summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-05-27MAINTAINERS: update Calxeda Highbank maintainer and statusRob Herring1-2/+2
Signed-off-by: Rob Herring <rob.herring@linaro.org> Message-id: 1400116198-3155-1-git-send-email-robherring2@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-27Merge remote-tracking branch 'remotes/rth/fix-tci' into stagingPeter Maydell1-0/+3
* remotes/rth/fix-tci: tci: Fix tcg_out_call Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-27target-arm: Fix segfault on startup when KVM enabledChristoffer Dall1-1/+1
Commit 50a2c6e55fa introduced a bug where QEMU would segfault on startup when using KVM on ARM hosts, because kvm_arm_reset_cpu() accesses cpu->cpreg_reset_values, which is not allocated before kvm_arch_init_vcpu(). Fix this by not calling cpu_reset() until after qemu_init_vcpu(). Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Andreas Faerber <afaerber@suse.de> Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org> Message-id: 1401194263-13010-1-git-send-email-christoffer.dall@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-22tci: Fix tcg_out_callRichard Henderson1-0/+3
Broken since dddbb2e1e3f8137d7e3f1faf9758c66cca0c94ea. Do all the rest of the things that tcg_out_op did before and after the big switch statement. Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-05-22Merge remote-tracking branch 'remotes/qmp-unstable/queue/qmp' into stagingPeter Maydell4-4/+4
* remotes/qmp-unstable/queue/qmp: qapi: zero-initialize all QMP command parameters scripts/qapi.py: Avoid syntax not supported by Python 2.4 doc: add "setup" to list of migration states Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-22Merge remote-tracking branch 'remotes/kraxel/tags/pull-chardev-2' into stagingPeter Maydell4-35/+36
purge error_is_set() # gpg: Signature made Wed 21 May 2014 11:43:44 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-chardev-2: error: error_is_set() is finally unused; remove char: Explain qmp_chardev_add()'s unusual error handling char: Clean up fragile use of error_is_set() char: Use return values instead of error_is_set(errp) qemu-socket: Clean up inet_connect_opts() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-22Merge remote-tracking branch 'remotes/kraxel/tags/pull-audio-5' into stagingPeter Maydell1-3/+4
audio: two intel-hda fixes. # gpg: Signature made Wed 21 May 2014 09:49:39 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-audio-5: hw/audio/intel-hda: Avoid shift into sign bit audio/intel-hda: support FIFORDY Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-22Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20140520' into stagingPeter Maydell19-332/+1111
some s390 patches: - Enable irqfds on s390 via the new adapter interrupt routing type. As a prereq, fix the kvm enable_cap helpers for some compilers and split the s390 flic into kvm and non-kvm parts. - Enable software and hardware debugging support on s390. This needs a kernel headers update. # gpg: Signature made Tue 20 May 2014 12:30:54 BST using RSA key ID C6F02FAF # gpg: Can't check signature: public key not found * remotes/cohuck/tags/s390x-20140520: s390x/kvm: hw debugging support via guest PER facility s390x/kvm: software breakpoint support s390x: remove duplicate definitions of DIAG 501 linux-headers: update s390x/virtio-ccw: wire up irq routing and irqfds s390x/virtio-ccw: reference-counted indicators s390x: add I/O adapter registration s390x: split flic into kvm and non-kvm parts kvm: Fix enable_cap helpers on older gcc Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-22Merge remote-tracking branch 'remotes/bonzini/scsi-next' into stagingPeter Maydell4-6/+7
* remotes/bonzini/scsi-next: megasas: remove buildtime strings block: iscsi build fix if LIBISCSI_FEATURE_IOVECTOR is not defined virtio-scsi: Plug memory leak on virtio_scsi_push_event() error path scsi: Document intentional fall through in scsi_req_length() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-21qapi: zero-initialize all QMP command parametersMichael Roth1-1/+1
