summaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2017-04-189pfs: local: set the path of the export root to "."Greg Kurz1-1/+6
The local backend was recently converted to using "at*()" syscalls in order to ensure all accesses happen below the shared directory. This requires that we only pass relative paths, otherwise the dirfd argument to the "at*()" syscalls is ignored and the path is treated as an absolute path in the host. This is actually the case for paths in all fids, with the notable exception of the root fid, whose path is "/". This causes the following backend ops to act on the "/" directory of the host instead of the virtfs shared directory when the export root is involved: - lstat - chmod - chown - utimensat ie, chmod /9p_mount_point in the guest will be converted to chmod / in the host for example. This could cause security issues with a privileged QEMU. All "*at()" syscalls are being passed an open file descriptor. In the case of the export root, this file descriptor points to the path in the host that was passed to -fsdev. The fix is thus as simple as changing the path of the export root fid to be "." instead of "/". This is CVE-2017-7471. Cc: qemu-stable@nongnu.org Reported-by: Léo Gaspard <leo@gaspard.io> Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-11Merge remote-tracking branch 'remotes/kraxel/tags/pull-fixes-20170411-1' ↵Peter Maydell2-0/+33
into staging qxl: bugfixes. # gpg: Signature made Tue 11 Apr 2017 08:00:00 BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-fixes-20170411-1: qxl: add migration blocker to avoid pre-save assert qxl: switch display on entering VGA Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-11qxl: add migration blocker to avoid pre-save assertGerd Hoffmann2-0/+32
Cc: 1635339@bugs.launchpad.net Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20170410113131.2585-1-kraxel@redhat.com
2017-04-109pfs: xattr: fix memory leak in v9fs_list_xattrLi Qiang1-0/+1
Free 'orig_value' in error path. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Greg Kurz <groug@kaod.org>
2017-04-07qxl: switch display on entering VGAMarc-André Lureau1-0/+1
Since commit cd958edb1fae85d, same size console resize is skipped. This change broke QXL incoming migration in VGA mode, qemu_spice_display_switch() is no longer called during qxl_post_load(), because default message surface is of the same size, and during displaychangelistener registration, PCIQXLDevice.mode is QXL_MODE_UNDEFINED. This triggers a later crash on refresh: ==2634== Invalid read of size 4 ==3516== at 0x65F3050: pixman_image_get_data (in /usr/lib64/libpixman-1.so.0.34.0) ==3516== by 0x6F0CEB: qemu_spice_create_update (spice-display.c:215) ==3516== by 0x6F1CC7: qemu_spice_display_refresh (spice-display.c:502) ==3516== by 0x58CF77: display_refresh (qxl.c:1948) ==3516== by 0x6E8084: do_safe_dpy_refresh (console.c:1591) ==3516== by 0x6E80D5: dpy_refresh (console.c:1604) ==3516== by 0x6E4508: gui_update (console.c:201) ==3516== by 0x81898E: timerlist_run_timers (qemu-timer.c:536) ==3516== by 0x8189D6: qemu_clock_run_timers (qemu-timer.c:547) ==3516== by 0x818D98: qemu_clock_run_all_timers (qemu-timer.c:662) ==3516== by 0x81952A: main_loop_wait (main-loop.c:514) ==3516== by 0x4ADD29: main_loop (vl.c:1898) One way to solve this is to explicitely call qemu_spice_display_switch() on entering VGA mode, which is called during qxl_post_load(). Fixes: "null pointer access on migration resume of systemrescuecd boot menu with qxl-vga" https://bugs.launchpad.net/qemu/+bug/1679126 https://bugzilla.redhat.com/show_bug.cgi?id=1438566 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20170406120513.638-4-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-06vfio/pci-quirks: Exclude non-ioport BAR from NVIDIA quirkAlex Williamson1-1/+1
The NVIDIA BAR5 quirk is targeting an ioport BAR. Some older devices have a BAR5 which is not ioport and can induce a segfault here. Test the BAR type to skip these devices. Link: https://bugs.launchpad.net/qemu/+bug/1678466 Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2017-04-06Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2-7/+0
* TCO watchdog fix # gpg: Signature made Wed 05 Apr 2017 16:24:52 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: tco: do not generate an NMI Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-05tco: do not generate an NMIPaolo Bonzini2-7/+0
