aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-12-11cutils: Assert in-range base for string-to-integer conversionsEric Blake
POSIX states that the value of endptr is unspecified if strtol() fails with EINVAL due to an invalid base argument. Since none of the callers to check_strtox_error() initialized endptr, we could end up propagating uninitialized data back to a caller on error. However, passing an out-of-range base is already a sign of poor programming, so let's just assert that base is in range, at which point check_strtox_error() can be tightened to assert that it is receiving an initialized ep that points somewhere within the caller's original string, regardless of whether strto*() succeeded or failed with ERANGE. Reported-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20181206151856.77503-1-eblake@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11util: vfio-helpers: use ARRAY_SIZE in qemu_vfio_init_pci()Li Qiang
Cc: qemu-trivial@nongnu.org Signed-off-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <1543571638-2892-1-git-send-email-liq3ea@gmail.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11target: hax: fix errors in commentLi Qiang
Cc: qemu-trivial@nongnu.org Signed-off-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <1543312812-2929-1-git-send-email-liq3ea@gmail.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Use my work email to review Build and test automation patchesPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20181125205000.10324-25-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add a missing entry for the NVDIMM devicePhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20181125205000.10324-22-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add a missing entry to the QMP sectionPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20181125205000.10324-20-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add a missing entry to SPICEPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20181125205000.10324-18-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add missing entries for the MPS2 machinePhilippe Mathieu-Daudé
Missed in de343bb632a. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20181125205000.10324-17-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add missing entries for the Canon DIGIC machinePhilippe Mathieu-Daudé
This pattern now also matches: - include/hw/timer/digic-timer.h - include/hw/char/digic-uart.h Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20181125205000.10324-16-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add missing entries to the vhost sectionPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20181125205000.10324-15-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add missing entries to the PC Chipset sectionPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20181125205000.10324-13-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add a missing entry for the sun4m machinesPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20181125205000.10324-10-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add a missing entry for the Old World machinesPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20181125205000.10324-9-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add a missing entry for the Xilinx S3A-DSP 1800 machinePhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20181125205000.10324-7-philmd@redhat.com> [lv: added the missing 'F:' field] Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add missing entries for the Jazz machinePhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com> Message-Id: <20181125205000.10324-6-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add missing entries for the Xilinx ZynqMP machinePhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20181125205000.10324-5-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add a missing entry to the SPARC CPUPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20181125205000.10324-3-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Fix ACPI tests data files pathPhilippe Mathieu-Daudé
Missed while moving those files in 438c78dab75. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20181125205000.10324-2-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11target: hax: replace g_malloc with g_new0Li Qiang
And also the g_malloc doesn't need check return value, remove it. Cc: qemu-trivial@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <1543226179-5135-1-git-send-email-liq3ea@gmail.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add nios2-related files to the Nios2 sectionThomas Huth
nios2_iic.c and the default-configs/nios2-softmmu.mak file are currently "unmaintained" according to the get_maintainers.pl script. Move them to the Nios2 section where they obviously belong to. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <1542899500-23346-1-git-send-email-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11MAINTAINERS: Add missing hw/pci-host entriesThomas Huth
Bonito belongs to Fulong-2E, Sabre belongs to Sun4u, and Mac-Newworld and Mips-Boston were missing the header files. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Acked-by: Aleksandar Markovic <amarkovic@wavecomp.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <1542891760-13937-1-git-send-email-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11misc: Avoid UTF-8 in error messagesEric Blake
