aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2016-09-15Merge remote-tracking branch 'remotes/awilliam/tags/vfio-fixes-20160915.0' ↵Peter Maydell
into staging VFIO fixes 2016-09-15 Fix a 2.7.0 regression affecting POWER8 systems in relation to EEH, possibly extending to subtle changes for other devices and archs. (David Gibson) # gpg: Signature made Thu 15 Sep 2016 18:31:42 BST # gpg: using RSA key 0x239B9B6E3BB08B22 # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" # gpg: aka "Alex Williamson <alex@shazbot.org>" # gpg: aka "Alex Williamson <alwillia@redhat.com>" # gpg: aka "Alex Williamson <alex.l.williamson@gmail.com>" # Primary key fingerprint: 42F6 C04E 540B D1A9 9E7B 8A90 239B 9B6E 3BB0 8B22 * remotes/awilliam/tags/vfio-fixes-20160915.0: vfio/pci: Fix regression in MSI routing configuration Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-15Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* Support multiple -d trace:PATTERN arguments (Daniel) * SCSI cleanups/fixes for removable meia (Fam) * SCSI security fixes (Li Qiang, PJP) * qemu-char segfault fix (Lin Ma) * "make help" and qemu-socket cleanups (Marc-André) * end of the buffer_is_zero reword (Richard) * Fix target-i386 syscall segfault (Stanislav) * split irqchip fix/robustification (Wanpeng) * misc cleanups (me, Jiangang) * x86 vmstate fixes (Pavel) # gpg: Signature made Thu 15 Sep 2016 14:11:35 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: pcspk: adding vmstate for save/restore kvmvapic: fix state change handler pc: apic: introduce APIC macro target-i386: Fixed syscall posssible segfault log: fix parsing of multiple trace:PATTERN log args qemu-char: avoid segfault if user lacks of permisson of a given logfile build-sys: add make 'help' target linux-user: complete omission of removing uses of strdup target-i386: fix ordering of fields in CPUX86State pc: apic: fix touch LAPIC when irqchip is split scsi: pvscsi: limit process IO loop to ring size memory: remove memory_region_destructor_rom_device Change net/socket.c to use socket_*() functions cutils: Rewrite x86 buffer zero checking scsi: mptsas: use g_new0 to allocate MPTSASRequest object virtio-scsi: Don't abort when media is ejected scsi-disk: Cleaning up around tray open state Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-15vfio/pci: Fix regression in MSI routing configurationDavid Gibson
d1f6af6 "kvm-irqchip: simplify kvm_irqchip_add_msi_route" was a cleanup of kvmchip routing configuration, that was mostly intended for x86. However, it also contains a subtle change in behaviour which breaks EEH[1] error recovery on certain VFIO passthrough devices on spapr guests. So far it's only been seen on a BCM5719 NIC on a POWER8 server, but there may be other hardware with the same problem. It's also possible there could be circumstances where it causes a bug on x86 as well, though I don't know of any obvious candidates. Prior to d1f6af6, both vfio_msix_vector_do_use() and vfio_add_kvm_msi_virq() used msg == NULL as a special flag to mark this as the "dummy" vector used to make the host hardware state sync with the guest expected hardware state in terms of MSI configuration. Specifically that flag caused vfio_add_kvm_msi_virq() to become a no-op, meaning the dummy irq would always be delivered via qemu. d1f6af6 changed vfio_add_kvm_msi_virq() so it takes a vector number instead of the msg parameter, and determines the correct message itself. The test for !msg was removed, and not replaced with anything there or in the caller. With an spapr guest which has a VFIO device, if an EEH error occurs on the host hardware, then the device will be isolated then reset. This is a combination of host and guest action, mediated by some EEH related hypercalls. I haven't fully traced the mechanics, but somehow installing the kvm irqchip route for the dummy irq on the BCM5719 means that after EEH reset and recovery, at least some irqs are no longer delivered to the guest. In particular, the guest never gets the link up event, and so the NIC is effectively dead. [1] EEH (Enhanced Error Handling) is an IBM POWER server specific PCI-* error reporting and recovery mechanism. The concept is somewhat similar to PCI-E AER, but the details are different. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1373802 Cc: Alex Williamson <alex.williamson@redhat.com> Cc: Peter Xu <peterx@redhat.com> Cc: Gavin Shan <gwshan@au1.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Cc: qemu-stable@nongnu.org Fixes: d1f6af6a17a6 ("kvm-irqchip: simplify kvm_irqchip_add_msi_route") Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2016-09-15Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into ↵Peter Maydell
