aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-04-28replay: Fix dangling location bug in replay_configure()Markus Armbruster
replay_configure() pushes and pops a Location with automatic storage duration. Except it fails to pop when -icount parameter "rr" isn't given. cur_loc then points to unused stack space, and will most likely get clobbered in short order. Clobbered cur_loc can make loc_pop() and error_print_loc() crash or report bogus locations. Broken in commit 890ad55. I didn't take the time to find a reproducer. Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1461767349-15329-3-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
2016-04-28QemuOpts: Fix qemu_opts_foreach() dangling location regressionMarkus Armbruster
qemu_opts_foreach() pushes and pops a Location with automatic storage duration. Except it fails to pop when @func() returns non-zero. cur_loc then points to unused stack space, and will most likely get clobbered in short order. Clobbered cur_loc can make loc_pop() and error_print_loc() crash or report bogus locations. Affects several qemu command line options as well as qemu-img, qemu-io, qemu-nbd -object, and blkdebug's configuration file. Broken in commit a4c7367, v2.4.0. Reproducer: $ qemu-system-x86_64 -nodefaults -display none -object secret,id=foo,foo=bar main() reports "Property '.foo' not found" like this: if (qemu_opts_foreach(qemu_find_opts("object"), user_creatable_add_opts_foreach, object_create_delayed, &err)) { error_report_err(err); exit(1); } cur_loc then points to where qemu_opts_foreach()'s Location used to be, i.e. unused stack space. With optimization, this Location doesn't get clobbered for me, and also happens to be the correct location. Without optimization, it does get clobbered in a way that makes error_report_err() report no location. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1461767349-15329-2-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2016-04-25usb/uhci: move pid checkGerd Hoffmann
commit "5f77e06 usb: add pid check at the first of uhci_handle_td()" moved the pid verification to the start of the uhci_handle_td function, to simplify the error handling (we don't have to free stuff which we didn't allocate in the first place ...). Problem is now the check fires too often, it raises error IRQs even for TDs which we are not going to process because they are not set active. So, lets move down the check a bit, so it is done only for active TDs, but still before we are going to allocate stuff to process the requested transfer. Reported-by: Joe Clifford <joe@thunderbug.co.uk> Tested-by: Joe Clifford <joe@thunderbug.co.uk> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1461321893-15811-1-git-send-email-kraxel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-25Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.6-20160423' ↵Peter Maydell
into staging ppc patch queue for 2016-03-23 A single fix for a bug in parameter handling for the spapr PCI host bridge. # gpg: Signature made Sat 23 Apr 2016 07:55:29 BST using RSA key ID 20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.6-20160423: hw/ppc/spapr: Fix crash when specifying bad parameters to spapr-pci-host-bridge Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-23hw/ppc/spapr: Fix crash when specifying bad parameters to spapr-pci-host-bridgeThomas Huth
QEMU currently crashes when using bad parameters for the spapr-pci-host-bridge device: $ qemu-system-ppc64 -device spapr-pci-host-bridge,buid=0x123,liobn=0x321,mem_win_addr=0x1,io_win_addr=0x10 Segmentation fault The problem is that spapr_tce_find_by_liobn() might return NULL, but the code in spapr_populate_pci_dt() does not check for this condition and then tries to dereference this NULL pointer. Apart from that, the return value of spapr_populate_pci_dt() also has to be checked for all PCI buses, not only for the last one, to make sure we catch all errors. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-04-22Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Mirror block job fixes for 2.6.0-rc4 # gpg: Signature made Fri 22 Apr 2016 15:46:41 BST using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: mirror: Workaround for unexpected iohandler events during completion aio-posix: Skip external nodes in aio_dispatch virtio: Mark host notifiers as external event-notifier: Add "is_external" parameter iohandler: Introduce iohandler_get_aio_context Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-22mirror: Workaround for unexpected iohandler events during completionFam Zheng
