aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-08-09ui: spice: Exit if gl=on EGL init failsCole Robinson1-2/+4
The user explicitly requested spice GL, so if we know it isn't going to work we should exit Signed-off-by: Cole Robinson <crobinso@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: e3789e35b16f9e3cc6f2652f91c52d88ba6d6936.1463588606.git.crobinso@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit daafc661cc1a1de5a2e8ea0a7c0f396b827ebc3b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09sdl2: skip init without outputsGerd Hoffmann1-0/+3
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Cole Robinson <crobinso@redhat.com> Message-id: 1464790116-32405-1-git-send-email-kraxel@redhat.com (cherry picked from commit 8efa5f29f83816ae34f428143de49acbaacccb24) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09ui: sdl2: Release grab before opening console windowCole Robinson1-0/+4
sdl 2.0.4 currently has a bug which causes our UI shortcuts to fire rapidly in succession: https://bugzilla.libsdl.org/show_bug.cgi?id=3287 It's a toss up whether ctrl+alt+f or ctrl+alt+2 will fire an odd or even number of times, thus determining whether the action succeeds or fails. Opening monitor/serial windows is doubly broken, since it will often lock the UI trying to grab the pointer: 0x00007fffef3720a5 in SDL_Delay_REAL () at /lib64/libSDL2-2.0.so.0 0x00007fffef3688ba in X11_SetWindowGrab () at /lib64/libSDL2-2.0.so.0 0x00007fffef2f2da7 in SDL_SendWindowEvent () at /lib64/libSDL2-2.0.so.0 0x00007fffef2f080b in SDL_SetKeyboardFocus () at /lib64/libSDL2-2.0.so.0 0x00007fffef35d784 in X11_DispatchFocusIn.isra.8 () at /lib64/libSDL2-2.0.so.0 0x00007fffef35dbce in X11_DispatchEvent () at /lib64/libSDL2-2.0.so.0 0x00007fffef35ee4a in X11_PumpEvents () at /lib64/libSDL2-2.0.so.0 0x00007fffef2eea6a in SDL_PumpEvents_REAL () at /lib64/libSDL2-2.0.so.0 0x00007fffef2eeab5 in SDL_WaitEventTimeout_REAL () at /lib64/libSDL2-2.0.so.0 0x000055555597eed0 in sdl2_poll_events (scon=0x55555876f928) at ui/sdl2.c:593 We can work around that hang by ungrabbing the pointer before launching a new window. This roughly matches what our sdl1 code does Signed-off-by: Cole Robinson <crobinso@redhat.com> Message-id: 31c9ab6540b031f7a614c59edcecea9877685612.1462557436.git.crobinso@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 56f289f383a871e871f944c7226920b35794efe6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09ui: gtk: fix crash when terminal inner-border is NULLCole Robinson1-4/+6
VTE terminal inner-border can be NULL. The vte-0.36 (API 2.90) code checks for the condition too so I assume it's not just a bug Fixes a crash on Fedora 24 with gtk 3.20 Signed-off-by: Cole Robinson <crobinso@redhat.com> Message-id: 2b2e85d403e8760ea53afd735a170500d5c17716.1462557436.git.crobinso@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 4fd811a6bd0b8f24f4761fc281454494c336d310) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09ahci: free irqs arrayMarc-André Lureau1-0/+1
Each irq is referenced by the IDEBus in ide_init2(), thus we can free the no longer used array. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Acked-by: John Snow <jsnow@redhat.com> (cherry picked from commit 9d324b0e67c2b570df389c1361f591b95a4e4278) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09ahci: fix sglist leak on retryMarc-André Lureau2-2/+2
ahci-test /x86_64/ahci/io/dma/lba28/retry triggers the following leak: Direct leak of 16 byte(s) in 1 object(s) allocated from: #0 0x7fc4b2a25e20 in malloc (/lib64/libasan.so.3+0xc6e20) #1 0x7fc4993bce58 in g_malloc (/lib64/libglib-2.0.so.0+0x4ee58) #2 0x556a187d4b34 in ahci_populate_sglist hw/ide/ahci.c:896 #3 0x556a187d8237 in ahci_dma_prepare_buf hw/ide/ahci.c:1367 #4 0x556a187b5a1a in ide_dma_cb hw/ide/core.c:844 #5 0x556a187d7eec in ahci_start_dma hw/ide/ahci.c:1333 #6 0x556a187b650b in ide_start_dma hw/ide/core.c:921 #7 0x556a187b61e6 in ide_sector_start_dma hw/ide/core.c:911 #8 0x556a187b9e26 in cmd_write_dma hw/ide/core.c:1486 #9 0x556a187bd519 in ide_exec_cmd hw/ide/core.c:2027 #10 0x556a187d71c5 in handle_reg_h2d_fis hw/ide/ahci.c:1204 #11 0x556a187d7681 in handle_cmd hw/ide/ahci.c:1254 #12 0x556a187d168a in check_cmd hw/ide/ahci.c:510 #13 0x556a187d0afc in ahci_port_write hw/ide/ahci.c:314 #14 0x556a187d105d in ahci_mem_write hw/ide/ahci.c:435 #15 0x556a1831d959 in memory_region_write_accessor /home/elmarco/src/qemu/memory.c:525 #16 0x556a1831dc35 in access_with_adjusted_size /home/elmarco/src/qemu/memory.c:591 #17 0x556a18323ce3 in memory_region_dispatch_write /home/elmarco/src/qemu/memory.c:1262 #18 0x556a1828cf67 in address_space_write_continue /home/elmarco/src/qemu/exec.c:2578 #19 0x556a1828d20b in address_space_write /home/elmarco/src/qemu/exec.c:2635 #20 0x556a1828d92b in address_space_rw /home/elmarco/src/qemu/exec.c:2737 #21 0x556a1828daf7 in cpu_physical_memory_rw /home/elmarco/src/qemu/exec.c:2746 #22 0x556a183068d3 in cpu_physical_memory_write /home/elmarco/src/qemu/include/exec/cpu-common.h:72 #23 0x556a18308194 in qtest_process_command /home/elmarco/src/qemu/qtest.c:382 #24 0x556a18309999 in qtest_process_inbuf /home/elmarco/src/qemu/qtest.c:573 #25 0x556a18309a4a in qtest_read /home/elmarco/src/qemu/qtest.c:585 #26 0x556a18598b85 in qemu_chr_be_write_impl /home/elmarco/src/qemu/qemu-char.c:387 #27 0x556a18598c52 in qemu_chr_be_write /home/elmarco/src/qemu/qemu-char.c:399 #28 0x556a185a2afa in tcp_chr_read /home/elmarco/src/qemu/qemu-char.c:2902 #29 0x556a18cbaf52 in qio_channel_fd_source_dispatch io/channel-watch.c:84 Follow John Snow recommendation: Everywhere else ncq_err is used, it is accompanied by a list cleanup except for ncq_cb, which is the case you are fixing here. Move the sglist destruction inside of ncq_err and then delete it from the other two locations to keep it tidy. Call dma_buf_commit in ide_dma_cb after the early return. Though, this is also a little wonky because this routine does more than clear the list, but it is at the moment the centralized "we're done with the sglist" function and none of the other side effects that occur in dma_buf_commit will interfere with the reset that occurs from ide_restart_bh, I think Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> (cherry picked from commit 5839df7b71540a2af2580bb53ad1e2005bb175e6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09macio: set res_count value to 0 after non-block ATAPI DMA transfersMark Cave-Ayland1-0/+1
res_count should be set to the number of outstanding bytes after a DBDMA request. Unfortunately this wasn't being set to zero by the non-block transfer codepath meaning drivers that checked the descriptor result for such requests (e.g reading the CDROM TOC) would assume from a non-zero result that the transfer had failed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> (cherry picked from commit 16275edb342342625cd7e7ac2048436474465b50) Conflicts: hw/ide/macio.c * removed context dependancy on ddd495e5 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-09atapi: fix halted DMA resetJohn Snow1-0/+1
Followup to 87ac25fd, this time for ATAPI DMA. Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1470164128-28158-1-git-send-email-jsnow@redhat.com Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> (cherry picked from commit 7f951b2d7765f68ae1e563c2fed44071ca774790) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05ide: fix halted IO segfault at resetJohn Snow1-0/+1
If one attempts to perform a system_reset after a failed IO request that causes the VM to enter a paused state, QEMU will segfault trying to free up the pending IO requests. These requests have already been completed and freed, though, so all we need to do is NULL them before we enter the paused state. Existing AHCI tests verify that halted requests are still resumed successfully after a STOP event. Analyzed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1469635201-11918-2-git-send-email-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com> (cherry picked from commit 87ac25fd1fed05a30a93d27dbeb2a4c4b83ec95f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05virtio: error out if guest exceeds virtqueue sizeStefan Hajnoczi1-0/+5
A broken or malicious guest can submit more requests than the virtqueue size permits, causing unbounded memory allocation in QEMU. The guest can submit requests without bothering to wait for completion and is therefore not bound by virtqueue size. This requires reusing vring descriptors in more than one request, which is not allowed by the VIRTIO 1.0 specification. In "3.2.1 Supplying Buffers to The Device", the VIRTIO 1.0 specification says: 1. The driver places the buffer into free descriptor(s) in the descriptor table, chaining as necessary and Note that the above code does not take precautions against the available ring buffer wrapping around: this is not possible since the ring buffer is the same size as the descriptor table, so step (1) will prevent such a condition. This implies that placing more buffers into the virtqueue than the descriptor table size is not allowed. QEMU is missing the check to prevent this case. Processing a request allocates a VirtQueueElement leading to unbounded memory allocation controlled by the guest. Exit with an error if the guest provides more requests than the virtqueue size permits. This bounds memory allocation and makes the buggy guest visible to the user. This patch fixes CVE-2016-5403 and was reported by Zhenhao Hong from 360 Marvel Team, China. Reported-by: Zhenhao Hong <hongzhenhao@360.cn> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit afd9096eb1882f23929f5b5c177898ed231bac66) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05target-i386: fix typo in xsetbv implementationDave Hansen1-1/+1