This behavior is not indicated in the datasheet and can confuse the OS. The TCO can trap NMIs from SERR# or IOCHK# and convert them to SMIs; but any other TCO event is either delivered as an SMI or completely disabled. Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-04-04Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell1-7/+10
Some 9pfs bugs fixes: potential hang at reset, migration blocker leak. # gpg: Signature made Tue 04 Apr 2017 17:07:55 BST # gpg: using DSA key 0x02FC3AEB0101DBC2 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Greg Kurz <groug@free.fr>" # gpg: aka "Greg Kurz <gkurz@linux.vnet.ibm.com>" # gpg: aka "Gregory Kurz (Groug) <groug@free.fr>" # gpg: aka "[jpeg image of size 3330]" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2BD4 3B44 535E C0A7 9894 DBA2 02FC 3AEB 0101 DBC2 * remotes/gkurz/tags/for-upstream: 9pfs: clear migration blocker at session reset 9pfs: fix multiple flush for same request Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-049pfs: clear migration blocker at session resetGreg Kurz1-5/+6
The migration blocker survives a device reset: if the guest mounts a 9p share and then gets rebooted with system_reset, it will be unmigratable until it remounts and umounts the 9p share again. This happens because the migration blocker is supposed to be cleared when we put the last reference on the root fid, but virtfs_reset() wrongly calls free_fid() instead of put_fid(). This patch fixes virtfs_reset() so that it honor the way fids are supposed to be manipulated: first get a reference and later put it back when you're done. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Li Qiang <liqiang6-s@360.cn>
2017-04-049pfs: fix multiple flush for same requestGreg Kurz1-2/+4
If a client tries to flush the same outstanding request several times, only the first flush completes. Subsequent ones keep waiting for the request completion in v9fs_flush() and, therefore, leak a PDU. This will cause QEMU to hang when draining active PDUs the next time the device is reset. Let have each flush request wake up the next one if any. The last waiter frees the cancelled PDU. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-04-04pci: Only unmap bus_master_enabled_region if was added previouslyAlexey Kardashevskiy1-2/+4
Normally pci_init_bus_master() would be called either via bus->machine_done.notify or directly from do_pci_register_device(). However if a device's realize() failed, pci_init_bus_master() is not called, and do_pci_unregister_device() fails on memory_region_del_subregion() as it was not mapped. This adds a check that subregion was mapped before unmapping it. Fixes: c53598ed18e4 ("pci: Add missing drop of bus master AS reference") Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: John Snow <jsnow@redhat.com>
2017-04-04Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell1-22/+12
* MemoryRegionCache revert * glib optimization workaround * fix "info lapic" segfault on isapc * fix QIOChannel memory leak # gpg: Signature made Mon 03 Apr 2017 18:17:00 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: main-loop: Acquire main_context lock around os_host_main_loop_wait. exec: revert MemoryRegionCache nbd: fix memory leak on socket_connect failed ipmi: Fix macro issues target-i386: fix "info lapic" segfault on isapc iscsi: drop unused IscsiAIOCB.qiov field Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-03block: add missed aio_context_acquire into release_driveDenis V. Lunev1-0/+4
Recently we expirience hang with iothreads enabled with the following call trace: Thread 1 (Thread 0x7fa95efebc80 (LWP 177117)): 0 ppoll () from /lib64/libc.so.6 2 qemu_poll_ns () at qemu-timer.c:313 3 aio_poll () at aio-posix.c:457 4 bdrv_flush () at block/io.c:2641 5 bdrv_close () at block.c:2143 6 bdrv_delete () at block.c:2352 7 bdrv_unref () at block.c:3429 8 blk_remove_bs () at block/block-backend.c:427 9 blk_delete () at block/block-backend.c:178 10 blk_unref () at block/block-backend.c:226 11 object_property_del_all () at qom/object.c:399 12 object_finalize () at qom/object.c:461 13 object_unref () at qom/object.c:898 14 object_property_del_child () at qom/object.c:422 15 qmp_marshal_device_del () at qmp-marshal.c:1145 16 handle_qmp_command () at /usr/src/debug/qemu-2.6.0/monitor.c:3929 Technically bdrv_flush() stucks in while (rwco.ret == NOT_DONE) { aio_poll(aio_context, true); } but rwco.ret is equal to 0 thus we have missed wakeup. Code investigation reveals that we do not have performed aio_context_acquire() on this call stack. This patch adds missed lock. Signed-off-by: Denis V. Lunev <den@openvz.org> CC: Kevin Wolf <kwolf@redhat.com> CC: Max Reitz <mreitz@redhat.com> CC: Eric Blake <eblake@redhat.com> CC: Markus Armbruster <armbru@redhat.com> Message-id: 1490717566-25516-1-git-send-email-den@openvz.org Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-04-03usb-host: switch to LIBUSB_API_VERSIONGerd Hoffmann1-2/+5
libusbx doesn't exist any more, the fork got merged back to libusb. So stop using LIBUSBX_API_VERSION and use LIBUSB_API_VERSION instead. For backward compatibility alias LIBUSB_API_VERSION to LIBUSBX_API_VERSION in case we figure LIBUSB_API_VERSION isn't defined. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20170403105238.23262-1-kraxel@redhat.com
2017-04-03Merge remote-tracking branch 'remotes/kraxel/tags/pull-fixes-20170403-1' ↵Peter Maydell1-1/+3
into staging bugfixes: xhci, input-linux and vnc # gpg: Signature made Mon 03 Apr 2017 11:25:29 BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-fixes-20170403-1: vnc: allow to connect with add_client when -vnc none Fix input-linux reading from device xhci: flush dequeue pointer to endpoint context Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-03xhci: flush dequeue pointer to endpoint contextGerd Hoffmann1-1/+3
When done processing a endpoint ring we must update the dequeue pointer in the endpoint context in guest memory. This is needed to make sure the guest has a correct view of things and also to make live migration work properly, because xhci post_load restores alot of the state from xhci data structures in guest memory. Add xhci_set_ep_state() call to do that. The recursive calls stopped by commit ddb603ab6c981c1d67cb42266fc700c33e5b2d8f had the (unintentional) side effect to hiding this bug. xhci_set_ep_state() was called before processing, to set the state to running, which updated the dequeue pointer too. Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20170331102521.29253-1-kraxel@redhat.com
2017-04-03pseries: Enforce homogeneous threads-per-coreDavid Gibson1-0/+6
For reasons that may be useful in future, CPU core objects, as used on the pseries machine type have their own nr-threads property, potentially allowing cores with different numbers of threads in the same system. If the user/management uses the values specified in query-hotpluggable-cpus as they're expected to do, this will never matter in pratice. But that's not actually enforced - it's possible to manually specify a core with a different number of threads from that in -smp. That will confuse the platform - most immediately, this can be used to create a CPU thread with index above max_cpus which leads to an assertion failure in spapr_cpu_core_realize(). For now, enforce that all cores must have the same, standard, number of threads. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
2017-04-02ipmi: Fix macro issuesCorey Minyard1-22/+12
Macro parameters should almost always have () around them when used. llvm reported an error on this. Remove redundant parenthesis and put parenthesis around the entire macros with assignments in case they are used in an expression. Remove some unused macros. Reported in https://bugs.launchpad.net/bugs/1651167 Signed-off-by: Corey Minyard <cminyard@mvista.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <1490894892-8055-1-git-send-email-minyard@acm.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-31Revert "vfio/pci-quirks.c: Disable stolen memory for igd VFIO"Xiong Zhang1-38/+27
This reverts commit c2b2e158cc7b1cb431bd6039824ec13c3184a775. The original patch intend to prevent linux i915 driver from using stolen meory. But this patch breaks windows IGD driver loading on Gen9+, as IGD HW will use stolen memory on Gen9+, once windows IGD driver see zero size stolen memory, it will unload. Meanwhile stolen memory will be disabled in 915 when i915 run as a guest. Signed-off-by: Xiong Zhang <xiong.y.zhang@intel.com> [aw: Gen9+ is SkyLake and newer] Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2017-03-31hw/intc/arm_gicv3_kvm: Check KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS in resetEric Auger1-6/+11
KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS needs to be checked before attempting to read ICC_CTLR_EL1; otherwise kernel versions not exposing this kvm device group will be incompatible with qemu 2.9. Fixes: 07a5628 ("hw/intc/arm_gicv3_kvm: Reset GICv3 cpu interface registers") Signed-off-by: Eric Auger <eric.auger@redhat.com> Reported-by: Prakash B <bjsprakash.linux@gmail.com> Tested-by: Alexander Graf <agraf@suse.de> Message-id: 1490721640-13052-1-git-send-email-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-31e1000: disable debug by defaultJason Wang1-1/+1
Disable debug output by default, the information were not needed for release. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Stefan Hajnoczi <stefanha@gmail.com> Cc: Leonid Bloch <leonid.bloch@ravellosystems.com> Cc: Dmitry Fleytman <dmitry.fleytman@ravellosystems.com> Cc: qemu-stable@nongnu.org Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-03-31virtio-net: avoid call tap_enable when there's only one queueJason Wang1-0/+4
We call tap_enable() even if for multiqueue is not enabled. This is wrong since it should be used for multiqueue codes to enable a disabled queue. Fixing this by only calling this when multiqueue is used. Fixes: 16dbaf905b72 ("tap: support enabling or disabling a queue") Reported-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Tested-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-03-30vhost: generalize iommu memory regionJason Wang1-20/+64
We assumes the iommu_ops were attached to the root region of address space. This may not be true for all kinds of IOMMU implementation and especially after commit 3716d5902d74 ("pci: introduce a bus master container"). So fix this by not assuming as->root has iommu_ops, instead depending on the regions reported by memory listener through: - register a memory listener to dma_as - during region_add, if it's a region of IOMMU, register a specific IOMMU notifier, and store all notifiers in a list. - during region_del, compare and delete the IOMMU notifier from the list This is also a must for making vhost device IOTLB works for all types of IOMMUs. Note, since we register one notifier during each .region_add, the IOTLB may be flushed more than one times, this is suboptimal and could be optimized in the future. Reported-by: Maxime Coquelin <maxime.coquelin@redhat.com> Fixes: 3716d5902d74 ("pci: introduce a bus master container") Cc: Peter Xu <peterx@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Tested-by: Maxime Coquelin <maxime.coquelin@redhat.com>
2017-03-30Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.9-20170329' ↵Peter Maydell2-5/+19
into staging ppc patch queue for 2017-03-29 Two more bugfixes of sufficient severity to warrant going into 2.9. # gpg: Signature made Wed 29 Mar 2017 04:33:19 BST # gpg: using RSA key 0x6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.9-20170329: spapr: fix memory hot-unplugging spapr: fix buffer-overflow Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-29spapr: fix memory hot-unpluggingLaurent Vivier1-3/+17
If, once the kernel has booted, we try to remove a memory hotplugged while the kernel was not started, QEMU crashes on an assert: qemu-system-ppc64: hw/virtio/vhost.c:651: vhost_commit: Assertion `r >= 0' failed. ... #4 in vhost_commit #5 in memory_region_transaction_commit #6 in pc_dimm_memory_unplug #7 in spapr_memory_unplug #8 spapr_machine_device_unplug #9 in hotplug_handler_unplug #10 in spapr_lmb_release #11 in detach #12 in set_allocation_state #13 in rtas_set_indicator ... If we take a closer look to the guest kernel log, we can see when we try to unplug the memory: pseries-hotplug-mem: Attempting to hot-add 4 LMB(s) What happens: 1- The kernel has ignored the memory hotplug event because it was not started when it was generated. 2- When we hot-unplug the memory, QEMU starts to remove the memory, generates an hot-unplug event, and signals the kernel of the incoming new event 3- as the kernel is started, on the QEMU signal, it reads the event list, decodes the hotplug event and tries to finish the hotplugging. 4- QEMU receive the the hotplug notification while it is trying to hot-unplug the memory. This moves the memory DRC to an invalid state This patch prevents this by not allowing to set the allocation state to USABLE while the DRC is awaiting release. RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1432382 Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-29spapr: fix buffer-overflowMarc-André Lureau1-2/+2