In general QMP command parameter values are specified by consumers of the QMP/HMP interface, but in the case of optional parameters these values may be left uninitialized. It is considered a bug for code to make use of optional parameters that have not been flagged as being present by the marshalling code (via corresponding has_<parameter> parameter), however our marshalling code will still pass these uninitialized values on to the corresponding QMP function (to then be ignored). Some compilers (clang in particular) consider this unsafe however, and generate warnings as a result. As reported by Peter Maydell: This is something clang's -fsanitize=undefined spotted. The code generated by qapi-commands.py in qmp-marshal.c for qmp_marshal_* functions where there are some optional arguments looks like this: bool has_force = false; bool force; mi = qmp_input_visitor_new_strict(QOBJECT(args)); v = qmp_input_get_visitor(mi); visit_type_str(v, &device, "device", errp); visit_start_optional(v, &has_force, "force", errp); if (has_force) { visit_type_bool(v, &force, "force", errp); } visit_end_optional(v, errp); qmp_input_visitor_cleanup(mi); if (error_is_set(errp)) { goto out; } qmp_eject(device, has_force, force, errp); In the case where has_force is false, we never initialize force, but then we use it by passing it to qmp_eject. I imagine we don't then actually use the value, but clang complains in particular for 'bool' variables because the value that ends up being loaded from memory for 'force' is not either 0 or 1 (being uninitialized stack contents). Fix this by initializing all QMP command parameters to {0} in the marshalling code prior to passing them on to the QMP functions. Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Reported-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2014-05-21scripts/qapi.py: Avoid syntax not supported by Python 2.4Luiz Capitulino1-1/+1
The Python "except Foo as x" syntax was only introduced in Python 2.6, but we aim to support Python 2.4 and later. Use the old-style "except Foo, x" syntax instead, thus fixing configure/compile on systems with older Python. Reported-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Andreas Färber <andreas.faerber@web.de> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2014-05-21error: error_is_set() is finally unused; removeMarkus Armbruster2-11/+0
Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-21char: Explain qmp_chardev_add()'s unusual error handlingMarkus Armbruster1-1/+7
Character backend open hasn't been fully converted to the Error API. Some opens fail without setting an error. qmp_chardev_add() needs to detect when that happens, and set a generic error. Explain that in a comment, and inline error_is_set() for clarity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-21char: Clean up fragile use of error_is_set()Markus Armbruster1-2/+4
Using error_is_set(ERRP) to find out whether a function failed is either wrong, fragile, or unnecessarily opaque. It's wrong when ERRP may be null, because errors go undetected when it is. It's fragile when proving ERRP non-null involves a non-local argument. Else, it's unnecessarily opaque (see commit 84d18f0). The error_is_set(errp) in qemu_chr_new_from_opts() is merely fragile, because the callers never pass a null errp argument. Make the code more robust and more obviously correct: receive the error in a local variable, then propagate it through the parameter. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-21char: Use return values instead of error_is_set(errp)Markus Armbruster1-9/+9
Using error_is_set(errp) to check whether a function call failed is fragile: it breaks when errp is null. Check perfectly suitable return values instead when possible. As far as I can tell, errp can't be null there, but this is more robust and more obviously correct Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-21qemu-socket: Clean up inet_connect_opts()Markus Armbruster1-12/+16
Separate the search for a working addrinfo from the code that does something with it. Makes for a clearer search loop. Use a local Error * to simplify resetting the error in the search loop. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-20doc: add "setup" to list of migration statesPeter Feiner2-2/+2
On a slow VM (e.g., nested), you see the "setup" state when you query the migration status. Signed-off-by: Peter Feiner <peter@gridcentric.ca> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2014-05-20megasas: remove buildtime stringsOlaf Hering1-2/+2
Using __DATE__ or __TIME__ in binary pkgs changes the checksum of compiled binaries if they get rebuilt, even if there are no other source changes. Replace the dynamic strings with some equally informative static strings. Signed-off-by: Olaf Hering <olaf@aepfle.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-05-20s390x/kvm: hw debugging support via guest PER facilityDavid Hildenbrand3-3/+156
This patch makes use of the hw debugging support in kvm (provided by the guest's PER facility) on s390. It enables the following features, available using the gdbserver: - single-stepping - hw breakpoints - hw watchpoints Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-05-20s390x/kvm: software breakpoint supportDavid Hildenbrand1-3/+22
