delayed, &err)) { error_report_err(err); exit(1); } cur_loc then points to where qemu_opts_foreach()'s Location used to be, i.e. unused stack space. With optimization, this Location doesn't get clobbered for me, and also happens to be the correct location. Without optimization, it does get clobbered in a way that makes error_report_err() report no location. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1461767349-15329-2-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2016-04-26spapr_drc: fix aborts during DRC-count based hotplugMichael Roth
CPU/memory resources can be signalled en-masse via spapr_hotplug_req_add_by_count(), and when doing so, actually change the meaning of the 'drc' parameter passed to spapr_hotplug_req_event() to be a count rather than an index. f40eb92 added a hook in spapr_hotplug_req_event() to record when a device had been 'signalled' to the guest, but that code assumes that drc is always an index. In cases where it's a count, such as memory hotplug, the DRC lookup will fail, leading to an assert. Fix this by only explicitly setting the signalled state for cases where we are doing PCI hotplug. For other resources types, since we cannot selectively track whether a resource has been signalled in cases where we signal attach as a count, set the 'signalled' state to true immediately upon making the resource available via drck->attach(). Reported-by: Bharata B Rao <bharata@linux.vnet.ibm.com> Cc: Bharata B Rao <bharata@linux.vnet.ibm.com> Cc: david@gibson.dropbear.id.au Cc: qemu-ppc@nongnu.org Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-04-25usb/uhci: move pid checkGerd Hoffmann
commit "5f77e06 usb: add pid check at the first of uhci_handle_td()" moved the pid verification to the start of the uhci_handle_td function, to simplify the error handling (we don't have to free stuff which we didn't allocate in the first place ...). Problem is now the check fires too often, it raises error IRQs even for TDs which we are not going to process because they are not set active. So, lets move down the check a bit, so it is done only for active TDs, but still before we are going to allocate stuff to process the requested transfer. Reported-by: Joe Clifford <joe@thunderbug.co.uk> Tested-by: Joe Clifford <joe@thunderbug.co.uk> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1461321893-15811-1-git-send-email-kraxel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-25Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.6-20160423' ↵Peter Maydell
into staging ppc patch queue for 2016-03-23 A single fix for a bug in parameter handling for the spapr PCI host bridge. # gpg: Signature made Sat 23 Apr 2016 07:55:29 BST using RSA key ID 20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.6-20160423: hw/ppc/spapr: Fix crash when specifying bad parameters to spapr-pci-host-bridge Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-23hw/ppc/spapr: Fix crash when specifying bad parameters to spapr-pci-host-bridgeThomas Huth
QEMU currently crashes when using bad parameters for the spapr-pci-host-bridge device: $ qemu-system-ppc64 -device spapr-pci-host-bridge,buid=0x123,liobn=0x321,mem_win_addr=0x1,io_win_addr=0x10 Segmentation fault The problem is that spapr_tce_find_by_liobn() might return NULL, but the code in spapr_populate_pci_dt() does not check for this condition and then tries to dereference this NULL pointer. Apart from that, the return value of spapr_populate_pci_dt() also has to be checked for all PCI buses, not only for the last one, to make sure we catch all errors. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-04-22Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Mirror block job fixes for 2.6.0-rc4 # gpg: Signature made Fri 22 Apr 2016 15:46:41 BST using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: mirror: Workaround for unexpected iohandler events during completion aio-posix: Skip external nodes in aio_dispatch virtio: Mark host notifiers as external event-notifier: Add "is_external" parameter iohandler: Introduce iohandler_get_aio_context Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-22mirror: Workaround for unexpected iohandler events during completionFam Zheng
Commit 5a7e7a0ba moved mirror_exit to a BH handler but didn't add any protection against new requests that could sneak in just before the BH is dispatched. For example (assuming a code base at that commit): main_loop_wait # 1 os_host_main_loop_wait g_main_context_dispatch aio_ctx_dispatch aio_dispatch ... mirror_run bdrv_drain (a) block_job_defer_to_main_loop qemu_iohandler_poll virtio_queue_host_notifier_read ... virtio_submit_multiwrite (b) blk_aio_multiwrite main_loop_wait # 2 <snip> aio_dispatch aio_bh_poll (c) mirror_exit At (a) we know the BDS has no pending request. However, the same main_loop_wait call is going to dispatch iohandlers (EventNotifier events), which may lead to a new I/O from guest. So the invariant is already broken at (c). Data loss. Commit f3926945c8 made iohandler to use aio API. The order of virtio_queue_host_notifier_read and block_job_defer_to_main_loop within a main_loop_wait becomes unpredictable, and even worse, if the host notifier event arrives at the next main_loop_wait call, the unpredictable order between mirror_exit and virtio_queue_host_notifier_read is also a trouble. As shown below, this commit made the bug easier to trigger: - Bug case 1: main_loop_wait # 1 os_host_main_loop_wait g_main_context_dispatch aio_ctx_dispatch (qemu_aio_context) ... mirror_run bdrv_drain (a) block_job_defer_to_main_loop aio_ctx_dispatch (iohandler_ctx) virtio_queue_host_notifier_read ... virtio_submit_multiwrite (b) blk_aio_multiwrite main_loop_wait # 2 ... aio_dispatch aio_bh_poll (c) mirror_exit - Bug case 2: main_loop_wait # 1 os_host_main_loop_wait g_main_context_dispatch aio_ctx_dispatch (qemu_aio_context) ... mirror_run bdrv_drain (a) block_job_defer_to_main_loop main_loop_wait # 2 ... aio_ctx_dispatch (iohandler_ctx) virtio_queue_host_notifier_read ... virtio_submit_multiwrite (b) blk_aio_multiwrite aio_dispatch aio_bh_poll (c) mirror_exit In both cases, (b) breaks the invariant wanted by (a) and (c). Until then, the request loss has been silent. Later, 3f09bfbc7be added asserts at (c) to check the invariant (in bdrv_replace_in_backing_chain), and Max reported an assertion failure first visible there, by doing active committing while the guest is running bonnie++. 2.5 added bdrv_drained_begin at (a) to protect the dataplane case from similar problems, but we never realize the main loop bug until now. As a bandage, this patch disables iohandler's external events temporarily together with bs->ctx. Launchpad Bug: 1570134 Cc: qemu-stable@nongnu.org Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-04-22aio-posix: Skip external nodes in aio_dispatchFam Zheng
aio_poll doesn't poll the external nodes so this should never be true, but aio_ctx_dispatch may get notified by the events from GSource. To make bdrv_drained_begin effective in main loop, we should check the is_external flag here too. Also do the check in aio_pending so aio_dispatch is not called superfluously, when there is no events other than external ones. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-04-22virtio: Mark host notifiers as externalFam Zheng
The effect of this change is the block layer drained section can work, for example when mirror job is being completed. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-04-22event-notifier: Add "is_external" parameterFam Zheng
All callers pass "false" keeping the old semantics. The windows implementation doesn't distinguish the flag yet. On posix, it is passed down to the underlying aio context. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-04-22iohandler: Introduce iohandler_get_aio_contextFam Zheng
Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-15 01:15:26 +0000