summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-07-29target-ppc: fix hugepage support when using memory-backend-fileMichael Roth1-6/+51
Current PPC code relies on -mem-path being used in order for hugepage support to be detected. With the introduction of MemoryBackendFile we can now handle this via: -object memory-file-backend,mem-path=...,id=hugemem0 \ -numa node,id=mem0,memdev=hugemem0 Management tools like libvirt treat the 2 approaches as interchangeable in some cases, which can lead to user-visible regressions even for previously supported guest configurations. Fix these by also iterating through any configured memory backends that may be backed by hugepages. Since the old code assumed hugepages always backed the entirety of guest memory, play it safe an pick the minimum across the max pages sizes for all backends, even ones that aren't backed by hugepages. Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit 2d103aae876518a91636ad6f4a4d866269c0d953) Conflicts: target-ppc/kvm.c *remove context dependency on header includes not in 2.3.0 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29spapr_vty: lookup should only return valid VTY objectsDavid Gibson1-0/+4
If a guest passes the reg property of a valid VIO object that is not a VTY to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast assertion and aborts. PAPR+ says "Hypervisor checks the termno parameter for validity against the Vterm IOA unit addresses assigned to the partition, else return H_Parameter." This patch adds a type check to ensure vty_lookup() either returns a pointer to a valid VTY object or NULL. H_GET_TERM_CHAR and H_PUT_TERM_CHAR will now return H_PARAMETER to the guest instead of crashing. The patch has no effect on the reg == 0 hack used to implement the RTAS call display-character. Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit 0f888bfaddfc5f55b0d82cde2e1164658a672375) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29s390x/ipl: Fix boot if no bootindex was specifiedChristian Borntraeger1-2/+2
commit fa92e218df1d ("s390x/ipl: avoid sign extension") introduced a regression: qemu-system-s390x -drive file=image.qcow,format=qcow2 does not boot, the bios states "No virtio-blk device found!" adding bootindex=1 does boot. The reason is that the uint32_t as return value will not do the right thing for the return -1 (default without bootindex). The bios itself, will interpret a 64bit -1 as autodetect (but it will interpret 32bit -1 as ccw device address ff.ff.ffff) Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: qemu-stable@nongnu.org # v2.3.0 Tested-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> (cherry picked from commit 6efd2c2a125b4369b8def585b0dac35c849b5eb3) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29block/nfs: limit maximum readahead size to 1MBPeter Lieven1-0/+7
a malicious caller could otherwise specify a very large value via the URI and force libnfs to allocate a large amount of memory for the readahead buffer. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Lieven <pl@kamp.de> Message-id: 1435317241-25585-1-git-send-email-pl@kamp.de Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 29c838cdc96c4d117f00c75bbcb941e1be9590fb) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29iotests: add QMP event waiting queueJohn Snow2-30/+103
A filter is added to allow callers to request very specific events to be pulled from the event queue, while leaving undesired events still in the stream. This allows us to poll for completion data for multiple asynchronous events in any arbitrary order. A new timeout context is added to the qmp pull_event method's wait parameter to allow tests to fail if they do not complete within some expected period of time. Also fixed is a bug in qmp.pull_event where we try to retrieve an event from an empty list if we attempt to retrieve an event with wait=False but no events have occurred. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1429314609-29776-19-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 7898f74e78a5900fc079868e255b65d807fa8a8f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29iotests: Use event_wait in wait_readyFam Zheng1-7/+2
Only poll the specific type of event we are interested in, to avoid stealing events that should be consumed by someone else. Suggested-by: John Snow <jsnow@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit d7b25297920d18fa2a2cde1ed21fde38a88c935f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29qemu-iotests: Add test case for mirror with unmapFam Zheng3-0/+65
This checks that the discard on mirror source that effectively zeroes data is also reflected by the data of target. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit c615091793f53ff33b8f6c1b1ba711cf7c93e97b) Conflicts: tests/qemu-iotests/group *remove context dependencies on newer block tests Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29qemu-iotests: Make block job methods commonFam Zheng2-51/+43
Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 866323f39d5c7bb053f5e5bf753908ad9f5abec7) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29block: Fix dirty bitmap in bdrv_co_discardFam Zheng1-13/+2
Unsetting dirty globally with discard is not very correct. The discard may zero out sectors (depending on can_write_zeroes_with_unmap), we should replicate this change to destination side to make sure that the guest sees the same data. Calling bdrv_reset_dirty also troubles mirror job because the hbitmap iterator doesn't expect unsetting of bits after current position. So let's do it the opposite way which fixes both problems: set the dirty bits if we are to discard it. Reported-by: wangxiaolong@ucloud.cn Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 508249952c0ea7472c62e17bf8132295dab4912d) Conflicts: block/io.c * applied manually to avoid dependency on 61007b316 * squashed in 6e82e4b bdrv_reset_dirty() is static in 2.3.0 and becomes unused as of this patch Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29mirror: Do zero write on target if sectors not allocatedFam Zheng1-2/+18
If guest discards a source cluster, mirroring with bdrv_aio_readv is overkill. Some protocols do zero upon discard, where it's best to use bdrv_aio_write_zeroes, otherwise, bdrv_aio_discard will be enough. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit dcfb3beb5130694b76b57de109619fcbf9c7e5b5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29qmp: Add optional bool "unmap" to drive-mirrorFam Zheng6-4/+24
If specified as "true", it allows discarding on target sectors where source is not allocated. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 0fc9f8ea2800b76eaea20a8a3a91fbeeb4bfa81b) * added to maintain any interdependencies between patches in the set. not intended as a new feature for 2.3.1, though it's there for anyone interested Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29block: Add bdrv_get_block_status_aboveFam Zheng2-11/+49
Like bdrv_is_allocated_above, this function follows the backing chain until seeing BDRV_BLOCK_ALLOCATED. Base is not included. Reimplement bdrv_is_allocated on top. [Initialized bdrv_co_get_block_status_above() ret to 0 to silence mingw64 compiler warning about the unitialized variable. assert(bs != base) prevents that case but I suppose the program could be compiled with -DNDEBUG. --Stefan] Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit ba3f0e2545c365ebe1dbddb0e53058710d41881e) Conflicts: block/io.c * applied manually to avoid dependency on 61007b316 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29virtio-ccw: complete handling of guest-initiated resetsCornelia Huck1-17/+22
For a guest-initiated reset, we need to not only reset the virtio device, but also reset the VirtioCcwDevice into a clean state. This includes resetting the indicators, or else a guest will not be able to e.g. switch from classic interrupts to adapter interrupts. Split off this routine into a new function virtio_ccw_reset_virtio() to make the distinction between resetting the virtio-related devices and the base subchannel device clear. CC: qemu-stable@nongnu.org Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> (cherry picked from commit fa8b0ca5d1b69975b715a259d3586cadf7a5280f) Conflicts: hw/s390x/virtio-ccw.c *removed context dependency on 0b352fd Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29vhost: correctly pass error to caller in vhost_dev_enable_notifiers()Jason Wang1-4/+4
We override the error value r in fail_vq, this will cause the caller can't detect the failure which may cause the caller may disable the notifiers twice if vhost is failed to start. Fix this by using another variable to keep track the return value of set_host_notifier(). Fixes b0b3db79559e57db340b292621c397e7a6cdbdc5 ("vhost-net: cleanup host notifiers at last step") Cc: qemu-stable@nongnu.org Cc: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 16617e36b02ebdc83f215d89db9ac00f7d6d6d83) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29hw/core: rebase sysbus_get_fw_dev_path() to g_strdup_printf()Laszlo Ersek1-10/+6
This is done mainly for improving readability, and in preparation for the next patch, but Markus pointed out another bonus for the string being returned: "No arbitrary length limit. Before the patch, it's 39 characters, and the code breaks catastrophically when qdev_fw_name() is longer: the second snprintf() is called with its first argument pointing beyond path[], and its second argument underflowing to a huge size." Cc: qemu-stable@nongnu.org Signed-off-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 5ba03e2dd785362026917e4cc8a1fd2c64e8e62c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29i8254: fix out-of-bounds memory access in pit_ioport_read()Petr Matousek1-0/+6