QEMU 2.6 added support for the XSAVE family of instructions, which includes the XSETBV instruction which allows setting the XCR0 register. But, when booting Linux kernels with XSAVE support enabled, I was getting very early crashes where the instruction pointer was set to 0x3. I tracked it down to a jump instruction generated by this: gen_jmp_im(s->pc - pc_start); where s->pc is pointing to the instruction after XSETBV and pc_start is pointing _at_ XSETBV. Subtract the two and you get 0x3. Whoops. The fix is to replace this typo with the pattern found everywhere else in the file when folks want to end the translation buffer. Richard Henderson confirmed that this is a bug and that this is the correct fix. Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Cc: qemu-stable@nongnu.org Cc: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit ba03584f4f88082368b2562e515c3d60421b68ce) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05pcie: fix link active status bit migrationMichael S. Tsirkin4-1/+23
We changed link status register in pci express endpoint capability over time. Specifically, commit b2101eae63ea57b571cee4a9075a4287d24ba4a4 ("pcie: Set the "link active" in the link status register") set data link layer link active bit in this register without adding compatibility to old machine types. When migrating from qemu 2.3 and older this affects xhci devices which under machine type 2.0 and older have a pci express endpoint capability even if they are on a pci bus. Add compatibility flags to make this bit value match what it was under 2.3. Additionally, to avoid breaking migration from qemu 2.3 and up, suppress checking link status during migration: this seems sane since hardware can change link status at any time. https://bugzilla.redhat.com/show_bug.cgi?id=1352860 Reported-by: Gerd Hoffmann <kraxel@redhat.com> Fixes: b2101eae63ea57b571cee4a9075a4287d24ba4a4 ("pcie: Set the "link active" in the link status register") Cc: qemu-stable@nongnu.org Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 6b4495401bdf442457b713b7e3994b465c55af35) Conflicts: hw/pci/pcie.c * removed functional dependency on 6383292 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05nbd: Limit nbdflags to 16 bitsEric Blake5-25/+25
Rather than asserting that nbdflags is within range, just give it the correct type to begin with :) nbdflags corresponds to the per-export portion of NBD Protocol "transmission flags", which is 16 bits in response to NBD_OPT_EXPORT_NAME and NBD_OPT_GO. Furthermore, upstream NBD has never passed the global flags to the kernel via ioctl(NBD_SET_FLAGS) (the ioctl was first introduced in NBD 2.9.22; then a latent bug in NBD 3.1 actually tried to OR the global flags with the transmission flags, with the disaster that the addition of NBD_FLAG_NO_ZEROES in 3.9 caused all earlier NBD 3.x clients to treat every export as read-only; NBD 3.10 and later intentionally clip things to 16 bits to pass only transmission flags). Qemu should follow suit, since the current two global flags (NBD_FLAG_FIXED_NEWSTYLE and NBD_FLAG_NO_ZEROES) have no impact on the kernel's behavior during transmission. CC: qemu-stable@nongnu.org Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1469129688-22848-3-git-send-email-eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 7423f417827146f956df820f172d0bf80a489495) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05nbd: Don't use *_to_cpup() functionsPeter Maydell3-11/+11
The *_to_cpup() functions are not very useful, as they simply do a pointer dereference and then a *_to_cpu(). Instead use either: * ld*_*_p(), if the data is at an address that might not be correctly aligned for the load * a local dereference and *_to_cpu(), if the pointer is the correct type and known to be correctly aligned Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <1465570836-22211-1-git-send-email-peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 773dce3c7286a66c37f7b07994177faf7046bfa8) * context prereq for 7423f417 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05nbd: More debug typo fixes, use correct formatsEric Blake2-40/+49
Clean up some debug message oddities missed earlier; this includes some typos, and recognizing that %d is not necessarily compatible with uint32_t. Also add a couple messages that I found useful while debugging things. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1463006384-7734-3-git-send-email-eblake@redhat.com> [Do not use PRIx16, clang complains. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 2cb347493c5a0c3634dc13942ba65fdcefbcd34b) * context prereq for 7423f41 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05Fix some typos found by codespellStefan Weil36-48/+48
Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit cb8d4c8f54b8271f642f02382eec29d468bb1c77) * context prereq for 2cb34749 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05block/iscsi: fix rounding in iscsi_allocationmap_setPeter Lieven1-3/+5
when setting clusters as alloacted the boundaries have to be expanded. As Paolo pointed out the calculation of the number of clusters is wrong: Suppose cluster_sectors is 2, sector_num = 1, nb_sectors = 6: In the "mark allocated" case, you want to set 0..8, i.e. cluster_num=0, nb_clusters=4. 0--.--2--.--4--.--6--.--8 <--|_________________|--> (<--> = expanded) Instead you are setting nb_clusters=3, so that 6..8 is not marked. 0--.--2--.--4--.--6--.--8 <--|______________|!!! (! = wrong) Cc: qemu-stable@nongnu.org Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Lieven <pl@kamp.de> Message-Id: <1468831940-15556-2-git-send-email-pl@kamp.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit eb36b953e0ebf4129b188a241fbc367062ac2e06) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05util: Fix MIN_NON_ZEROFam Zheng1-1/+2
MIN_NON_ZERO(1, 0) is evaluated to 0. Rewrite the macro to fix it. Reported-by: Miroslav Rezanina <mrezanin@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1468306113-847-1-git-send-email-famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit d27ba624aa1dfe5c07cc01200d95967ffce905d9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05qemu-iotests: Test naming of throttling groupsAlberto Garcia2-2/+100
Throttling groups are named using the 'group' parameter of the block_set_io_throttle command and the throttling.group command-line option. If that parameter is unspecified the groups get the name of the block device. This patch adds a new test to check the naming of throttling groups. Signed-off-by: Alberto Garcia <berto@igalia.com> * backport of 435d5ee Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05blockdev: Fix regression with the default naming of throttling groupsAlberto Garcia1-3/+6
When I/O limits are set for a block device, the name of the throttling group is taken from the BlockBackend if the user doesn't specify one. Commit efaa7c4eeb7490c6f37f3 moved the naming of the BlockBackend in blockdev_init() to the end of the function, after I/O limits are set. The consequence is that the throttling group gets an empty name. Signed-off-by: Alberto Garcia <berto@igalia.com> Reported-by: Stefan Hajnoczi <stefanha@redhat.com> Cc: Max Reitz <mreitz@redhat.com> Cc: qemu-stable@nongnu.org * backport of ff356ee Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05s390x/ipl: fix reboots for migration from different biosDavid Hildenbrand2-2/+11
When migrating from a different QEMU version, the start_address and bios_start_address may differ. During migration these values are migrated and overwrite the values that were detected by QEMU itself. On a reboot, QEMU will reload its own BIOS, but use the migrated start addresses, which does not work if the values differ. Fix this by not relying on the migrated values anymore, but still provide them during migration, so existing QEMUs continue to work. Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> (cherry picked from commit bb0995468a39f14077ceaa8ed5afdca849f00c7c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05Revert "virtio-net: unbreak self announcement and guest offloads after ↵Michael S. Tsirkin1-23/+17
migration" This reverts commit 1f8828ef573c83365b4a87a776daf8bcef1caa21. Cc: qemu-stable@nongnu.org Reported-by: Robin Geuze <robing@transip.nl> Tested-by: Robin Geuze <robing@transip.nl> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 6c6668232e71b7cf7ff39fa1a7abf660c40f9cea) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05virtio: set low features early on loadMichael S. Tsirkin1-0/+10
virtio migrates the low 32 feature bits twice, the first copy is there for compatibility but ever since 019a3edbb25f1571e876f8af1ce4c55412939e5d: ("virtio: make features 64bit wide") it's ignored on load. This is wrong since virtio_net_load tests self announcement and guest offloads before the second copy including high feature bits is loaded. This means that self announcement, control vq and guest offloads are all broken after migration. Fix it up by loading low feature bits: somewhat ugly since high and low bits become out of sync temporarily, but seems unavoidable for compatibility. The right thing to do for new features is probably to test the host features, anyway. Fixes: 019a3edbb25f1571e876f8af1ce4c55412939e5d ("virtio: make features 64bit wide") Cc: qemu-stable@nongnu.org Reported-by: Robin Geuze <robing@transip.nl> Tested-by: Robin Geuze <robing@transip.nl> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 62cee1a28aada2cce4b0e1fb835d8fc830aed7ac) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05target-sparc: fix register corruption in ldstub if there is no write permissionArtyom Tarasenko1-1/+4
Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> (cherry picked from commit b64d2e57e704edbb56ae969de864292dd38379bf) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05scsi: Advertise limits by blocksize, not 512Eric Blake1-1/+2
s->blocksize may be larger than 512, in which case our tweaks to max_xfer_len and opt_xfer_len must be scaled appropriately. CC: qemu-stable@nongnu.org Reported-by: Fam Zheng <famz@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit efaf4781a995aacd22b1dd521b14e4644bafae14) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05scsi-generic: Merge block max xfer len in INQUIRY responseFam Zheng1-0/+12
The rationale is similar to the above mode sense response interception: this is practically the only channel to communicate restraints from elsewhere such as host and block driver. The scsi bus we attach onto can have a larger max xfer len than what is accepted by the host file system (guarding between the host scsi LUN and QEMU), in which case the SG_IO we generate would get -EINVAL. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1464243305-10661-3-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 063143d5b1fde0fdcbae30bc7d6d14e76fa607d2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05nbd: Allow larger requestsEric Blake2-4/+1
The NBD layer was breaking up request at a limit of 2040 sectors (just under 1M) to cater to old qemu-nbd. But the server limit was raised to 32M in commit 2d8214885 to match the kernel, more than three years ago; and the upstream NBD Protocol is proposing documentation that without any explicit communication to state otherwise, a client should be able to safely assume that a 32M transaction will work. It is time to rely on the larger sizing, and any downstream distro that cares about maximum interoperability to older qemu-nbd servers can just tweak the value of #define NBD_MAX_SECTORS. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 476b923c32ece0e268580776aaf1fab4ab4459a8) Conflicts: include/block/nbd.h * removed context dependency on 943cec86 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05vfio/pci: Fix VGA quirksAlex Williamson2-5/+4
Commit 2d82f8a3cdb2 ("vfio/pci: Convert all MemoryRegion to dynamic alloc and consistent functions") converted VFIOPCIDevice.vga to be dynamically allocted, negating the need for VFIOPCIDevice.has_vga. Unfortunately not all of the has_vga users were converted, nor was the field removed from the structure. Correct these oversights. Reported-by: Peter Maloney <peter.maloney@brockmann-consult.de> Tested-by: Peter Maloney <peter.maloney@brockmann-consult.de> Fixes: 2d82f8a3cdb2 ("vfio/pci: Convert all MemoryRegion to dynamic alloc and consistent functions") Fixes: https://bugs.launchpad.net/qemu/+bug/1591628 Cc: qemu-stable@nongnu.org Signed-off-by: Alex Williamson <alex.williamson@redhat.com> (cherry picked from commit 4d3fc4fdc6857e33346ed58ae55870f59391ee71) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05pci-assign: Move "Invalid ROM" error message to pci-assign-load-rom.cLin Ma2-4/+3
In function pci_assign_dev_load_option_rom, For those pci devices don't have 'rom' file under sysfs or if loading ROM from external file, The function returns NULL, and won't set the passed 'size' variable. In these 2 cases, qemu still reports "Invalid ROM" error message, Users may be confused by it. Signed-off-by: Lin Ma <lma@suse.com> Message-Id: <1466010327-22368-1-git-send-email-lma@suse.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit be968c721ee9df49708691ab58f0e66b394dea82) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05qapi: Fix crash on missing alternate member of QAPI structEric Blake2-0/+20
If a QAPI struct has a mandatory alternate member which is not present on input, the input visitor reports an error for the missing alternate without setting the discriminator, but the cleanup code for the struct still tries to use the dealloc visitor to clean up the alternate. Commit dbf11922 changed visit_start_alternate to set *obj to NULL when an error occurs, where it was previously left untouched. Thus, before the patch, the dealloc visitor is blindly trying to cleanup whatever branch corresponds to (*obj)->type == 0 (that is, QTYPE_NONE, because *obj still pointed to zeroed memory), which selects the default branch of the switch and sets an error, but this second error is ignored by the way the dealloc visitor is used; but after the patch, the attempt to switch dereferences NULL. When cleaning up after a partial object parse, we specifically check for !