Skip to main content

Browse the archive

https://github.com/qemu/qemu
22 September 2024, 01:22:56 UTC
sort by:
Revision Author Date Message Commit Date
5433472 Michael Roth 15 August 2014, 20:51:19 UTC Update VERSION for 2.0.1 release Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 15 August 2014, 20:51:19 UTC
3c548f6 Kevin Wolf 01 July 2014, 14:52:21 UTC mirror: Fix qiov size for short requests When mirroring an image of a size that is not a multiple of the mirror job granularity, the last request would have the right nb_sectors argument, but a qiov that is rounded up to the next multiple of the granularity. Don't do this. This fixes a segfault that is caused by raw-posix being confused by this and allocating a buffer with request length, but operating on it with qiov length. [s/Driver/Drive/ in qemu-iotests 041 as suggested by Eric --Stefan] Reported-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Tested-by: Eric Blake <eblake@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 5a0f6fd5c84573387056e0464a7fc0c6fb70b2dc) Conflicts: tests/qemu-iotests/041.out *updated 041.out to reflect tests missing from 2.0 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 07 August 2014, 22:59:15 UTC
d0d83e8 Fam Zheng 24 June 2014, 12:26:38 UTC qemu-iotests: Test 0-length image for mirror All behavior and invariant should hold for images with 0 length, so add a class to repeat all the tests in TestSingleDrive. Hide two unapplicable test methods that would fail with 0 image length because it's also used as cluster size. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 3b9f27d2b34cb8c5cc6cec993712c7e1943e9de9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 07 August 2014, 22:42:39 UTC
98103fa Jeff Cody 30 June 2014, 13:14:15 UTC block: make 'top' argument to block-commit optional Now that active layer block-commit is supported, the 'top' argument no longer needs to be mandatory. Change it to optional, with the default being the active layer in the device chain. [kwolf: Rebased and resolved conflict in tests/qemu-iotests/040] Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 7676e2c597000eff3a7233b40cca768b358f9bc9) Conflicts: qapi/block-core.json *removed dependency on 1ad166b6 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 07 August 2014, 08:58:45 UTC
e5f0eb0 Fam Zheng 24 June 2014, 12:26:37 UTC qemu-iotests: Test BLOCK_JOB_READY event for 0Kb image active commit There should be a BLOCK_JOB_READY event with active commit, regardless of image length. Let's test the 0 length image case, and make sure it goes through the ready->complete process. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 8b9a30ca5bc10545637429486836f3c206c39fab) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 07 August 2014, 08:52:48 UTC
43ac708 Fam Zheng 24 June 2014, 12:26:36 UTC mirror: Go through ready -> complete process for 0 len image When mirroring or active committing a zero length image, BLOCK_JOB_READY is not reported now, instead the job completes because we short circuit the mirror job loop. This is inconsistent with non-zero length images, and only confuses management software. Let's do the same thing when seeing a 0-length image: report ready immediately; wait for block-job-cancel or block-job-complete; clear the cancel flag as existing non-zero image synced case (cancelled after ready); then jump to the exit. Reported-by: Eric Blake <eblake@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 9e48b025400b2d284e17860862b0a4aa02c6032d) *removed dependency on bcada37b Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 07 August 2014, 08:50:04 UTC
8e09e20 Fam Zheng 24 June 2014, 12:26:35 UTC blockjob: Add block_job_yield() This will unset busy flag and put coroutine to sleep, can be used to wait for QMP complete/cancel. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit dc71ce45ded4e872e25c2de32d5e7a71842b0985) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 07 August 2014, 08:39:35 UTC
520b341 Fam Zheng 29 April 2014, 10:09:09 UTC mirror: Fix resource leak when bdrv_getlength fails The direct return will skip releasing of all the resouces at immediate_exit, don't miss that. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 373df5b135b4a54e0abb394e9e703fef3ded093c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 07 August 2014, 08:24:19 UTC
e0efb02 Peter Maydell 04 August 2014, 13:41:53 UTC hw/arm/boot: Set PC correctly when loading AArch64 ELF files The code in do_cpu_reset() correctly handled AArch64 CPUs when running Linux kernels, but was missing code in the branch of the if() that deals with loading ELF files. Correctly jump to the ELF entry point on reset rather than leaving the reset PC at zero. Reported-by: Christopher Covington <cov@codeaurora.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Christopher Covington <cov@codeaurora.org> Cc: qemu-stable@nongnu.org (cherry picked from commit a9047ec3f6ab56295cba5b07e0d46cded9e2a7ff) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 20:09:41 UTC
d56b0b8 Peter Maydell 22 July 2014, 16:10:01 UTC hw/misc/imx_ccm.c: Add missing VMState list terminator The VMStateDescription for the imx_ccm device was missing its terminator. Found by static search of the codebase using a regex based on one suggested by Ian Jackson: pcregrep -rMi '(?s)VMStateField(?:(?!END_OF_LIST).)*?;' $(git grep -l 'VMStateField\[\]') Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org (cherry picked from commit ef493d5c291e4689d64ff4973915a7442109a5c5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 19:55:49 UTC
750f169 Laszlo Ersek 22 July 2014, 15:26:41 UTC vmstate_xhci_event: fix unterminated field list "vmstate_xhci_event" was introduced in commit 37352df3 ("xhci: add live migration support"), and first released in v1.6.0. The field list in this VMSD is not terminated with the VMSTATE_END_OF_LIST() macro. During normal use (ie. migration), the issue is practically invisible, because the "vmstate_xhci_event" object (with the unterminated field list) is only ever referenced -- via "vmstate_xhci_intr" -- if xhci_er_full() returns true, for the "ev_buffer" test. Since that field_exists() check (apparently) almost always returns false, we almost never traverse "vmstate_xhci_event" during migration, which hides the bug. However, Amit's vmstate checker forces recursion into this VMSD as well, and the lack of VMSTATE_END_OF_LIST() breaks the field list terminator check (field->name != NULL) in dump_vmstate_vmsd(). The result is undefined behavior, which in my case translates to infinite recursion (because the loop happens to overflow into "vmstate_xhci_intr", which then links back to "vmstate_xhci_event"). Add the missing terminator. Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 3afca1d6d413592c2b78cf28f52fa24a586d8f56) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 19:55:49 UTC