Commit 5a7e7a0ba moved mirror_exit to a BH handler but didn't add any protection against new requests that could sneak in just before the BH is dispatched. For example (assuming a code base at that commit): main_loop_wait # 1 os_host_main_loop_wait g_main_context_dispatch aio_ctx_dispatch aio_dispatch ... mirror_run bdrv_drain (a) block_job_defer_to_main_loop qemu_iohandler_poll virtio_queue_host_notifier_read ... virtio_submit_multiwrite (b) blk_aio_multiwrite main_loop_wait # 2 <snip> aio_dispatch aio_bh_poll (c) mirror_exit At (a) we know the BDS has no pending request. However, the same main_loop_wait call is going to dispatch iohandlers (EventNotifier events), which may lead to a new I/O from guest. So the invariant is already broken at (c). Data loss. Commit f3926945c8 made iohandler to use aio API. The order of virtio_queue_host_notifier_read and block_job_defer_to_main_loop within a main_loop_wait becomes unpredictable, and even worse, if the host notifier event arrives at the next main_loop_wait call, the unpredictable order between mirror_exit and virtio_queue_host_notifier_read is also a trouble. As shown below, this commit made the bug easier to trigger: - Bug case 1: main_loop_wait # 1 os_host_main_loop_wait g_main_context_dispatch aio_ctx_dispatch (qemu_aio_context) ... mirror_run bdrv_drain (a) block_job_defer_to_main_loop aio_ctx_dispatch (iohandler_ctx) virtio_queue_host_notifier_read ... virtio_submit_multiwrite (b) blk_aio_multiwrite main_loop_wait # 2 ... aio_dispatch aio_bh_poll (c) mirror_exit - Bug case 2: main_loop_wait # 1 os_host_main_loop_wait g_main_context_dispatch aio_ctx_dispatch (qemu_aio_context) ... mirror_run bdrv_drain (a) block_job_defer_to_main_loop main_loop_wait # 2 ... aio_ctx_dispatch (iohandler_ctx) virtio_queue_host_notifier_read ... virtio_submit_multiwrite (b) blk_aio_multiwrite aio_dispatch aio_bh_poll (c) mirror_exit In both cases, (b) breaks the invariant wanted by (a) and (c). Until then, the request loss has been silent. Later, 3f09bfbc7be added asserts at (c) to check the invariant (in bdrv_replace_in_backing_chain), and Max reported an assertion failure first visible there, by doing active committing while the guest is running bonnie++. 2.5 added bdrv_drained_begin at (a) to protect the dataplane case from similar problems, but we never realize the main loop bug until now. As a bandage, this patch disables iohandler's external events temporarily together with bs->ctx. Launchpad Bug: 1570134 Cc: qemu-stable@nongnu.org Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-04-22aio-posix: Skip external nodes in aio_dispatchFam Zheng
aio_poll doesn't poll the external nodes so this should never be true, but aio_ctx_dispatch may get notified by the events from GSource. To make bdrv_drained_begin effective in main loop, we should check the is_external flag here too. Also do the check in aio_pending so aio_dispatch is not called superfluously, when there is no events other than external ones. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-04-22virtio: Mark host notifiers as externalFam Zheng
The effect of this change is the block layer drained section can work, for example when mirror job is being completed. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-04-22event-notifier: Add "is_external" parameterFam Zheng
All callers pass "false" keeping the old semantics. The windows implementation doesn't distinguish the flag yet. On posix, it is passed down to the underlying aio context. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-04-22iohandler: Introduce iohandler_get_aio_contextFam Zheng
Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-04-22util: align memory allocations to 2M on AArch64Christoffer Dall
For KVM to use Transparent Huge Pages (THP) we have to ensure that the alignment of the userspace address of the KVM memory slot and the IPA that the guest sees for a memory region have the same offset from the 2M huge page size boundary. One way to achieve this is to always align the IPA region at a 2M boundary and ensure that the mmap alignment is also at 2M. Unfortunately, we were only doing this for __arm__, not for __aarch64__, so add this simple condition. This fixes a performance regression using KVM/ARM on AArch64 platforms that showed a performance penalty of more than 50%, introduced by the following commit: 9fac18f (oslib: allocate PROT_NONE pages on top of RAM, 2015-09-10) We were only lucky before the above commit, because we were allocating large regions and naturally getting a 2M alignment on those allocations then. Cc: qemu-stable@nongnu.org Reported-by: Shih-Wei Li <shihwei@cs.columbia.edu> Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: wrapped long line] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-22nbd: Don't mishandle unaligned client requestsEric Blake