Running postcopy-test with ASAN produces the following error: QTEST_QEMU_BINARY=ppc64-softmmu/qemu-system-ppc64 tests/postcopy-test ... ================================================================= ==23641==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f1556600000 at pc 0x55b8e9d28208 bp 0x7f1555f4d3c0 sp 0x7f1555f4d3b0 READ of size 8 at 0x7f1556600000 thread T6 #0 0x55b8e9d28207 in htab_save_first_pass /home/elmarco/src/qq/hw/ppc/spapr.c:1528 #1 0x55b8e9d2939c in htab_save_iterate /home/elmarco/src/qq/hw/ppc/spapr.c:1665 #2 0x55b8e9beae3a in qemu_savevm_state_iterate /home/elmarco/src/qq/migration/savevm.c:1044 #3 0x55b8ea677733 in migration_thread /home/elmarco/src/qq/migration/migration.c:1976 #4 0x7f15845f46c9 in start_thread (/lib64/libpthread.so.0+0x76c9) #5 0x7f157d9d0f7e in clone (/lib64/libc.so.6+0x107f7e) 0x7f1556600000 is located 0 bytes to the right of 2097152-byte region [0x7f1556400000,0x7f1556600000) allocated by thread T0 here: #0 0x7f159bb76980 in posix_memalign (/lib64/libasan.so.3+0xc7980) #1 0x55b8eab185b2 in qemu_try_memalign /home/elmarco/src/qq/util/oslib-posix.c:106 #2 0x55b8eab186c8 in qemu_memalign /home/elmarco/src/qq/util/oslib-posix.c:122 #3 0x55b8e9d268a8 in spapr_reallocate_hpt /home/elmarco/src/qq/hw/ppc/spapr.c:1214 #4 0x55b8e9d26e04 in ppc_spapr_reset /home/elmarco/src/qq/hw/ppc/spapr.c:1261 #5 0x55b8ea12e913 in qemu_system_reset /home/elmarco/src/qq/vl.c:1697 #6 0x55b8ea13fa40 in main /home/elmarco/src/qq/vl.c:4679 #7 0x7f157d8e9400 in __libc_start_main (/lib64/libc.so.6+0x20400) Thread T6 created by T0 here: #0 0x7f159bae0488 in __interceptor_pthread_create (/lib64/libasan.so.3+0x31488) #1 0x55b8eab1d9cb in qemu_thread_create /home/elmarco/src/qq/util/qemu-thread-posix.c:465 #2 0x55b8ea67874c in migrate_fd_connect /home/elmarco/src/qq/migration/migration.c:2096 #3 0x55b8ea66cbb0 in migration_channel_connect /home/elmarco/src/qq/migration/migration.c:500 #4 0x55b8ea678f38 in socket_outgoing_migration /home/elmarco/src/qq/migration/socket.c:87 #5 0x55b8eaa5a03a in qio_task_complete /home/elmarco/src/qq/io/task.c:142 #6 0x55b8eaa599cc in gio_task_thread_result /home/elmarco/src/qq/io/task.c:88 #7 0x7f15823e38e6 (/lib64/libglib-2.0.so.0+0x468e6) SUMMARY: AddressSanitizer: heap-buffer-overflow /home/elmarco/src/qq/hw/ppc/spapr.c:1528 in htab_save_first_pass index seems to be wrongly incremented, unless I miss something that would be worth a comment. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-29pci: Add missing drop of bus master AS referenceAlexey Kardashevskiy1-0/+2
The recent introduction of a bus master container added memory_region_add_subregion() into the PCI device registering path but missed memory_region_del_subregion() in the unregistering path leaving a reference to the root memory region of the new container. This adds missing memory_region_del_subregion(). Fixes: 3716d5902d743 ("pci: introduce a bus master container") Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-279pfs: fix file descriptor leakLi Qiang1-0/+8
The v9fs_create() and v9fs_lcreate() functions are used to create a file on the backend and to associate it to a fid. The fid shouldn't be already in-use, otherwise both functions may silently leak a file descriptor or allocated memory. The current code doesn't check that. This patch ensures that the fid isn't already associated to anything before using it. Signed-off-by: Li Qiang <liqiang6-s@360.cn> (reworded the changelog, Greg Kurz) Signed-off-by: Greg Kurz <groug@kaod.org>
2017-03-27Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell4-67/+32
