aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-12-06Update version for v3.1.0-rc5 releasev3.1.0-rc5Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-06i2c: pm_smbus: check smb_index before block transfer writePrasad J Pandit
While performing block transfer write in smb_ioport_writeb(), 'smb_index' is incremented and used to index smb_data[] array. Check 'smb_index' value to avoid OOB access. Note that this bug is exploitable by a guest to escape from the virtual machine. However the commit which introduced the bug was only made after the 3.0 release, and so it is not present in any released QEMU versions. Fixes: 38ad4fae43 i2c: pm_smbus: Add block transfer capability Reported-by: Michael Hanselmann <public@hansmi.ch> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Michael Hanselmann <public@hansmi.ch> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20181206121830.6177-1-ppandit@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-04Update version for v3.1.0-rc4 releasev3.1.0-rc4Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-04virtio-net-test: add large tx buffer testJason Wang
This test tries to build a packet whose size is greater than INT_MAX which tries to trigger integer overflow in qemu_net_queue_append_iov() which may result OOB. Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20181204035347.6148-6-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-04virtio-net-test: remove unused macroJason Wang
Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Message-id: 20181204035347.6148-5-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-04virtio-net-test: accept variable length argument in pci_test_start()Jason Wang
This allows flexibility to be reused for all kinds of command line used by other tests. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Message-id: 20181204035347.6148-4-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-04net: hub: suppress warnings of no host network for qtestJason Wang
If we want to qtest through hub, it would be much more simpler and safer to configure the hub without host network. So silent this warnings for qtest. Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20181204035347.6148-3-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-04net: drop too large packet earlyJason Wang
We try to detect and drop too large packet (>INT_MAX) in 1592a9947036 ("net: ignore packet size greater than INT_MAX") during packet delivering. Unfortunately, this is not sufficient as we may hit another integer overflow when trying to queue such large packet in qemu_net_queue_append_iov(): - size of the allocation may overflow on 32bit - packet->size is integer which may overflow even on 64bit Fixing this by moving the check to qemu_sendv_packet_async() which is the entrance of all networking codes and reduce the limit to NET_BUFSIZE to be more conservative. This works since: - For the callers that call qemu_sendv_packet_async() directly, they only care about if zero is returned to determine whether to prevent the source from producing more packets. A callback will be triggered if peer can accept more then source could be enabled. This is usually used by high speed networking implementation like virtio-net or netmap. - For the callers that call qemu_sendv_packet() that calls qemu_sendv_packet_async() indirectly, they often ignore the return value. In this case qemu will just the drop packets if peer can't receive. Qemu will copy the packet if it was queued. So it was safe for both kinds of the callers to assume the packet was sent. Since we move the check from qemu_deliver_packet_iov() to qemu_sendv_packet_async(), it would be safer to make qemu_deliver_packet_iov() static to prevent any external user in the future. This is a revised patch of CVE-2018-17963. Cc: qemu-stable@nongnu.org Cc: Li Qiang <liq3ea@163.com> Fixes: 1592a9947036 ("net: ignore packet size greater than INT_MAX") Reported-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20181204035347.6148-2-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/fixes-31-20181203-pull-request' into staging usb: mtp fixes. # gpg: Signature made Mon 03 Dec 2018 19:50:26 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-31-20181203-pull-request: usb-mtp: outlaw slashes in filenames usb-mtp: fix utf16_to_str Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03usb-mtp: outlaw slashes in filenamesGerd Hoffmann
Slash is unix directory separator, so they are not allowed in filenames. Note this also stops the classic escape via "../". Fixes: CVE-2018-16867 Reported-by: Michael Hanselmann <public@hansmi.ch> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181203101045.27976-3-kraxel@redhat.com
2018-12-03usb-mtp: fix utf16_to_strGerd Hoffmann
