summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-09-09exec: add parameter errp to gethugepagesizeHu Tao
Add parameter errp to gethugepagesize thus callers can handle errors. If user adds a memory-backend-file object using object_add command, specifying a non-existing directory for property mem-path, qemu will core dump with message: /nonexistingdir: No such file or directory Bad ram offset fffffffffffff000 Aborted (core dumped) This patch fixes the problem. With this patch, qemu reports an error message like: qemu-system-x86_64: -object memory-backend-file,mem-path=/nonexistingdir,id=mem-file0,size=128M: failed to get page size of file /nonexistingdir: No such file or directory Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-09exec: report error when memory < hpagesizeHu Tao
Report an error when memory < hpagesize in file_ram_alloc() so callers can handle the error. If user adds a memory-backend-file object using object_add command, specifying a size that is less than huge page size, qemu will core dump with message: Bad ram offset fffffffffffff000 Aborted (core dumped) This patch fixes the problem. With this patch, qemu reports error message like: qemu-system-x86_64: -object memory-backend-file,mem-path=/hugepages,id=mem-file0,size=1M: memory size 0x100000 must be equal to or larger than huge page size 0x200000 Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-09hostmem-ram: don't exit qemu if size of memory-backend-ram is way too bigHu Tao
When using monitor command object_add to add a memory backend whose size is way too big to allocate memory for it, qemu just exits. In the case we'd better give an error message and keep guest running. The problem can be reproduced as follows: 1. run qemu 2. (monitor)object_add memory-backend-ram,size=100000G,id=ram0 Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-09memory: add parameter errp to memory_region_init_rom_deviceHu Tao
Add parameter errp to memory_region_init_rom_device and update all call sites to propagate the error. Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> [Propagate the error out of realize. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-09memory: add parameter errp to memory_region_init_ramHu Tao
Add parameter errp to memory_region_init_ram and update all call sites to pass in &error_abort. Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-09exec: add parameter errp to qemu_ram_alloc and qemu_ram_alloc_from_ptrHu Tao
Add parameter errp to qemu_ram_alloc and qemu_ram_alloc_from_ptr so that we can handle errors. Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> [Assert ptr != NULL in memory_region_init_ram_ptr. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-09rules.mak: Fix DSO build by pulling in archive symbolsFam Zheng
This fixes an issue with module build system. block/iscsi.so is currently broken: $ ~/build/last/qemu-img Failed to open module: /home/fam/build/master/block-iscsi.so: undefined symbol: qmp_query_uuid qemu-img: Not enough arguments Try 'qemu-img --help' for more information To fix this, we should (at least) let qemu-img link qmp_query_uuid from libqemustub.a. (There are a few other symbols missing, as well.) This patch changes the linking rules to: 1) Build ".mo" with "ld -r -o $@ $^" for each ".so", and later build .so with it. 2) Always build all the .mo before linking the executables. This is achieved by adding those .mo files to the executables' "-y" variables. 3) When linking an executable, those .mo files in its "-y" variables are filtered out, and replaced by one or more -Wl,-u,$symbol flags. This is done in the added macro "process-archive-undefs". These "-Wl,-u,$symbol" flags will force ld to pull in the function definition from the archives when linking. Note that the .mo objects, that are actually meant to be linked in the executables, are already expanded in unnest-vars, before the linking command. So we are safe to simply filter out .mo for the purpose of pulling undefined symbols. process-archive-undefs works as this: For each ".mo", find all the undefined symbols in it, filter ones that are defined in the archives. For each of these symbols, generate a "-Wl,-u,$symbol" in the link command, and put them before archive names in the command line. Suggested-by: H.J. Lu <hjl.tools@gmail.com> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-09util: Don't link host-utils.o if it's emptyFam Zheng
Reported-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-09util: Move general qemu_getauxval to util/getauxval.cFam Zheng
So that we won't have an empty getauxval.o which is disliked by ranlib. Reported-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-09trace: Only link generated-tracers.o with "simple" backendFam Zheng
In any other cases the object file is effectively empty, which is disliked by ranlib and nm on Mac OS X. Reported-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-09kvm: do not abort if KVM_RUN failsPaolo Bonzini
Just go to the internal error runstate. This lets you use the "x", "dump-guest-memory" or "info register" commands. Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-05Merge remote-tracking branch 'remotes/afaerber/tags/qom-cpu-for-peter' into ↵Peter Maydell
