qemu.git
4 years agoUpdate version for 2.5.1.1 release stable-2.5 github/stable-2.5 v2.5.1.1
Michael Roth [Mon, 9 May 2016 16:10:47 +0000 (11:10 -0500)] 
Update version for 2.5.1.1 release

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com
4 years agocadence_uart: bounds check write offset
Michael S. Tsirkin [Mon, 18 Apr 2016 10:07:35 +0000 (13:07 +0300)] 
cadence_uart: bounds check write offset

cadence_uart_init() initializes an I/O memory region of size 0x1000
bytes.  However in uart_write(), the 'offset' parameter (offset within
region) is divided by 4 and then used to index the array 'r' of size
CADENCE_UART_R_MAX which is much smaller: (0x48/4).  If 'offset>>=2'
exceeds CADENCE_UART_R_MAX, this will cause an out-of-bounds memory
write where the offset and the value are controlled by guest.

This will corrupt QEMU memory, in most situations this causes the vm to
crash.

Fix by checking the offset against the array size.

Cc: qemu-stable@nongnu.org
Reported-by: 李强 <liqiang6-s@360.cn>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20160418100735.GA517@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 5eb0b194e9b01ba0f3613e6ddc2cb9f63ce96ae5)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoRevert "ehci: make idt processing more robust"
Gerd Hoffmann [Mon, 18 Apr 2016 07:20:54 +0000 (09:20 +0200)] 
Revert "ehci: make idt processing more robust"

This reverts commit 156a2e4dbffa85997636a7a39ef12da6f1b40254.

Breaks FreeBSD.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit a49923d2837d20510d645d3758f1ad87c32d0730)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoehci: apply limit to iTD/sidt descriptors
Gerd Hoffmann [Mon, 18 Apr 2016 07:11:38 +0000 (09:11 +0200)] 
ehci: apply limit to iTD/sidt descriptors

Commit "156a2e4 ehci: make idt processing more robust" tries to avoid a
DoS by the guest (create a circular iTD queue and let qemu ehci
emulation run in circles forever).  Unfortunately this has two problems:
First it misses the case of siTDs, and second it reportedly breaks
FreeBSD.

So lets go for a different approach: just count the number of iTDs and
siTDs we have seen per frame and apply a limit.  That should really
catch all cases now.

Reported-by: 杜少博 <dushaobo@360.cn>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 1ae3f2f178087711f9591350abad133525ba93f2)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agovga: make sure vga register setup for vbe stays intact (CVE-2016-3712).
Gerd Hoffmann [Tue, 26 Apr 2016 12:48:06 +0000 (14:48 +0200)] 
vga: make sure vga register setup for vbe stays intact (CVE-2016-3712).

Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT
registers, to make sure the vga registers will always have the
values needed by vbe mode.  This makes sure the sanity checks
applied by vbe_fixup_regs() are effective.

Without this guests can muck with shift_control, can turn on planar
vga modes or text mode emulation while VBE is active, making qemu
take code paths meant for CGA compatibility, but with the very
large display widths and heigts settable using VBE registers.

Which is good for one or another buffer overflow.  Not that
critical as they typically read overflows happening somewhere
in the display code.  So guests can DoS by crashing qemu with a
segfault, but it is probably not possible to break out of the VM.

Fixes: CVE-2016-3712
Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com>
Reported-by: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agovga: update vga register setup on vbe changes
Gerd Hoffmann [Tue, 26 Apr 2016 13:39:22 +0000 (15:39 +0200)] 
vga: update vga register setup on vbe changes

Call the new vbe_update_vgaregs() function on vbe configuration
changes, to make sure vga registers are up-to-date.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agovga: factor out vga register setup
Gerd Hoffmann [Tue, 26 Apr 2016 13:24:18 +0000 (15:24 +0200)] 
vga: factor out vga register setup

When enabling vbe mode qemu will setup a bunch of vga registers to make
sure the vga emulation operates in correct mode for a linear
framebuffer.  Move that code to a separate function so we can call it
from other places too.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agovga: add vbe_enabled() helper
Gerd Hoffmann [Tue, 26 Apr 2016 12:11:34 +0000 (14:11 +0200)] 
vga: add vbe_enabled() helper

Makes code a bit easier to read.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agovga: fix banked access bounds checking (CVE-2016-3710)
Gerd Hoffmann [Tue, 26 Apr 2016 06:49:10 +0000 (08:49 +0200)] 
vga: fix banked access bounds checking (CVE-2016-3710)

vga allows banked access to video memory using the window at 0xa00000
and it supports a different access modes with different address
calculations.

The VBE bochs extentions support banked access too, using the
VBE_DISPI_INDEX_BANK register.  The code tries to take the different
address calculations into account and applies different limits to
VBE_DISPI_INDEX_BANK depending on the current access mode.

Which is probably effective in stopping misprogramming by accident.
But from a security point of view completely useless as an attacker
can easily change access modes after setting the bank register.

Drop the bogus check, add range checks to vga_mem_{readb,writeb}
instead.

Fixes: CVE-2016-3710
Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoUpdate version for 2.5.1 release v2.5.1
Michael Roth [Tue, 29 Mar 2016 20:47:56 +0000 (15:47 -0500)] 
Update version for 2.5.1 release

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agohyperv: cpu hotplug fix with HyperV enabled
Denis V. Lunev [Mon, 22 Feb 2016 09:13:02 +0000 (12:13 +0300)] 
hyperv: cpu hotplug fix with HyperV enabled

With Hyper-V enabled CPU hotplug stops working. The CPU appears
in device manager on Windows but does not appear in peformance
monitor and control panel.

The root of the problem is the following. Windows checks
HV_X64_CPU_DYNAMIC_PARTITIONING_AVAILABLE bit in CPUID. The
presence of this bit is enough to cure the situation.

The bit should be set when CPU hotplug is allowed for HyperV VM.
The check that hot_add_cpu callback is defined is enough from the
protocol point of view. Though this callback is defined almost
always thus there is no need to export that knowledge in the
other way.

Signed-off-by: Denis V. Lunev <den@openvz.org>
Reviewed-by: Roman Kagan <rkagan@virtuozzo.com>
CC: Paolo Bonzini <pbonzini@redhat.com>
CC: Richard Henderson <rth@twiddle.net>
CC: Eduardo Habkost <ehabkost@redhat.com>
CC: "Andreas Färber" <afaerber@suse.de>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
(cherry picked from commit 4467c6c118b85133846785f517e5733112e811b4)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agovmdk: Fix converting to streamOptimized
Fam Zheng [Mon, 25 Jan 2016 02:26:23 +0000 (10:26 +0800)] 
vmdk: Fix converting to streamOptimized

Commit d62d9dc4b8 lifted streamOptimized images's version to 3, but we
now refuse to open version 3 images read-write.  We need to make
streamOptimized an exception to allow converting to it. This fixes the
accidentally broken iotests case 059 for the same reason.

Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
(cherry picked from commit 3db1d98a20262228373bb973ca62b1ab64b29af4)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agovmdk: Create streamOptimized as version 3
Fam Zheng [Thu, 17 Sep 2015 05:04:10 +0000 (13:04 +0800)] 
vmdk: Create streamOptimized as version 3

VMware products accept only version 3 for streamOptimized, let's bump
the version.

Reported-by: Radoslav Gerganov <rgerganov@vmware.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit d62d9dc4b814950dcc8bd261a3e2e9300d9065e6)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agousb: check USB configuration descriptor object
Prasad J Pandit [Thu, 11 Feb 2016 11:01:20 +0000 (16:31 +0530)] 
usb: check USB configuration descriptor object

When processing remote NDIS control message packets, the USB Net
device emulator checks to see if the USB configuration descriptor
object is of RNDIS type(2). But it does not check if it is null,
which leads to a null dereference error. Add check to avoid it.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 1455188480-14688-1-git-send-email-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 80eecda8e5d09c442c24307f340840a5b70ea3b9)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agousb: check RNDIS message length
Prasad J Pandit [Tue, 16 Feb 2016 18:53:40 +0000 (00:23 +0530)] 
usb: check RNDIS message length

When processing remote NDIS control message packets, the USB Net
device emulator uses a fixed length(4096) data buffer. The incoming
packet length could exceed this limit. Add a check to avoid it.

Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 1455648821-17340-2-git-send-email-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 64c9bc181fc78275596649f591302d72df2d3071)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agousb: check RNDIS buffer offsets & length
Prasad J Pandit [Tue, 16 Feb 2016 18:53:41 +0000 (00:23 +0530)] 
usb: check RNDIS buffer offsets & length

When processing remote NDIS control message packets,
the USB Net device emulator uses a fixed length(4096) data buffer.
The incoming informationBufferOffset & Length combination could
overflow and cross that range. Check control message buffer
offsets and length to avoid it.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 1455648821-17340-3-git-send-email-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit fe3c546c5ff2a6210f9a4d8561cc64051ca8603e)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agousb: check page select value while processing iTD
Prasad J Pandit [Tue, 19 Jan 2016 19:56:46 +0000 (01:26 +0530)] 
usb: check page select value while processing iTD

While processing isochronous transfer descriptors(iTD), the page
select(PG) field value could lead to an OOB read access. Add
check to avoid it.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 1453233406-12165-1-git-send-email-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 49d925ce50383a286278143c05511d30ec41a36e)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agonet: ne2000: fix bounds check in ioport operations
Prasad J Pandit [Thu, 31 Dec 2015 11:35:27 +0000 (17:05 +0530)] 
net: ne2000: fix bounds check in ioport operations

While doing ioport r/w operations, ne2000 device emulation suffers
from OOB r/w errors. Update respective array bounds check to avoid
OOB access.

Reported-by: Ling Liu <liuling-it@360.cn>
Cc: qemu-stable@nongnu.org
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit aa7f9966dfdff500bbbf1956d9e115b1fa8987a6)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agonet: check packet payload length
Prasad J Pandit [Wed, 2 Mar 2016 11:59:58 +0000 (17:29 +0530)] 
net: check packet payload length

While computing IP checksum, 'net_checksum_calculate' reads
payload length from the packet. It could exceed the given 'data'
buffer size. Add a check to avoid it.

Reported-by: Liu Ling <liuling-it@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 362786f14a753d8a5256ef97d7c10ed576d6572b)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoide: ahci: reset ncq object to unused on error
Prasad J Pandit [Mon, 11 Jan 2016 19:10:42 +0000 (14:10 -0500)] 
ide: ahci: reset ncq object to unused on error

When processing NCQ commands, AHCI device emulation prepares a
NCQ transfer object; To which an aio control block(aiocb) object
is assigned in 'execute_ncq_command'. In case, when the NCQ
command is invalid, the 'aiocb' object is not assigned, and NCQ
transfer object is left as 'used'. This leads to a use after
free kind of error in 'bdrv_aio_cancel_async' via 'ahci_reset_port'.
Reset NCQ transfer object to 'unused' to avoid it.

[Maintainer edit: s/ACHI/AHCI/ in the commit message. --js]

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 1452282511-4116-1-git-send-email-ppandit@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
(cherry picked from commit 4ab0359a8ae182a7ac5c99609667273167703fab)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoi386: avoid null pointer dereference
P J P [Fri, 18 Dec 2015 06:05:07 +0000 (11:35 +0530)] 
i386: avoid null pointer dereference

    Hello,

A null pointer dereference issue was reported by Mr Ling Liu, CC'd here. It
occurs while doing I/O port write operations via hmp interface. In that,
'current_cpu' remains null as it is not called from cpu_exec loop, which
results in the said issue.

Below is a proposed (tested)patch to fix this issue; Does it look okay?

===
From ae88a4947fab9a148cd794f8ad2d812e7f5a1d0f Mon Sep 17 00:00:00 2001
From: Prasad J Pandit <pjp@fedoraproject.org>
Date: Fri, 18 Dec 2015 11:16:07 +0530
Subject: [PATCH] i386: avoid null pointer dereference

When I/O port write operation is called from hmp interface,
'current_cpu' remains null, as it is not called from cpu_exec()
loop. This leads to a null pointer dereference in vapic_write
routine. Add check to avoid it.

Reported-by: Ling Liu <liuling-it@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <alpine.LFD.2.20.1512181129320.9805@wniryva>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: P J P <ppandit@redhat.com>
(cherry picked from commit 4c1396cb576c9b14425558b73de1584c7a9735d7)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agohmp: fix sendkey out of bounds write (CVE-2015-8619)
Wolfgang Bumiller [Wed, 13 Jan 2016 08:09:58 +0000 (09:09 +0100)] 
hmp: fix sendkey out of bounds write (CVE-2015-8619)

When processing 'sendkey' command, hmp_sendkey routine null
terminates the 'keyname_buf' array. This results in an OOB
write issue, if 'keyname_len' was to fall outside of
'keyname_buf' array.

Since the keyname's length is known the keyname_buf can be
removed altogether by adding a length parameter to
index_from_key() and using it for the error output as well.

Reported-by: Ling Liu <liuling-it@360.cn>
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Message-Id: <20160113080958.GA18934@olga>
[Comparison with "<" dumbed down, test for junk after strtoul()
tweaked]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
(cherry picked from commit 64ffbe04eaafebf4045a3ace52a360c14959d196)

Conflicts:
hmp.c

*removed dependency on 7fb1cf16

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoahci: Do not unmap NULL addresses
John Snow [Wed, 10 Feb 2016 18:29:40 +0000 (13:29 -0500)] 
ahci: Do not unmap NULL addresses

Definitely don't try to unmap a garbage address.

Reported-by: Zuozhi fzz <zuozhi.fzz@alibaba-inc.com>
Signed-off-by: John Snow <jsnow@redhat.com>
Message-id: 1454103689-13042-2-git-send-email-jsnow@redhat.com
(cherry picked from commit 99b4cb71069f109b79b27bc629fc0cf0886dbc4b)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agomigration: allow machine to enforce configuration section migration
Greg Kurz [Thu, 18 Feb 2016 11:32:25 +0000 (12:32 +0100)] 
migration: allow machine to enforce configuration section migration

Migration of pseries-2.3 doesn't have configuration section. Unfortunately,
QEMU 2.4/2.4.1/2.5 are buggy and always stream and expect the configuration
section, and break migration both ways.

This patch introduces a property which allows to enforce a configuration
section for machines who don't have one.

It can be set at startup:

-machine enforce-config-section=on

or later from the QEMU monitor:

qom-set /machine enforce-config-section on

It is up to the tooling to set or unset this property according to the
version of the QEMU at the other end of the pipe.

Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
(cherry picked from commit 902c053d834e3b802ec736f170edf226d4a841ff)

Conflicts:
qemu-options.hx

* removed context dependency on 87252e1b
* added to provide 2.5<->2.5.1 migration compat option for
  pseries-2.3 machines

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agovl.c: Fix regression in machine error message
Marcel Apfelbaum [Fri, 12 Feb 2016 19:02:24 +0000 (17:02 -0200)] 
vl.c: Fix regression in machine error message

Commit e1ce0c3cb (vl.c: fix regression when reading machine type
from config file) fixed the error message when the machine type
was supplied inside the config file. However now the option name
is not displayed correctly if the error happens when the machine
is specified at command line.

Running
    ./x86_64-softmmu/qemu-system-x86_64 -M q35-1.5 -redir tcp:8022::22
will result in the error message:
    qemu-system-x86_64: -redir tcp:8022::22: unsupported machine type
    Use -machine help to list supported machines

Fixed it by restoring the error location and also extracted the code
dealing with machine options into a separate function.

Reported-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <1455303747-19776-2-git-send-email-ehabkost@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
(cherry picked from commit 34f405ae6d5c4170b192a12b2e654a2aea0c3b50)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoquorum: Fix crash in quorum_aio_cb()
Alberto Garcia [Thu, 10 Mar 2016 11:55:24 +0000 (13:55 +0200)] 
quorum: Fix crash in quorum_aio_cb()

quorum_aio_cb() emits the QUORUM_REPORT_BAD event if there's
an I/O error in a Quorum child. However sacb->aiocb must be
correctly initialized for this to happen. read_quorum_children() and
read_fifo_child() are not doing this, which results in a QEMU crash.