While most developers are now using UTF-8 environments, it's harder to guarantee that error messages will be output to a multibyte locale. Rather than risking error messages that get corrupted into mojibake when the user runs qemu in a non-multibyte locale, let's stick to straight ASCII error messages, rather than assuming that our use of UTF-8 in source code string constants will work unchanged in other locales. Found with: $ LC_ALL=C git grep -l $'".*[\x80-\xff].*"' origin -- '**/*.[ch]' | cat origin:hw/misc/tmp105.c origin:hw/misc/tmp421.c Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20181120203628.2367003-1-eblake@redhat.com> [lv: added command line to find non ASCII characters] Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11qapi: Reduce Makefile boilerplateEric Blake
Adding a new qapi module had some rather tedious repetition to wire it into Makefile, Makefile.objs, and .gitignore (for example, see commit bf42508f and its followup b61acdec). For make, add some indirection by taking advantage of GNU Make string processing to expand a list of module names into all the required artifacts, so that future additions of a new module need only touch the list of module names. And for gitignore, use globs to cover all generated file names. The list has to live in Makefile.objs, due to the way that our unnest-vars macro slirps in that file without remembering any definition of $(QAPI_MODULES) from Makefile. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Tested-by: Yuval Shaia <yuval.shaia@oracle.com> Message-Id: <20181116200016.2080785-1-eblake@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11hw: set_netdev: remove useless codeLi Qiang
In set_netdev(), the peers[i] is initialized qemu_find_net_clients_except() when i is in 0 between 'queues' it can't be NULL. Signed-off-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1541751214-17515-1-git-send-email-liq3ea@gmail.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11misc: fix spellingMarc-André Lureau
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20181105135400.18366-1-marcandre.lureau@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11virtio: pass argument by value for virtqueue_map_iovec()Dongli Zhang
Pass num_sg by value instead of by pointer, as num_sg is never modified in virtqueue_map_iovec(). Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1541139396-4727-1-git-send-email-dongli.zhang@oracle.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11hw: qdev: fix error in commentLi Qiang
Cc: qemu-trivial@nongnu.org Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20181030151637.37207-1-liq3ea@163.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-12-11Update version for v3.1.0 releasev3.1.0Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-06Update version for v3.1.0-rc5 releasev3.1.0-rc5Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-06i2c: pm_smbus: check smb_index before block transfer writePrasad J Pandit
While performing block transfer write in smb_ioport_writeb(), 'smb_index' is incremented and used to index smb_data[] array. Check 'smb_index' value to avoid OOB access. Note that this bug is exploitable by a guest to escape from the virtual machine. However the commit which introduced the bug was only made after the 3.0 release, and so it is not present in any released QEMU versions. Fixes: 38ad4fae43 i2c: pm_smbus: Add block transfer capability Reported-by: Michael Hanselmann <public@hansmi.ch> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Michael Hanselmann <public@hansmi.ch> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20181206121830.6177-1-ppandit@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-04Update version for v3.1.0-rc4 releasev3.1.0-rc4Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-04virtio-net-test: add large tx buffer testJason Wang
This test tries to build a packet whose size is greater than INT_MAX which tries to trigger integer overflow in qemu_net_queue_append_iov() which may result OOB. Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20181204035347.6148-6-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-04virtio-net-test: remove unused macroJason Wang
Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Message-id: 20181204035347.6148-5-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-04virtio-net-test: accept variable length argument in pci_test_start()Jason Wang
This allows flexibility to be reused for all kinds of command line used by other tests. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Message-id: 20181204035347.6148-4-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-04net: hub: suppress warnings of no host network for qtestJason Wang
If we want to qtest through hub, it would be much more simpler and safer to configure the hub without host network. So silent this warnings for qtest. Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20181204035347.6148-3-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-04net: drop too large packet earlyJason Wang