046e357 Chen Gang 19 July 2014, 01:21:46 UTC kvm-all: Use 'tmpcpu' instead of 'cpu' in sub-looping to avoid 'cpu' be NULL If kvm_arch_remove_sw_breakpoint() in CPU_FOREACH() always be fail, it will let 'cpu' NULL. And the next kvm_arch_remove_sw_breakpoint() in QTAILQ_FOREACH_SAFE() will get NULL parameter for 'cpu'. And kvm_arch_remove_sw_breakpoint() can assumes 'cpu' must never be NULL, so need define additional temporary variable for 'cpu' to avoid the case. Cc: qemu-stable@nongnu.org Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit dc54e2525389e903cee2b847cf761b5d857f75cb) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 19:55:49 UTC
b1251db KONRAD Frederic 15 July 2014, 15:18:44 UTC cadence_uart: check for serial backend before using it. This checks that s->chr is not NULL before using it. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit af52fe862fba686713044efdf9158195f84535ab) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 19:55:49 UTC
29cffd3 Jason J. Herne 29 November 2012, 15:09:42 UTC s390x/kvm: synchronize guest floating point registers Add code to kvm_arch_get_registers and kvm_arch_put_registers to save/restore floating point registers. This missing sync was unnoticed until migration of userspace that uses fprs. Signed-off-by: Jason J. Herne <jjherne@us.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> [Update patch to latest upstream] Cc: qemu-stable@nongnu.org Reviewed-by: Alexander Graf <agraf@suse.de> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> (cherry picked from commit 85ad6230b3af048109b3e949ca95ade4dd9a0bfa) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 19:55:49 UTC
5a782bb Stefano Stabellini 07 July 2014, 15:25:07 UTC disas/libvixl: prepend the include path of libvixl header files Currently the Makefile of disas/libvixl appends -I$(SRC_PATH)/disas/libvixl to QEMU_CFLAGS. As a consequence C++ files that #include "utils.h", such as disas/libvixl/a64/instructions-a64.cc, are going to look for utils.h on all the other include paths first. When building QEMU as part of the Xen make system, another unrelated utils.h file is going to be chosen for inclusion, causing a build failure: In file included from disas/libvixl/a64/instructions-a64.cc:27:0: /qemu/disas/libvixl/a64/instructions-a64.h:88:64: error: 'rawbits_to_float' was not declared in this scope const float kFP32PositiveInfinity = rawbits_to_float(0x7f800000); Fix the problem by prepending (rather than appending) the libvixl include path to QEMU_CFLAGS. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 834fb1b269f4c9eb0ffc058fd6ab5a018c3bce1f) *added 2.0-specific fixup from Stefano in disas/Makefile.obj due to lack of 849d8284 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 19:55:49 UTC
ad0d183 Paolo Bonzini 08 July 2014, 05:42:05 UTC mc146818rtc: register the clock reset notifier on the right clock Commit 884f17c (aio / timers: Convert rtc_clock to be a QEMUClockType, 2013-08-21) erroneously changed an occurrence of rtc_clock to QEMU_CLOCK_REALTIME, which broke the RTC reset notifier in mc146818rtc. Fix this. I redid the patch myself since the original reporter did not sign off on his. Cc: qemu-stable@nongnu.org Reported-by: Lb peace <peaceustc@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 13c0cbaec5698f3984606e52bfcfb63ddfc29f00) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 19:55:49 UTC
210ec8f Le Tan 02 July 2014, 00:06:35 UTC pci: assign devfn to pci_dev before calling pci_device_iommu_address_space() In function do_pci_register_device() in file hw/pci/pci.c, move the assignment of pci_dev->devfn to the position before the call to pci_device_iommu_address_space(pci_dev) which will use the value of pci_dev->devfn. Fixes: 9eda7d373e9c691c070eddcbe3467b991f67f6bd pci: Introduce helper to retrieve a PCI device's DMA address space Cc: qemu-stable@nongnu.org Signed-off-by: Le Tan <tamlokveer@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit efc8188e9398e54567b238b756eec2cc746cd2a4) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 19:55:49 UTC
55103ab Dr. David Alan Gilbert 27 June 2014, 19:02:48 UTC Allow mismatched virtio config-len Commit 'virtio: validate config_len on load' restricted config_len loaded from the wire to match the config_len that the device had. Unfortunately, there are cases where this isn't true, the one we found it on was the wce addition in virtio-blk. Allow mismatched config-lengths: *) If the version on the wire is shorter then fine *) If the version on the wire is longer, load what we have space for and skip the rest. (This is mst@redhat.com's rework of what I originally posted) Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 2f5732e9648fcddc8759a8fd25c0b41a38352be6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 19:55:48 UTC
3bb84a6 Michael S. Tsirkin 28 April 2014, 13:08:23 UTC virtio: validate config_len on load Malformed input can have config_len in migration stream exceed the array size allocated on destination, the result will be heap overflow. To fix, that config_len matches on both sides. CVE-2014-0182 Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> -- v2: use %ix and %zx to print config_len values Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit a890a2f9137ac3cf5b607649e66a6f3a5512d8dc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 19:55:48 UTC
48935f0 Michael S. Tsirkin 03 April 2014, 16:51:14 UTC virtio: out-of-bounds buffer write on invalid state load CVE-2013-4151 QEMU 1.0 out-of-bounds buffer write in virtio_load@hw/virtio/virtio.c So we have this code since way back when: num = qemu_get_be32(f); for (i = 0; i < num; i++) { vdev->vq[i].vring.num = qemu_get_be32(f); array of vqs has size VIRTIO_PCI_QUEUE_MAX, so on invalid input this will write beyond end of buffer. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit cc45995294b92d95319b4782750a3580cabdbc0c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 19:55:48 UTC
3477445 Andreas Färber 18 June 2014, 07:55:18 UTC hw: Fix qemu_allocate_irqs() leaks Replace qemu_allocate_irqs(foo, bar, 1)[0] with qemu_allocate_irq(foo, bar, 0). This avoids leaking the dereferenced qemu_irq *. Cc: Markus Armbruster <armbru@redhat.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andreas Färber <afaerber@suse.de> [PC Changes: * Applied change to instance in sh4/sh7750.c ] Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Kirill Batuzov <batuzovk@ispras.ru> [AF: Fix IRQ index in sh4/sh7750.c] Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit f3c7d0389fe8a2792fd4c1cf151b885de03c8f62) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 16:56:14 UTC
7be09af Andreas Färber 13 May 2014, 09:39:42 UTC sdhci: Fix misuse of qemu_free_irqs() It does a g_free() on the pointer, so don't pass a local &foo reference. Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit 127a4e1a51c038ec9167083b65d376dddcc64530) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 16:53:56 UTC