* MTTCG fix for win32 * virtio-scsi assertion failure * mem-prealloc coverity fix * x86 migration revert which requires more thought * x86 instruction limit (avoids >2 page translation blocks) * nbd dead code cleanup * small memory.c logic fix # gpg: Signature made Mon 27 Mar 2017 17:03:04 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: scsi-generic: Fill in opt_xfer_len in INQUIRY reply if it is zero Revert "apic: save apic_delivered flag" nbd: drop unused NBDClientSession.is_unix field win32: replace custom mutex and condition variable with native primitives mem-prealloc: fix sysconf(_SC_NPROCESSORS_ONLN) failure case. tcg/i386: Check the size of instruction being translated virtio-scsi: Fix acquire/release in dataplane handlers virtio-scsi: Make virtio_scsi_acquire/release public clear pending status before calling memory commit Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-27scsi-generic: Fill in opt_xfer_len in INQUIRY reply if it is zeroFam Zheng1-3/+2
When opt_xfer_len is zero, Linux ignores max_xfer_len erroneously. While that obviously should be fixed, we do older guests a favor to always filling in a value. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170327142625.1249-1-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-27Revert "apic: save apic_delivered flag"Paolo Bonzini1-33/+0
This reverts commit 07bfa354772f2de67008dc66c201b627acff0106. The global variable is only read as part of a apic_reset_irq_delivered(); qemu_irq_raise(s->irq); if (!apic_get_irq_delivered()) { sequence, so the value never matters at migration time. Reported-by: Dr. David Alan Gilbert <dglibert@redhat.com> Cc: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-27cirrus: fix PUTPIXEL macroGerd Hoffmann1-2/+2
Should be "c" not "col". The macro is used with "col" as third parameter everywhere, so this tyops doesn't break something. Fixes: 026aeffcb4752054830ba203020ed6eb05bcaba8 Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1490168303-24588-1-git-send-email-kraxel@redhat.com
2017-03-27virtio-input: fix eventq batchingLadi Prosek1-15/+14
virtio_input_send buffers input events until it sees a SYNC. Then it either sends or drops the entire batch, depending on whether eventq has enough space available. The case to avoid here is partial sends where only part of the batch would get to the guest. Using virtqueue_get_avail_bytes to check the state of eventq was not correct. The queue may have a smaller number of larger buffers available so bytes may be enough but the batch would still not be possible to send, leading to the "Huh? No vq elem available" error. Instead of checking available bytes, this patch optimistically pops buffers from the queue and puts them back in case it runs out of space and the batch needs to be dropped. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1490365490-4854-3-git-send-email-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-03-27virtio-input: free event queue when finalizingLadi Prosek1-2/+4
VirtIOInput.queue was never freed. This commit adds an explicit g_free to virtio_input_finalize and switches the allocation function from realloc to g_realloc in virtio_input_send. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1490365490-4854-2-git-send-email-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-03-24virtio-scsi: Fix acquire/release in dataplane handlersFam Zheng2-17/+30
After the AioContext lock push down, there is a race between virtio_scsi_dataplane_start and those "assert(s->ctx && s->dataplane_started)", because the latter doesn't isn't wrapped in aio_context_acquire. Reproducer is simply booting a Fedora guest with an empty virtio-scsi-dataplane controller: qemu-system-x86_64 \ -drive if=none,id=root,format=raw,file=Fedora-Cloud-Base-25-1.3.x86_64.raw \ -device virtio-scsi \ -device scsi-disk,drive=root,bootindex=1 \ -object iothread,id=io \ -device virtio-scsi-pci,iothread=io \ -net user,hostfwd=tcp::10022-:22 -net nic,model=virtio -m 2048 \ --enable-kvm Fix this by moving acquire/release pairs from virtio_scsi_handle_*_vq to their callers - and wrap the broken assertions in. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170317061447.16243-3-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-24virtio-scsi: Make virtio_scsi_acquire/release publicFam Zheng1-14/+0
They will be used in virtio-scsi-dataplane.c as well, so move them to header. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170317061447.16243-2-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-24trace: Avoid abuse of amdvi_mmio_readEric Blake2-2/+2