Signed-off-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 8138570d071ba7e25db3736979234a1fd71dbd05.1457610443.git.berto@igalia.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
(cherry picked from commit b9c600d20716b3d942cb07188ff998fb236a8365)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agotarget-arm: Make reserved ranges in ID_AA64* spaces RAZ, not UNDEF
Peter Maydell [Fri, 19 Feb 2016 14:07:43 +0000 (14:07 +0000)] 
target-arm: Make reserved ranges in ID_AA64* spaces RAZ, not UNDEF

The v8 ARM ARM defines that unused spaces in the ID_AA64* system
register ranges are Reserved and must RAZ, rather than being UNDEF.
Implement this.

In particular, ARM v8.2 adds a new feature register ID_AA64MMFR2,
and newer versions of the Linux kernel will attempt to read this,
which causes them not to boot up on versions of QEMU missing this fix.

Since the encoding .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6
is actually defined in ARMv8 (as ID_MMFR4), we give it an entry in
the ARMCPU struct so CPUs can override it, though since none do
this too will just RAZ.

Cc: qemu-stable@nongnu.org
Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1455890863-11203-1-git-send-email-peter.maydell@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
(cherry picked from commit e20d84c1407d43d5a2e2ac95dbb46db3b0af8f9f)

Conflicts:
target-arm/helper.c

* remove context dep on 4054bfa9

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agovhost-user: don't merge regions with different fds
Michael S. Tsirkin [Sun, 21 Feb 2016 15:01:47 +0000 (17:01 +0200)] 
vhost-user: don't merge regions with different fds

vhost currently merges regions with contiguious virtual and physical
addresses.  This breaks for vhost-user since that also needs fds to
match.

Add a vhost_ops entry to compare the fds for vhost-user only.

Cc: qemu-stable@nongnu.org
Cc: Victor Kaplansky <victork@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit ffe42cc14c770549abc7995a90cf53bca3659b7f)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agofw_cfg: unbreak migration compatibility for 2.4 and earlier machines
Laszlo Ersek [Thu, 18 Feb 2016 19:31:00 +0000 (20:31 +0100)] 
fw_cfg: unbreak migration compatibility for 2.4 and earlier machines

When I reviewed Marc's fw_cfg DMA patches, I completely missed that the
way we set dma_enabled would break migration.

Gerd explained the right way (see reference below): dma_enabled should be
set to true by default, and only true->false transitions should be
possible:

- when the user requests that with

    -global fw_cfg_mem.dma_enabled=off

  or

   -global fw_cfg_io.dma_enabled=off

  as appropriate for the platform,

- when HW_COMPAT_2_4 dictates it,

- when board code initializes fw_cfg without requesting DMA support.

Cc: Marc Marí <markmb@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Alexandre DERUMIER <aderumier@odiso.com>
Cc: qemu-stable@nongnu.org
Ref: http://thread.gmane.org/gmane.comp.emulators.qemu/390272/focus=391042
Ref: https://bugs.launchpad.net/qemu/+bug/1536487
Suggested-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 1455823860-22268-1-git-send-email-lersek@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit e6915b5f3a874a467a9a65f7ec1d6ef8d251a51a)

Conflicts:
include/hw/compat.h

* remove cosmetic dep on c9c0afbb

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agohw/virtio: group virtio flags into an enum
Marcel Apfelbaum [Wed, 10 Feb 2016 13:31:13 +0000 (15:31 +0200)] 
hw/virtio: group virtio flags into an enum

Minimizes the possibility to assign
the same bit to different features.

Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit fc1769b758a5b6167bb9cdb4e10369a49b4fa930)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agohw/virtio: fix double use of a virtio flag
Marcel Apfelbaum [Wed, 10 Feb 2016 13:31:12 +0000 (15:31 +0200)] 
hw/virtio: fix double use of a virtio flag

Commits 1811e64c and a6df8adf use the same virtio feature bit 4
for different features.

Fix it by using different bits.

Reported-by: Laurent Vivier <lvivier@redhat.com>
Tested-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 631a4387554d53a0d19dd7973851ed760a5bff97)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agospapr: skip configuration section during migration of older machines
Greg Kurz [Thu, 18 Feb 2016 11:32:18 +0000 (12:32 +0100)] 
spapr: skip configuration section during migration of older machines

Since QEMU 2.4, we have a configuration section in the migration stream.
This must be skipped for older machines, like it is already done for x86.

This patch fixes the migration of pseries-2.3 from/to QEMU 2.3, but it
breaks migration of the same machine from/to QEMU 2.4/2.4.1/2.5. We do
that anyway because QEMU 2.3 is likely to be more widely deployed than
newer QEMU versions.

Fixes: 61964c23e5ddd5a33f15699e45ce126f879e3e33
Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
(cherry picked from commit 09b5e30da5b19f44768a5429f603caaede216757)

Conflicts:
hw/ppc/spapr.c

*remove dep on 5013c5474

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoe1000: eliminate infinite loops on out-of-bounds transfer start
Laszlo Ersek [Tue, 19 Jan 2016 13:17:20 +0000 (14:17 +0100)] 
e1000: eliminate infinite loops on out-of-bounds transfer start

The start_xmit() and e1000_receive_iov() functions implement DMA transfers
iterating over a set of descriptors that the guest's e1000 driver
prepares:

- the TDLEN and RDLEN registers store the total size of the descriptor
  area,

- while the TDH and RDH registers store the offset (in whole tx / rx
  descriptors) into the area where the transfer is supposed to start.

Each time a descriptor is processed, the TDH and RDH register is bumped
(as appropriate for the transfer direction).

QEMU already contains logic to deal with bogus transfers submitted by the
guest:

- Normally, the transmit case wants to increase TDH from its initial value
  to TDT. (TDT is allowed to be numerically smaller than the initial TDH
  value; wrapping at or above TDLEN bytes to zero is normal.) The failsafe
  that QEMU currently has here is a check against reaching the original
  TDH value again -- a complete wraparound, which should never happen.

- In the receive case RDH is increased from its initial value until
  "total_size" bytes have been received; preferably in a single step, or
  in "s->rxbuf_size" byte steps, if the latter is smaller. However, null
  RX descriptors are skipped without receiving data, while RDH is
  incremented just the same. QEMU tries to prevent an infinite loop
  (processing only null RX descriptors) by detecting whether RDH assumes
  its original value during the loop. (Again, wrapping from RDLEN to 0 is
  normal.)

What both directions miss is that the guest could program TDLEN and RDLEN
so low, and the initial TDH and RDH so high, that these registers will
immediately be truncated to zero, and then never reassume their initial
values in the loop -- a full wraparound will never occur.

The condition that expresses this is:

  xdh_start >= s->mac_reg[XDLEN] / sizeof(desc)

i.e., TDH or RDH start out after the last whole rx or tx descriptor that
fits into the TDLEN or RDLEN sized area.

This condition could be checked before we enter the loops, but
pci_dma_read() / pci_dma_write() knows how to fill in buffers safely for
bogus DMA addresses, so we just extend the existing failsafes with the
above condition.

This is CVE-2016-1981.

Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Cc: Prasad Pandit <ppandit@redhat.com>
Cc: Michael Roth <mdroth@linux.vnet.ibm.com>
Cc: Jason Wang <jasowang@redhat.com>
Cc: qemu-stable@nongnu.org
RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1296044
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit dd793a74882477ca38d49e191110c17dfee51dcc)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoblock: qemu-iotests - add test for snapshot, commit, snapshot bug
Jeff Cody [Tue, 2 Feb 2016 01:33:11 +0000 (20:33 -0500)] 
block: qemu-iotests - add test for snapshot, commit, snapshot bug

Signed-off-by: Jeff Cody <jcody@redhat.com>
Message-id: 2dbc05efba2f683cb3aaf71aaa9b776ebf7ec57c.1454376655.git.jcody@redhat.com
Reviewed-by: Max Reitz <mreitz@redhat.com>
[Moved test number from 143 to 144]
Signed-off-by: Max Reitz <mreitz@redhat.com>
(cherry picked from commit 8983b670f62ab5e5e8dd2690bf8304123651bfe5)

Conflicts:
tests/qemu-iotests/group

*removed context dependencies on newer test groups

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoblock: set device_list.tqe_prev to NULL on BDS removal
Jeff Cody [Tue, 2 Feb 2016 01:33:10 +0000 (20:33 -0500)] 
block: set device_list.tqe_prev to NULL on BDS removal

This fixes a regression introduced with commit 3f09bfbc7.  Multiple
bugs arise in conjunction with live snapshots and mirroring operations
(which include active layer commit).