Make utf16_to_str return an allocated string. Remove the assumtion that the number of string bytes equals the number of utf16 chars (which is only true for ascii chars). Instead call wcstombs twice, once to figure the storage size and once for the actual conversion (as suggested by the wcstombs manpage). FIXME: surrogate pairs are not working correctly. Pre-existing bug, fixing that is left for another day. Reported-by: Michael Hanselmann <public@hansmi.ch> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20181203101045.27976-2-kraxel@redhat.com
2018-12-03Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-12-03' into ↵Peter Maydell
staging nbd patches for 2018-12-03 Improve x-dirty-bitmap handling for experimenting with pull mode incremental backups. - Eric Blake: 0/3 NBD dirty bitmap cleanups # gpg: Signature made Mon 03 Dec 2018 15:56:23 GMT # gpg: using RSA key A7A16B4A2527436A # gpg: Good signature from "Eric Blake <eblake@redhat.com>" # gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" # gpg: aka "[jpeg image of size 6874]" # Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A * remotes/ericb/tags/pull-nbd-2018-12-03: nbd/client: Send NBD_CMD_DISC if open fails after connect nbd/client: Make x-dirty-bitmap more reliable nbd/server: Advertise all contexts in response to bare LIST Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches: - mirror: Fix deadlock # gpg: Signature made Mon 03 Dec 2018 16:57:33 GMT # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: iotests: simple mirror test with kvm on 1G image mirror: fix dead-lock Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03iotests: simple mirror test with kvm on 1G imageVladimir Sementsov-Ogievskiy
This test is broken without previous commit fixing dead-lock in mirror. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Max Reitz <mreitz@redhat.com> Acked-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-12-03mirror: fix dead-lockVladimir Sementsov-Ogievskiy
Let start from the beginning: Commit b9e413dd375 (in 2.9) "block: explicitly acquire aiocontext in aio callbacks that need it" added pairs of aio_context_acquire/release to mirror_write_complete and mirror_read_complete, when they were aio callbacks for blk_aio_* calls. Then, commit 2e1990b26e5 (in 3.0) "block/mirror: Convert to coroutines" dropped these blk_aio_* calls, than mirror_write_complete and mirror_read_complete are not callbacks more, and don't need additional aiocontext acquiring. Furthermore, mirror_read_complete calls blk_co_pwritev inside these pair of aio_context_acquire/release, which leads to the following dead-lock with mirror: (gdb) info thr Id Target Id Frame 3 Thread (LWP 145412) "qemu-system-x86" syscall () 2 Thread (LWP 145416) "qemu-system-x86" __lll_lock_wait () * 1 Thread (LWP 145411) "qemu-system-x86" __lll_lock_wait () (gdb) bt #0 __lll_lock_wait () #1 _L_lock_812 () #2 __GI___pthread_mutex_lock #3 qemu_mutex_lock_impl (mutex=0x561032dce420 <qemu_global_mutex>, file=0x5610327d8654 "util/main-loop.c", line=236) at util/qemu-thread-posix.c:66 #4 qemu_mutex_lock_iothread_impl #5 os_host_main_loop_wait (timeout=480116000) at util/main-loop.c:236 #6 main_loop_wait (nonblocking=0) at util/main-loop.c:497 #7 main_loop () at vl.c:1892 #8 main Printing contents of qemu_global_mutex, I see that "__owner = 145416", so, thr1 is main loop, and now it wants BQL, which is owned by thr2. (gdb) thr 2 (gdb) bt #0 __lll_lock_wait () #1 _L_lock_870 () #2 __GI___pthread_mutex_lock #3 qemu_mutex_lock_impl (mutex=0x561034d25dc0, ... #4 aio_context_acquire (ctx=0x561034d25d60) #5 dma_blk_cb #6 dma_blk_io #7 dma_blk_read #8 ide_dma_cb #9 bmdma_cmd_writeb #10 bmdma_write #11 memory_region_write_accessor #12 access_with_adjusted_size #15 flatview_write #16 address_space_write #17 address_space_rw #18 kvm_handle_io #19 kvm_cpu_exec #20 qemu_kvm_cpu_thread_fn #21 qemu_thread_start #22 start_thread #23 clone () Printing mutex in fr 2, I see "__owner = 145411", so thr2 wants aio context mutex, which is owned by thr1. Classic dead-lock. Then, let's check that aio context is hold by mirror coroutine: just print coroutine stack of first tracked request in mirror job target: (gdb) [...] (gdb) qemu coroutine 0x561035dd0860 #0 qemu_coroutine_switch #1 qemu_coroutine_yield #2 qemu_co_mutex_lock_slowpath #3 qemu_co_mutex_lock #4 qcow2_co_pwritev #5 bdrv_driver_pwritev #6 bdrv_aligned_pwritev #7 bdrv_co_pwritev #8 blk_co_pwritev #9 mirror_read_complete () at block/mirror.c:232 #10 mirror_co_read () at block/mirror.c:370 #11 coroutine_trampoline #12 __start_context Yes it is mirror_read_complete calling blk_co_pwritev after acquiring aio context. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-12-03i386: hvf: Fix overrun of _decode_tbl1Roman Bolshakov