staging trivial patches for 2016-09-15 # gpg: Signature made Thu 15 Sep 2016 13:40:55 BST # gpg: using RSA key 0x701B4F6B1A693E59 # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * remotes/mjt/tags/trivial-patches-fetch: (21 commits) mptsas: change .realize function name linux-user/qemu.h: change malloc to g_malloc, free to g_free win32: don't run subprocess tests on Mingw32 platform sheepdog: remove useless casts fw_cfg: remove useless casts tricore: remove useless cast s390x: remove useless cast linux-user,s390x: remove useless cast coccinelle: add a script to remove useless casts curl: Operate on zero-length file Remove unused function declarations ivshmem: Delete duplicate debug message sh4: fix broken link to documentation MAINTAINERS: Fix up F: entry bit rot MAINTAINERS: Add include/sysemu/cpus.h MAINTAINERS: Add include/hw/sh4/ to SH4 section MAINTAINERS: Add include/hw/tricore/ to TriCore section MAINTAINERS: Add include/hw/unicore32/ to UniCore32 section ui/console: Fix non-working backspace key in monitor of gtk UI tcg: Remove duplicate header includes ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-15Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20160914-1' into ↵Peter Maydell
staging usb-mtp: add support for files larger than 4g (gsoc) xhci & usb-host: bugfixes. # gpg: Signature made Wed 14 Sep 2016 10:30:38 BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-usb-20160914-1: usb-mtp: added object properties usb-mtp: fix sending files larger than 4gb usb:xhci:fix memory leak in usb_xhci_exit usb-host: fix streams detection in usb_host_speed_compat xhci: Fix remainder field for TR_SETUP completion event. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-15pcspk: adding vmstate for save/restorePavel Dovgalyuk
VMState added by this patch preserves correct loading of the PC speaker device state. Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Message-Id: <20160915090133.6440.65457.stgit@PASHA-ISP> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-15kvmvapic: fix state change handlerPavel Dovgalyuk
This patch fixes kvmvapic state change handler. It clears vmsentry field to allow recreating it at further vmstate loads. Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Message-Id: <20160915090127.6440.48793.stgit@PASHA-ISP> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-15pc: apic: introduce APIC macroWanpeng Li
Introduce a new APIC macro to replace APIC_COMMON macro in hw/intc/apic.c in order to capture access LAPIC in qemu even if LAPIC is emulated in kvm. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Radim Krčmář <rkrcmar@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com> Message-Id: <1473923759-13912-1-git-send-email-wanpeng.li@hotmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-15mptsas: change .realize function nameCao jin
All the other devices` .realize function name are xxx_realize, except this one. cc: Michael S. Tsirkin <mst@redhat.com> cc: Marcel Apfelbaum <marcel@redhat.com> cc: Paolo Bonzini <pbonzini@redhat.com> cc: Markus Armbruster <armbru@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-15fw_cfg: remove useless castsLaurent Vivier
This patch is the result of coccinelle script scripts/coccinelle/typecast.cocci CC: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-15tricore: remove useless castLaurent Vivier
This patch is the result of coccinelle script scripts/coccinelle/typecast.cocci CC: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-15s390x: remove useless castLaurent Vivier
This patch is the result of coccinelle script scripts/coccinelle/typecast.cocci CC: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-15Remove unused function declarationsLadi Prosek
Unused function declarations were found using a simple gcc plugin and manually verified by grepping the sources. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-15ivshmem: Delete duplicate debug messageStefano Dong (董兴水)
Duplicated in commit ca0b756. Delete it. Signed-off-by: Stefano Dong (董兴水) <opensource.dxs@aliyun.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-15sh4: fix broken link to documentationReda Sallahi