After a live snapshot occurs, the active layer and the base layer both
have a non-NULL tqe_prev field in the device_list, although the base
node's tqe_prev field points to a NULL entry.  This non-NULL tqe_prev
field occurs after the bdrv_append() in the external snapshot calls
change_parent_backing_link().

In change_parent_backing_link(), when the previous active layer is
removed from device_list, the device_list.tqe_prev pointer is not
set to NULL.

The operating scheme in the block layer is to indicate that a BDS belongs
in the bdrv_states device_list iff the device_list.tqe_prev pointer
is non-NULL.

This patch does two things:

1.) Introduces a new block layer helper bdrv_device_remove() to remove a
    BDS from the device_list, and
2.) uses that new API, which also fixes the regression once used in
    change_parent_backing_link().

Signed-off-by: Jeff Cody <jcody@redhat.com>
Message-id: 0cd51e11c0666c04ddb7c05293fe94afeb551e89.1454376655.git.jcody@redhat.com
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
(cherry picked from commit f8aa905a4fec89863c82de4186352447d851871e)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoqmp: Fix reference-counting of qnull on empty output visit
Eric Blake [Fri, 29 Jan 2016 13:49:00 +0000 (06:49 -0700)] 
qmp: Fix reference-counting of qnull on empty output visit

Commit 6c2f9a15 ensured that we would not return NULL when the
caller used an output visitor but had nothing to visit. But
in doing so, it added a FIXME about a reference count leak
that could abort qemu in the (unlikely) case of SIZE_MAX such
visits (more plausible on 32-bit).  (Although that commit
suggested we might fix it in time for 2.5, we ran out of time;
fortunately, it is unlikely enough to bite that it was not
worth worrying about during the 2.5 release.)

This fixes things by documenting the internal contracts, and
explaining why the internal function can return NULL and only
the public facing interface needs to worry about qnull(),
thus avoiding over-referencing the qnull_ global object.

It does not, however, fix the stupidity of the stack mixing
up two separate pieces of information; add a FIXME to explain
that issue, which will be fixed shortly in a future patch.

Signed-off-by: Eric Blake <eblake@redhat.com>
Cc: qemu-stable@nongnu.org
Message-Id: <1454075341-13658-25-git-send-email-eblake@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
(cherry picked from commit a86156401559cb4401cf9ecc704faeab6fc8bb19)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agocpus: use broadcast on qemu_pause_cond
Dr. David Alan Gilbert [Mon, 25 Jan 2016 10:08:18 +0000 (10:08 +0000)] 
cpus: use broadcast on qemu_pause_cond

Jiri saw a hang on pause_all_vcpus called from postcopy_start,
where the cpus are all apparently stopped ('stopped' flag set)
but pause_all_vcpus is still stuck on a cond_wait on qemu_paused_cond.
We suspect this is happening if a qmp_stop is called at about the
same time as the postcopy code calls that pause_all_vcpus;
although they both should have the main lock held, Paolo spotted
the cond_wait unlocks the global lock so perhaps they both
could end up waiting at the same time?

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reported-by: Jiri Denemark <jdenemar@redhat.com>
Message-Id: <1453716498-27238-1-git-send-email-dgilbert@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 96bce6831bd19b61e965384427741d805c7234c3)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agofw_cfg: avoid calculating invalid current entry pointer
Gabriel L. Somlo [Thu, 5 Nov 2015 14:32:50 +0000 (09:32 -0500)] 
fw_cfg: avoid calculating invalid current entry pointer

When calculating a pointer to the currently selected fw_cfg item, the
following is used:

  FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];

When s->cur_entry is FW_CFG_INVALID, we are calculating the address of
a non-existent element in s->entries[arch][...], which is undefined.

This patch ensures the resulting entry pointer is set to NULL whenever
s->cur_entry is FW_CFG_INVALID.

Reported-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
Message-id: 1446733972-1602-5-git-send-email-somlo@cmu.edu
Cc: Marc Marí <markmb@redhat.com>
Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 66f8fd9dda312191b78d2a2ba2848bcee76127a2)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agos390x/css: fix control flags during csch
Halil Pasic [Wed, 20 Jan 2016 18:51:30 +0000 (19:51 +0100)] 
s390x/css: fix control flags during csch

From the beginning, css support contained an error in csch handling:
instead of setting the clear bit in the function control bits twice, we
need to set the clear pending bit in the activity control bits. Let's
fix this.

Cc: qemu-stable@nongnu.org
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
(cherry picked from commit 4c6bf79a222934ac9ff0e45fc98ea1c986ed5c67)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agos390x/ioinst: set type and len for SEI response
Pierre Morel [Thu, 14 Jan 2016 12:29:53 +0000 (13:29 +0100)] 
s390x/ioinst: set type and len for SEI response

If no event information is pending, the return code
is set to 0x0005 and the length of the response is
set to 8 bytes.

Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Reviewed-by: Song Shan Gong <gongss@linux.vnet.ibm.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
(cherry picked from commit f70202be535b5601fd02c725dc1d74f3bfc5039c)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoblock/raw-posix: avoid bogus fixup for cylinders on DASD disks
Christian Borntraeger [Mon, 14 Dec 2015 15:41:19 +0000 (16:41 +0100)] 
block/raw-posix: avoid bogus fixup for cylinders on DASD disks

large volume DASD that have > 64k cylinders do claim to have
0xFFFE cylinders as special value in the old 16 bit field. We
want to pass this "token" along to the guest, instead of
calculating the real number. Otherwise qemu might fail with
"cyls must be between 1 and 65535"

Cc: qemu-stable@nongnu.org
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 972b543c6b63579aee590b738d21af09f01569f7)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoehci: update irq on reset
Gerd Hoffmann [Tue, 19 Jan 2016 11:44:44 +0000 (12:44 +0100)] 
ehci: update irq on reset

After clearing the status register we also have to update the irq line
status.  Otherwise a irq which happends to be pending at reset time
causes a interrupt storm.  And the guest can't stop as the status
register doesn't indicate any pending interrupt.

Both NetBSD and FreeBSD hang on shutdown because of that.

Cc: qemu-stable@nongnu.org
Reported-by: Andrey Korolyov <andrey@xdel.ru>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1453203884-4125-1-git-send-email-kraxel@redhat.com
(cherry picked from commit 5a8660741a8aa19fbf8a5e8a2b3aac88664f4e66)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agonet: set endianness on all backend devices
Laurent Vivier [Wed, 13 Jan 2016 19:26:25 +0000 (20:26 +0100)] 
net: set endianness on all backend devices

commit 5be7d9f1b1452613b95c6ba70b8d7ad3d0797991
       vhost-net: tell tap backend about the vnet endianness

makes vhost net to set the endianness of the device, but only for
the first device.

In case of multiqueue, we have multiple devices... This patch sets the
endianness for all the devices of the interface.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit a407644079c8639002e7ea635d851953b10a38c3)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agonet: ne2000: check ring buffer control registers
Prasad J Pandit [Wed, 24 Feb 2016 06:11:33 +0000 (11:41 +0530)] 
net: ne2000: check ring buffer control registers

Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152)
bytes to process network packets. Registers PSTART & PSTOP
define ring buffer size & location. Setting these registers
to invalid values could lead to infinite loop or OOB r/w
access issues. Add check to avoid it.

Reported-by: Yang Hongke <yanghongke@huawei.com>
Tested-by: Yang Hongke <yanghongke@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 415ab35a441eca767d033a2702223e785b9d5190)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agonet/filter: fix nf->netdev_id leak
Li Zhijian [Wed, 23 Dec 2015 07:43:18 +0000 (15:43 +0800)] 
net/filter: fix nf->netdev_id leak

Cc: Jason Wang <jasowang@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 671f66f87fbf6cc6a3879f3055f16347b1db91e9)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agonet/dump: fix nfds->filename leak
Li Zhijian [Wed, 23 Dec 2015 07:43:19 +0000 (15:43 +0800)] 
net/dump: fix nfds->filename leak

Cc: Jason Wang <jasowang@redhat.com>
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit b50c7d452f5aef52cc9e7461f215cab87c3f3b03)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoblockdev: Fix 'change' for slot devices
Max Reitz [Fri, 29 Jan 2016 19:49:11 +0000 (20:49 +0100)] 
blockdev: Fix 'change' for slot devices

'change' and related operations did not work when used on guest devices
featuring removable media but no actual tray, because
blk_dev_is_tray_open() always returned false for them and the
blockdev-{insert,remove}-medium commands required it to return true.