We try to detect and drop too large packet (>INT_MAX) in 1592a9947036 ("net: ignore packet size greater than INT_MAX") during packet delivering. Unfortunately, this is not sufficient as we may hit another integer overflow when trying to queue such large packet in qemu_net_queue_append_iov(): - size of the allocation may overflow on 32bit - packet->size is integer which may overflow even on 64bit Fixing this by moving the check to qemu_sendv_packet_async() which is the entrance of all networking codes and reduce the limit to NET_BUFSIZE to be more conservative. This works since: - For the callers that call qemu_sendv_packet_async() directly, they only care about if zero is returned to determine whether to prevent the source from producing more packets. A callback will be triggered if peer can accept more then source could be enabled. This is usually used by high speed networking implementation like virtio-net or netmap. - For the callers that call qemu_sendv_packet() that calls qemu_sendv_packet_async() indirectly, they often ignore the return value. In this case qemu will just the drop packets if peer can't receive. Qemu will copy the packet if it was queued. So it was safe for both kinds of the callers to assume the packet was sent. Since we move the check from qemu_deliver_packet_iov() to qemu_sendv_packet_async(), it would be safer to make qemu_deliver_packet_iov() static to prevent any external user in the future. This is a revised patch of CVE-2018-17963. Cc: qemu-stable@nongnu.org Cc: Li Qiang <liq3ea@163.com> Fixes: 1592a9947036 ("net: ignore packet size greater than INT_MAX") Reported-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20181204035347.6148-2-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/fixes-31-20181203-pull-request' into staging usb: mtp fixes. # gpg: Signature made Mon 03 Dec 2018 19:50:26 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-31-20181203-pull-request: usb-mtp: outlaw slashes in filenames usb-mtp: fix utf16_to_str Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03usb-mtp: outlaw slashes in filenamesGerd Hoffmann
Slash is unix directory separator, so they are not allowed in filenames. Note this also stops the classic escape via "../". Fixes: CVE-2018-16867 Reported-by: Michael Hanselmann <public@hansmi.ch> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181203101045.27976-3-kraxel@redhat.com
2018-12-03usb-mtp: fix utf16_to_strGerd Hoffmann
Make utf16_to_str return an allocated string. Remove the assumtion that the number of string bytes equals the number of utf16 chars (which is only true for ascii chars). Instead call wcstombs twice, once to figure the storage size and once for the actual conversion (as suggested by the wcstombs manpage). FIXME: surrogate pairs are not working correctly. Pre-existing bug, fixing that is left for another day. Reported-by: Michael Hanselmann <public@hansmi.ch> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20181203101045.27976-2-kraxel@redhat.com
2018-12-03Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-12-03' into ↵Peter Maydell
staging nbd patches for 2018-12-03 Improve x-dirty-bitmap handling for experimenting with pull mode incremental backups. - Eric Blake: 0/3 NBD dirty bitmap cleanups # gpg: Signature made Mon 03 Dec 2018 15:56:23 GMT # gpg: using RSA key A7A16B4A2527436A # gpg: Good signature from "Eric Blake <eblake@redhat.com>" # gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" # gpg: aka "[jpeg image of size 6874]" # Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A * remotes/ericb/tags/pull-nbd-2018-12-03: nbd/client: Send NBD_CMD_DISC if open fails after connect nbd/client: Make x-dirty-bitmap more reliable nbd/server: Advertise all contexts in response to bare LIST Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches: - mirror: Fix deadlock # gpg: Signature made Mon 03 Dec 2018 16:57:33 GMT # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: iotests: simple mirror test with kvm on 1G image mirror: fix dead-lock Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03iotests: simple mirror test with kvm on 1G imageVladimir Sementsov-Ogievskiy
This test is broken without previous commit fixing dead-lock in mirror. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Max Reitz <mreitz@redhat.com> Acked-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-12-03mirror: fix dead-lockVladimir Sementsov-Ogievskiy
Let start from the beginning: Commit b9e413dd375 (in 2.9) "block: explicitly acquire aiocontext in aio callbacks that need it" added pairs of aio_context_acquire/release to mirror_write_complete and mirror_read_complete, when they were aio callbacks for blk_aio_* calls. Then, commit 2e1990b26e5 (in 3.0) "block/mirror: Convert to coroutines" dropped these blk_aio_* calls, than mirror_write_complete and mirror_read_complete are not callbacks more, and don't need additional aiocontext acquiring. Furthermore, mirror_read_complete calls blk_co_pwritev inside these pair of aio_context_acquire/release, which leads to the following dead-lock with mirror: (gdb) info thr Id Target Id Frame 3 Thread (LWP 145412) "qemu-system-x86" syscall () 2 Thread (LWP 145416) "qemu-system-x86" __lll_lock_wait () * 1 Thread (LWP 