Due converting PIO to the new memory read/write api we no longer provide separate I/O region lenghts for read and write operations. As a result, reading from PIT Mode/Command register will end with accessing pit->channels with invalid index. Fix this by ignoring read from the Mode/Command register. This is CVE-2015-3214. Reported-by: Matt Tait <matttait@google.com> Fixes: 0505bcdec8228d8de39ab1a02644e71999e7c052 Cc: qemu-stable@nongnu.org Signed-off-by: Petr Matousek <pmatouse@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit d4862a87e31a51de9eb260f25c9e99a75efe3235) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29spice-display: fix segfault in qemu_spice_create_updateGerd Hoffmann1-4/+5
Although it is pretty unusual the stride for the guest image and the mirror image maintained by spice-display can be different. So use separate variables for them. https://bugzilla.redhat.com/show_bug.cgi?id=1163047 Cc: qemu-stable@nongnu.org Reported-by: perrier vincent <clownix@clownix.net> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit c6e484707f28b3e115e64122a0570f6b3c585489) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29sdl2: fix crash in handle_windowevent() when restoring the screen sizeAlberto Garcia1-0/+4
The Ctrl-Alt-u keyboard shortcut restores the screen to its original size. In the SDL2 UI this is done by destroying the window and creating a new one. The old window emits SDL_WINDOWEVENT_HIDDEN when it's destroyed, but trying to call SDL_GetWindowFromID() from that event's window ID returns a null pointer. handle_windowevent() assumes that the pointer is never null so it results in a crash. Cc: qemu-stable@nongnu.org Signed-off-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 08d49df0dbaacc220a099dbfb644e1dc0eda57be) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29vmdk: Use vmdk_find_index_in_cluster everywhereFam Zheng1-8/+2
Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 90df601f06de14f062d2e8dc1bc57f0decf86fd1) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29vmdk: Fix index_in_cluster calculation in vmdk_co_get_block_statusFam Zheng1-1/+12
It has the similar issue with b1649fae49a8. Since the calculation is repeated for a few times already, introduce a function so it can be reused. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 61f0ed1d54601b91b8195c1a30d7046f83283b40) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29iotests: qcow2 COW with minimal L2 cache sizeMax Reitz2-0/+15
This adds a test case to test 103 for performing a COW operation in a qcow2 image using an L2 cache with minimal size (which should be at least two clusters so the COW can access both source and destination simultaneously). Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit a4291eafc597c0944057930acf3e51d899f79c2e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29qcow2: Set MIN_L2_CACHE_SIZE to 2Max Reitz1-1/+2
The L2 cache must cover at least two L2 tables, because during COW two L2 tables are accessed simultaneously. Reported-by: Alexander Graf <agraf@suse.de> Cc: qemu-stable <qemu-stable@nongnu.org> Signed-off-by: Max Reitz <mreitz@redhat.com> Tested-by: Alexander Graf <agraf@suse.de> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 57e216695948a79d9ced82fc217a37cce70fd986) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29kbd: add brazil kbd keys to x11 evdev mapGerd Hoffmann1-2/+2
This patch adds the two extra brazilian keys to the evdev keymap for X11. This patch gets the two keys going with the vnc, gtk and sdl1 UIs. The SDL2 library complains it doesn't know these keys, so the SDL2 library must be fixed before we can update ui/sdl2-keymap.h Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 33aa30cafcce053b833f9fe09fbb88e2f54b93aa) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29kbd: add brazil kbd keys to qemuGerd Hoffmann2-1/+7
The brazilian computer keyboard layout has two extra keys (compared to the usual 105-key intl ps/2 keyboard). This patch makes these two keys known to qemu. For historic reasons qemu has two ways to specify a key: A QKeyCode (name-based) or a number (ps/2 scancode based). Therefore we have to update multiple places to make new keys known to qemu: (1) The QKeyCode definition in qapi-schema.json (2) The QKeyCode <-> number mapping table in ui/input-keymap.c This patch does just that. With this patch applied you can send those two keys to the guest using the send-key monitor command. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit b771f470f3e2f99f585eaae68147f0c849fd1f8d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29qga/commands-posix: Fix bug in guest-fstrimJustin Ossevoort1-5/+4