Fix this by making blockdev-{insert,remove}-medium work on tray-less
devices. Also, blockdev-{open,close}-tray are now explicitly no-ops when
invoked on such devices, and blk_dev_change_media_cb() is instead
called by blockdev-{insert,remove}-medium (for tray-less devices only).

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-id: 1454096953-31773-3-git-send-email-mreitz@redhat.com
Reviewed-by: Eric Blake <eblake@redhat.com>
(cherry picked from commit 12c7ec87a7d88919b23736176eba3118d1521372)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoblock: Add blk_dev_has_tray()
Max Reitz [Fri, 29 Jan 2016 19:49:10 +0000 (20:49 +0100)] 
block: Add blk_dev_has_tray()

Pull out the check whether a block device has a tray from
blk_dev_is_tray_open() into its own function so both attributes (whether
there is a tray vs. whether that tray is open) can be queried
independently.

Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-id: 1454096953-31773-2-git-send-email-mreitz@redhat.com
(cherry picked from commit 8f3a73bc57ea83e5b3930d14fc596ea51859987a)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agonet: rocker: fix an incorrect array bounds check
Prasad J Pandit [Mon, 28 Dec 2015 10:54:08 +0000 (16:24 +0530)] 
net: rocker: fix an incorrect array bounds check

While processing transmit(tx) descriptors in 'tx_consume' routine
the switch emulator suffers from an off-by-one error, if a
descriptor was to have more than allowed(ROCKER_TX_FRAGS_MAX=16)
fragments. Fix an incorrect bounds check to avoid it.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 007cd223de527b5f41278f2d886c1a4beb3e67aa)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoivshmem: remove redundant assignment, fix crash with msi=off
Marc-André Lureau [Fri, 18 Dec 2015 14:13:08 +0000 (15:13 +0100)] 
ivshmem: remove redundant assignment, fix crash with msi=off

Fix crash when msi=false introduced in 660c97ee (msi_vectors is NULL in
this case)

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
(cherry picked from commit 47213eb1104709bf238c8d16db20aa47d37b1c59)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoivshmem: no need for opaque argument
Marc-André Lureau [Fri, 18 Dec 2015 11:20:51 +0000 (12:20 +0100)] 
ivshmem: no need for opaque argument

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
(cherry picked from commit 2c64846972897fc3aec4072f849fae2b00322f8b)
*context dependency for 47213eb
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoscsi: initialise info object with appropriate size
P J P [Mon, 21 Dec 2015 09:43:13 +0000 (15:13 +0530)] 
scsi: initialise info object with appropriate size

While processing controller 'CTRL_GET_INFO' command, the routine
'megasas_ctrl_get_info' overflows the '&info' object size. Use its
appropriate size to null initialise it.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <alpine.LFD.2.20.1512211501420.22471@wniryva>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: P J P <ppandit@redhat.com>
(cherry picked from commit 36fef36b91f7ec0435215860f1458b5342ce2811)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agovirtio-9p: use accessor to get thread_pool
Greg Kurz [Wed, 23 Dec 2015 09:56:58 +0000 (10:56 +0100)] 
virtio-9p: use accessor to get thread_pool

The aio_context_new() function does not allocate a thread pool. This is
deferred to the first call to the aio_get_thread_pool() accessor. It is
hence forbidden to access the thread_pool field directly, as it may be
NULL. The accessor *must* be used always.

Fixes: ebac1202c95a4f1b76b6ef3f0f63926fa76e753e
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Cc: qemu-stable@nongnu.org
Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
(cherry picked from commit 4b3a4f2d458ca5a7c6c16ac36a8d9ac22cc253d6)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoxenfb: avoid reading twice the same fields from the shared page
Stefano Stabellini [Fri, 18 Dec 2015 15:10:09 +0000 (15:10 +0000)] 
xenfb: avoid reading twice the same fields from the shared page

Reading twice the same field could give the guest an attack of
opportunity. In the case of event->type, gcc could compile the switch
statement into a jump table, effectively ending up reading the type
field multiple times.

This is part of XSA-155.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
(cherry picked from commit 7ea11bf376aea4bf8340eb363de9777c7f93e556)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoxen/blkif: Avoid double access to src->nr_segments
Stefano Stabellini [Fri, 18 Dec 2015 15:09:58 +0000 (15:09 +0000)] 
xen/blkif: Avoid double access to src->nr_segments

src is stored in shared memory and src->nr_segments is dereferenced
twice at the end of the function.  If a compiler decides to compile this
into two separate memory accesses then the size limitation could be
bypassed.

Fix it by removing the double access to src->nr_segments.

This is part of XSA-155.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
(cherry picked from commit f9e98e5d7a67367b862941e339a98b8322fa0cea)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoconfigure: Fix shell syntax to placate OpenBSD's pdksh
Peter Maydell [Mon, 14 Dec 2015 15:02:36 +0000 (15:02 +0000)] 
configure: Fix shell syntax to placate OpenBSD's pdksh

Unfortunately the OpenBSD pdksh does not like brackets inside
the right part of a ${variable+word} parameter expansion:

  $ echo "${a+($b)}"
  ksh: ${a+($b)}": bad substitution

though both bash and dash accept them. In any case this line
was causing odd output in the case where nettle is not present:
  nettle    no ()

(because if nettle is not present then $nettle will be "no",
not a null string or unset).

Rewrite it to just use an if.

This bug was originally introduced in becaeb726 and was present
in the 2.4.0 release.

Fixes: https://bugs.launchpad.net/qemu/+bug/1525682
Reported-by: Dmitrij D. Czarkoff
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1450105357-8516-1-git-send-email-peter.maydell@linaro.org
(cherry picked from commit 18f49881cf8359e89396aac12f5d3cf3f8a632ba)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agotarget-ppc: kvm: fix floating point registers sync on little-endian hosts
Greg Kurz [Fri, 15 Jan 2016 15:00:12 +0000 (16:00 +0100)] 
target-ppc: kvm: fix floating point registers sync on little-endian hosts

On VSX capable CPUs, the 32 FP registers are mapped to the high-bits
of the 32 first VSX registers. So if you have:

VSR31 = (uint128) 0x0102030405060708090a0b0c0d0e0f00

then

FPR31 = (uint64) 0x0102030405060708

The kernel stores the VSX registers in the fp_state struct following the
host endian element ordering.

On big-endian:

fp_state.fpr[31][0] = 0x0102030405060708
fp_state.fpr[31][1] = 0x090a0b0c0d0e0f00

On little-endian:

fp_state.fpr[31][0] = 0x090a0b0c0d0e0f00
fp_state.fpr[31][1] = 0x0102030405060708

The KVM_GET_ONE_REG and KVM_SET_ONE_REG ioctls preserve this ordering, but
QEMU considers it as big-endian and always copies element [0] to the
fpr[] array and element [1] to the vsr[] array. This does not work with
little-endian hosts, and you will get:

(qemu) p $f31
0x90a0b0c0d0e0f00

instead of:

(qemu) p $f31
0x102030405060708

This patch fixes the element ordering for little-endian hosts.

Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
(cherry picked from commit 3a4b791b4c13e02537a5cc572fa3de70bc5f68da)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agonet: vmxnet3: avoid memory leakage in activate_device
P J P [Tue, 15 Dec 2015 06:57:54 +0000 (12:27 +0530)] 
net: vmxnet3: avoid memory leakage in activate_device

Vmxnet3 device emulator does not check if the device is active
before activating it, also it did not free the transmit & receive
buffers while deactivating the device, thus resulting in memory
leakage on the host. This patch fixes both these issues to avoid
host memory leakage.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Reviewed-by: Dmitry Fleytman <dmitry@daynix.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit aa4a3dce1c88ed51b616806b8214b7c8428b7470)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
4 years agoehci: make idt processing more robust
Gerd Hoffmann [Mon, 14 Dec 2015 08:21:23 +0000 (09:21 +0100)] 
ehci: make idt processing more robust

Make ehci_process_itd return an error in case we didn't do any actual
iso transfer because we've found no active transaction.  That'll avoid
ehci happily run in circles forever if the guest builds a loop out of
idts.