hw/i386/trace-events has an amdvi_mmio_read trace that is used for both normal reads (listing the register name, address, size, and offset) and for an error case (abusing the register name to show an error message, the address to show the maximum value supported, then shoehorning address and size into the size and offset parameters). The change from a wide address to a narrower size parameter could truncate a (rather-large) bogus read attempt, so it's better to create a separate dedicated trace with correct types, rather than abusing the trace mechanism. Broken since its introduction in commit d29a09c. [Change trace event argument type from hwaddr to uint64_t since user-defined types should not be used for trace events. This fixes a build failure with LTTng UST. --Stefan] Signed-off-by: Eric Blake <eblake@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-03-24trace: Fix incorrect megasas trace parametersEric Blake1-3/+3
hw/scsi/trace-events lists cmd as the first parameter for both megasas_iovec_overflow and megasas_iovec_underflow, but the caller was mistakenly passing cmd->iov_size twice instead of the command index. Also, trace_megasas_abort_invalid is called with parameters in the wrong order. Broken since its introduction in commit e8f943c3. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Hannes Reinecke <hare@suse.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-03-23Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.9-20170323' ↵Peter Maydell2-0/+11
into staging ppc patch queue for 2017-03-23 Just a single bugfix in this batch. It's not strictly in ppc code, though it's for the pseries machine's benefit. Eduardo suggested it go through my tree however. # gpg: Signature made Thu 23 Mar 2017 10:09:17 GMT # gpg: using RSA key 0x6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.9-20170323: numa,spapr: align default numa node memory size to 256MB Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-22hw/acpi/vmgenid: prevent more than one vmgenid deviceLaszlo Ersek1-0/+8
A system with multiple VMGENID devices is undefined in the VMGENID spec by omission. Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Ben Warren <ben@skyportsystems.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2017-03-22hw/acpi/vmgenid: prevent device realization on pre-2.5 machine typesLaszlo Ersek1-0/+14
The WRITE_POINTER linker/loader command that underlies VMGENID depends on commit baf2d5bfbac0 ("fw-cfg: support writeable blobs", 2017-01-12), which in turn depends on fw_cfg DMA. DMA for fw_cfg is enabled in 2.5+ machine types only (see commit e6915b5f3a87, "fw_cfg: unbreak migration compatibility for 2.4 and earlier machines", 2016-02-18). Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Ben Warren <ben@skyportsystems.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Ben Warren <ben@skyportsystems.com <mailto:ben@skyportsystems.com>> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2017-03-22virtio: always use handle_aio_output if registeredPaolo Bonzini1-1/+12
Commit ad07cd6 ("virtio-scsi: always use dataplane path if ioeventfd is active", 2016-10-30) and 9ffe337 ("virtio-blk: always use dataplane path if ioeventfd is active", 2016-10-30) broke the virtio 1.0 indirect access registers. The indirect access registers bypass the ioeventfd, so that virtio-blk and virtio-scsi now repeatedly try to initialize dataplane instead of triggering the guest->host EventNotifier. Detect the situation by checking vq->handle_aio_output; if it is not NULL, trigger the EventNotifier, which is how the device expects to get notifications and in fact the only thread-safe manner to deliver them. Fixes: ad07cd6 Fixes: 9ffe337 Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-03-22virtio: Fix error handling in virtio_bus_device_pluggedFam Zheng1-3/+17
For one thing we shouldn't continue if an error happened, for the other two steps failing can cause an abort() in error_setg because we reuse the same errp blindly. Add error handling checks to fix both issues. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2017-03-22numa,spapr: align default numa node memory size to 256MBLaurent Vivier2-0/+11