staging QOM CPUState and X86CPU * Include exception state in CPU VMState * Fix -cpu *,migratable=foo * Error out on unknown -cpu *,+foo,-bar # gpg: Signature made Fri 05 Sep 2014 15:38:14 BST using RSA key ID 3E7E013F # gpg: Good signature from "Andreas Färber <afaerber@suse.de>" # gpg: aka "Andreas Färber <afaerber@suse.com>" * remotes/afaerber/tags/qom-cpu-for-peter: target-i386: Reject invalid CPU feature names on the command-line target-i386: Support migratable=no properly exec: Save CPUState::exception_index field Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-05target-i386: Reject invalid CPU feature names on the command-lineEduardo Habkost
Instead of simply printing a warning, report an error when invalid CPU options are provided on the CPU model string. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-09-05target-i386: Support migratable=no properlyEduardo Habkost
When the "migratable" property was implemented, the behavior was tested by changing the default on the code, but actually using the option on the command-line (e.g. "-cpu host,migratable=false") doesn't work as expected. This is a regression for a common use case of "-cpu host", which is to enable features that are supported by the host CPU + kernel before feature-specific code is added to QEMU. Fix this by initializing the feature words for "-cpu host" on x86_cpu_parse_featurestr(), right after parsing the CPU options. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-09-05exec: Save CPUState::exception_index fieldPavel Dovgaluk
This patch adds a subsection with exception_index field to the VMState for correct saving the CPU state. Without this patch, simulator could miss the pending exception in the saved virtual machine state. Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-09-05Merge remote-tracking branch 'remotes/kraxel/tags/pull-chardev-20140905-1' ↵Peter Maydell
into staging pty: Fix byte loss bug when connecting to pty # gpg: Signature made Fri 05 Sep 2014 12:57:32 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-chardev-20140905-1: pty: Fix byte loss bug when connecting to pty Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-05pty: Fix byte loss bug when connecting to ptySebastian Tanase
When trying to print data to the pty, we first check if it is connected. If not, we try to reconnect, but we drop the pending data even if we have successfully reconnected; this makes us lose the first byte of the very first transmission. This small fix addresses the issue by checking once more if the pty is connected after having tried to reconnect. Signed-off-by: Sebastian Tanase <sebastian.tanase@openwide.fr> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-05Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/pull-cve-2014-3615-20140905-1' into staging CVE-2014-3615: fix sanity checks in vbe (bochs dispi) and spice. # gpg: Signature made Fri 05 Sep 2014 12:18:04 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-cve-2014-3615-20140905-1: spice: make sure we don't overflow ssd->buf vbe: rework sanity checks vbe: make bochs dispi interface return the correct memory size with qxl Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-05spice: make sure we don't overflow ssd->bufGerd Hoffmann
Related spice-only bug. We have a fixed 16 MB buffer here, being presented to the spice-server as qxl video memory in case spice is used with a non-qxl card. It's also used with qxl in vga mode. When using display resolutions requiring more than 16 MB of memory we are going to overflow that buffer. In theory the guest can write, indirectly via spice-server. The spice-server clears the memory after setting a new video mode though, triggering a segfault in the overflow case, so qemu crashes before the guest has a chance to do something evil. Fix that by switching to dynamic allocation for the buffer. CVE-2014-3615 Cc: qemu-stable@nongnu.org Cc: secalert@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2014-09-04Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' ↵Peter Maydell
into staging QOM infrastructure fixes and device conversions * Cleanups for recursive device unrealization # gpg: Signature made Thu 04 Sep 2014 18:17:35 BST using RSA key ID 3E7E013F # gpg: Good signature from "Andreas Färber <afaerber@suse.de>" # gpg: aka "Andreas Färber <afaerber@suse.com>" * remotes/afaerber/tags/qom-devices-for-peter: qdev: Add cleanup logic in device_set_realized() to avoid resource leak qdev: Use NULL instead of local_err for qbus_child unrealize qdev: Use error_abort instead of using local_err memory: Remove object_property_add_child_array() qom: Add automatic arrayification to object_property_add() machine: Clean up -machine handling qom: Make object_child_foreach() safe for objects removal Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-04Merge remote-tracking branch 'remotes/kvaneesh/for-upstream' into stagingPeter Maydell
* remotes/kvaneesh/for-upstream: hw/9pfs: Don't return type from host in readdir on local 9p filesystem hw/9pfs: Use little-endian format for xattr values Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-04qdev: Add cleanup logic in device_set_realized() to avoid resource leakGonglei