This patch allows to insert and remove sw breakpoints using the QEMU gdbserver on s390 as well as to interrupt execution on a breakpoint hit when running with KVM enabled. Whenever a software breakpoint is inserted, common code calls kvm ioctl KVM_UPDATE_GUEST_DEBUG. As this method's default on s390 is to return an error if not implement, the insertion will fail. Therefore, KVM also has to be updated in order to make use of software breakpoints. Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-05-20s390x: remove duplicate definitions of DIAG 501David Hildenbrand1-8/+12
When restoring the previously saved instruction in kvm_arch_remove_sw_breakpoint(), we only restored one byte. Let's use the sizeof() operator to make sure we restore the entire instruction. While we are at it, let's remove the duplicate definitions of DIAG 501 and replace its size (used when reading/writing the instruction) with a sizeof() operator to make the code self explaining and less error-prone. Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-05-20linux-headers: updateJens Freimann2-1/+34
Sync linux-headers with kvm/next (87c00572ba05aa8c9db118da75c608f47eb10b9e) Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-05-20s390x/virtio-ccw: wire up irq routing and irqfdsCornelia Huck11-18/+329
Make use of the new s390 adapter irq routing support to enable real in-kernel irqfds for virtio-ccw with adapter interrupts. Note that s390 doesn't provide the common KVM_CAP_IRQCHIP capability, but rather needs KVM_CAP_S390_IRQCHIP to be enabled. This is to ensure backward compatibility. Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-05-20s390x/virtio-ccw: reference-counted indicatorsCornelia Huck2-20/+73
Make code using the same indicators point to a single allocated structure that is freed when the last user goes away. This will be used by the irqfd code to unmap addresses after the last user is gone. Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-05-20s390x: add I/O adapter registrationCornelia Huck7-0/+106
Register an I/O adapter interrupt source for when virtio-ccw devices start using adapter interrupts. Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-05-20s390x: split flic into kvm and non-kvm partsCornelia Huck5-299/+399
Introduce a common parent class for both cases, where kvm and non-kvm can hook up callbacks. This will be used by follow-on patches for adapter registration and mapping. We now always have a flic, regardless of whether we use kvm; the non-kvm implementation just doesn't do anything. Reviewed-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-05-20kvm: Fix enable_cap helpers on older gccAlexander Graf1-2/+2
Commit 40f1ee27aa1 introduced handy helpers for enable_cap calls on vcpu and vm level. Unfortunately some older gcc versions (4.7.1, 4.6) seem to choke on signedness detection in inline created variables: target-ppc/kvm.c: In function 'kvmppc_booke_watchdog_enable': target-ppc/kvm.c:1302:21: error: comparison of unsigned expression < 0 is always false [-Werror=type-limits] target-ppc/kvm.c: In function 'kvmppc_set_papr': target-ppc/kvm.c:1504:21: error: comparison of unsigned expression < 0 is always false [-Werror=type-limits] However - thanks to Thomas Huth for the suggestion - we can just cast the offending potentially 0 value to a signed type, making the comparison signed. Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-05-20Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell31-96/+809
Block patches # gpg: Signature made Mon 19 May 2014 15:21:14 BST using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: (22 commits) block: optimize zero writes with bdrv_write_zeroes blockdev: add a function to parse enum ids from strings util: add qemu_iovec_is_zero qcow1: Stricter backing file length check qcow1: Validate image size (CVE-2014-0223) qcow1: Validate L2 table size (CVE-2014-0222) qcow1: Check maximum cluster size qcow1: Make padding in the header explicit curl: Add usage documentation curl: Add sslverify option curl: Remove broken parsing of options from url curl: Fix build when curl_multi_socket_action isn't available qemu-iotests: Fix blkdebug in VM drive in 030 qemu-iotests: Fix core dump suppression in test 039 iotests: Add test for the JSON protocol block: Allow JSON filenames check-qdict: Add test for qdict_join() qdict: Add qdict_join() block: add test for vhdx image created by Disk2VHD block: vhdx - account for identical header sections ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-20block: iscsi build fix if LIBISCSI_FEATURE_IOVECTOR is not definedJeff Cody1-3/+1
Commit b03c380 introduced the function iscsi_allocationmap_is_allocated(), however it is only used within a code block that is conditionally compiled. This produces a warning (error with -werror) of "defined but not used" for the the function, if LIBISCSI_FEATURE_IOVECTOR is not defined. This wraps iscsi_allocationmap_is_allocated() in the same conditional. Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-05-20hw/audio/intel-hda: Avoid shift into sign bitPeter Maydell1-2/+2