Since commit 224245b ("spapr: Add LMB DR connectors"), NUMA node memory size must be aligned to 256MB (SPAPR_MEMORY_BLOCK_SIZE). But when "-numa" option is provided without "mem" parameter, the memory is equally divided between nodes, but 8MB aligned. This can be not valid for pseries. In that case we can have: $ ./ppc64-softmmu/qemu-system-ppc64 -m 4G -numa node -numa node -numa node qemu-system-ppc64: Node 0 memory size 0x55000000 is not aligned to 256 MiB With this patch, we have: (qemu) info numa 3 nodes node 0 cpus: 0 node 0 size: 1280 MB node 1 cpus: node 1 size: 1280 MB node 2 cpus: node 2 size: 1536 MB Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-21Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell2-15/+19
This pull request fixes a potential QEMU hang in 9pfs and two issues reported by Coverity. # gpg: Signature made Tue 21 Mar 2017 09:57:58 GMT # gpg: using DSA key 0x02FC3AEB0101DBC2 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Greg Kurz <groug@free.fr>" # gpg: aka "Greg Kurz <gkurz@linux.vnet.ibm.com>" # gpg: aka "Gregory Kurz (Groug) <groug@free.fr>" # gpg: aka "[jpeg image of size 3330]" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2BD4 3B44 535E C0A7 9894 DBA2 02FC 3AEB 0101 DBC2 * remotes/gkurz/tags/for-upstream: 9pfs: proxy: assert if unmarshal fails 9pfs: don't try to flush self and avoid QEMU hang on reset Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-21add opengl_cflags to QEMU_CFLAGSGerd Hoffmann1-5/+1
... and drop OPENGL_CFLAGS from Makefiles. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1490079888-29029-1-git-send-email-kraxel@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-219pfs: proxy: assert if unmarshal failsGreg Kurz1-11/+11
Replies from the virtfs proxy are made up of a fixed-size header (8 bytes) and a payload of variable size (maximum 64kb). When receiving a reply, the proxy backend first reads the whole header and then unmarshals it. If the header is okay, it then does the same operation with the payload. Since the proxy backend uses a pre-allocated buffer which has enough room for a header and the maximum payload size, marshalling should never fail with fixed size arguments. Any error here is likely to result from a more serious corruption in QEMU and we'd better dump core right away. This patch adds error checks where they are missing and converts the associated error paths into assertions. This should also address Coverity's complaints CID 1348519 and CID 1348520, about not always checking the return value of proxy_unmarshal(). Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2017-03-219pfs: don't try to flush self and avoid QEMU hang on resetGreg Kurz1-4/+8
According to the 9P spec [*], when a client wants to cancel a pending I/O request identified by a given tag (uint16), it must send a Tflush message and wait for the server to respond with a Rflush message before reusing this tag for another I/O. The server may still send a completion message for the I/O if it wasn't actually cancelled but the Rflush message must arrive after that. QEMU hence waits for the flushed PDU to complete before sending the Rflush message back to the client. If a client sends 'Tflush tag oldtag' and tag == oldtag, QEMU will then allocate a PDU identified by tag, find it in the PDU list and wait for this same PDU to complete... i.e. wait for a completion that will never happen. This causes a tag and ring slot leak in the guest, and a PDU leak in QEMU, all of them limited by the maximal number of PDUs (128). But, worse, this causes QEMU to hang on device reset since v9fs_reset() wants to drain all pending I/O. This insane behavior is likely to denote a bug in the client, and it would deserve an Rerror message to be sent back. Unfortunately, the protocol allows it and requires all flush requests to suceed (only a Tflush response is expected). The only option is to detect when we have to handle a self-referencing flush request and report success to the client right away. [*] http://man.cat-v.org/plan_9/5/flush Reported-by: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Greg Kurz <groug@kaod.org>
2017-03-20Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell6-6/+6
fixes for 2.9-rc1, plus removal of -mno-cygwin references # gpg: Signature made Mon 20 Mar 2017 11:25:07 GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: hax: fix breakage in locking configure: remove Cygwin xen: do not build backends for targets that do not support xen qemu-ga: obey LISTEN_PID when using systemd socket activation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.1 (git 2.18.0) at 2024-05-28 09:02:55 +0000