cab7dfc Don Slutz 25 June 2014, 20:19:07 UTC pc: make isapc and pc-0.10 to pc-0.13 have 1.7.0 memory layout QEMU 2.0 changed memory layout for isapc and pc-0.10 to pc-0.13. This prevents migration from QEMU 1.7.0 for these machine types when -m 3.5G is specified. Paolo Bonzini asked that: smbios_legacy_mode = true; has_reserved_memory = false; option_rom_has_mr = true; rom_file_has_mr = false; also be done. Cc: qemu-stable@nongnu.org Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Don Slutz <dslutz@verizon.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Fixes: https://bugs.launchpad.net/qemu/+bug/1334307 Tested-by: "Slutz, Donald Christopher" <dslutz@verizon.com> (cherry picked from commit 5f8632d3c3d7bc5ef24166ba7cf90fcfb2adbf7d) Conflicts: hw/i386/pc_piix.c *removed dependency on c97294ec: smbios_legacy_mode always true pre-2.1.0 *removed dependency on de268e13: has_reserved_memory always false pre-2.1.0 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 06 August 2014, 16:46:52 UTC
b5706a7 Gabriel L. Somlo 23 April 2014, 13:42:38 UTC SMBIOS: Rename symbols to better reflect future use Rename the following symbols: - smbios_set_type1_defaults() to the more general smbios_set_defaults(); - bool smbios_type1_defaults to the more general smbios_defaults; - smbios_get_table() to smbios_get_table_legacy(); This patch contains no functional changes. Signed-off-by: Gabriel Somlo <somlo@cmu.edu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit e6667f719caa7b5edcb491f61a7744f6a6affd27) Conflicts: hw/i386/pc_piix.c hw/i386/pc_q35.c *removed dependency on 3458b2b0 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 19:33:01 UTC
4197181 Hani Benhabiles 31 May 2014, 21:39:42 UTC nbd: Shutdown socket before closing. This forces finishing data sending to client before closing the socket like in exports listing or replying with NBD_REP_ERR_UNSUP cases. Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 27e5eae4577316f7e86a56eb7363d4e78f79e3e5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 19:19:27 UTC
3f977a5 Hani Benhabiles 12 May 2014, 23:35:15 UTC nbd: Close socket on negotiation failure. Otherwise, the nbd client may hang waiting for the server response. Signed-off-by: Hani Benhabiles <hani@linux.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 36af599417dde11747a27dc8550ff2281657a8ff) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 19:19:22 UTC
80cfe4a Hani Benhabiles 18 May 2014, 10:50:05 UTC nbd: Don't validate from and len in NBD_CMD_DISC. These values aren't used in this case. Currently, the from field in the request sent by the nbd kernel module leading to a false error message when ending the connection with the client. $ qemu-nbd some.img -v // After nbd-client -d /dev/nbd0 nbd.c:nbd_trip():L1031: From: 18446744073709551104, Len: 0, Size: 20971520, Offset: 0 nbd.c:nbd_trip():L1032: requested operation past EOF--bad client? nbd.c:nbd_receive_request():L638: read failed Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 8c5d1abbb79193dca8e4823ef53d8d1e650362ae) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 19:17:53 UTC
01083f1 Hani Benhabiles 18 May 2014, 10:50:04 UTC nbd: Don't export a block device with no medium. The device is exported with erroneous values and can't be read. Before the patch: $ sudo nbd-client localhost -p 10809 /dev/nbd0 -name floppy0 Negotiation: ..size = 17592186044415MB bs=1024, sz=18446744073709547520 bytes $ sudo mount /dev/nbd0 /mnt/tmp/ mount: block device /dev/nbd0 is write-protected, mounting read-only mount: /dev/nbd0: can't read superblock After the patch: (qemu) nbd_server_add ide0-hd0 (qemu) nbd_server_add floppy0 Device 'floppy0' has no medium Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 60fe4fac22895576973e317d7148b084c31cc64c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 19:17:41 UTC
9221efd Alexander Graf 24 June 2014, 17:13:50 UTC virtio-serial: don't migrate the config space The device configuration is set at realize time and never changes. It should not be migrated as it is done today. For the sake of compatibility, let's just skip them at load time. Signed-off-by: Alexander Graf <agraf@suse.de> [ added missing casts to uint16_t *, added From, SoB and commit message, Greg Kurz <gkurz@linux.vnet.ibm.com> ] Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit e38e943a1fa20d04deb1899be19b12aadec7a585) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 19:16:50 UTC
4ce91be Cédric Le Goater 24 June 2014, 17:11:32 UTC virtio-net: byteswap virtio-net header TCP connectivity fails when the guest has a different endianness. The packets are silently dropped on the host by the tap backend when they are read from user space because the endianness of the virtio-net header is in the wrong order. These lines may appear in the guest console: [ 454.709327] skbuff: bad partial csum: csum=8704/4096 len=74 [ 455.702554] skbuff: bad partial csum: csum=8704/4096 len=74 The issue that got first spotted with a ppc64le PowerKVM guest, but it also exists for the less common case of a x86_64 guest run by a big-endian ppc64 TCG hypervisor. Signed-off-by: Cédric Le Goater <clg@fr.ibm.com> [ Ported from PowerKVM, Greg Kurz <gkurz@linux.vnet.ibm.com> ] Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 032a74a1c0fcdd5fd1c69e56126b4c857ee36611) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 19:16:30 UTC
b2f0e92 Eduardo Habkost 30 April 2014, 16:48:34 UTC target-i386: Filter FEAT_7_0_EBX TCG features too The TCG_7_0_EBX_FEATURES macro was defined but never used (it even had a typo that was never noticed). Make the existing TCG feature filtering code use it. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit d0a70f46fa9a3257089a56f2f620b0eff868557f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 19:14:43 UTC
f9ac1dc Eduardo Habkost 30 April 2014, 16:48:33 UTC target-i386: Make TCG feature filtering more readable Instead of an #ifdef in the middle of the code, just set TCG_EXT2_FEATURES to a different value depending on TARGET_X86_64. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit a42d9938a162c3e3c9e441d1927dca5bd59167d9) Conflicts: target-i386/cpu.c *removed dependency on 77549a78 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 19:13:15 UTC
a1d8207 Max Filippov 20 June 2014, 14:02:10 UTC hw/xtensa/xtfpga: fix FLASH mapping to boot region for KC705 On KC705 bootloader area is located at FLASH offset 0x06000000, not 0 as on older xtfpga boards. Cc: qemu-stable@nongnu.org Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> (cherry picked from commit 37ed7c4b24f265c2a8c7248666544c9755514ec2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 19:05:20 UTC