The page that was previously linked in the source code and the README file is no longer available so it now returns a 404 error message. This puts a previous snapshot from archive.org instead. Signed-off-by: Reda Sallahi <fullmanet@gmail.com> Acked-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-15Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* minor patches here and there * MTTCG: lock-free TB lookup * SCSI: bugfixes for MPTSAS, MegaSAS, LSI53c, vmw_pvscsi * buffer_is_zero rewrite (except for one patch) * chardev: qemu_chr_fe_write checks * checkpatch improvement for markdown preformatted text * default-configs cleanups * atomics cleanups # gpg: Signature made Tue 13 Sep 2016 18:14:30 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (58 commits) cutils: Add generic prefetch cutils: Add SSE4 version cutils: Add test for buffer_is_zero cutils: Remove ppc buffer zero checking cutils: Remove aarch64 buffer zero checking cutils: Rearrange buffer_is_zero acceleration cutils: Export only buffer_is_zero cutils: Remove SPLAT macro cutils: Move buffer_is_zero and subroutines to a new file ppc: do not redefine CPUPPCState x86/lapic: Load LAPIC state at post_load optionrom: do not rely on compiler's bswap optimization checkpatch: Fix whitespace checks for documentation code blocks atomics: Use __atomic_*_n() variant primitives atomics: Remove redundant barrier()'s kvm-all: drop kvm_setup_guest_memory i8257: Make device "i8257" unavailable with -device Revert "megasas: remove useless check for cmd->frame" char: convert qemu_chr_fe_write to qemu_chr_fe_write_all hw: replace most use of qemu_chr_fe_write with qemu_chr_fe_write_all ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Conflicts: cpus.c tests/Makefile.include
2016-09-14pc: apic: fix touch LAPIC when irqchip is splitWanpeng Li
Add -kernel_irqchip=split ./x86-run x86/eventinj.flat qemu-system-x86_64 -enable-kvm -machine kernel_irqchip=split -cpu host -device pc-testdev -device isa-debug-exit,iobase=0xf4,iosize=0x4 -vnc none -serial stdio -device pci-testdev -kernel x86/eventinj.flat enabling apic paging enabled cr0 = 80010011 cr3 = 7fff000 cr4 = 20 Sending vec 33 and 62 and mask one with TPR irq1 running irq1 running After 33/62 TPR test FAIL: TPR irq0 running irq0 running Both irq1 and irq0 are executing twice. kvm_entry: vcpu 0 kvm_exit: reason MSR_WRITE rip 0x401f33 info 0 0 kvm_apic: apic_write APIC_EOI = 0x0 kvm_eoi: apicid 0 vector 62 kvm_msr: msr_write 80b = 0x0 kvm_entry: vcpu 0 kvm_exit: reason PENDING_INTERRUPT rip 0x401f35 info 0 0 kvm_userspace_exit: reason KVM_EXIT_IRQ_WINDOW_OPEN (7) kvm_inj_virq: irq 62 kvm_entry: vcpu 0 kvm_exit: reason IO_INSTRUCTION rip 0x4016ec info 3fd0008 0 From the trace we can see there is an interrupt window exit after the first interrupt EOI(irq 62), and the same irq(62) is injected duplicately after the interrupt window. QEMU does KVM_INTERRUPT(62) ioctl after KVM exits with KVM_EXIT_IRQ_WINDOW_OPEN, which QEMU requested while the guest was printing. The printing calls serial_update_irq() -> qemu_irq_lower() -> qemu_set_irq() -> gsi_handler() -> qemu_set_irq() -> pic_irq_request() -> apic_deliver_pic_intr() -> kvm_handle_interrupt() kvm_handle_interrupt() does interrupt_request |= CPU_INTERRUPT_HARD which later calls cpu_get_pic_interrupt() in kvm_arch_pre_run(), but that function uses stale information from APIC and injects 62 again. If we synchronized the APIC, then the test would #GP, because there would be no injectable interrupt in LAPIC or PIC, so pic_read_irq() would return 15, thinking it was spurious. This patch fix it by don't touch LAPIC if LAPIC is in kernel. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Suggested-by: Radim Krčmář <rkrcmar@redhat.com> Cc: qemu-stable@nongnu.org Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Radim Krčmář <rkrcmar@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com> Message-Id: <1473832464-3478-1-git-send-email-wanpeng.li@hotmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14scsi: pvscsi: limit process IO loop to ring sizePrasad J Pandit
Vmware Paravirtual SCSI emulator while processing IO requests could run into an infinite loop if 'pvscsi_ring_pop_req_descr' always returned positive value. Limit IO loop to the ring size. Cc: qemu-stable@nongnu.org Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1473845952-30785-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14scsi: mptsas: use g_new0 to allocate MPTSASRequest objectLi Qiang
When processing IO request in mptsas, it uses g_new to allocate a 'req' object. If an error occurs before 'req->sreq' is allocated, It could lead to an OOB write in mptsas_free_request function. Use g_new0 to avoid it. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1473684251-17476-1-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14virtio-scsi: Don't abort when media is ejectedFam Zheng
With an ejected block backend, blk_get_aio_context() would return qemu_aio_context. In this case don't assert. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1473848224-24809-3-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14scsi-disk: Cleaning up around tray open stateFam Zheng