Single opcode instructions in ff group were incorrectly processed because an overrun of _decode_tbl1[0xff] resulted in access of _decode_tbl2[0x0]. Thus, decode_sldtgroup was called instead of decode_ffgroup: 7d71: decode_sldtgroup: 1 Unimplemented handler (7d71) for 108 (ff 0) While at it correct maximum length for _decode_tbl2 and _decode_tbl3. Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03i2c: Add a length check to the SMBus write handlingCorey Minyard
Avoid an overflow. Signed-off-by: Corey Minyard <cminyard@mvista.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: QEMU Stable <qemu-stable@nongnu.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-30nbd/client: Send NBD_CMD_DISC if open fails after connectEric Blake
If nbd_client_init() fails after we are already connected, then the server will spam logs with: Disconnect client, due to: Unexpected end-of-file before all bytes were read unless we gracefully disconnect before closing the connection. Ways to trigger this: $ opts=driver=nbd,export=foo,server.type=inet,server.host=localhost,server.port=10809 $ qemu-img map --output=json --image-opts $opts,read-only=off $ qemu-img map --output=json --image-opts $opts,x-dirty-bitmap=nosuch: Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181130023232.3079982-4-eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2018-11-30nbd/client: Make x-dirty-bitmap more reliableEric Blake
The implementation of x-dirty-bitmap in qemu 3.0 (commit 216ee365) silently falls back to treating the server as not supporting NBD_CMD_BLOCK_STATUS if a requested meta_context name was not negotiated, which in turn means treating the _entire_ image as data. Since our hack relied on using 'qemu-img map' to view which portions of the image were dirty by seeing what the redirected bdrv_block_status() treats as holes, this means that our fallback treats the entire image as clean. Better would have been to treat the entire image as dirty, or to fail to connect because the user's request for a specific context could not be honored. This patch goes with the latter. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181130023232.3079982-3-eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2018-11-30nbd/server: Advertise all contexts in response to bare LISTEric Blake
The NBD spec, and even our code comment, says that if the client asks for NBD_OPT_LIST_META_CONTEXT with 0 queries, then we should reply with (a possibly-compressed representation of) ALL contexts that we are willing to let them try. But commit 3d068aff forgot to advertise qemu:dirty-bitmap:FOO. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20181130023232.3079982-2-eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2018-11-28Update version for v3.1.0-rc3 releasev3.1.0-rc3Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-28target/arm/sve_helper: Fix compilation with clang 3.4Thomas Huth
Clang 3.4 does not know the "flatten" attribute yet. We've already introduced the QEMU_FLATTEN macro for this in commit 97ff87c0ed020c2, so use this macro now here, too, to fix this issue. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1543399094-2260-1-git-send-email-thuth@redhat.com Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-28hw/arm/aspeed: Fix build issue with clang 3.4Thomas Huth
When using clang 3.4.2, compilation of QEMU fails like this: CC aarch64-softmmu/hw/arm/aspeed.o hw/arm/aspeed.c:36:3: error: redefinition of typedef 'AspeedBoardState' is a C11 feature [-Werror,-Wtypedef-redefinition] } AspeedBoardState; ^ include/hw/arm/aspeed.h:14:33: note: previous definition is here typedef struct AspeedBoardState AspeedBoardState; ^ 1 error generated. make[1]: *** [hw/arm/aspeed.o] Error 1 make: *** [subdir-aarch64-softmmu] Error 2 Remove the duplicated typedef to fix this issue. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-id: 1543397736-8198-1-git-send-email-thuth@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-28Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* lsi HBA reselection fix (George) * Small cleanups (Li Qiang) * bugfixes for vhost-user-bridge and hostmem (Marc-André) * single-thread TCG fix (me) * VMX migration blocker (me) * target/i386 fix for LOCK (Richard) * MAINTAINERS update (Philippe, Thomas) # gpg: Signature made Wed 28 Nov 2018 10:51:36 GMT # gpg: using RSA key BFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: hostmem: no need to check for host_memory_backend_mr_inited() in alloc() hostmem-memfd: honour share=on/off property MAINTAINERS: Add an entry for the Firmware Configuration (fw_cfg) device MAINTAINERS: Add some missing entries related to accelerators target/i386: Generate #UD when applying LOCK to a register destination checkpatch: g_test_message does not need a trailing newline vl.c: remove outdated comment vhost-user-bridge: fix recvmsg iovlen vl: Improve error message when we can't load fw_cfg from file vmstate: constify VMStateField migration: savevm: consult migration blockers lsi: Reselection needed to remove pending commands from queue cpus: run work items for all vCPUs if single-threaded target/i386: kvm: add VMX migration blocker Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-28hostmem: no need to check for host_memory_backend_mr_inited() in alloc()Marc-André Lureau