*obj after visit_start_struct() (see gen_visit_object()); doing the same for alternates fixes the crash. Enhance the testsuite to give coverage for both missing struct and missing alternate members. Also add an abort - we expect visit_start_alternate() to either set an error or to set (*obj)->type to a valid QType that corresponds to actual user input, and QTYPE_NONE should never be reachable from valid input. Had the abort() been in place earlier, we might have noticed the dealloc visitor dereferencing bogus zeroed memory prior to when commit dbf11922 forced our hand by setting *obj to NULL and causing a fault. Test case: {'execute':'blockdev-add', 'arguments':{'options':{'driver':'raw'}}} The choice of 'driver':'raw' selects a BlockdevOptionsGenericFormat struct, which has a mandatory 'file':'BlockdevRef' in QAPI. Since 'file' is missing as a sibling of 'driver', this should report a graceful error rather than fault. After this patch, we are back to: {"error": {"class": "GenericError", "desc": "Parameter 'file' is missing"}} Generated code in qapi-visit.c changes as: |@@ -2444,6 +2444,9 @@ void visit_type_BlockdevRef(Visitor *v, | if (err) { | goto out; | } |+ if (!*obj) { |+ goto out_obj; |+ } | switch ((*obj)->type) { | case QTYPE_QDICT: | visit_start_struct(v, name, NULL, 0, &err); |@@ -2459,10 +2462,13 @@ void visit_type_BlockdevRef(Visitor *v, | case QTYPE_QSTRING: | visit_type_str(v, name, &(*obj)->u.reference, &err); | break; |+ case QTYPE_NONE: |+ abort(); | default: | error_setg(&err, QERR_INVALID_PARAMETER_TYPE, name ? name : "null", | "BlockdevRef"); | } |+out_obj: | visit_end_alternate(v); Reported by Kashyap Chamarthy <kchamart@redhat.com> CC: qemu-stable@nongnu.org Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1466012271-5204-1-git-send-email-eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Tested-by: Kashyap Chamarthy <kchamart@redhat.com> [Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com> (cherry picked from commit 9b4e38fe6a35890bb1d995316d7be08de0b30ee5) Conflicts: tests/test-qmp-input-visitor.c * removed contexual/functional dependencies on 68ab47e Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05qcow2: Avoid making the L1 table too bigMax Reitz1-1/+2
We refuse to open images whose L1 table we deem "too big". Consequently, we should not produce such images ourselves. Cc: qemu-stable@nongnu.org Signed-off-by: Max Reitz <mreitz@redhat.com> Message-id: 20160615153630.2116-3-mreitz@redhat.com Reviewed-by: Eric Blake <eblake@redhat.com> [mreitz: Added QEMU_BUILD_BUG_ON()] Signed-off-by: Max Reitz <mreitz@redhat.com> (cherry picked from commit 84c26520d3c1c9ff4a10455748139463278816d5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05backup: Don't leak BackupBlockJob in error pathKevin Wolf1-2/+5
Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> (cherry picked from commit 91ab68837933232bcef99da7c968e6d41900419b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05net: fix qemu_announce_self not emitting packetsPeter Lieven1-1/+1
commit fefe2a78 accidently dropped the code path for injecting raw packets. This feature is needed for sending gratuitous ARPs after an incoming migration has completed. The result is increased network downtime for vservers where the network card is not virtio-net with the VIRTIO_NET_F_GUEST_ANNOUNCE feature. Fixes: fefe2a78abde932e0f340b21bded2c86def1d242 Cc: qemu-stable@nongnu.org Cc: hongyang.yang@easystack.cn Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit ca1ee3d6b546e841a1b9db413eb8fa09f13a061b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05ui: fix regression in printing VNC host/port on startupDaniel P. Berrange1-1/+1
If VNC is chosen as the compile time default display backend, QEMU will print the host/port it listens on at startup. Previously this would look like VNC server running on '::1:5900' but in 04d2529da27db512dcbd5e99d0e26d333f16efcc the ':' was accidentally replaced with a ';'. This the ':' back. Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1465382576-25552-1-git-send-email-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 83cf07b0b577bde1afe1329d25bbcc762966e637) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05io: remove mistaken call to object_ref on QTaskDaniel P. Berrange1-2/+1
The QTask struct is just a standalone struct, not a QOM Object, so calling object_ref() on it is not appropriate. This results in mangling the 'destroy' field in the QTask struct, causing the later call to qtask_free() to try to call the function at address 0x1, with predictably segfault happy results. There is in fact no need for ref counting with QTask, as the call to qtask_abort() or qtask_complete() will automatically free associated memory. This fixes the crash shown in https://bugs.launchpad.net/qemu/+bug/1589923 Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> (cherry picked from commit bc35d51077b33e68a0ab10a057f352747214223f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05vmsvga: don't process more than 1024 fifo commands at onceGerd Hoffmann1-2/+2