The NBD protocol does not (yet) force any alignment constraints on clients. Even though qemu NBD clients always send requests that are aligned to 512 bytes, we must be prepared for non-qemu clients that don't care about alignment (even if it means they are less efficient). Our use of blk_read() and blk_write() was silently operating on the wrong file offsets when the client made an unaligned request, corrupting the client's data (but as the client already has control over the file we are serving, I don't think it is a security hole, per se, just a data corruption bug). Note that in the case of NBD_CMD_READ, an unaligned length could cause us to return up to 511 bytes of uninitialized trailing garbage from blk_try_blockalign() - hopefully nothing sensitive from the heap's prior usage is ever leaked in that manner. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Tested-by: Kevin Wolf <kwolf@redhat.com> Message-id: 1461249750-31928-1-git-send-email-eblake@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-21Update version for v2.6.0-rc3 releasev2.6.0-rc3Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-21tcg: check for CONFIG_DEBUG_TCG instead of NDEBUGAurelien Jarno
Check for CONFIG_DEBUG_TCG instead of NDEBUG, drop now useless code. Cc: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 1461228530-14852-2-git-send-email-aurelien@aurel32.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-21tcg: use tcg_debug_assert instead of assert (fix performance regression)Aurelien Jarno
The TCG code is quite performance sensitive, but at the same time can also be quite tricky. That is why asserts that can be enabled with the --enable-debug-tcg configure option. This used to work the following way: | #include "config.h" | | ... | | #if !defined(CONFIG_DEBUG_TCG) && !defined(NDEBUG) | /* define it to suppress various consistency checks (faster) */ | #define NDEBUG | #endif | | ... | | #include <assert.h> Since commit 757e725b (tcg: Clean up includes) "config.h" as been replaced by "qemu/osdep.h" which itself includes <assert.h>. As a consequence the assertions are always enabled, even when using --disable-debug-tcg, causing a performance regression, especially on targets with many registers. For instance on qemu-system-ppc the speed difference is about 15%. tcg_debug_assert is controlled directly by CONFIG_DEBUG_TCG and already uses in some places. This patch replaces all the calls to assert into calss to tcg_debug_assert. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 1461228530-14852-1-git-send-email-aurelien@aurel32.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-21hw/arm/boot: always clear r0 when booting kernelsSylvain Garrigues
The 32-bit ARM Linux kernel booting ABI requires that r0 is 0 when calling the kernel image. A bug in commit 10b8ec73e610e01 meant that for boards which use the write_board_setup hook (which means "highbank", "midway", "raspi2" and "xilinx-zynq-a9") we were incorrectly skipping the "clear r0" instruction in the mini-bootloader. Use the right offset in the "add lr, pc, #n" instruction so that we return from the board-setup code to the correct place. Signed-off-by: Sylvain Garrigues <sylvain@sylvaingarrigues.com> [PMM: Expanded commit message] Cc: qemu-stable@nongnu.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-21MAINTAINERS: Avoid using K: for NUMA sectionEduardo Habkost
When using K: in MAINTAINERS, false positives makes get_maintainer.pl not use git history to find contributors. As those patterns cause lots of false positives they are causing more harm than good, so remove them. Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-id: 1461164130-3847-1-git-send-email-ehabkost@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-20Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Mirror block job fixes for 2.6.0-rc3 # gpg: Signature made Wed 20 Apr 2016 15:56:43 BST using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: iotests: Test case for drive-mirror with unaligned image size iotests: Add iotests.image_size mirror: Don't extend the last sub-chunk block/mirror: Refresh stale bitmap iterator cache block/mirror: Revive dead yielding code Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-20Merge remote-tracking branch 'remotes/sstabellini/tags/xen-2016-04-20' into ↵Peter Maydell
staging Xen 2016/04/20 # gpg: Signature made Wed 20 Apr 2016 12:08:56 BST using RSA key ID 70E1AE90 # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>" * remotes/sstabellini/tags/xen-2016-04-20: xenfb: use the correct condition to avoid excessive looping Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-20iotests: Test case for drive-mirror with unaligned image sizeFam Zheng
This is the regression test for the virtual size mismatch issue between target and source images. [ kwolf: Added test_unaligned_with_update ] Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com>
2016-04-20iotests: Add iotests.image_sizeFam Zheng
This retrieves the virtual size of the image out of qemu-img info. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-04-20mirror: Don't extend the last sub-chunkFam Zheng