Even if tray is not open, it can be empty (blk_is_inserted() == false). Handle both cases correctly by replacing the s->tray_open checks with blk_is_available(), which is an AND of the two. Also simplify successive checks of them into blk_is_available(), in a couple cases. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1473848224-24809-2-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14usb-mtp: added object propertiesIsaac Lozano
Windows uses object properties to determine the size of a file, so to add object properties, we must also add a minimum set of new commands and object properties. Most object properties are data that we already have, except for the unique persistant object identifier. Windows doesn't use this property, it seems, so we can cheat a bit and just use the object handle for it. Signed-off-by: Isaac Lozano <109lozanoi@gmail.com> Message-id: a741d0dd380cd7eb1695e1eb34ee6f341183f20a.1470477265.git.109lozanoi@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-09-14usb-mtp: fix sending files larger than 4gbIsaac Lozano
MTP requires that if a file is larger than 4gb or if sending data larger than 4gb, that the length field be set to 0xFFFFFFFF. Also widened a couple variables to prevent overflow errors. Signed-off-by: Isaac Lozano <109lozanoi@gmail.com> Message-id: 01ad8ec7775f58575801ac3f13716f553a16815e.1470477265.git.109lozanoi@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-09-13x86/lapic: Load LAPIC state at post_loadDr. David Alan Gilbert
Load the LAPIC state during post_load (rather than when the CPU starts). This allows an interrupt to be delivered from the ioapic to the lapic prior to cpu loading, in particular the RTC that starts ticking as soon as we load it's state. Fixes a case where Windows hangs after migration due to RTC interrupts disappearing. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13i8257: Make device "i8257" unavailable with -deviceMarkus Armbruster
The ISA DMA controller needs to be wired up to the ISA bus by isa_bus_dma() to actually work. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1472660151-19517-1-git-send-email-armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13Revert "megasas: remove useless check for cmd->frame"Paolo Bonzini
This reverts commit 8cc46787b5b58f01a11c919c7ff939ed009e27fc. It turns out that cmd->frame can be NULL and thus the commit can cause a SIGSEGV Reported-by: Holger Schranz <holger@fam-schranz.de> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13hw: replace most use of qemu_chr_fe_write with qemu_chr_fe_write_allDaniel P. Berrange
The qemu_chr_fe_write method will return -1 on EAGAIN if the chardev backend write would block. Almost no callers of the qemu_chr_fe_write() method check the return value, instead blindly assuming data was successfully sent. In most cases this will lead to silent data loss on interactive consoles, but in some cases (eg RNG EGD) it'll just cause corruption of the protocol being spoken. We unfortunately can't fix the virtio-console code, due to a bug in the Linux guest drivers, which would cause the entire Linux kernel to hang if we delay processing of the incoming data in any way. Fixing this requires first fixing the guest driver to not hold spinlocks while writing to the hvc device backend. Fixes bug: https://bugs.launchpad.net/qemu/+bug/1586756 Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1473170165-540-4-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13sclpconsolelm: remove bogus check for -EAGAINDaniel P. Berrange
The write_console_data() method in sclpconsole-lm.c checks whether the return value of qemu_chr_fe_write() has the value of -EAGAIN and if so then increments the buffer offset by the value of EAGAIN. Fortunately qemu_chr_fe_write() will never return EAGAIN directly, rather it returns -1 with errno set to EAGAIN, so this broken code path was not reachable. The behaviour on EAGAIN was stil bad though, causing the write_console_data() to busy_wait repeatedly calling qemu_chr_fe_write() with no sleep between iters. Just remove all this loop logic and replace with a call to qemu_chr_fe_write_all(). Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1473170165-540-3-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13ipmi: check return of qemu_chr_fe_write() for errorsDaniel P. Berrange
The continue_send() method in ipmi_bmc_extern.c directly assigns the return value of qemu_chr_fe_write() to the variable tracking the I/O buffer offset. This ignores the possibility that the return value could be -1 and so will cause I/O go backwards on EAGAIN. Fortunately 'outpos' is unsigned, so can't go negative - it will become MAX_INT which will cause the loop to stop, and avoid an accidental out of bounds array access. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1473170165-540-2-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi: pvscsi: limit loop to fetch SG listPrasad J Pandit