This is CVE-2015-8558.

Cc: qemu-stable@nongnu.org
Reported-by: Qinghao Tang <luodalongde@gmail.com>
Tested-by: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 156a2e4dbffa85997636a7a39ef12da6f1b40254)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
5 years agoUpdate version for v2.5.0 release v2.5.0
Peter Maydell [Wed, 16 Dec 2015 16:10:14 +0000 (16:10 +0000)] 
Update version for v2.5.0 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoUpdate version for v2.5.0-rc4 release v2.5.0-rc4
Peter Maydell [Fri, 11 Dec 2015 16:37:55 +0000 (16:37 +0000)] 
Update version for v2.5.0-rc4 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoblockdev: Mark {insert, remove}-medium experimental
Max Reitz [Fri, 11 Dec 2015 15:23:05 +0000 (16:23 +0100)] 
blockdev: Mark {insert, remove}-medium experimental

While in the long term we want throttling to be its own block filter
BDS, in the short term we want it to be part of the BB instead of a BDS;
even in the long term we may want legacy throttling to be automatically
tied to the BB.

blockdev-insert-medium and blockdev-remove-medium do not retain
throttling information in the BB (deliberately so). Therefore, using
them means tying this information to a BDS, which would break the model
described above. (The same applies to other flags such as
detect_zeroes.) We probably want to move this information to the BB or
its own filter BDS before blockdev-{insert,remove}-medium can be
considered completely stable.

Therefore, mark these functions experimental for the time being.

Suggested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Acked-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1449847385-13986-2-git-send-email-mreitz@redhat.com
Reviewed-by: Eric Blake <eblake@redhat.com>
[PMM: fixed format nit (underlining) in qmp-commands.hx]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoFix xbzrle vs last_sent_block update
Dr. David Alan Gilbert [Thu, 10 Dec 2015 16:31:46 +0000 (16:31 +0000)] 
Fix xbzrle vs last_sent_block update

My fix (84e7b80a) replaced the last_sent_block update that I'd
removed earlier; however it was too aggressive in the xbzrle case.

save_xbzrle_page might return '0' to mean that the page didn't
need sending since it was the same as the last sent version;
in this case we can't update 'last_sent_block' since we didn't
actually send it.

Symptom: 'Illegal RAM offset 1018000' as we try and send a page
        to the wrong RAMBlock;  potentially that could be a data
        corruption if you were really unlucky.

Fixes: 84e7b80a05c0c44b90533c6cd2f1db5c932ccf77

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-id: 1449765106-6528-1-git-send-email-dgilbert@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoUpdate language files for QEMU 2.5.0
Peter Maydell [Thu, 10 Dec 2015 13:34:27 +0000 (13:34 +0000)] 
Update language files for QEMU 2.5.0

Update translation files (change created via 'make -C po update').

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Message-id: 1449754467-3496-1-git-send-email-peter.maydell@linaro.org

5 years agosparc: allow CASA with ASI 0xa from user space
Alex Zuepke [Fri, 4 Dec 2015 15:01:02 +0000 (16:01 +0100)] 
sparc: allow CASA with ASI 0xa from user space

LEON3 allows the CASA instruction to be used from user space
if the ASI is set to 0xa (user data).

Signed-off-by: Alex Zuepke <azu@sysgo.de>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMAINTAINERS: add maintainer to virtio-9p
Greg Kurz [Mon, 30 Nov 2015 15:40:16 +0000 (16:40 +0100)] 
MAINTAINERS: add maintainer to virtio-9p

As suggested by Paolo, I add myself as maintainer for virtio-9p.

Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
Acked-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Message-id: 20151130154016.20108.79073.stgit@bahia.huguette.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agovirtio-9p-device: add minimal unrealize handler
Greg Kurz [Tue, 8 Dec 2015 15:54:57 +0000 (16:54 +0100)] 
virtio-9p-device: add minimal unrealize handler

Since commit 4652f1640e029e1f2433fa77ba6af285 "virtio-9p: add savevm
handlers", if the user hot-unplugs a quiescent 9p device and live
migrates, the source QEMU crashes before migration completetion...
This happens because virtio-9p devices have a realize handler which
calls virtio_init() and register_savevm().  Both calls store pointers
to the device internals, that get dereferenced during migration even
if the device got unplugged.

This patch simply adds an unrealize handler to perform minimal
cleanup and avoid the crash.  Hot unplug of non-quiescent 9p devices
is still not supported in QEMU, and not supported by linux guests
either.

Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 20151208155457.27775.69441.stgit@bahia.huguette.org
[PMM: rewrapped long lines in commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoUpdate version for v2.5.0-rc3 release v2.5.0-rc3
Peter Maydell [Mon, 7 Dec 2015 17:47:40 +0000 (17:47 +0000)] 
Update version for v2.5.0-rc3 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agosd: Mark brittle abuse of blk_attach_dev() FIXME
Markus Armbruster [Mon, 7 Dec 2015 15:55:10 +0000 (16:55 +0100)] 
sd: Mark brittle abuse of blk_attach_dev() FIXME

blk_attach_dev() fails here only when we're working for device
"sdhci-pci" (which already attached the backend), and then we don't
want to attach a second time.  If we ever create another failure mode,
we're setting up ourselves to using the same backend from multiple
frontends, which is likely to end in tears.  Can't clean this up this
close to the release, so mark it FIXME.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1449503710-3707-3-git-send-email-armbru@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agosdhci: Sanitize "sdhci-pci" properties for future qomification
Markus Armbruster [Mon, 7 Dec 2015 15:55:09 +0000 (16:55 +0100)] 
sdhci: Sanitize "sdhci-pci" properties for future qomification

We currently fuse controller and card into a single device model, but
we intend qomify things properly and separate the two.  The properties
that really belong to the card would then have to somehow pass-through
to the card's properties.  To avoid that complication, either mark
them experimental or drop them.

Properties "capareg", "maxcurr" and the usual PCI device properties
belong to the controller.  Property "drive" belongs to the card;
rename it to "x-drive".  Properties "logical_block_size",
"physical_block_size", "min_io_size", "opt_io_size",
"discard_granularity" belong to the card, but have no effect; drop
them.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1449503710-3707-2-git-send-email-armbru@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agovirtio-blk: Drop x-data-plane option
Fam Zheng [Mon, 7 Dec 2015 10:59:27 +0000 (18:59 +0800)] 
virtio-blk: Drop x-data-plane option

The official way of enabling dataplane is through the "iothread"
property that references an iothread object created by "-object
iothread".  Since the old "x-data-plane=on" way now even crashes, it's
probably easier to just drop it:

$ qemu-system-x86_64 -drive file=null-co://,id=d0,if=none \
    -device virtio-blk-pci,drive=d0,x-data-plane=on

ERROR:/home/fam/work/qemu/qom/object.c:1515:
object_get_canonical_path_component: assertion failed: (obj->parent != NULL)
Aborted

Signed-off-by: Fam Zheng <famz@redhat.com>
Message-id: 1449485967-19240-1-git-send-email-famz@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging
Peter Maydell [Mon, 7 Dec 2015 14:18:31 +0000 (14:18 +0000)] 
Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging

# gpg: Signature made Mon 07 Dec 2015 14:06:07 GMT using RSA key ID 398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F  3562 EF04 965B 398D 6211

* remotes/jasowang/tags/net-pull-request:
  lan9118: log and ignore access to invalid registers, rather than aborting
  lan9118: fix emulation of MAC address loaded bit in E2P_CMD register
  vmxnet3: silence warning
  pcnet: fix rx buffer overflow(CVE-2015-7512)
  net: pcnet: add check to validate receive data size(CVE-2015-7504)
  e1000: fix hang of win2k12 shutdown with flood ping

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agolan9118: log and ignore access to invalid registers, rather than aborting
Andrew Baumann [Fri, 4 Dec 2015 18:58:50 +0000 (10:58 -0800)] 
lan9118: log and ignore access to invalid registers, rather than aborting

With this change, access to invalid/unimplemented device registers are
logged as a "guest error" rather than aborting qemu with
hw_error. This enables drivers for similar devices (e.g. SMSC 9221),
by simply ignoring the unimplemented writes. It's also closer to what
real hardware does.

Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
5 years agolan9118: fix emulation of MAC address loaded bit in E2P_CMD register
Andrew Baumann [Fri, 4 Dec 2015 18:58:49 +0000 (10:58 -0800)] 
lan9118: fix emulation of MAC address loaded bit in E2P_CMD register

There appears to have been a longstanding typo in the implementation
of the "MAC address loaded" bit in the E2P_CMD (EEPROM command)
register. The code was using 0x10, but the controller spec says it
should be bit 8 (0x100).

Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
5 years agovmxnet3: silence warning
Michael S. Tsirkin [Mon, 30 Nov 2015 16:26:24 +0000 (18:26 +0200)] 
vmxnet3: silence warning

vmxnet3 always produces a warning under qtest.

This is not a user error, don't warn.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
5 years agopcnet: fix rx buffer overflow(CVE-2015-7512)
Jason Wang [Mon, 30 Nov 2015 07:00:06 +0000 (15:00 +0800)] 
pcnet: fix rx buffer overflow(CVE-2015-7512)

Backends could provide a packet whose length is greater than buffer
size. Check for this and truncate the packet to avoid rx buffer
overflow in this case.

Cc: Prasad J Pandit <pjp@fedoraproject.org>
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
5 years agonet: pcnet: add check to validate receive data size(CVE-2015-7504)
Prasad J Pandit [Fri, 20 Nov 2015 06:20:31 +0000 (11:50 +0530)] 
net: pcnet: add check to validate receive data size(CVE-2015-7504)

In loopback mode, pcnet_receive routine appends CRC code to the
receive buffer. If the data size given is same as the buffer size,
the appended CRC code overwrites 4 bytes after s->buffer. Added a
check to avoid that.

Reported by: Qinghao Tang <luodalongde@gmail.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
5 years agoe1000: fix hang of win2k12 shutdown with flood ping
Denis V. Lunev [Fri, 27 Nov 2015 06:48:41 +0000 (09:48 +0300)] 
e1000: fix hang of win2k12 shutdown with flood ping

e1000 driver in Win2k12 is really well rotten. It 100% hangs on shutdown
of UP VM under flood ping. The guest checks card state and reinjects
itself interrupt in a loop. This is fatal for UP machine.

There is no good way to fix this misbehavior but to kludge it. The
emulation has interrupt throttling register aka ITR which limits
interrupt rate and allows the guest to proceed this phase.
There is no problem with this kludge for Linux guests - it adjust the
value of it itself.

On the other hand according to the initial research in
    commit e9845f0985f088dd01790f4821026df0afba5795
    Author: Vincenzo Maffione <v.maffione@gmail.com>
    Date:   Fri Aug 2 18:30:52 2013 +0200

    e1000: add interrupt mitigation support

    ...

    Interrupt mitigation boosts performance when the guest suffers from
    an high interrupt rate (i.e. receiving short UDP packets at high packet
    rate). For some numerical results see the following link
    http://info.iet.unipi.it/~luigi/papers/20130520-rizzo-vm.pdf

this should also boost performance a bit.

See https://bugzilla.redhat.com/show_bug.cgi?id=874406 for additional
details.

Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Vincenzo Maffione <v.maffione@gmail.com>
CC: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
5 years agoMerge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging
Peter Maydell [Fri, 4 Dec 2015 18:11:40 +0000 (18:11 +0000)] 
Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging

QOM infrastructure fixes and device conversions

* Documentation update
* qom-test and related fixes

# gpg: Signature made Fri 04 Dec 2015 17:54:55 GMT using RSA key ID 3E7E013F
# gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
# gpg:                 aka "Andreas Färber <afaerber@suse.com>"

* remotes/afaerber/tags/qom-devices-for-peter:
  qom-test: Fix qmp() leaks
  tests: Use proper functions types instead of void (*fn)
  qom: Update documentation comment of struct Object
  tests: Fix check-report-qtest-% target

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoqom-test: Fix qmp() leaks
Marc-André Lureau [Wed, 2 Dec 2015 20:20:34 +0000 (21:20 +0100)] 
qom-test: Fix qmp() leaks

Before this patch ASAN reported:
SUMMARY: AddressSanitizer: 677165875 byte(s) leaked in 1272437 allocation(s)

After this patch:
SUMMARY: AddressSanitizer: 465 byte(s) leaked in 32 allocation(s)

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <1448551895-871-1-git-send-email-marcandre.lureau@redhat.com>
[Straightforwardly rebased onto the previous patch]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
5 years agotests: Use proper functions types instead of void (*fn)
Markus Armbruster [Wed, 2 Dec 2015 20:20:33 +0000 (21:20 +0100)] 
tests: Use proper functions types instead of void (*fn)

We have several function parameters declared as void (*fn).  This is
just a stupid way to write void *, and the only purpose writing it
like that could serve is obscuring the sin of bypassing the type
system without need.

The original sin is commit 49ee359: its qtest_add_func() is a wrapper
for g_test_add_func().  Fix the parameter type to match
g_test_add_func()'s.  This uncovers type errors in ide-test.c; fix
them.

Commit 7949c0e faithfully repeated the sin for qtest_add_data_func().
Fix it the same way, along with a harmless type error uncovered in
vhost-user-test.c.

Commit 063c23d repeated it for qtest_add_abrt_handler().  The screwy
parameter gets assigned to GHook member func, so change its type to
match.  Requires wrapping kill_qemu() to keep the type checker happy.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
[AF/armbru: Inline GTestFunc/GTestDataFunc typedef for old GLib]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
5 years agoMerge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-12-04' into...
Peter Maydell [Fri, 4 Dec 2015 10:55:03 +0000 (10:55 +0000)] 
Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-12-04' into staging

trivial patches for 2015-12-04

# gpg: Signature made Fri 04 Dec 2015 06:40:23 GMT using RSA key ID A4C3D7DB
# gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
# gpg:                 aka "Michael Tokarev <mjt@debian.org>"

* remotes/mjt/tags/pull-trivial-patches-2015-12-04:
  bt: check struct sizes
  typedefs: Put them back into alphabetical order
  scsi: remove scsi_req_free prototype
  gt64xxx: fix decoding of ISD register
  configure: use appropriate code fragment for -fstack-protector checks
  crypto: avoid two coverity false positive error reports
  configure: Diagnose broken linkers directly
  bt: avoid unintended sign extension
  util/id: fully allocate names table

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.5-20151204' into staging
Peter Maydell [Fri, 4 Dec 2015 09:49:28 +0000 (09:49 +0000)] 
Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.5-20151204' into staging

ppc patch queue for 2.5 2015-12-04

This contains some last minute QOM behaviour fixes from Markus
Armbruster.

# gpg: Signature made Fri 04 Dec 2015 06:43:54 GMT using RSA key ID 20D9B392
# gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>"
# gpg:                 aka "David Gibson (Red Hat) <dgibson@redhat.com>"
# gpg:                 aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dgibson/tags/ppc-for-2.5-20151204:
  spapr_drc: Change value of property "fdt" from null back to {}
  spapr_drc: Make device "spapr-dr-connector" unavailable with -device
  spapr_drc: Handle visitor errors properly

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agobt: check struct sizes
Paolo Bonzini [Mon, 30 Nov 2015 09:57:25 +0000 (10:57 +0100)] 
bt: check struct sizes

See http://permalink.gmane.org/gmane.linux.bluez.kernel/36505.  For historical
reasons these do not use sizeof, and Coverity caught a mistake in
EVT_ENCRYPT_CHANGE_SIZE.

In addition:

- remove status from create_conn_cancel_cp; the "status" field is only
in rp structs.  Note that this means that the OCF_CREATE_CONN_CANCEL
could never have worked (it would have failed the LENGTH_CHECK), but
I am keeping it anyway.

- OCF_READ_LINK_QUALITY similarly could never have worked, but I am
fixing read_link_quality_cp anyway.