e4b3a2b Peter Maydell 23 June 2014, 14:55:03 UTC coroutine-win32.c: Add noinline attribute to work around gcc bug A gcc codegen bug in x86_64-w64-mingw32-gcc (GCC) 4.6.3 means that non-debug builds of QEMU for Windows tend to assert when using coroutines. Work around this by marking qemu_coroutine_switch as noinline. If we allow gcc to inline qemu_coroutine_switch into coroutine_trampoline, then it hoists the code to get the address of the TLS variable "current" out of the while() loop. This is an invalid transformation because the SwitchToFiber() call may be called when running thread A but return in thread B, and so we might be in a different thread context each time round the loop. This can happen quite often. Typically. a coroutine is started when a VCPU thread does bdrv_aio_readv: VCPU thread main VCPU thread coroutine I/O coroutine bdrv_aio_readv -----> start I/O operation thread_pool_submit_co <------------ yields back to emulation Then I/O finishes and the thread-pool.c event notifier triggers in the I/O thread. event_notifier_ready calls thread_pool_co_cb, and the I/O coroutine now restarts *in another thread*: iothread main iothread coroutine I/O coroutine (formerly in VCPU thread) event_notifier_ready thread_pool_co_cb -----> current = I/O coroutine; call AIO callback But on Win32, because of the bug, the "current" being set here the current coroutine of the VCPU thread, not the iothread. noinline is a good-enough workaround, and quite unlikely to break in the future. (Thanks to Paolo Bonzini for assistance in diagnosing the problem and providing the detailed example/ascii art quoted above.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1403535303-14939-1-git-send-email-peter.maydell@linaro.org Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <rth@twiddle.net> (cherry picked from commit ff4873cb8c81db89668d8b56e19e57b852edb5f5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 19:03:00 UTC
84461c7 Eduardo Habkost 13 June 2014, 03:28:32 UTC q35: Use PC_Q35_COMPAT_1_4 on pc-q35-1.4 compat_props pc-q35-1.4 was incorrectly using PC_COMPAT_1_4 instead of PC_Q35_COMPAT_1_4. The only side-effect was that the hpet compat property (inherited from PC_Q35_COMPAT_1_7) was missing. Without this patch, pc-q35-1.4 inicorrectly initializes hpet-intcap to 0xff0104 (behavior introduced in QEMU 2.0, by commit 7a10ef51c2397ac4323bc786af02c58b413b5cd2). Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> (cherry picked from commit 48cb7f3c1526b4632bd63d945cac80d26616d6f5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 19:02:09 UTC
552e70d Alexander Graf 06 June 2014, 12:46:05 UTC KVM: Fix GSI number space limit KVM tells us the number of GSIs it can handle inside the kernel. That value is basically KVM_MAX_IRQ_ROUTES. However when we try to set the GSI mapping table, it checks for r = -EINVAL; if (routing.nr >= KVM_MAX_IRQ_ROUTES) goto out; erroring out even when we're only using all of the GSIs. To make sure we never hit that limit, let's reduce the number of GSIs we get from KVM by one. Cc: qemu-stable@nongnu.org Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 00008418aa22700f6c49e794e79f53aeb157d10f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 19:01:11 UTC
6ef0b7a Hani Benhabiles 17 June 2014, 23:23:34 UTC usb: Fix usb-bt-dongle initialization. Due to an incomplete initialization, adding a usb-bt-dongle device through HMP or QMP will cause a segmentation fault. Signed-off-by: Hani Benhabiles <hani@linux.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit c340a284f382a5f40774521f41b4bade76ddfa58) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 19:00:31 UTC
aa69eda Ming Lei 19 June 2014, 08:12:00 UTC virtio-scsi: define dummy handle_output for vhost-scsi vqs vhost userspace needn't to handle vq's notification from guest, so define dummy handle_output callback for all vqs of vhost-scsi. In some corner cases(such as when handling vq's reset from VM), virtio-pci still trys to handle pending virtio-scsi events, then object check failure inside virtio_scsi_handle_event() for vhost-scsi can be triggered. The issue can be reproduced by 'rmmod virtio-scsi', 'system sleep' or reboot inside VM. Cc: qemu-stable@nongnu.org Cc: Anthony Liguori <aliguori@amazon.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 91d670fbf9945ca4ecbd123affb36889e7fe8a5d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:58:37 UTC
8dedaf0 Michael S. Tsirkin 18 June 2014, 15:55:22 UTC vhost: fix resource leak in error handling vhost_verify_ring_mappings leaks mappings on error. Fix this up. Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 8617343faae6ba7e916137c6c9e3ef22c00565d8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:57:04 UTC
eb3eb3d Ulrich Obergfell 08 June 2014, 17:22:33 UTC scsi-disk: fix bug in scsi_block_new_request() introduced by commit 137745c This patch fixes a bug in scsi_block_new_request() that was introduced by commit 137745c5c60f083ec982fe9e861e8c16ebca1ba8. If the host cache is used - i.e. if BDRV_O_NOCACHE is _not_ set - the 'break' statement needs to be executed to 'fall back' to SG_IO. Cc: qemu-stable@nongnu.org Signed-off-by: Ulrich Obergfell <uobergfe@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 2fe5a9f73b3446690db2cae8a58473b0b4beaa32) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:56:29 UTC
88efef6 Paolo Bonzini 11 June 2014, 12:52:09 UTC qdev: recursively unrealize devices when unrealizing bus When the patch was posted that became 5c21ce7 (qdev: Realize buses on device realization, 2014-03-12), it included recursive realization and unrealization of devices when the bus's "realized" property was toggled. However, due to the same old worries about recursive realization and prerequisites not being realized yet, those hunks were dropped when committing the patch. Unfortunately, this causes a use-after-free bug (easily reproduced by a PCI hot-unplug action). Before the patch, device_unparent behaved as follows: for each child bus unparent bus ----------------------------. | for each child device | | unparent device ---------------. | | | unrealize device | | | | call dc->unparent | | | '------------------------------- | '----------------------------------------' unrealize device After the patch, it behaves as follows instead: unrealize device --------------------. | for each child bus | | unrealize bus (A) | '------------------------------------' for each child bus unparent bus ----------------------. | for each child device | | unrealize device (B) | | call dc->unparent | '----------------------------------' At the step marked (B) the device might use data from the bus that is not available anymore due to step (A). To fix this, we need to unrealize devices before step (A). To sidestep concerns about recursive realization, only do recursive unrealization and leave the "value && !bus->realized" case as it is. The resulting flow is: for each child bus unrealize bus ---------------------. | for each child device | | unrealize device (B) | | call bc->unrealize (A) | '----------------------------------' unrealize device for each child bus unparent bus ----------------------. | for each child device | | unparent device | '----------------------------------' where everything is "powered down" before it is unassembled. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit 5942a19040fed313b316ab7b6e3d2d8e7b1625bb) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:55:40 UTC
ab139bf Paolo Bonzini 11 June 2014, 12:52:08 UTC qdev: reorganize error reporting in bus_set_realized No semantic change. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit b7b34d055d82abaa511b35c9fc24efbb63dca0b1) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:55:07 UTC
d728daf Markus Armbruster 25 April 2014, 10:44:21 UTC hw: Consistently name Error ** objects errp, and not err Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit a7737e4496aa3c1c8c3a4b4b9d5e44875fe21e12) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:54:57 UTC