In PVSCSI paravirtual SCSI bus, pvscsi_convert_sglist can take a very long time or go into an infinite loop due to two different bugs: 1) the request descriptor data length is defined to be 64 bit. While building SG list from a request descriptor, it gets truncated to 32bit in routine 'pvscsi_convert_sglist'. This could lead to an infinite loop situation large 'dataLen' values when data_length is cast to uint32_t and chunk_size becomes always zero. Fix this by removing the incorrect cast. 2) pvscsi_get_next_sg_elem can be called arbitrarily many times if the element has a zero length. Get out of the loop early when this happens, by introducing an upper limit on the number of SG list elements. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1473108643-12983-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi: mptconfig: fix misuse of MPTSAS_CONFIG_PACKPaolo Bonzini
These issues cause respectively a QEMU crash and a leak of 2 bytes of stack. They were discovered by VictorV of 360 Marvel Team. Reported-by: Tom Victor <i-tangtianwen@360.cm> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi: mptconfig: fix an assert expressionPrasad J Pandit
When LSI SAS1068 Host Bus emulator builds configuration page headers, mptsas_config_pack() should assert that the size fits in a byte. However, the size is expressed in 32-bit units, so up to 1020 bytes fit. The assertion was only allowing replies up to 252 bytes, so fix it. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1472645167-30765-2-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13vmw_pvscsi: check page count while initialising descriptor ringsPrasad J Pandit
Vmware Paravirtual SCSI emulation uses command descriptors to process SCSI commands. These descriptors come with their ring buffers. A guest could set the page count for these rings to an arbitrary value, leading to infinite loop or OOB access. Add check to avoid it. Reported-by: Tom Victor <vv474172261@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1472626169-12989-1-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi-disk: change disk serial length from 20 to 36Rony Weng
Openstack Cinder assigns volume a 36 characters uuid as serial. QEMU will shrinks the uuid to 20 characters, which does not match the original uuid. Note that there is no limit to the length of the serial number in the SCSI spec. 20 was copy-pasted from virtio-blk which in turn was copy-pasted from ATA; 36 is even more arbitrary. However, bumping it up too much might cause issues (e.g. 252 seems to make sense because then the maximum amount of returned data is 256; but who knows there's no off-by-one somewhere for such a nicely rounded number). Signed-off-by: Rony Weng <ronyweng@synology.com> Message-Id: <1472457138-23386-1-git-send-email-ronyweng@synology.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13lsi: never set DMA FIFO Empty (DFE) bit in DSTAT registerHervé Poussineau
53C895A datasheet says: "This bit (DFE) is a pure status bit and will not cause an interrupt" This bit is already auto-generated in lsi_read_reg when reading the DSTAT register. This fixes IBM RS/6000 7020 firmware, which is: - resetting the adapter - enabling all interrupt sources (including DIP, ie interrupts from DSTAT) - waiting for ISTAT0 to become 0 (including DIP=0, ie no interrupt coming from DSTAT) Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1471505489-1221-5-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
2016-09-13lsi: implement I/O memory space for Memory Move instructionsHervé Poussineau
Memory Move instructions can read/write data either from PCI memory or from PCI I/O. Implement second case. Windows 98 now works with LSI 53C810A adapter. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1471505489-1221-4-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
2016-09-13lsi: do not exit QEMU if reading invalid registerHervé Poussineau
When guest accesses invalid register, return 0xff instead of exiting. Also add a log when reading or writing invalid registers. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1471505489-1221-3-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
2016-09-13lsi: print register names in debug printsHervé Poussineau
Modify lsi_reg_readb function to have a single exit point. Debug print can now contain the returned value. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1471505489-1221-2-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
2016-09-13Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into ↵Peter Maydell