Add a U suffix to avoid shifting into the sign bit (which is undefined behaviour in C). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-20audio/intel-hda: support FIFORDYStanislav Vorobiov1-1/+2
linux kernel 3.12 has changed intel-hda driver to always check for FIFORDY, this causes long hangs in guest since QEMU always has this bit set to 0. We now simply set it to 1 always, since we're synchronous anyway and always ready to receive the stream Signed-off-by: Stanislav Vorobiov <s.vorobiov@samsung.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-19Merge remote-tracking branch 'remotes/qmp-unstable/queue/qmp' into stagingPeter Maydell27-445/+752
* remotes/qmp-unstable/queue/qmp: qapi: skip redundant includes monitor: Add netdev_del id argument completion. monitor: Add netdev_add type argument completion. monitor: Add set_link arguments completion. monitor: Add chardev-add backend argument completion. monitor: Add chardev-remove command completion. monitor: Convert sendkey to use command_completion. qapi: Show qapi-commands.py invocation in qapi-code-gen.txt qapi: Replace uncommon use of the error API by the common one tests: Don't call visit_end_struct() after visit_start_struct() fails hw: Don't call visit_end_struct() after visit_start_struct() fails hmp: Call visit_end_struct() after visit_start_struct() succeeds qapi: Un-inline visit of implicit struct qapi-visit.py: Clean up a sloppy use of field prefix qapi: Clean up shadowing of parameters and locals in inner scopes qapi-visit.py: Clean up confusing push_indent() / pop_indent() use qapi: Replace start_optional()/end_optional() by optional() qapi: Remove unused Visitor callbacks start_handle(), end_handle() qapi: Normalize marshalling's visitor initialization and cleanup qapi: Update qapi-code-gen.txt example to match current code Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-19Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-8' into stagingPeter Maydell8-282/+553
Input code update: - add keycode mapping helpers to core. - start switching devices to new input api. - misc bugfixes. # gpg: Signature made Fri 16 May 2014 07:43:45 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-input-8: input: sparc32 kbd: claim en-us layout input: sparc32 kbd: fix some key mappings input: remove sparc keymap hack input: switch sparc32 kbd to new input api input: switch ps/2 mouse to new input api input: switch ps/2 kbd to new input api input: use KeyValue directly in sendkey monitor command input: add qemu_input_handler_deactivate input: key mapping helpers ps2: set ps/2 output buffer size as the same as kernel Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-19block: optimize zero writes with bdrv_write_zeroesPeter Lieven9-20/+91
this patch tries to optimize zero write requests by automatically using bdrv_write_zeroes if it is supported by the format. This significantly speeds up file system initialization and should speed zero write test used to test backend storage performance. I ran the following 2 tests on my internal SSD with a 50G QCOW2 container and on an attached iSCSI storage. a) mkfs.ext4 -E lazy_itable_init=0,lazy_journal_init=0 /dev/vdX QCOW2 [off] [on] [unmap] ----- runtime: 14secs 1.1secs 1.1secs filesize: 937M 18M 18M iSCSI [off] [on] [unmap] ---- runtime: 9.3s 0.9s 0.9s b) dd if=/dev/zero of=/dev/vdX bs=1M oflag=direct QCOW2 [off] [on] [unmap] ----- runtime: 246secs 18secs 18secs filesize: 51G 192K 192K throughput: 203M/s 2.3G/s 2.3G/s iSCSI* [off] [on] [unmap] ---- runtime: 8mins 45secs 33secs throughput: 106M/s 1.2G/s 1.6G/s allocated: 100% 100% 0% * The storage was connected via an 1Gbit interface. It seems to internally handle writing zeroes via WRITESAME16 very fast. Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-05-19Merge remote-tracking branch 'remotes/bonzini/scsi-next' into stagingPeter Maydell7-132/+313
* remotes/bonzini/scsi-next: [PATCH] block/iscsi: bump year in copyright notice block/iscsi: allow cluster_size of 4K and greater block/iscsi: clarify the meaning of ISCSI_CHECKALLOC_THRES block/iscsi: speed up read for unallocated sectors block/iscsi: allow fall back to WRITE SAME without UNMAP MAINTAINERS: mark megasas as maintained megasas: Add MSI support megasas: Enable MSI-X support megasas: Implement LD_LIST_QUERY scsi: Improve error messages more scsi-disk: Improve error messager if can't get version number Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-19blockdev: add a function to parse enum ids from stringsPeter Lieven1-0/+19
this adds a generic function to recover the enum id of a parameter given as a string. Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-05-19util: add qemu_iovec_is_zeroPeter Lieven2-0/+22
Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-05-19qcow1: Stricter backing file length checkKevin Wolf3-2/+23
Like qcow2 since commit 6d33e8e7, error out on invalid lengths instead of silently truncating them to 1023. Also don't rely on bdrv_pread() catching integer overflows that make len negative, but use unsigned variables in the first place. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net>
2014-05-19qcow1: Validate image size (CVE-2014-0223)Kevin Wolf3-2/+30
A huge image size could cause s->l1_size to overflow. Make sure that images never require a L1 table larger than what fits in s->l1_size. This cannot only cause unbounded allocations, but also the allocation of a too small L1 table, resulting in out-of-bounds array accesses (both reads and writes). Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-05-19qcow1: Validate L2 table size (CVE-2014-0222)Kevin Wolf3-0/+34
Too large L2 table sizes cause unbounded allocations. Images actually created by qemu-img only have 512 byte or 4k L2 tables. To keep things consistent with cluster sizes, allow ranges between 512 bytes and 64k (in fact, down to 1 entry = 8 bytes is technically working, but L2 table sizes smaller than a cluster don't make a lot of sense). This also means that the number of bytes on the virtual disk that are described by the same L2 table is limited to at most 8k * 64k or 2^29, preventively avoiding any integer overflows. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net>
2014-05-19qcow1: Check maximum cluster sizeKevin Wolf4-2/+85
Huge values for header.cluster_bits cause unbounded allocations (e.g. for s->cluster_cache) and crash qemu this way. Less huge values may survive those allocations, but can cause integer overflows later on. The only cluster sizes that qemu can create are 4k (for standalone images) and 512 (for images with backing files), so we can limit it to 64k. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net>
2014-05-19qcow1: Make padding in the header explicitKevin Wolf1-1/+2
We were relying on all compilers inserting the same padding in the header struct that is used for the on-disk format. Let's not do that. Mark the struct as packed and insert an explicit padding field for compatibility. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net>
2014-05-19curl: Add usage documentationMatthew Booth1-0/+68
Signed-off-by: Matthew Booth <mbooth@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-05-19curl: Add sslverify optionMatthew Booth1-0/+12
This allows qemu to use images over https with a self-signed certificate. It defaults to verifying the certificate. Signed-off-by: Matthew Booth <mbooth@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-05-19curl: Remove broken parsing of options from urlMatthew Booth1-42/+10
The block layer now supports a generic json syntax for passing option parameters explicitly, making parsing of options from the url redundant. Signed-off-by: Matthew Booth <mbooth@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-05-19curl: Fix build when curl_multi_socket_action isn't availableMatthew Booth1-0/+15
Signed-off-by: Matthew Booth <mbooth@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-05-19qemu-iotests: Fix blkdebug in VM drive in 030Fam Zheng1-1/+1
The test test_stream_pause in this class uses vm.pause_drive, which requires a blkdebug driver on top of image, otherwise it's no-op and the test running is undeterministic. So add it. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-05-19qemu-iotests: Fix core dump suppression in test 039Markus Armbruster3-12/+12
The shell script attempts to suppress core dumps like this: old_ulimit=$(ulimit -c) ulimit -c 0 $QEMU_IO arg... ulimit -c "$old_ulimit" This breaks the test hard unless the limit was zero to begin with! ulimit sets both hard and soft limit by default, and (re-)raising the hard limit requires privileges. Broken since it was added in commit dc68afe. Could be fixed by adding -S to set only the soft limit, but I'm not sure how portable that is in practice. Simply do it in a subshell instead, like this: (ulimit -c 0; exec $QEMU_IO arg...) Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-05-19iotests: Add test for the JSON protocolMax Reitz3-0/+185
Add a test for the JSON protocol driver. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-05-19block: Allow JSON filenamesMax Reitz1-0/+41
If the filename given to bdrv_open() is prefixed with "json:", parse the rest as a JSON object and merge the result into the options QDict. If there are conflicts, the options QDict takes precedence. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
generated by cgit v1.2.1 (git 2.18.0) at 2024-07-13 07:44:28 +0000