0f00455 Michael R. Hines 18 February 2014, 02:34:06 UTC rdma: bug fixes 1. Fix small memory leak in parsing inet address from command line in data_init() 2. Fix ibv_post_send() return value check and pass error code back up correctly. 3. Fix rdma_destroy_qp() segfault after failure to connect to destination. Reported-by: frank.yangjie@gmail.com Reported-by: dgilbert@redhat.com Signed-off-by: Michael R. Hines <mrhines@us.ibm.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit e325b49a320b493cc5d69e263751ff716dc458fe) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:47:52 UTC
6ea6bd5 Peter Lieven 10 June 2014, 09:29:16 UTC migration: catch unknown flags in ram_load if a saved vm has unknown flags in the memory data qemu currently simply ignores this flag and continues which yields in an unpredictable result. This patch catches all unknown flags and aborts the loading of the vm. Additionally error reports are thrown if the migration aborts abnormally. Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit db80facefa62dff42bb50c73b0f03eda5f732b49) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:45:18 UTC
86cfc10 Chen Gang 01 May 2014, 13:28:11 UTC arch_init: Be sure of only one exit entry with DPRINTF() for ram_load() When DPRINTF() has effect, the original author wants to print all ram_load() calling results. So need use 'goto' instead of 'return' within ram_load(), just like other areas have done. Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 4798fe55c4d539ddf8c7f5befcddfa145b3c6102) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:45:11 UTC
fe7e98c ChenLiang 25 April 2014, 09:06:20 UTC migration: remove duplicate code version_id is checked twice in the ram_load. Signed-off-by: ChenLiang <chenliang88@huawei.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 21a246a43b606ee833f907d589d8dcbb54a2761e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:45:05 UTC
ba980a5 Gonglei 19 May 2014, 07:26:03 UTC qga: Fix handle fd leak in acquire_privilege() token should be closed in all conditions. So move CloseHandle(token) to "out" branch. Signed-off-by: Wang Rui <moon.wangrui@huawei.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> (cherry picked from commit 374044f08fe18a18469b981812cd8695f5b3569c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:41:28 UTC
df54f5e Stefan Hajnoczi 03 June 2014, 09:21:01 UTC aio: fix qemu_bh_schedule() bh->ctx race condition qemu_bh_schedule() is supposed to be thread-safe at least the first time it is called. Unfortunately this is not quite true: bh->scheduled = 1; aio_notify(bh->ctx); Since another thread may run the BH callback once it has been scheduled, there is a race condition if the callback frees the BH before aio_notify(bh->ctx) has a chance to run. Reported-by: Stefan Priebe <s.priebe@profihost.ag> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Stefan Priebe <s.priebe@profihost.ag> (cherry picked from commit 924fe1293c3e7a3c787bbdfb351e7f168caee3e9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:35:17 UTC
0d38666 Cornelia Huck 27 May 2014, 10:40:44 UTC s390x/css: handle emw correctly for tsch We should not try to store the emw portion of the irb if extended measurements are not applicable. In particular, we should not surprise the guest by storing a larger irb if it did not enable extended measurements. Cc: qemu-stable@nongnu.org Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Tested-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> (cherry picked from commit f068d320def7fd83bf0fcdca37b305f1c2ac5413) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:34:34 UTC
27fb65d Peter Maydell 09 June 2014, 14:43:26 UTC target-arm: Fix errors in writes to generic timer control registers The code for handling writes to the generic timer control registers had several bugs: * ISTATUS (bit 2) is read-only but we forced it to zero on any write * the check for "was IMASK (bit 1) toggled?" incorrectly used '&' where it should be '^' * the handling of IMASK was inverted: we should set the IRQ if ISTATUS is set and IMASK is clear, not if both are set The combination of these bugs meant that when running a Linux guest that uses the generic timers we would fairly quickly end up either forgetting that the timer output should be asserted, or failing to set the IRQ when the timer was unmasked. The result is that the guest never gets any more timer interrupts. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1401803208-1281-1-git-send-email-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org (cherry picked from commit d3afacc7269fee45d54d1501a46b51f12ea7bb15) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:33:30 UTC
6ea80ed Richard Henderson 28 May 2014, 21:01:44 UTC tcg-i386: Fix win64 qemu store The first non-register argument isn't placed at offset 0. Cc: qemu-stable@nongnu.org Reviewed-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Richard Henderson <rth@twiddle.net> (cherry picked from commit 0b919667302aa395bfde0328749dc21a0b123c44) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:32:36 UTC
f99329c Peter Maydell 15 May 2014, 13:40:23 UTC linux-user: Don't overrun guest buffer in sched_getaffinity If the guest's "long" type is smaller than the host's, then our sched_getaffinity wrapper needs to round the buffer size up to a multiple of the host sizeof(long). This means that when we copy the data back from the host buffer to the guest's buffer there might be more than we can fit. Rather than overflowing the guest's buffer, handle this case by returning EINVAL or ignoring the unused extra space, as appropriate. Note that only guests using the syscall interface directly might run into this bug -- the glibc wrappers around it will always use a buffer whose size is a multiple of 8 regardless of guest architecture. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Riku Voipio <riku.voipio@linaro.org> (cherry picked from commit be3bd286bc06bb68cdc71748d9dd4edcd57b2b24) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 18:30:29 UTC
207f61d Markus Armbruster 28 May 2014, 09:16:56 UTC qcow2: Plug memory leak on qcow2_invalidate_cache() error paths Introduced in commit 5a8a30d. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit a1904e48c4a9fb114d155419700bfb7d760273b9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 16:43:00 UTC
d1567e2 Markus Armbruster 28 May 2014, 09:16:57 UTC block: Plug memory leak on brv_open_image() error path Introduced in commit da557a. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit b20e61e0d52eef57cf5db55087b16e0b5207e730) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 16:42:52 UTC
5e3322e Markus Armbruster 28 May 2014, 09:16:59 UTC qemu-io: Plug memory leak in open command Introduced in commit b543c5c. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 29f2601aa605f0af0cba8eedcff7812c6c8532e9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 16:42:09 UTC