The FITRIM ioctl updates the fstrim_range structure it receives. This way the caller can determine how many bytes were trimmed. The guest-fstrim logic reuses the same fstrim_range for each filesystem, effectively limiting each filesystem to trim at most as much as the previous was able to trim. If a previous filesystem would have trimmed 0 bytes, than the next filesystem would report an error 'Invalid argument' because a FITRIM request with length 0 is not valid. This change resets the fstrim_range structure for each filesystem. Signed-off-by: Justin Ossevoort <justin@quarantainenet.nl> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> (cherry picked from commit 73a652a1b08445e8d91e50cdbb2da50e571c61b3) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29hw/acpi/aml-build: Fix memory leakShannon Zhao1-0/+1
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> (cherry picked from commit afcf905cff7971324c2706600ead35a1f41f417a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29qemu-iotests: Test unaligned sub-block zero writeFam Zheng2-0/+43
Test zero write in byte range 512~1024 for 4k alignment. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-id: 1431522721-3266-4-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit ab53c44718305d3fde3d9d2251889f1cab694be2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29block: Fix NULL deference for unaligned write if qiov is NULLFam Zheng1-2/+95
For zero write, callers pass in NULL qiov (qemu-io "write -z" or scsi-disk "write same"). Commit fc3959e466 fixed bdrv_co_write_zeroes which is the common case for this bug, but it still exists in bdrv_aio_write_zeroes. A simpler fix would be in bdrv_co_do_pwritev which is the NULL dereference point and covers both cases. So don't access it in bdrv_co_do_pwritev in this case, use three aligned writes. [Initialize ret to 0 in bdrv_co_do_zero_pwritev() to avoid uninitialized variable warning with gcc 4.9.2. --Stefan] Signed-off-by: Fam Zheng <famz@redhat.com> Message-id: 1431522721-3266-3-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 9eeb6dd1b27bd57eb4e3869290e87feac8e8b226) Conflicts: block/io.c * moved hunks into corresponding location in block.c due to lack of 61007b316 in v2.3.0 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29Revert "block: Fix unaligned zero write"Michael Roth1-39/+6
This reverts commit fc3959e4669a1c2149b91ccb05101cfc7ae1fc05. From upstream commit d01c07f: This reverts commit fc3959e4669a1c2149b91ccb05101cfc7ae1fc05. The core write code already handles the case, so remove this duplication. Because commit 61007b316 moved the touched code from block.c to block/io.c, the change is manually reverted. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> v2.3.0 does not contain 61007b316 so we can revert the change directly. Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28fdc: force the fifo access to be in bounds of the allocated bufferPetr Matousek1-6/+11
During processing of certain commands such as FD_CMD_READ_ID and FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory access could get out of bounds leading to memory corruption with values coming from the guest. Fix this by making sure that the index is always bounded by the allocated memory. This is CVE-2015-3456. Signed-off-by: Petr Matousek <pmatouse@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> (cherry picked from commit e907746266721f305d67bc0718795fedee2e824c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28target-arm: Avoid buffer overrun on UNPREDICTABLE ldrd/strdPeter Maydell1-24/+32
A LDRD or STRD where rd is not an even number is UNPREDICTABLE. We were letting this fall through, which is OK unless rd is 15, in which case we would attempt to do a load_reg or store_reg to a nonexistent r16 for the second half of the double-word. Catch the odd-numbered-rd cases and UNDEF them instead. To do this we rearrange the structure of the code a little so we can put the UNDEF catches at the top before we've allocated TCG temporaries. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1431348973-21315-1-git-send-email-peter.maydell@linaro.org (cherry picked from commit 3960c336ad96c2183549c8bf32bbff93ecda7ea4) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28virtio-net: fix the upper bound when trying to delete queuesJason Wang1-1/+1
Virtqueue were indexed from zero, so don't delete virtqueue whose index is n->max_queues * 2 + 1. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: qemu-stable <qemu-stable@nongnu.org> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 27a46dcf5038e20451101ed2d5414aebf3846e27) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28usb: fix usb-net segfaultMichal Kazior1-0/+4