The last sub-chunk is rounded up to the copy granularity in the target image, resulting in a larger size than the source. Add a function to clip the copied sectors to the end. This undoes the "wrong" changes to tests/qemu-iotests/109.out in e5b43573e28. The remaining two offset changes are okay. [ kwolf: Use DIV_ROUND_UP to calculate nb_chunks now ] Reported-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com>
2016-04-20block/mirror: Refresh stale bitmap iterator cacheMax Reitz
If the drive's dirty bitmap is dirtied while the mirror operation is running, the cache of the iterator used by the mirror code may become stale and not contain all dirty bits. This only becomes an issue if we are looking for contiguously dirty chunks on the drive. In that case, we can easily detect the discrepancy and just refresh the iterator if one occurs. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-04-20block/mirror: Revive dead yielding codeMax Reitz
mirror_iteration() is supposed to wait if the current chunk is subject to a still in-flight mirroring operation. However, it mixed checking this conflict situation with checking the dirty status of a chunk. A simplification for the latter condition (the first chunk encountered is always dirty) led to neglecting the former: We just skip the first chunk and thus never test whether it conflicts with an in-flight operation. To fix this, pull out the code which waits for in-flight operations on the first chunk of the range to be mirrored to settle. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-04-20Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2016-04-19-tag' ↵Peter Maydell
into staging qemu-ga patch queue for 2.6 * fixes inadvertant change that unconditionally disables qemu-ga unit test * fixes make check failures when building with --disable-guest-agent that were present visible before the unit test was inadvertantly disabled. # gpg: Signature made Tue 19 Apr 2016 23:30:09 BST using RSA key ID F108B584 # gpg: Good signature from "Michael Roth <flukshun@gmail.com>" # gpg: aka "Michael Roth <mdroth@utexas.edu>" # gpg: aka "Michael Roth <mdroth@linux.vnet.ibm.com>" * remotes/mdroth/tags/qga-pull-2016-04-19-tag: qemu-ga: do not run qga test when guest agent disabled Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-20Merge remote-tracking branch 'remotes/cody/tags/block-pull-request' into stagingPeter Maydell
# gpg: Signature made Tue 19 Apr 2016 17:28:01 BST using RSA key ID C0DE3057 # gpg: Good signature from "Jeffrey Cody <jcody@redhat.com>" # gpg: aka "Jeffrey Cody <jeff@codyprime.org>" # gpg: aka "Jeffrey Cody <codyprime@gmail.com>" * remotes/cody/tags/block-pull-request: block/gluster: prevent data loss after i/o error block/gluster: code movement of qemu_gluster_close() block/gluster: return correct error value Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-19qemu-ga: do not run qga test when guest agent disabledYang Hongyang
When configure with --disable-guest-agent, make check will fail with: ERROR:tests/test-qga.c:74:fixture_setup: assertion failed (error == NULL): Failed to execute child process "/home/xx/qemu/qemu-ga" (No such file or directory) (g-exec-error-quark, 8) make: *** [check-tests/test-qga] Error 1 This check was commented out by bab47d9a75a. I think that was by mistake, because the commit message of that commit didn't mention this change. Signed-off-by: Yang Hongyang <hongyang.yang@easystack.cn> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Michael Roth <mdroth@linux.vnet.ibm.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Cc: qemu-stable@nongnu.org
2016-04-19Update language files for QEMU 2.6.0Peter Maydell
Update translation files (change created via 'make -C po update'). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1461059023-14470-1-git-send-email-peter.maydell@linaro.org Reviewed-by: Stefan Weil <sw@weilnetz.de>
2016-04-19block/gluster: prevent data loss after i/o errorJeff Cody
Upon receiving an I/O error after an fsync, by default gluster will dump its cache. However, QEMU will retry the fsync, which is especially useful when encountering errors such as ENOSPC when using the werror=stop option. When using caching with gluster, however, the last written data will be lost upon encountering ENOSPC. Using the write-behind-cache xlator option of 'resync-failed-syncs-after-fsync' should cause gluster to retain the cached data after a failed fsync, so that ENOSPC and other transient errors are recoverable. Unfortunately, we have no way of knowing if the 'resync-failed-syncs-after-fsync' xlator option is supported, so for now close the fd and set the BDS driver to NULL upon fsync error. Signed-off-by: Jeff Cody <jcody@redhat.com>
2016-04-19block/gluster: code movement of qemu_gluster_close()Jeff Cody
Move qemu_gluster_close() further up in the file, in preparation for the next patch, to avoid a forward declaration. Signed-off-by: Jeff Cody <jcody@redhat.com>
2016-04-19block/gluster: return correct error valueJeff Cody