5a0913f Markus Armbruster 28 May 2014, 09:17:01 UTC blockdev: Plug memory leak in blockdev_init() blockdev_init() leaks bs_opts when qemu_opts_create() fails, i.e. when the ID is bad. Missed in commit ec9c10d. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 6376f9522372d589f3efe60001dc0486237dd375) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 16:41:40 UTC
40a3fb5 Markus Armbruster 28 May 2014, 09:17:02 UTC blockdev: Plug memory leak in drive_init() bs_opts is leaked on all paths from its qdev_new() that don't got through blockdev_init(). Add the missing QDECREF(), and zap bs_opts after blockdev_init(), so the new QDECREF() does nothing when we go through blockdev_init(). Leak introduced in commit f298d07. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 3cb0e25c4b417b7336816bd92de458f0770d49ff) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 16:41:34 UTC
98646a1 Markus Armbruster 28 May 2014, 09:17:03 UTC block/qapi: Plug memory leak in dump_qobject() case QTYPE_QERROR Introduced in commit a8d8ecb. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit f25391c2a6ef1674384204265429520ea50e82bc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 16:41:26 UTC
53bdfb5 Markus Armbruster 28 May 2014, 09:17:04 UTC block/vvfat: Plug memory leak in check_directory_consistency() On error path. Introduced in commit a046433a. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 6262bbd363b53a1f19c473345d7cc40254dd5c73) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 16:41:18 UTC
a3e3f09 Markus Armbruster 28 May 2014, 09:17:05 UTC block/vvfat: Plug memory leak in read_directory() Has always been leaky. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit b122c3b6d020e529b203836efb8f611ece787293) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 16:41:12 UTC
7812cbe Markus Armbruster 28 May 2014, 09:17:06 UTC block/sheepdog: Plug memory leak in sd_snapshot_create() Has always been leaky. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 2df5fee2dbd56a9c34afd6d7df6744da2d951ccb) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 16:41:07 UTC
12d5fc6 Markus Armbruster 28 May 2014, 09:17:07 UTC qemu-img: Plug memory leak in convert command Introduced in commit 661a0f7. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit bb9cd2ee99f6537c072d5f4bac441717d3cd2bed) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 16:41:00 UTC
b203bba Andrew Oates 24 May 2014, 00:16:09 UTC input (curses): mask keycodes to remove modifier bits Without the mask, control bits are passed on in the keycode, generating incorrect PS/2 sequences when SHIFT, ALT, etc are held down. Cc: qemu-stable@nongnu.org Signed-off-by: Andrew Oates <andrew@aoates.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit f5c0ab131265270c1e7852ec0d4e284a219d63d4) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 16:36:31 UTC
91148de Stefan Weil 28 April 2014, 17:20:00 UTC cputlb: Fix regression with TCG interpreter (bug 1310324) Commit 0f842f8a246f2b5b51a11c13f933bf7a90ae8e96 replaced GETPC_EXT() which was derived from GETPC() by GETRA_EXT() without fixing cputlb.c. A later patch replaced GETRA_EXT() by GETRA() in exec/softmmu_template.h which is included in cputlb.c. The TCG interpreter failed because the values returned by GETRA() were no longer explicitly set to 0. The redefinition of GETRA() introduced here fixes this. In addition, GETPC_ADJ which is also used in exec/softmmu_template.h is set to 0. Both changes reduce the compiled code size for cputlb.c by more than 100 bytes, so the normal TCG without interpreter also profits from the reduced code size and slightly faster code. Cc: qemu-stable@nongnu.org Reported-by: Giovanni Mascellani <gio@debian.org> Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 7e4e88656c1e6192e9e47a2054d2dc190c1b840b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 05 August 2014, 16:33:36 UTC
ae2e18e Max Filippov 20 May 2014, 10:48:45 UTC target-xtensa: fix cross-page jumps/calls at the end of TB Use tb->pc instead of dc->pc to check for cross-page jumps. When TB translation stops at the page boundary dc->pc points to the next page allowing chaining to TBs in it, which is wrong. Cc: qemu-stable@nongnu.org Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> (cherry picked from commit 433d33c555deeed375996e338df1a9510df401c6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:34:00 UTC
2dbd09f Markus Armbruster 16 May 2014, 15:44:06 UTC virtio-scsi: Plug memory leak on virtio_scsi_push_event() error path Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 91e7fcca4743cf694eb0c8e7a8d938cf359b5bd8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:33:18 UTC
3d5acbe Kevin Wolf 08 May 2014, 11:35:09 UTC qcow1: Stricter backing file length check Like qcow2 since commit 6d33e8e7, error out on invalid lengths instead of silently truncating them to 1023. Also don't rely on bdrv_pread() catching integer overflows that make len negative, but use unsigned variables in the first place. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> (cherry picked from commit d66e5cee002c471b78139228a4e7012736b375f9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:32:15 UTC
a4b73ed Kevin Wolf 08 May 2014, 11:08:20 UTC qcow1: Validate image size (CVE-2014-0223) A huge image size could cause s->l1_size to overflow. Make sure that images never require a L1 table larger than what fits in s->l1_size. This cannot only cause unbounded allocations, but also the allocation of a too small L1 table, resulting in out-of-bounds array accesses (both reads and writes). Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 46485de0cb357b57373e1ca895adedf1f3ed46ec) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:32:10 UTC
a3967c7 Kevin Wolf 15 May 2014, 14:10:11 UTC qcow1: Validate L2 table size (CVE-2014-0222) Too large L2 table sizes cause unbounded allocations. Images actually created by qemu-img only have 512 byte or 4k L2 tables. To keep things consistent with cluster sizes, allow ranges between 512 bytes and 64k (in fact, down to 1 entry = 8 bytes is technically working, but L2 table sizes smaller than a cluster don't make a lot of sense). This also means that the number of bytes on the virtual disk that are described by the same L2 table is limited to at most 8k * 64k or 2^29, preventively avoiding any integer overflows. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> (cherry picked from commit 42eb58179b3b215bb507da3262b682b8a2ec10b5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:32:05 UTC
5c85998 Kevin Wolf 07 May 2014, 15:30:30 UTC qcow1: Check maximum cluster size Huge values for header.cluster_bits cause unbounded allocations (e.g. for s->cluster_cache) and crash qemu this way. Less huge values may survive those allocations, but can cause integer overflows later on. The only cluster sizes that qemu can create are 4k (for standalone images) and 512 (for images with backing files), so we can limit it to 64k. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> (cherry picked from commit 7159a45b2bf2dcb9f49f1e27d1d3d135a0247a2f) Conflicts: tests/qemu-iotests/group *removed context lines for tests not present in v2.0.0 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:30:36 UTC