The dev->config pointer isn't set until guest system initializes usb devices (via usb_desc_set_config). However qemu networking can go through some motions prior to that, e.g.: #0 is_rndis (s=0x555557261970) at hw/usb/dev-network.c:653 #1 0x000055555585f723 in usbnet_can_receive (nc=0x55555641e820) at hw/usb/dev-network.c:1315 #2 0x000055555587635e in qemu_can_send_packet (sender=0x5555572660a0) at net/net.c:470 #3 0x0000555555878e34 in net_hub_port_can_receive (nc=0x5555562d7800) at net/hub.c:101 #4 0x000055555587635e in qemu_can_send_packet (sender=0x5555562d7980) at net/net.c:470 #5 0x000055555587dbca in tap_can_send (opaque=0x5555562d7980) at net/tap.c:172 The command to reproduce most reliably was: qemu-system-i386 -usb -device usb-net,vlan=0 -net tap,vlan=0 This wasn't strictly a problem with tap. Other networking endpoints (vde, user) could trigger this problem as well. Fixes: https://bugs.launchpad.net/qemu/+bug/1050823 Cc: qemu-stable@nongnu.org Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 278412d0e710e2e848c6e510f8308e5b1ed4d03e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28qcow2: Flush pending discards before allocating clusterKevin Wolf1-0/+5
Before a freed cluster can be reused, pending discards for this cluster must be processed. The original assumption was that this was not a problem because discards are only cached during discard/write zeroes operations, which are synchronous so that no concurrent write requests can cause cluster allocations. However, the discard/write zeroes operation itself can allocate a new L2 table (and it has to in order to put zero flags there), so make sure we can cope with the situation. This fixes https://bugs.launchpad.net/bugs/1349972. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> (cherry picked from commit ecbda7a22576591a84f44de1be0150faf6001f1c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28vmdk: Fix overflow if l1_size is 0x20000000Fam Zheng1-1/+2
Richard Jones caught this bug with afl fuzzer. In fact, that's the only possible value to overflow (extent->l1_size = 0x20000000) l1_size: l1_size = extent->l1_size * sizeof(long) => 0x80000000; g_try_malloc returns NULL because l1_size is interpreted as negative during type casting from 'int' to 'gsize', which yields a enormous value. Hence, by coincidence, we get a "not too bad" behavior: qemu-img: Could not open '/tmp/afl6.img': Could not open '/tmp/afl6.img': Cannot allocate memory Values larger than 0x20000000 will be refused by the validation in vmdk_add_extent. Values smaller than 0x20000000 will not overflow l1_size. Cc: qemu-stable@nongnu.org Reported-by: Richard W.M. Jones <rjones@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Tested-by: Richard W.M. Jones <rjones@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 13c4941cdd8685d28c7e3a09e393a5579b58db46) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28vmdk: Fix next_cluster_sector for compressed writeFam Zheng1-4/+10
This fixes the bug introduced by commit c6ac36e (vmdk: Optimize cluster allocation). Sometimes, write_len could be larger than cluster size, because it contains both data and marker. We must advance next_cluster_sector in this case, otherwise the image gets corrupted. Cc: qemu-stable@nongnu.org Reported-by: Antoni Villalonga <qemu-list@friki.cat> Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 5e82a31eb967db135fc4e688b134fb0972d62de3) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28nbd/trivial: fix type cast for ioctlBogdan Purcareata1-1/+1
This fixes ioctl behavior on powerpc e6500 platforms with 64bit kernel and 32bit userspace. The current type cast has no effect there and the value passed to the kernel is still 0. Probably an issue related to the compiler, since I'm assuming the same configuration works on a similar setup on x86. Also ensure consistency with previous type cast in TRACE message. Signed-off-by: Bogdan Purcareata <bogdan.purcareata@freescale.com> Message-Id: <1428058914-32050-1-git-send-email-bogdan.purcareata@freescale.com> Cc: qemu-stable@nongnu.org [Fix parens as noticed by Michael. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit d064d9f381b00538e41f14104b88a1ae85d78865) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28Strip brackets from vnc hostJán Tomko1-1/+8
Commit v2.2.0-1530-ge556032 vnc: switch to inet_listen_opts bypassed the use of inet_parse in inet_listen, making literal IPv6 addresses enclosed in brackets fail: qemu-kvm: -vnc [::1]:0: Failed to start VNC server on `(null)': address resolution failed for [::1]:5900: Name or service not known Strip the brackets to make it work again. Signed-off-by: Ján Tomko <jtomko@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 274c3b52e10466a4771d591f6298ef61e8354ce0) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28block/iscsi: do not forget to logout from targetPeter Lieven1-0/+6