vmsvga_fifo_run is called in regular intervals (on each display update) and will resume where it left off. So we can simply exit the loop, without having to worry about how processing will continue. Fixes: CVE-2016-4453 Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1464592161-18348-5-git-send-email-kraxel@redhat.com (cherry picked from commit 4e68a0ee17dad7b8d870df0081d4ab2e079016c2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05vmsvga: shadow fifo registersGerd Hoffmann1-29/+28
The fifo is normal ram. So kvm vcpu threads and qemu iothread can access the fifo in parallel without syncronization. Which in turn implies we can't use the fifo pointers in-place because the guest can try changing them underneath us. So add shadows for them, to make sure the guest can't modify them after we've applied sanity checks. Fixes: CVE-2016-4454 Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1464592161-18348-4-git-send-email-kraxel@redhat.com (cherry picked from commit 7e486f7577764a07aa35588e119903c80a5c30a2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05vmsvga: add more fifo checksGerd Hoffmann1-1/+4
Make sure all fifo ptrs are within range. Fixes: CVE-2016-4454 Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1464592161-18348-3-git-send-email-kraxel@redhat.com (cherry picked from commit c2e3c54d3960bc53bfa3a5ce7ea7a050b9be267e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05vmsvga: move fifo sanity checks to vmsvga_fifo_lengthGerd Hoffmann1-13/+15
Sanity checks are applied when the fifo is enabled by the guest (SVGA_REG_CONFIG_DONE write). Which doesn't help much if the guest changes the fifo registers afterwards. Move the checks to vmsvga_fifo_length so they are done each time qemu is about to read from the fifo. Fixes: CVE-2016-4454 Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1464592161-18348-2-git-send-email-kraxel@redhat.com (cherry picked from commit 521360267876d3b6518b328051a2e56bca55bef8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05block: Drop bdrv_ioctl_bh_cbFam Zheng1-18/+2
Similar to the "!drv || !drv->bdrv_aio_ioctl" case above, here it is okay to set co.ret and return. As pointed out by Paolo, a BH will be created as necessary by the caller (bdrv_co_maybe_schedule_bh). Besides, as pointed out by Kevin, "data" was leaked before. Reported-by: Kevin Wolf <kwolf@redhat.com> Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20160601015223.19277-1-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit c8a9fd80719e63615dac12e3625223fb54aa8430) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05scsi: mptsas: infinite loop while fetching requestsPrasad J Pandit1-5/+4
The LSI SAS1068 Host Bus Adapter emulator in Qemu, periodically looks for requests and fetches them. A loop doing that in mptsas_fetch_requests() could run infinitely if 's->state' was not operational. Move check to avoid such a loop. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Cc: qemu-stable@nongnu.org Message-Id: <1464077264-25473-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 06630554ccbdd25780aa03c3548aaff1eb56dffd) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952)Prasad J Pandit1-4/+20
Vmware Paravirtual SCSI emulation uses command descriptors to process SCSI commands. These descriptors come with their ring buffers. A guest could set the ring buffer size to an arbitrary value leading to OOB access issue. Add check to avoid it. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Cc: qemu-stable@nongnu.org Message-Id: <1464000485-27041-1-git-send-email-ppandit@redhat.com> Reviewed-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 3e831b40e015ba34dfb55ff11f767001839425ff) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05Fix configure test for PBKDF2 in nettleSteven Luo1-0/+1
On my Debian jessie system, including nettle/pbkdf2.h does not cause NULL to be defined, which causes the test to fail to compile. Include stddef.h to bring in a definition of NULL. Cc: qemu-trivial@nongnu.org Cc: qemu-stable@nongnu.org Signed-off-by: Steven Luo <steven+qemu@steven676.net> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 9e87a691bd46846e2232f8c30605c491c85ac987) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05savevm: fail if migration blockers are presentGreg Kurz3-7/+17