d234c8f Kevin Wolf 07 May 2014, 14:56:10 UTC qcow1: Make padding in the header explicit We were relying on all compilers inserting the same padding in the header struct that is used for the on-disk format. Let's not do that. Mark the struct as packed and insert an explicit padding field for compatibility. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> (cherry picked from commit ea54feff58efedc809641474b25a3130309678e7) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:29:09 UTC
3ba1e61 Michael S. Tsirkin 12 May 2014, 09:04:20 UTC virtio: allow mapping up to max queue size It's a loop from i < num_sg and the array is VIRTQUEUE_MAX_SIZE - so it's OK if the value read is VIRTQUEUE_MAX_SIZE. Not a big problem in practice as people don't use such big queues, but it's inelegant. Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 937251408051e0489f78e4db3c92e045b147b38b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:27:40 UTC
96e7f7a Michael S. Tsirkin 28 April 2014, 14:02:21 UTC pci-assign: limit # of msix vectors KVM only supports MSIX table size up to 256 vectors, but some assigned devices support more vectors, at the moment attempts to assign them fail with EINVAL. Tweak the MSIX capability exposed to guest to limit table size to a supported value. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Gonglei <arei.gonglei@huawei.com> Cc: qemu-stable@nongnu.org Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 639973a4740f38789057744b550df3a175bc49ad) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:25:40 UTC
c230ab2 Peter Lieven 08 May 2014, 16:03:15 UTC Revert "qapi: Clean up superfluous null check in qapi_dealloc_type_str()" This reverts commit 25a7017555f1b4aeb543b5d323ff4afb8f9c5437. Turns out the argument *can* be null: QEMU now segfaults if it receives an invalid parameter via a qmp command instead of throwing an error. For example: { "execute": "blockdev-add", "arguments": { "options" : { "driver": "invalid-driver" } } } CC: qemu-stable@nongnu.org Signed-off-by: Peter Lieven <pl@kamp.de> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com> (cherry picked from commit b690d679c1ca65d71b0544a2331d50e9f0f95116) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:23:46 UTC
274c96e Michael Tokarev 02 May 2014, 11:36:39 UTC configure: remove bashism Commit e26110cfc67d48 added a check for shacmd to create a hash for modules. This check in configure is using bash construct &> to redirect both stdout and stderr, which does fun things on some shells. Get rid of it, use standard redirection instead. Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Fam Zheng <famz@redhat.com> (cherry picked from commit 4fc00556ab68fc91c6d0150152f824d262c0be12) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:20:36 UTC
32c113c Alexey Kardashevskiy 07 April 2014, 12:53:21 UTC spapr_pci: Fix number of returned vectors in ibm, change-msi Current guest kernels try allocating as many vectors as the quota is. For example, in the case of virtio-net (which has just 3 vectors) the guest requests 4 vectors (that is the quota in the test) and the existing ibm,change-msi handler returns 4. But before it returns, it calls msix_set_message() in a loop and corrupts memory behind the end of msix_table. This limits the number of vectors returned by ibm,change-msi to the maximum supported by the actual device. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Cc: qemu-stable@nongnu.org [agraf: squash in bugfix from aik] Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit b26696b519f853c9844e5154858e583600ee3cdc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:20:07 UTC
912d9cc Peter Maydell 02 May 2014, 13:45:14 UTC linux-user/elfload.c: Fix A64 code which was incorrectly acting like A32 The ARM target-specific code in elfload.c was incorrectly allowing the 64-bit ARM target to use most of the existing 32-bit definitions: most noticably this meant that our HWCAP bits passed to the guest were wrong, and register handling when dumping core was totally broken. Fix this by properly separating the 64 and 32 bit code, since they have more differences than similarities. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org Signed-off-by: Riku Voipio <riku.voipio@linaro.org> (cherry picked from commit 24e76ff06bcd0936ee8b04b15dca42efb7d614d1) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:17:33 UTC
074f673 Peter Maydell 02 May 2014, 13:45:13 UTC linux-user/elfload.c: Update ARM HWCAP bits The kernel has added support for a number of new ARM HWCAP bits; add them to QEMU, including support for setting them where we have a corresponding CPU feature bit. We were also incorrectly setting the VFPv3D16 HWCAP -- this means "only 16 D registers", not "supports 16-bit floating point format"; since QEMU always has 32 D registers for VFPv3, we can just remove the line that incorrectly set this bit. The kernel does not set the HWCAP_FPA even if it is providing FPA emulation via nwfpe, so don't set this bit in QEMU either. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org Signed-off-by: Riku Voipio <riku.voipio@linaro.org> (cherry picked from commit 24682654654a2e7b50afc27880f4098e5fca3742) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:17:19 UTC
83b1dc1 Peter Maydell 02 May 2014, 13:45:12 UTC linux-user/elfload.c: Fix incorrect ARM HWCAP bits The ELF HWCAP bits for ARM features THUMBEE, NEON, VFPv3 and VFPv3D16 are all off by one compared to the kernel definitions. Fix this discrepancy and add in the missing CRUNCH bit which was the cause of the off-by-one error. (We don't emulate any of the CPUs which have that weird hardware, so it's otherwise uninteresting to us.) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Riku Voipio <riku.voipio@linaro.org> (cherry picked from commit 43ce393ee5f7b96d2ac22fedc40d6b6fb3f65a3e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:17:09 UTC
c2d3722 Edgar E. Iglesias 01 May 2014, 14:24:45 UTC target-arm: Make vbar_write 64bit friendly on 32bit hosts Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1398926097-28097-2-git-send-email-edgar.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit fed3ffb9f157f33bc9b2b1c3ef68e710ee6b7b4b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:16:25 UTC
e40585f Edgar E. Iglesias 01 May 2014, 14:24:45 UTC target-arm: A64: Handle blr lr For linked branches, updates to the link register happen conceptually after the read of the branch target register. Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Cc: qemu-stable@nongnu.org Message-id: 1398926097-28097-3-git-send-email-edgar.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 1b505f93bcf605e7c4144fef83bd039b0d4f2576) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:15:16 UTC