memfd_backend_memory_alloc/file_backend_memory_alloc both needlessly are are calling host_memory_backend_mr_inited() which creates an illusion that alloc could be called multiple times but it isn't, it's called once from UserCreatable complete(). Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27scsi: Address spurious clang warningJohn Snow
Some versions of Clang prior to 6.0 (and some builds of clang after, such as 6.0.1-2.fc28) fail to recognize { 0 } as a valid initializer for a struct with subobjects when -Wmissing-braces is enabled. https://bugs.llvm.org/show_bug.cgi?id=21689 and https://reviews.llvm.org/rL314499 suggests this should be fixed in 6.0, but it might not be the case for older versions or downstream versions. For now, follow the precedent of ebf2a499 and replace the standard { 0 } with the accepted { } to silence this warning and allow the build to work under clang 6.0.1-2.fc28, and builds prior to 6.0. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 20181127184929.20065-1-jsnow@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27vfio-helpers: Fix qemu_vfio_open_pci() crashMarkus Armbruster
qemu_vfio_open_common() initializes s->lock only after passing s to qemu_vfio_dma_map() via qemu_vfio_init_ramblock(). qemu_vfio_dma_map() tries to lock the uninitialized lock and crashes. Fix by initializing s->lock first. RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1645840 Fixes: 418026ca43bc2626db092d7558258f9594366f28 Cc: qemu-stable@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20181127084143.1113-1-armbru@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27hostmem-memfd: honour share=on/off propertyMarc-André Lureau
The share=on/off property is used to modified mmap() MAP_SHARED setting. Make it on by default for convenience and compatibility reasons. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27MAINTAINERS: Add an entry for the Firmware Configuration (fw_cfg) devicePhilippe Mathieu-Daudé
Step in to maintain it, with Laszlo (EDK2) and Gerd (SeaBIOS) as designated reviewers. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20181122021139.1486-1-philmd@redhat.com> Acked-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27MAINTAINERS: Add some missing entries related to acceleratorsThomas Huth
Add some files from accel/stubs/, include/hw/kvm/ and scripts/kvm/ to the MAINTAINERS file. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <1542891438-13329-1-git-send-email-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27target/i386: Generate #UD when applying LOCK to a register destinationRichard Henderson
Fixes a TCG crash due to attempting the atomic operation without having set up the address first. This does not attempt to fix all of the other missing checks for LOCK. Fixes: a7cee522f35 Fixes: https://bugs.launchpad.net/qemu/+bug/1803160 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20181113193510.24862-1-richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27checkpatch: g_test_message does not need a trailing newlinePaolo Bonzini
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27vl.c: remove outdated commentLi Qiang
Cc: qemu-trivial@nongnu.org Signed-off-by: Li Qiang <liq3ea@gmail.com> Message-Id: <1542276385-7638-1-git-send-email-liq3ea@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27vhost-user-bridge: fix recvmsg iovlenMarc-André Lureau
After iov_discard_front(), the iov may be smaller than its initial size. Fixes the heap-buffer-overflow spotted by ASAN: ==9036==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060000001e0 at pc 0x7fe632eca3f0 bp 0x7ffddc4a05a0 sp 0x7ffddc49fd48 WRITE of size 32 at 0x6060000001e0 thread T0 #0 0x7fe632eca3ef (/lib64/libasan.so.5+0x773ef) #1 0x7fe632ecad23 in __interceptor_recvmsg (/lib64/libasan.so.5+0x77d23) #2 0x561e7491936b in vubr_backend_recv_cb /home/elmarco/src/qemu/tests/vhost-user-bridge.c:333 #3 0x561e74917711 in dispatcher_wait /home/elmarco/src/qemu/tests/vhost-user-bridge.c:160 #4 0x561e7491c3b5 in vubr_run /home/elmarco/src/qemu/tests/vhost-user-bridge.c:725 #5 0x561e7491c85c in main /home/elmarco/src/qemu/tests/vhost-user-bridge.c:806 #6 0x7fe631a6c412 in __libc_start_main (/lib64/libc.so.6+0x24412) #7 0x561e7491667d in _start (/home/elmarco/src/qemu/build/tests/vhost-user-bridge+0x3967d) 0x6060000001e0 is located 0 bytes to the right of 64-byte region [0x6060000001a0,0x6060000001e0) allocated by thread T0 here: #0 0x7fe632f42848 in __interceptor_malloc (/lib64/libasan.so.5+0xef848) #1 0x561e7493acd8 in