At present, this function doesn't have partial cleanup implemented, which will cause resource leaks in some scenarios. Example: 1. Assume that "dc->realize(dev, &local_err)" executes successful and local_err == NULL; 2. device hotplug in hotplug_handler_plug() executes but fails (it is prone to occur). Then local_err != NULL; 3. error_propagate(errp, local_err) and return. But the resources which have been allocated in dc->realize() will be leaked. Simple backtrace: dc->realize() |->device_realize |->pci_qdev_init() |->do_pci_register_device() |->etc. Add fuller cleanup logic which assures that function can goto appropriate error label as local_err population is detected at each relevant point. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-09-04qdev: Use NULL instead of local_err for qbus_child unrealizeGonglei
Forcefully unrealize all children regardless of errors in earlier iterations (if any). We should keep going with cleanup operation rather than report an error immediately. Therefore store the first child unrealization failure and propagate it at the end. We also forcefully unregister vmsd and unrealize actual object, too. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-09-04Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into ↵Peter Maydell
staging Net patches # gpg: Signature made Thu 04 Sep 2014 17:32:44 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/net-pull-request: virtio-net: purge outstanding packets when starting vhost net: complete all queued packets on VM stop net: invoke callback when purging queue virtio: don't call device on !vm_running virtio-net: don't run bh on vm stopped net: Forbid dealing with packets when VM is not running Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-04virtio-net: purge outstanding packets when starting vhostMichael S. Tsirkin
whenever we start vhost, virtio could have outstanding packets queued, when they complete later we'll modify the ring while vhost is processing it. To prevent this, purge outstanding packets on vhost start. Cc: qemu-stable@nongnu.org Cc: Jason Wang <jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-04net: complete all queued packets on VM stopMichael S. Tsirkin
This completes all packets, ensuring that callbacks will not run when VM is stopped. Cc: qemu-stable@nongnu.org Cc: Jason Wang <jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-04net: invoke callback when purging queueMichael S. Tsirkin
devices rely on packet callbacks eventually running, but we violate this rule whenever we purge the queue. To fix, invoke callbacks on all packets on purge. Set length to 0, this way callers can detect that this happened and re-queue if necessary. Cc: qemu-stable@nongnu.org Cc: Jason Wang <jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-04virtio: don't call device on !vm_runningMichael S. Tsirkin
On vm stop, virtio changes vm_running state too soon, so callbacks can get envoked with vm_running = false; Cc: qemu-stable@nongnu.org Cc: Jason Wang <jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-04virtio-net: don't run bh on vm stoppedMichael S. Tsirkin
commit 783e7706937fe15523b609b545587a028a2bdd03 virtio-net: stop/start bh when appropriate is incomplete: BH might execute within the same main loop iteration but after vmstop, so in theory, we might trigger an assertion. I was unable to reproduce this in practice, but it seems clear enough that the potential is there, so worth fixing. Cc: qemu-stable@nongnu.org Reported-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-04hw/9pfs: Don't return type from host in readdir on local 9p filesystemBastian Blank
When using mapped mode in 9pfs, readdir implementation should not return file type in d_type from the host readdir, instead, it should use the type stored in the extended attributes. Since d_type is optional and reading ext attrs for every readdir is expensive, it should be sufficient to just set d_type to DT_UNKNOWN, so guest will know to look it up separately. This is a -stable material. Signed-off-by: Bastian Blank <waldi@debian.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
2014-09-04qdev: Use error_abort instead of using local_errGonglei
This error can not happen normally. If it happens, it indicates something very wrong, we should abort QEMU. Moreover, the user can only refer to /machine/peripheral or /objects, not /machine/unattached. While at it, remove superfluous check about local_err. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-09-04memory: Remove object_property_add_child_array()Peter Crosthwaite
Obsoleted by automatic object_property_add() arrayification. Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-09-04qom: Add automatic arrayification to object_property_add()Peter Crosthwaite
If "[*]" is given as the last part of a QOM property name, treat that as an array property. The added property is given the first available name, replacing the * with a decimal number counting from 0. First add with name "foo[*]" will be "foo[0]". Second "foo[1]" and so on. Callers may inspect the ObjectProperty * return value to see what number the added property was given. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-09-04machine: Clean up -machine handlingAndreas Färber