145411) "qemu-system-x86" __lll_lock_wait () (gdb) bt #0 __lll_lock_wait () #1 _L_lock_812 () #2 __GI___pthread_mutex_lock #3 qemu_mutex_lock_impl (mutex=0x561032dce420 <qemu_global_mutex>, file=0x5610327d8654 "util/main-loop.c", line=236) at util/qemu-thread-posix.c:66 #4 qemu_mutex_lock_iothread_impl #5 os_host_main_loop_wait (timeout=480116000) at util/main-loop.c:236 #6 main_loop_wait (nonblocking=0) at util/main-loop.c:497 #7 main_loop () at vl.c:1892 #8 main Printing contents of qemu_global_mutex, I see that "__owner = 145416", so, thr1 is main loop, and now it wants BQL, which is owned by thr2. (gdb) thr 2 (gdb) bt #0 __lll_lock_wait () #1 _L_lock_870 () #2 __GI___pthread_mutex_lock #3 qemu_mutex_lock_impl (mutex=0x561034d25dc0, ... #4 aio_context_acquire (ctx=0x561034d25d60) #5 dma_blk_cb #6 dma_blk_io #7 dma_blk_read #8 ide_dma_cb #9 bmdma_cmd_writeb #10 bmdma_write #11 memory_region_write_accessor #12 access_with_adjusted_size #15 flatview_write #16 address_space_write #17 address_space_rw #18 kvm_handle_io #19 kvm_cpu_exec #20 qemu_kvm_cpu_thread_fn #21 qemu_thread_start #22 start_thread #23 clone () Printing mutex in fr 2, I see "__owner = 145411", so thr2 wants aio context mutex, which is owned by thr1. Classic dead-lock. Then, let's check that aio context is hold by mirror coroutine: just print coroutine stack of first tracked request in mirror job target: (gdb) [...] (gdb) qemu coroutine 0x561035dd0860 #0 qemu_coroutine_switch #1 qemu_coroutine_yield #2 qemu_co_mutex_lock_slowpath #3 qemu_co_mutex_lock #4 qcow2_co_pwritev #5 bdrv_driver_pwritev #6 bdrv_aligned_pwritev #7 bdrv_co_pwritev #8 blk_co_pwritev #9 mirror_read_complete () at block/mirror.c:232 #10 mirror_co_read () at block/mirror.c:370 #11 coroutine_trampoline #12 __start_context Yes it is mirror_read_complete calling blk_co_pwritev after acquiring aio context. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-12-03i386: hvf: Fix overrun of _decode_tbl1Roman Bolshakov
Single opcode instructions in ff group were incorrectly processed because an overrun of _decode_tbl1[0xff] resulted in access of _decode_tbl2[0x0]. Thus, decode_sldtgroup was called instead of decode_ffgroup: 7d71: decode_sldtgroup: 1 Unimplemented handler (7d71) for 108 (ff 0) While at it correct maximum length for _decode_tbl2 and _decode_tbl3. Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03i2c: Add a length check to the SMBus write handlingCorey Minyard
Avoid an overflow. Signed-off-by: Corey Minyard <cminyard@mvista.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: QEMU Stable <qemu-stable@nongnu.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-30nbd/client: Send NBD_CMD_DISC if open fails after connectEric Blake
If nbd_client_init() fails after we are already connected, then the server will spam logs with: Disconnect client, due to: Unexpected end-of-file before all bytes were read unless we gracefully disconnect before closing the connection. Ways to trigger this: $ opts=driver=nbd,export=foo,server.type=inet,server.host=localhost,server.port=10809 $ qemu-img map --output=json --image-opts $opts,read-only=off $ qemu-img map --output=json --image-opts $opts,x-dirty-bitmap=nosuch: Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181130023232.3079982-4-eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2018-11-30nbd/client: Make x-dirty-bitmap more reliableEric Blake
The implementation of x-dirty-bitmap in qemu 3.0 (commit 216ee365) silently falls back to treating the server as not supporting NBD_CMD_BLOCK_STATUS if a requested meta_context name was not negotiated, which in turn means treating the _entire_ image as data. Since our hack relied on using 'qemu-img map' to view which portions of the image were dirty by seeing what the redirected bdrv_block_status() treats as holes, this means that our fallback treats the entire image as clean. Better would have been to treat the entire image as dirty, or to fail to connect because the user's request for a specific context could not be honored. This patch goes with the latter. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181130023232.3079982-3-eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2018-11-30nbd/server: Advertise all contexts in response to bare LISTEric Blake
The NBD spec, and even our code comment, says that if the client asks for NBD_OPT_LIST_META_CONTEXT with 0 queries, then we should reply with (a possibly-compressed representation of) ALL contexts that we are willing to let them try. But commit 3d068aff forgot to advertise qemu:dirty-bitmap:FOO. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181130023232.3079982-2-eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2018-11-28Update version for v3.1.0-rc3 releasev3.1.0-rc3Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-28target/arm/sve_helper: Fix compilation with clang 3.4Thomas Huth
Clang 3.4 does not know the "flatten" attribute yet. We've already introduced the QEMU_FLATTEN macro for this in commit 97ff87c0ed020c2, so use this macro now here, too, to fix this issue. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1543399094-2260-1-git-send-email-thuth@redhat.com Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-24 18:19:06 +0000