virtqueue_alloc_element /home/elmarco/src/qemu/contrib/libvhost-user/libvhost-user.c:1848 #2 0x561e7493c2a8 in vu_queue_pop /home/elmarco/src/qemu/contrib/libvhost-user/libvhost-user.c:1954 #3 0x561e749189bf in vubr_backend_recv_cb /home/elmarco/src/qemu/tests/vhost-user-bridge.c:297 #4 0x561e74917711 in dispatcher_wait /home/elmarco/src/qemu/tests/vhost-user-bridge.c:160 #5 0x561e7491c3b5 in vubr_run /home/elmarco/src/qemu/tests/vhost-user-bridge.c:725 #6 0x561e7491c85c in main /home/elmarco/src/qemu/tests/vhost-user-bridge.c:806 #7 0x7fe631a6c412 in __libc_start_main (/lib64/libc.so.6+0x24412) SUMMARY: AddressSanitizer: heap-buffer-overflow (/lib64/libasan.so.5+0x773ef) Shadow bytes around the buggy address: 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c0c7fff8000: fa fa fa fa 00 00 00 00 00 00 05 fa fa fa fa fa 0x0c0c7fff8010: 00 00 00 00 00 00 00 00 fa fa fa fa fd fd fd fd 0x0c0c7fff8020: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00 00 00[fa]fa fa fa 0x0c0c7fff8040: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd 0x0c0c7fff8050: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd 0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0c7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20181109173028.3372-1-marcandre.lureau@redhat.com> Signed-off-by: Paolo BOnzini <pbonzini@redhat.com>
2018-11-27vl: Improve error message when we can't load fw_cfg from fileLi Qiang
parse_fw_cfg() reports "can't load" without further details. Get the details from g_file_get_contents(), and include them in the error message. Signed-off-by: Li Qiang <liq3ea@gmail.com> Message-Id: <1541051971-28584-1-git-send-email-liq3ea@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27vmstate: constify VMStateFieldMarc-André Lureau
Because they are supposed to remain const. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20181114132931.22624-1-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches: - block: Fix crash on migration with explicit child nodes - nvme: Fix spurious interrupts # gpg: Signature made Tue 27 Nov 2018 11:59:40 GMT # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: nvme: Fix spurious interrupts iotests: Test migration with -blockdev block: Don't inactivate children before parents Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27migration: savevm: consult migration blockersPaolo Bonzini
There is really no difference between live migration and savevm, except that savevm does not require bdrv_invalidate_cache to be implemented by all disks. However, it is unlikely that savevm is used with anything except qcow2 disks, so the penalty is small and worth the improvement in catching bad usage of savevm. Only one place was taking care of savevm when adding a migration blocker, and it can be removed. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27lsi: Reselection needed to remove pending commands from queueGeorge Kennedy
Under heavy IO (e.g. fio) the queue is not checked frequently enough for pending commands. As a result some pending commands are timed out by the linux sym53c8xx driver, which sends SCSI Abort messages for the timed out commands. The SCSI Abort messages result in linux errors, which show up on the console and in /var/log/messages. e.g. sd 0:0:3:0: [sdd] tag#33 ABORT operation started scsi target0:0:3: control msgout: 80 20 47 d sd 0:0:3:0: ABORT operation complete. scsi target0:0:4: message d sent on bad reselection Now following a WAIT DISCONNECT Script instruction, and if there is no current command, check for a pending command on the queue and if one exists call lsi_reselect(). Signed-off-by: George Kennedy <george.kennedy@oracle.com> Message-Id: <1541776692-12271-1-git-send-email-george.kennedy@oracle.com> [For safety, add a s->current check in lsi_update_irq - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27cpus: run work items for all vCPUs if single-threadedPaolo Bonzini
This avoids the following I/O thread deadlock: 1) the I/O thread calls run_on_cpu for CPU 3 from a timer. single_tcg_halt_cond is signaled 2) CPU 1 is running and exits. It finds no work item and enters CPU 2 3) because the I/O thread is stuck in run_on_cpu, the round-robin kick timer never triggers, and CPU 3 never runs the work item 4) run_on_cpu never completes Reviewed-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27target/i386: kvm: add VMX migration blockerPaolo Bonzini
Nested VMX does not support live migration yet. Add a blocker until that is worked out. Nested SVM only does not support it, but unfortunately it is enabled by default for -cpu host so we cannot really disable it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27hw/virt/arm: Add support for Cortex-A72 in virtZhiPeng Lu
Signed-off-by: ZhiPeng Lu <luzhipeng@uniudc.com> Message-id: 1543316565-1101590-1-git-send-email-luzhipeng@uniudc.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27nvme: Fix spurious interruptsKeith Busch