We actually were always impolitely dropping the connection and not cleanly logging out. CC: qemu-stable@nongnu.org Signed-off-by: Peter Lieven <pl@kamp.de> Message-id: 1429193313-4263-2-git-send-email-pl@kamp.de Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 20474e9aa040b9a255c63127f1eb873c29c54f68) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28bt-sdp: fix broken uuids power-of-2 calculationStefan Hajnoczi1-1/+1
The binary search in sdp_uuid_match() only works when the number of elements to search is a power of two. lo = record->uuid; hi = record->uuids; while (hi >>= 1) if (lo[hi] <= val) lo += hi; return *lo == val; I noticed that the record->uuids calculation in sdp_service_record_build() was suspect: record->uuids = 1 << ffs(record->uuids - 1); Unlike most ffs(val) - 1 users, the expression is ffs(val - 1)! Actually ffs() is the wrong function to use for power-of-2. Use pow2ceil() to achieve the correct effect. Now the record->uuid[] array is sized correctly and the binary search in sdp_uuid_match() should work. I'm not sure how to run/test this code. Cc: Andrzej Zaborowski <balrog@zabor.org> Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1427124571-28598-2-git-send-email-stefanha@redhat.com Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 588ef9d411339012fc3c94bfad8911e9d0a517a2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-04-24Update version for v2.3.0 releasev2.3.0Peter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-20Update version for v2.3.0-rc4 releasev2.3.0-rc4Peter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-20vhost: fix log base addressMichael S. Tsirkin1-2/+5
VHOST_SET_LOG_BASE got an incorrect address, causing migration errors and potentially even memory corruption. Reported-by: Wen Congyang <wency@cn.fujitsu.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Amos Kong <akong@redhat.com> Message-id: 1429283565-32265-1-git-send-email-mst@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-17hmp: fix crash in 'info block -n -v'Alberto Garcia1-1/+2
The image field in BlockDeviceInfo should never be null, however bdrv_block_device_info() is not filling it in. This makes the 'info block -n -v' command crash QEMU. The proper solution is probably to move the relevant code from bdrv_query_info() to bdrv_block_device_info(), but since we're too close to the release for that this simpler workaround solves the crash. Signed-off-by: Alberto Garcia <berto@igalia.com> Message-id: 1429274688-8115-1-git-send-email-berto@igalia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-17Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150417-2' into stagingPeter Maydell1-2/+2
MIPS patches 2015-04-17 Changes: * fix broken fulong2e # gpg: Signature made Fri Apr 17 12:14:37 2015 BST using RSA key ID 0B29DA6B # gpg: Can't check signature: public key not found * remotes/lalrae/tags/mips-20150417-2: mips: fix broken fulong2e machine Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-17Merge remote-tracking branch 'remotes/kraxel/tags/pull-fwcfg-20150414-1' ↵Peter Maydell1-0/+205
into staging fw_cfg: add documentation file (docs/specs/fw_cfg.txt) # gpg: Signature made Tue Apr 14 12:22:20 2015 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-fwcfg-20150414-1: fw_cfg: add documentation file (docs/specs/fw_cfg.txt) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-17mips: fix broken fulong2e machinePaolo Bonzini1-2/+2
After commit 5312bd8 the bonito_readl() and bonito_writel() have been accessing incorrect addresses. Consequently QEMU is crashing when trying to boot Linux kernel on fulong2e machine. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
2015-04-17target-ppc: don't invalidate msr MSR_HVB bit in cpu_post_loadMark Cave-Ayland1-2/+2
The invalidation code introduced in commit 2360b works by inverting most bits of env->msr to ensure that hreg_store_msr() will forcibly update the CPU env state to reflect the new msr value post-migration. Unfortunately hreg_store_msr() is called with alter_hv set to 0 which preserves the MSR_HVB state from the CPU env which is now the opposite value to what it should be. Ensure that we don't invalidate the msr MSR_HVB bit during cpu_post_load so that the correct value is restored. This fixes suspend/resume for PPC64. Reported-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Alexander Graf <agraf@suse.de> Message-id: 1429255009-12751-1-git-send-email-mark.cave-ayland@ilande.co.uk Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-14fw_cfg: add documentation file (docs/specs/fw_cfg.txt)Gabriel L. Somlo1-0/+205
This document covers the guest-side hardware interface, as well as the host-side programming API of QEMU's firmware configuration (fw_cfg) device. Signed-off-by: Jordan Justen <jordan.l.justen@intel.com> Signed-off-by: Gabriel Somlo <somlo@cmu.edu> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-04-13Update version for v2.3.0-rc3 releasev2.3.0-rc3Peter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.1 (git 2.18.0) at 2024-06-30 13:17:55 +0000