Upon error, gluster will call the aio callback function with a ret value of -1, with errno set to the proper error value. If we set the acb->ret value to the return value in the callback, that results in every error being EPERM (i.e. 1). Instead, set it to the proper error result. Reviewed-by: Niels de Vos <ndevos@redhat.com> Signed-off-by: Jeff Cody <jcody@redhat.com>
2016-04-19Merge remote-tracking branch 'remotes/armbru/tags/pull-fw_cfg-2016-04-19' ↵Peter Maydell
into staging fw_cfg: Adopt /opt/RFQDN convention # gpg: Signature made Tue 19 Apr 2016 15:14:20 BST using RSA key ID EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" * remotes/armbru/tags/pull-fw_cfg-2016-04-19: fw_cfg: Adopt /opt/RFQDN convention Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-19fw_cfg: Adopt /opt/RFQDN conventionMarkus Armbruster
FW CFG's primary user is QEMU, which uses it to expose configuration information (in the widest sense) to Firmware. Thus the name FW CFG. FW CFG can also be used by others for their own purposes. QEMU is merely acting as transport then. Names starting with opt/ are reserved for such uses. There is no provision, however, to guide safe sharing among different such users. Fix that, loosely following QMP precedence: names should start with opt/RFQDN/, where RFQDN is a reverse fully qualified domain name you control. Based on a more ambitious patch from Michael Tsirkin. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Gabriel L. Somlo <somlo@cmu.edu> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Gabriel Somlo <somlo@cmu.edu> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2016-04-19Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20160419-1' into ↵Peter Maydell
staging ehci: fix (s)iTD looping issue (CVE-2015-8558) in a different way. # gpg: Signature made Tue 19 Apr 2016 07:22:22 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-usb-20160419-1: Revert "ehci: make idt processing more robust" ehci: apply limit to iTD/sidt descriptors Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-19Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.6-20160419' ↵Peter Maydell
into staging ppc patch queueu for 2016-04-19 A single fix for a regression since 2.5. This should be the last ppc pull request for 2.6. # gpg: Signature made Tue 19 Apr 2016 02:48:30 BST using RSA key ID 20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.6-20160419: cuda: fix off-by-one error in SET_TIME command Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-19cadence_uart: bounds check write offsetMichael S. Tsirkin
cadence_uart_init() initializes an I/O memory region of size 0x1000 bytes. However in uart_write(), the 'offset' parameter (offset within region) is divided by 4 and then used to index the array 'r' of size CADENCE_UART_R_MAX which is much smaller: (0x48/4). If 'offset>>=2' exceeds CADENCE_UART_R_MAX, this will cause an out-of-bounds memory write where the offset and the value are controlled by guest. This will corrupt QEMU memory, in most situations this causes the vm to crash. Fix by checking the offset against the array size. Cc: qemu-stable@nongnu.org Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 20160418100735.GA517@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-19Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into ↵Peter Maydell
staging X86 fix for 2.6.0-rc3 # gpg: Signature made Mon 18 Apr 2016 20:02:15 BST using RSA key ID 984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" * remotes/ehabkost/tags/x86-pull-request: target-i386: Set AMD alias bits after filtering CPUID data Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-19Revert "ehci: make idt processing more robust"Gerd Hoffmann
This reverts commit 156a2e4dbffa85997636a7a39ef12da6f1b40254. Breaks FreeBSD. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-04-19ehci: apply limit to iTD/sidt descriptorsGerd Hoffmann
Commit "156a2e4 ehci: make idt processing more robust" tries to avoid a DoS by the guest (create a circular iTD queue and let qemu ehci emulation run in circles forever). Unfortunately this has two problems: First it misses the case of siTDs, and second it reportedly breaks FreeBSD. So lets go for a different approach: just count the number of iTDs and siTDs we have seen per frame and apply a limit. That should really catch all cases now. Reported-by: 杜少博 <dushaobo@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-04-19cuda: fix off-by-one error in SET_TIME commandAurelien Jarno
With the new framework the cuda_cmd_set_time command directly receive the data, without the command byte. Therefore the time is stored at in_data[0], not at in_data[1]. This fixes the "hwclock --systohc" command in a guest. Cc: Hervé Poussineau <hpoussin@reactos.org> Cc: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> [this fixes a regression introduced by e647317 "cuda: port SET_TIME command to new framework"] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-04-18target-i386: Set AMD alias bits after filtering CPUID dataEduardo Habkost