Since commit c4090f8, -object options are no longer handled through object_set_property(), so clean up -object leftovers by renaming the function and dropping special-casing of qom-type and id properties. Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel.a@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-09-04qom: Make object_child_foreach() safe for objects removalAlexey Kardashevskiy
Current object_child_foreach() uses QTAILQ_FOREACH() to walk through children and that makes children removal from the callback impossible. This makes object_child_foreach() use QTAILQ_FOREACH_SAFE(). Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Hu Tao <hutao@cn.fujitsu.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-09-04net: Forbid dealing with packets when VM is not runningzhanghailiang
For all NICs(except virtio-net) emulated by qemu, Such as e1000, rtl8139, pcnet and ne2k_pci, Qemu can still receive packets when VM is not running. If this happened in *migration's* last PAUSE VM stage, but before the end of the migration, the new receiving packets will possibly dirty parts of RAM which has been cached in *iovec*(will be sent asynchronously) and dirty parts of new RAM which will be missed. This will lead serious network fault in VM. To avoid this, we forbid receiving packets in generic net code when VM is not running. Bug reproduction steps: (1) Start a VM which configured at least one NIC (2) In VM, open several Terminal and do *Ping IP -i 0.1* (3) Migrate the VM repeatedly between two Hosts And the *PING* command in VM will very likely fail with message: 'Destination HOST Unreachable', the NIC in VM will stay unavailable unless you run 'service network restart' Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-04Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-09-03' ↵Peter Maydell
into staging trivial patches for 2014-09-03 # gpg: Signature made Wed 03 Sep 2014 06:53:42 BST using RSA key ID A4C3D7DB # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 6F67 E18E 7C91 C5B1 5514 66A7 BEE5 9D74 A4C3 D7DB * remotes/mjt/tags/trivial-patches-2014-09-03: slirp: Honour vlan/stack in hostfwd_remove commands hmp: fix MemdevList memory leak qom/object.c, hmp.c: fix string_output_get_string() memory leak query-memdev: fix potential memory leaks MAINTAINERS: Add VMWare devices maintainer device_tree.c: dump all err mesages with error_report device_tree.c: redirect load_device_tree err message to stderr scripts: Remove scripts/qtest Fix debug print warning curl: The macro that you have to uncomment to get debugging is DEBUG_CURL. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-04Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pci, pc fixes, features A bunch of bugfixes - these will make sense for 2.1.1 Initial Intel IOMMU support. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 03 Sep 2014 14:41:23 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: acpi-build: Set FORCE_APIC_CLUSTER_MODEL bit for FADT flags vhost-scsi: init backend features earlier vhost_net: init acked_features to backend_features vhost_net: start/stop guest notifiers properly Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-04Revert "vhost_net: start/stop guest notifiers properly"Peter Maydell
This reverts commit aad4dce934649b3a398396fc2a76f215bb194ea4. I accidentally merged the wrong version of a pull request which had a buggy version of this patch. Reverting the buggy version means we can then cleanly merge in the correct pull with the corrected change. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-04vbe: rework sanity checksGerd Hoffmann
Plug a bunch of holes in the bochs dispi interface parameter checking. Add a function doing verification on all registers. Call that unconditionally on every register write. That way we should catch everything, even changing one register affecting the valid range of another register. Some of the holes have been added by commit e9c6149f6ae6873f14a12eea554925b6aa4c4dec. Before that commit the maximum possible framebuffer (VBE_DISPI_MAX_XRES * VBE_DISPI_MAX_YRES * 32 bpp) has been smaller than the qemu vga memory (8MB) and the checking for VBE_DISPI_MAX_XRES + VBE_DISPI_MAX_YRES + VBE_DISPI_MAX_BPP was ok. Some of the holes have been there forever, such as VBE_DISPI_INDEX_X_OFFSET and VBE_DISPI_INDEX_Y_OFFSET register writes lacking any verification. Security impact: (1) Guest can make the ui (gtk/vnc/...) use memory rages outside the vga frame buffer as source -> host memory leak. Memory isn't leaked to the guest but to the vnc client though. (2) Qemu will segfault in case the memory range happens to include unmapped areas -> Guest can DoS itself. The guest can not modify host memory, so I don't think this can be used by the guest to escape. CVE-2014-3615 Cc: qemu-stable@nongnu.org Cc: secalert@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2014-09-04vbe: make bochs dispi interface return the correct memory size with qxlGerd Hoffmann
VgaState->vram_size is the size of the pci bar. In case of qxl not the whole pci bar can be used as vga framebuffer. Add a new variable vbe_size to handle that case. By default (if unset) it equals vram_size, but qxl can set vbe_size to something else. This makes sure VBE_DISPI_INDEX_VIDEO_MEMORY_64K returns correct results and sanity checks are done with the correct size too. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2014-09-03acpi-build: Set FORCE_APIC_CLUSTER_MODEL bit for FADT flagszhanghailiang