QEMU has currently two ways to prevent migration to occur: - migration blocker when it depends on runtime state - VMStateDescription.unmigratable when migration is not supported at all This patch gathers all the logic into a single function to be called from both the savevm and the migrate paths. This fixes a bug with 9p, at least, where savevm would succeed and the following would happen in the guest after loadvm: $ ls /host ls: cannot access /host: Protocol error With this patch: (qemu) savevm foo Migration is disabled when VirtFS export path '/' is mounted in the guest using mount_tag 'host' Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <146239057139.11271.9011797645454781543.stgit@bahia.huguette.org> [Update subject according to Paolo's suggestion - Amit] Signed-off-by: Amit Shah <amit.shah@redhat.com> (cherry picked from commit 24f3902b088cd4f2dbebfd90527b5d81d6a050e9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05nbd: Don't trim unrequested bytesEric Blake1-6/+14
Similar to commit df7b97ff, we are mishandling clients that give an unaligned NBD_CMD_TRIM request, and potentially trimming bytes that occur before their request; which in turn can cause potential unintended data loss (unlikely in practice, since most clients are sane and issue aligned trim requests). However, while we fixed read and write by switching to the byte interfaces of blk_, we don't yet have a byte interface for discard. On the other hand, trim is advisory, so rounding the user's request to simply ignore the first and last unaligned sectors (or the entire request, if it is sub-sector in length) is just fine. CC: qemu-stable@nongnu.org Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1464173965-9694-1-git-send-email-eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 353ab969730742b7392414d62f4ba9632e8cf22c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05block/iscsi: avoid potential overflow of acb->task->cdbPeter Lieven1-0/+7
at least in the path via virtio-blk the maximum size is not restricted. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Lieven <pl@kamp.de> Message-Id: <1464080368-29584-1-git-send-email-pl@kamp.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit a6b3167fa0e825aebb5a7cd8b437b6d41584a196) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-05vfio: Fix broken EEHGavin Shan1-1/+1
vfio_eeh_container_op() is the backend that communicates with host kernel to support EEH functionality in QEMU. However, the functon should return the value from host kernel instead of 0 unconditionally. dwg: Specifically the problem occurs for the handful of EEH sub-operations which can return a non-zero, non-error result. Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com> Acked-by: Alex Williamson <alex.williamson@redhat.com> [dwg: clarification to commit message] Signed-off-by: David Gibson <david@gibson.dropbear.id.au> (cherry picked from commit d917e88d85a147a99f38a62a4f95cac21e366d51) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04vga: add sr_vbe register setGerd Hoffmann2-22/+29
Commit "fd3c136 vga: make sure vga register setup for vbe stays intact (CVE-2016-3712)." causes a regression. The win7 installer is unhappy because it can't freely modify vga registers any more while in vbe mode. This patch introduces a new sr_vbe register set. The vbe_update_vgaregs will fill sr_vbe[] instead of sr[]. Normal vga register reads and writes go to sr[]. Any sr register read access happens through a new sr() helper function which will read from sr_vbe[] with vbe active and from sr[] otherwise. This way we can allow guests update sr[] registers as they want, without allowing them disrupt vbe video modes that way. Cc: qemu-stable@nongnu.org Reported-by: Thomas Lamprecht <thomas@lamprecht.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1463475294-14119-1-git-send-email-kraxel@redhat.com (cherry picked from commit 94ef4f337fb614f18b765a8e0e878a4c23cdedcd) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04usb/ohci: Fix crash with when specifying too many num-portsThomas Huth1-0/+6
QEMU currently crashes when an OHCI controller is instantiated with too many ports, e.g. "-device pci-ohci,num-ports=100,masterbus=1". Thus add a proper check in usb_ohci_init() to make sure that we do not use more than OHCI_MAX_PORTS = 15 ports here. Ticket: https://bugs.launchpad.net/qemu/+bug/1581308 Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1463995387-11710-1-git-send-email-thuth@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit d400fc018b326104d26d730e5cc8c36c1f662c34) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-08-04block/nfs: refuse readahead if cache.direct is onPeter Lieven1-4/+16
if we open a NFS export with disabled cache we should refuse the readahead feature as it will cache data inside libnfs. If a export was opened with readahead enabled it should futher not be allowed to disable the cache while running. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Lieven <pl@kamp.de> Reviewed-by: Jeff Cody <jcody@redhat.com> Message-id: 1463662083-20814-2-git-send-email-pl@kamp.de Signed-off-by: Jeff Cody <jcody@redhat.com> (cherry picked from commit 38f8d5e0251ae7d8257cf099cb3e5a375ef60378) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
generated by cgit v1.1 at 2025-08-03 23:49:42 +0000