The code had asserted an interrupt every time it was requested to check for new completion queue entries.This can result in spurious interrupts seen by the guest OS. Fix this by asserting an interrupt only if there are un-acknowledged completion queue entries available. Reported-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Keith Busch <keith.busch@intel.com> Tested-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-27iotests: Test migration with -blockdevKevin Wolf
Check that block node activation and inactivation works with a block graph that is built with individually created nodes. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2018-11-27block: Don't inactivate children before parentsKevin Wolf
bdrv_child_cb_inactivate() asserts that parents are already inactive when children get inactivated. This precondition is necessary because parents could still issue requests in their inactivation code. When block nodes are created individually with -blockdev, all of them are monitor owned and will be returned by bdrv_next() in an undefined order (in practice, in the order of their creation, which is usually children before parents), which obviously fails the assertion: qemu: block.c:899: bdrv_child_cb_inactivate: Assertion `bs->open_flags & BDRV_O_INACTIVE' failed. This patch fixes the ordering by skipping nodes with still active parents in bdrv_inactivate_recurse() because we know that they will be covered by recursion when the last active parent becomes inactive. With the correct parents-before-children ordering, we also got rid of the reason why commit aad0b7a0bfb introduced two passes, so we can go back to a single-pass recursion. This is necessary so we can rely on the BDRV_O_INACTIVE flag to skip nodes with active parents (the flag used to be set only in pass 2, so we would always skip non-root nodes in pass 1 because all parents would still be considered active; setting the flag in pass 1 would mean, that we never skip anything in pass 2 because all parents are already considered inactive). Because of the change to single pass, this patch is best reviewed with whitespace changes ignored. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2018-11-27Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/fixes-31-20181127-pull-request' into staging various bugfixes for 3.1: fmops, ps2, cirrus, hda, usb-host, qapi # gpg: Signature made Tue 27 Nov 2018 06:49:13 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-31-20181127-pull-request: qapi: add query-display-options command usb-host: set ifs.detached as true if kernel driver is not active audio/hda: fix guest triggerable assert cirrus_vga/migration: update the bank offset before use ps2kbd: default to scan enabled after reset fmops: fix off-by-one in AR_TABLE and DR_TABLE array size Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27Merge remote-tracking branch ↵Peter Maydell
'remotes/ehabkost/tags/x86-for-3.1-pull-request' into staging x86 fixes for -rc3 * Fix SynIC crash * Fix x86 crash on MSR code on AMD hosts # gpg: Signature made Mon 26 Nov 2018 20:58:34 GMT # gpg: using RSA key 2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/x86-for-3.1-pull-request: hw/hyperv: fix NULL dereference with pure-kvm SynIC kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES support Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27qapi: add query-display-options commandGerd Hoffmann
Add query-display-options command, which allows querying the qemu display configuration. This isn't particularly useful, except it exposes QAPI type DisplayOptions in query-qmp-schema, so that libvirt can discover recently added -display parameter rendernode (commit d4dc4ab133b). Works around lack of sufficiently powerful command line introspection. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: Eric Blake <eblake@redhat.com> Tested-by: Erik Skultety <eskultet@redhat.com> Message-id: 20181122071613.2889-1-kraxel@redhat.com [ kraxel: reworded commit message as suggested by armbru ]
2018-11-27usb-host: set ifs.detached as true if kernel driver is not activelinzhecheng
If no kernel driver is active, we can already claim and perform I/O on it without detaching it. Signed-off-by: linzhecheng <linzhecheng@huawei.com> Message-id: 20181120083419.17716-1-linzhecheng@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-27audio/hda: fix guest triggerable assertGerd Hoffmann
Guest writes to a readonly register trigger the assert in intel_hda_reg_write(). Add a check and just ignore them. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1628433 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20181123063957.9515-1-kraxel@redhat.com
generated by cgit v1.2.3 (git 2.26.2) at 2024-11-25 11:03:52 +0000