If we start Windows 2008 R2 DataCenter with number of cpu less than 8, The system will use APIC Flat Logical destination mode as default configuration, Which has an upper limit of 8 CPUs. The fault is that VM can not show all processors within Task Manager if we hot-add cpus when the number of cpus in VM extends the limit of 8. If we use cluster destination model, the problem will be solved. Note: This flag was introduced later than ACPI v1.0 specification while QEMU generates v1.0 tables only, but... linux kernel ignores this flag, so patch has no influence on it. Tested with Win[XPsp3|Srv2003EE|Srv2008DC|Srv2008R2|Srv2012R2], there isn't BSODs and guests boot just fine. In cases guest doesn't support cpu-hotplug, cpu becomes visible after reboot and in case the guest supports cpu-hotplug, it works as expected with this patch. Cc: qemu-stable@nongnu.org Signed-off-by: huangzhichao <huangzhichao@huawei.com> Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-By: Igor Mammedov <imammedo@redhat.com>
2014-09-03vhost-scsi: init backend features earlierMichael S. Tsirkin
As vhost core can use backend_features during init, clear it earlier to avoid using uninitialized memory. This use would be harmless since vhost scsi ignores the result anyway, but initializing earlier will help prevent valgrind errors, and make scsi and net behave similarly. Cc: qemu-stable@nongnu.org Acked-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-09-03vhost_net: init acked_features to backend_featuresJason Wang
commit 2e6d46d77ed328d34a94688da8371bcbe243479b (vhost: add vhost_get_features and vhost_ack_features) removes the step that initializes the acked_features to backend_features. As this field is now uninitialized, vhost initialization will sometimes fail. To fix, initialize acked_features on each ack. Tested-by: Andrey Korolyov <andrey@xdel.ru> Cc: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com> Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-09-03vhost_net: start/stop guest notifiers properlyJason Wang
commit a9f98bb5ebe6fb1869321dcc58e72041ae626ad8 "vhost: multiqueue support" changed the order of stopping the device. Previously vhost_dev_stop would disable backend and only afterwards, unset guest notifiers. We now unset guest notifiers while vhost is still active. This can lose interrupts causing guest networking to fail. In particular, this has been observed during migration. To fix this, several other changes are needed: - remove the hdev->started assertion in vhost.c since we may want to start the guest notifiers before vhost starts and stop the guest notifiers after vhost is stopped. - introduce the vhost_net_set_vq_index() and call it before setting guest notifiers. This is to guarantee vhost_net has the correct virtqueue index when setting guest notifiers. MST: fix up error handling. Cc: qemu-stable@nongnu.org Cc: Jason Wang <jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Andrey Korolyov <andrey@xdel.ru> Reported-by: "Zhangjie (HZ)" <zhangjie14@huawei.com> Tested-by: William Dauchy <william@gandi.net> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2014-09-02hw/9pfs: Use little-endian format for xattr valuesAneesh Kumar K.V
With security_model=mapped-xattr, we encode the uid,gid and other file attributes as extended attributes of the file. We save them under user.virtfs.* namespace. Use little-endian encoding for on-disk values. This enables us to export the same directory from both little-endian and big-endian hosts. NOTE: This will break big-endian host that have virtFS exports using security model mapped-xattr. They will have to use external tools to convert the xattr to little-endian format. Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
2014-09-02slirp: Honour vlan/stack in hostfwd_remove commandsPeter Maydell
The hostfwd_add and hostfwd_remove monitor commands allow the user to optionally specify a vlan/stack tuple. hostfwd_add honours this, but hostfwd_remove does not (it looks up the tuple but then ignores the SlirpState it has looked up and always uses the first stack in the list anyway). Correct this to honour what the user requested. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-09-02hmp: fix MemdevList memory leakChen Fan
the memdev_list in hmp_info_memdev() is never freed. so we use existent method qapi_free_MemdevList() to free it. and also we can use qapi_free_MemdevList() to replace list loops to clean up the memdev list in error path. Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Hu Tao <hutao@cn.fujitsu.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-09-02qom/object.c, hmp.c: fix string_output_get_string() memory leakChen Fan
string_output_get_string() uses g_string_free(str, false) to transfer the 'str' pointer to callers and never free it. Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Hu Tao <hutao@cn.fujitsu.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-09-02query-memdev: fix potential memory leaksChen Fan
Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Hu Tao <hutao@cn.fujitsu.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-14 10:19:15 +0000