QEMU complains about -cpu host on an AMD machine: warning: host doesn't support requested feature: CPUID.80000001H:EDX [bit 0] For bits 0,1,3,4,5,6,7,8,9,12,13,14,15,16,17,23,24. KVM_GET_SUPPORTED_CPUID and and x86_cpu_get_migratable_flags() don't handle the AMD CPUID aliases bits, making x86_cpu_filter_features() print warnings and clear those CPUID bits incorrectly. To avoid hacking x86_cpu_get_migratable_flags() to handle CPUID_EXT2_AMD_ALIASES (just like the existing hack inside kvm_arch_get_supported_cpuid()), simply move the CPUID_EXT2_AMD_ALIASES code in x86_cpu_realizefn() after the x86_cpu_filter_features() call. This will probably make the CPUID_EXT2_AMD_ALIASES hack in kvm_arch_get_supported_cpuid() unnecessary, too. The hack will be removed in a follow-up patch after v2.6.0. Reported-by: Radim Krčmář <rkrcmar@redhat.com> Tested-by: Radim Krčmář <rkrcmar@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-04-18Merge remote-tracking branch 'remotes/afaerber/tags/qom-cpu-for-peter' into ↵Peter Maydell
staging QOM CPUState and X86CPU * MAINTAINERS cleanup # gpg: Signature made Mon 18 Apr 2016 17:23:16 BST using RSA key ID 3E7E013F # gpg: Good signature from "Andreas Färber <afaerber@suse.de>" # gpg: aka "Andreas Färber <afaerber@suse.com>" * remotes/afaerber/tags/qom-cpu-for-peter: MAINTAINERS: Drop target-i386 from CPU subsystem Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-18MAINTAINERS: Drop target-i386 from CPU subsystemAndreas Färber
X86CPU QOM type is in good hands and actively maintained these days, so drop it from the generic QOM CPU subsystem. Some refactorings and design questions will still intersect, but review and discussions of individual series can still take place while opting out of general X86CPU patch review. Acked-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2016-04-18Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' ↵Peter Maydell
into staging Update OpenBIOS images # gpg: Signature made Mon 18 Apr 2016 09:39:31 BST using RSA key ID AE0F321F # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" * remotes/mcayland/tags/qemu-openbios-signed: Update OpenBIOS images Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-18Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.6-20160418' ↵Peter Maydell
into staging ppc patch queue for 2-16-04-18 Three bugfixe patches for 2.6 here. * Two for bad implementation of some of the strong load/store instructions * One for bad migration of the XER register. This is a regression from 2.5, cause by a change in the way we represent at XER during runtime. # gpg: Signature made Mon 18 Apr 2016 06:17:03 BST using RSA key ID 20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.6-20160418: ppc: Fix migration of the XER register ppc: Fix the bad exception NIP value and the range check in LSWX ppc: Fix the range check in the LSWI instruction Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-18Merge remote-tracking branch 'remotes/otubo/tags/pull-seccomp-20160416' into ↵Peter Maydell
staging seccomp branch queue # gpg: Signature made Sat 16 Apr 2016 19:58:46 BST using RSA key ID 12F8BD2F # gpg: Good signature from "Eduardo Otubo (Software Engineer @ ProfitBricks) <eduardo.otubo@profitbricks.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 1C96 46B6 E1D1 C38A F2EC 3FDE FD0C FF5B 12F8 BD2F * remotes/otubo/tags/pull-seccomp-20160416: seccomp: adding sysinfo system call to whitelist seccomp: Whitelist cacheflush since 2.2.0 not 2.2.3 configure: Enable seccomp sandbox for MIPS Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-18Merge remote-tracking branch 'remotes/weil/tags/pull-wxx-20160415' into stagingPeter Maydell
wxx patch queue # gpg: Signature made Fri 15 Apr 2016 18:36:41 BST using RSA key ID 677450AD # gpg: Good signature from "Stefan Weil <sw@weilnetz.de>" # gpg: aka "Stefan Weil <stefan.weil@weilnetz.de>" # gpg: aka "Stefan Weil <stefan.weil@bib.uni-mannheim.de>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 4923 6FEA 75C9 5D69 8EC2 B78A E08C 21D5 6774 50AD * remotes/weil/tags/pull-wxx-20160415: wxx: Fix broken TCP networking (regression) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-18Update OpenBIOS imagesMark Cave-Ayland
Update OpenBIOS images to SVN r1395 built from submodule. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2016-04-18ppc: Fix migration of the XER registerThomas Huth
env->xer only holds the lower bits of the XER register nowadays, the SO, OV and CA bits are stored in separate variables (see the function cpu_write_xer() for details). Since the migration code currently only reads the "xer" variable, the upper bits are lost during migration. Fix it by using cpu_read_xer() instead. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-02 07:50:52 +0000