staging trivial patches for 2016-09-13 # gpg: Signature made Tue 13 Sep 2016 16:53:11 BST # gpg: using RSA key 0x701B4F6B1A693E59 # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * remotes/mjt/tags/trivial-patches-fetch: hw/net/e1000e: Fix compiler warning target-m68k: fix get_mac_extf helper timer/cpus: fix some typos and update some comments timer.h: fix inconsistency between comment and function prototype timer.h: fix typo maint: Ignore generated version file Document that curses usually needs -k option too trace-event: display "%d" instead of "0x%d" linux-user, trivial: display "0x%x" instead of "0x%d" pic: fix typo in error message: KVM_GET_IRQCHIP -> KVM_SET_IRQCHIP sparc: Use g_memdup() instead of g_new0() + memcpy() vl: remove unnecessary duplicate call to tpm_cleanup arm: spelling fix: mismatch hw/dma/omap: spelling fix: endianness hw/bt/hci: spelling fix: endianness docs: Fix description of the leaky bucket algorithm in throttle.txt Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-13hw/net/e1000e: Fix compiler warningChanglong Xie
slave:~/.xie/qemu-colo # gcc --version gcc (SUSE Linux) 4.3.4 [gcc-4_3-branch revision 152973] slave:~/.xie/qemu-colo # make -j8 CC hw/net/e1000e_core.o hw/net/e1000e_core.c:56: warning: ‘e1000e_set_interrupt_cause’ declared inline after being called hw/net/e1000e_core.c:56: warning: previous declaration of ‘e1000e_set_interrupt_cause’ was here LINK x86_64-softmmu/qemu-system-x86_64 Signed-off-by: Changlong Xie <xiecl.fnst@cn.fujitsu.com> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-13trace-event: display "%d" instead of "0x%d"Laurent Vivier
Display the slot number of mhp_pc_dimm_assigned_slot() using "%d" without the "0x". Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-13pic: fix typo in error message: KVM_GET_IRQCHIP -> KVM_SET_IRQCHIPBruce Rogers
Signed-off-by: Bruce Rogers <brogers@suse.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-13hw/dma/omap: spelling fix: endiannessMichael Tokarev
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-13hw/bt/hci: spelling fix: endiannessMichael Tokarev
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-13Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging Pull request v2: * Fixed qcow2 sanitizer warnings [Peter] * Renamed get_error test cases to get_error_all to avoid tripping "error:" grep scripts [Peter] * Added Fam's iothread stop patch # gpg: Signature made Tue 13 Sep 2016 11:02:30 BST # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: iothread: Stop threads before main() quits tests: fix qvirtqueue_kick MAINTAINERS: add maintainer for replication support replication driver in blockdev-add tests: add unit test case for replication replication: Implement new driver for block replication replication: Introduce new APIs to do replication operation configure: support replication mirror: auto complete active commit docs: block replication's description block: Link backup into block core Backup: export interfaces for extra serialization Backup: clear all bitmap when doing block checkpoint block: unblock backup operations in backing file virtio-blk: rename virtio_device_info to virtio_blk_info linux-aio: process completions from ioq_submit() linux-aio: split processing events function linux-aio: consume events in userspace instead of calling io_getevents qcow2: avoid memcpy(dst, NULL, len) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-13usb:xhci:fix memory leak in usb_xhci_exitLi Qiang
If the xhci uses msix, it doesn't free the corresponding memory, thus leading a memory leak. This patch avoid this. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 57d7d2e0.d4301c0a.d13e9.9a55@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-09-13virtio-blk: rename virtio_device_info to virtio_blk_infoChanglong Xie
The old one is confusing with @virtio_device_info in virtio.c, so make it more appropriate. Signed-off-by: Changlong Xie <xiecl.fnst@cn.fujitsu.com> Message-id: 1470214147-32560-1-git-send-email-xiecl.fnst@cn.fujitsu.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-09-13virtio-vga: adapt to page-per-vq=offGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1473319012-27560-1-git-send-email-kraxel@redhat.com
2016-09-13virtio-gpu-pci: tag as not hotpluggableGerd Hoffmann
We can't hotplug display adapters in qemu, tag virtio-gpu-pci accordingly (virtio-vga already has this). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1473319037-27645-1-git-send-email-kraxel@redhat.com
2016-09-13vmsvga: correct bitmap and pixmap size checksPrasad J Pandit
When processing svga command DEFINE_CURSOR in vmsvga_fifo_run, the computed BITMAP and PIXMAP size are checked against the 'cursor.mask[]' and 'cursor.image[]' array sizes in bytes. Correct these checks to avoid OOB memory access. Reported-by: Qinghao Tang <luodalongde@gmail.com> Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 1473338754-15430-1-git-send-email-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-19 00:19:57 +0000