- fix inquiry_info which is shorter by one: the kernel has a struct that
is 14 byte long, but not counting the initial num_responses byte which
the kernel parses separately;

- remove extended_inquiry_info altogether, since it's not used and unlike
the other inquiry structs does not have the initial num_responses byte.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
5 years agotypedefs: Put them back into alphabetical order
Markus Armbruster [Thu, 19 Nov 2015 12:29:28 +0000 (13:29 +0100)] 
typedefs: Put them back into alphabetical order

"Please keep this list in alphabetical order" has been more honoured
in the breach than in the observance.  Clean up.

While there, drop a redundant struct declaration.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
5 years agoscsi: remove scsi_req_free prototype
Hervé Poussineau [Thu, 12 Nov 2015 21:26:33 +0000 (22:26 +0100)] 
scsi: remove scsi_req_free prototype

Function has been deleted in ad2d30f79d3b0812f02c741be2189796b788d6d7.

Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
5 years agogt64xxx: fix decoding of ISD register
Paolo Bonzini [Fri, 6 Nov 2015 15:34:06 +0000 (16:34 +0100)] 
gt64xxx: fix decoding of ISD register

The GT64xxx's internal registers can be placed above the first 4 GiB
in the address space, but not above the first 64 GiB.  Correctly cast
the register to a 64-bit integer, and mask away bits above bit 35.

Datasheet at http://pdf.datasheetarchive.com/datasheetsmain/Datasheets-33/DSA-655889.pdf
(bug reported by Coverity).

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
5 years agoconfigure: use appropriate code fragment for -fstack-protector checks
Rodrigo Rebello [Thu, 12 Nov 2015 14:04:28 +0000 (12:04 -0200)] 
configure: use appropriate code fragment for -fstack-protector checks

The check for stack-protector support consisted in compiling and linking
the test program below (output by function write_c_skeleton()) with the
compiler flag -fstack-protector-strong first and then with
-fstack-protector-all if the first one failed to work:

  int main(void) { return 0; }

This caused false positives when using certain toolchains in which the
compiler accepted -fstack-protector-strong but no support was provided
by the C library, since for this stack-protector variant the compiler
emits canary code only for functions that meet specific conditions
(local arrays, memory references to local variables, etc.) and the code
fragment under test included none of them (hence no stack protection
code generated, no link failure).

This fix changes the test program used for -fstack-protector checks to
include a function that meets conditions which cause the compiler to
generate canary code in all variants.

Signed-off-by: Rodrigo Rebello <rprebello@gmail.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
5 years agocrypto: avoid two coverity false positive error reports
Daniel P. Berrange [Fri, 13 Nov 2015 17:45:27 +0000 (17:45 +0000)] 
crypto: avoid two coverity false positive error reports

In qcrypto_tls_creds_get_path() coverity complains that
we are checking '*creds' for NULL, despite having
dereferenced it previously. This is harmless bug due
to fact that the trace call was too early. Moving it
after the cleanup gets the desired semantics.

In qcrypto_tls_creds_check_cert_key_purpose() coverity
complains that we're passing a pointer to a previously
free'd buffer into gnutls_x509_crt_get_key_purpose_oid()
This is harmless because we're passing a size == 0, so
gnutls won't access the buffer, but rather just report
what size it needs to be. We can avoid it though by
explicitly setting the buffer to NULL after free'ing
it.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
5 years agoconfigure: Diagnose broken linkers directly
Peter Maydell [Tue, 24 Nov 2015 14:55:46 +0000 (14:55 +0000)] 
configure: Diagnose broken linkers directly

Currently if the user's compiler works for creating .o files but
their linker is broken such that compiling an executable from a
C file does not work, we will report a misleading error message
about the compiler not supporting __thread (since that happens
to be the first test we run which requires a working linker).
Explicitly check that compile_prog works as well as compile_object,
so that people whose toolchain setup is broken get a more helpful
error message.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
5 years agobt: avoid unintended sign extension
Paolo Bonzini [Fri, 27 Nov 2015 12:08:25 +0000 (13:08 +0100)] 
bt: avoid unintended sign extension

In the case of a 4-byte length, shifting a value by 24 may cause
an unintended sign extension when converting from int to size_t.
Use a uint32_t variable instead.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
5 years agoutil/id: fully allocate names table
John Snow [Wed, 25 Nov 2015 21:03:37 +0000 (16:03 -0500)] 
util/id: fully allocate names table

Trivial: this array should be allocated to have ID_MAX entries always.
Otherwise if someone were to forget to expand this table, the assertion
in the id generator won't actually trigger; it will read junk data.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
5 years agospapr_drc: Change value of property "fdt" from null back to {}
Markus Armbruster [Thu, 3 Dec 2015 16:37:39 +0000 (17:37 +0100)] 
spapr_drc: Change value of property "fdt" from null back to {}

prop_get_fdt() misuses the visitor API: when fdt is null, it doesn't
visit anything.  object_property_get_qobject() happily
object_property_get_qobject().  Amazingly, the latter survives the
misuse.  Turns out we've papered over it long before prop_get_fdt()
existed, in commit 1d10b44.

However, commit 6c2f9a1 changed how we paper over it, and as a side
effect changed qom-get's value from {} to null.  Change it right back
by fixing the visitor misuse.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_drc: Make device "spapr-dr-connector" unavailable with -device
Markus Armbruster [Thu, 3 Dec 2015 16:37:40 +0000 (17:37 +0100)] 
spapr_drc: Make device "spapr-dr-connector" unavailable with -device

It should only be created via spapr_dr_connector_new().  Attempting to
create it with -device crashes.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_drc: Handle visitor errors properly
Markus Armbruster [Thu, 3 Dec 2015 16:37:38 +0000 (17:37 +0100)] 
spapr_drc: Handle visitor errors properly

Since prop_get_fdt() is only used with QmpOutputVisitor, errors
shouldn't actually happen, so this is only a latent bug.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agoqom: Update documentation comment of struct Object
Cao jin [Thu, 5 Nov 2015 07:39:03 +0000 (15:39 +0800)] 
qom: Update documentation comment of struct Object

It doesn't have "GSList *interfaces" anymore, drop the paragraph.

Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
5 years agotests: Fix check-report-qtest-% target
Andreas Färber [Sat, 21 Nov 2015 01:20:06 +0000 (02:20 +0100)] 
tests: Fix check-report-qtest-% target

Commit e253c28 ("tests: Fix how qom-test is run") introduced
$(qtest-generic-y) and used it for check-qtest-% target, but did not
update check-report-qtest-%. This causes check-report-qtest-aarch64.xml
target to fail with a gtester usage error for lack of test arguments.

Fix this by adding $(qtest-generic-y) in check-report-qtest-%.
Also add it in check-clean target, spotted by Markus.

Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
5 years agoui: vnc: avoid floating point exception
Prasad J Pandit [Thu, 3 Dec 2015 13:24:17 +0000 (18:54 +0530)] 
ui: vnc: avoid floating point exception

While sending 'SetPixelFormat' messages to a VNC server,
the client could set the 'red-max', 'green-max' and 'blue-max'
values to be zero. This leads to a floating point exception in
write_png_palette while doing frame buffer updates.

Reported-by: Lian Yihan <lianyihan@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
Peter Maydell [Thu, 3 Dec 2015 11:08:43 +0000 (11:08 +0000)] 
Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

# gpg: Signature made Thu 03 Dec 2015 04:59:48 GMT using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/block-pull-request:
  iotests: Add regresion test case for write notifier assertion failure
  iotests: Add "add_drive_raw" method
  block: Don't wait serialising for non-COR read requests
  iothread: include id in thread name

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/juanquintela/tags/migration/20151203' into...
Peter Maydell [Thu, 3 Dec 2015 10:43:43 +0000 (10:43 +0000)] 
Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20151203' into staging

migration/next for 20151203

# gpg: Signature made Wed 02 Dec 2015 23:19:10 GMT using RSA key ID 5872D723
# gpg: Good signature from "Juan Quintela <quintela@redhat.com>"
# gpg:                 aka "Juan Quintela <quintela@trasno.org>"

* remotes/juanquintela/tags/migration/20151203:
  migration: do floating-point division
  migration: Clean up use of g_poll() in socket_writev_buffer()

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>