837e02e Amos Kong 16 April 2014, 01:57:14 UTC qdev: Fix crash by validating the object type QEMU crashed when I try to list device parameters and the driver name is actually an available bus name. # qemu -device virtio-pci-bus,? # qemu -device virtio-bus,? # qemu -device virtio-serial-bus,? qdev-monitor.c:212:qdev_device_help: Object 0x7fd932f50620 is not an instance of type device Aborted (core dumped) We can also reproduce this bug by adding device from monitor, so it's worth to fix the crash. (qemu) device_add virtio-serial-bus qdev-monitor.c:491:qdev_device_add: Object 0x7f5e89530920 is not an instance of type device Aborted (core dumped) Cc: qemu-stable@nongnu.org Signed-off-by: Amos Kong <akong@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit ce0abca3e35a9f95e9edcb5d6b2910b2fcd52099) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:14:21 UTC
46a1b0e Paolo Bonzini 29 April 2014, 11:10:05 UTC target-i386: fix set of registers zeroed on reset BND0-3, BNDCFGU, BNDCFGS, BNDSTATUS were not zeroed on reset, but they should be (Intel Instruction Set Extensions Programming Reference 319433-015, pages 9-4 and 9-6). Same for YMM. XCR0 should be reset to 1. TSC and TSC_RESET were zeroed already by the memset, remove the explicit assignments. Cc: Andreas Faerber <afaerber@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 05e7e819d7d159a75a46354aead95e1199b8f168) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:13:08 UTC
a14d429 Christian Borntraeger 03 April 2014, 13:54:58 UTC s390x/kvm: rework KVM synchronize to tracing for some ONEREGS Some ONE_REGS on s390 are not protected by a capability. Older kernels might not provide those and return an error. Fortunately these registers are only critical for the migration path. There is no need to error out on reset and normal runtime. Furthermore, these kernels don't provide a proper dirty bitmap anyway, so let's use tracing for those errors. Also provide generic one reg helper to simplify the code. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> (cherry picked from commit 860643bc5aa902f9b736c57b66e301ef08a2b68e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:12:20 UTC
2ac9549 Michael S. Tsirkin 28 April 2014, 13:08:26 UTC stellaris_enet: block migration Incoming migration with stellaris_enet is unsafe. It's being reworked, but for now, simply block it since noone is using it anyway. Block outgoing migration for good measure. CVE-2013-4532 Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:10:36 UTC
2f18e44 Michael S. Tsirkin 28 April 2014, 05:15:32 UTC acpi: fix tables for no-hpet configuration acpi build tried to add offset of hpet table to rsdt even when hpet was disabled. If no tables follow hpet, this could lead to a malformed rsdt. Fix it up. To avoid such errors in the future, rearrange code slightly to make it clear that acpi_add_table stores the offset of the following table - not of the previous one. Reported-by: TeLeMan <geleman@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Cc: qemu-stable@nongnu.org (cherry picked from commit 9ac1c4c07e7e6ab16a3e2149e9b32c0d092cb3f5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:05:57 UTC
4c1e064 Michael Tokarev 27 April 2014, 09:32:07 UTC po/Makefile: fix $SRC_PATH reference The rule for messages.po appears to be slightly wrong. Move the `cd' command within parens. Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Tested-by: Stefan Weil <sw@weilnetz.de> (cherry picked from commit b920cad6693d6f2baa0217543c9f9cca5ebaf6ce) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:05:57 UTC
4a7a497 David Hildenbrand 03 September 2012, 10:45:13 UTC s390x: empty function stubs in preparation for __KVM_HAVE_GUEST_DEBUG This patch creates empty function stubs (used by the gdbserver) in preparation for the hw debugging support by kvm on s390, which will enable the __KVM_HAVE_GUEST_DEBUG define in the linux headers and require these methods on the qemu side. Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> (cherry picked from commit 8c0124490bcd78c9c54139cd654c71c5fbd95e6b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:05:57 UTC
7dfa87e Benoît Canet 22 April 2014, 15:05:27 UTC block: Prevent coroutine stack overflow when recursing in bdrv_open_backing_file. In 1.7.1 qcow2_create2 reopen the file for flushing without the BDRV_O_NO_BACKING flags. As a consequence the code would recursively open the whole backing chain. These three stack arrays would pile up through the recursion and lead to a coroutine stack overflow. Convert these array to malloced buffers in order to streamline the coroutine footprint. Symptoms where freezes or segfaults on production machines while taking QMP externals snapshots. The overflow disturbed coroutine switching. [Resolved conflicts on qemu.git/master since the patch was against v1.7.1 --Stefan] Signed-off-by: Benoit Canet <benoit.canet@gmail.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 1ba4b6a553ad9ff4645af7fab8adfc6e810fcc69) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:05:57 UTC
7b0387a Peter Crosthwaite 17 April 2014, 03:20:52 UTC arm: translate.c: Fix smlald Instruction The smlald (and probably smlsld) instruction was doing incorrect sign extensions of the operands amongst 64bit result calculation. The instruction psuedo-code is: operand2 = if m_swap then ROR(R[m],16) else R[m]; product1 = SInt(R[n]<15:0>) * SInt(operand2<15:0>); product2 = SInt(R[n]<31:16>) * SInt(operand2<31:16>); result = product1 + product2 + SInt(R[dHi]:R[dLo]); R[dHi] = result<63:32>; R[dLo] = result<31:0>; The result calculation should be done in 64 bit arithmetic, and hence product1 and product2 should be sign extended to 64b before calculation. The current implementation was adding product1 and product2 together then sign-extending the intermediate result leading to false negatives. E.G. if product1 = product2 = 0x4000000, their sum = 0x80000000, which will be incorrectly interpreted as -ve on sign extension. We fix by doing the 64b extensions on both product1 and product2 before any addition/subtraction happens. We also fix where we were possibly incorrectly setting the Q saturation flag for SMLSLD, which the ARM ARM specifically says is not set. Reported-by: Christina Smith <christina.smith@xilinx.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 2cddb6f5a15be4ab8d2160f3499d128ae93d304d.1397704570.git.peter.crosthwaite@xilinx.com Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 33bbd75a7c3321432fe40a8cbacd64619c56138c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:05:56 UTC
1624861 Hannes Reinecke 16 April 2014, 14:44:13 UTC megasas: Implement LD_LIST_QUERY Newer firmware implement a LD_LIST_QUERY command, and due to a driver issue no drives might be detected if this command isn't supported. So add emulation for this command, too. Cc: qemu-stable@nongnu.org Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 34bb4d02e00e508fa9d111a6a31b45bbfecbdba5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:05:56 UTC
fb03901 Alex Bennée 16 April 2014, 11:29:39 UTC target-arm: A64: fix unallocated test of scalar SQXTUN The test for the U bit was incorrectly inverted in the scalar case of SQXTUN. This doesn't affect the vector case as the U bit is used to select XTN(2). Reported-by: Hao Liu <hao.liu@arm.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit e44a90c59697cf98e05619fbb6f77a403d347495) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:05:56 UTC
5ad12b3 Michael S. Tsirkin 03 April 2014, 16:52:17 UTC virtio-scsi: fix buffer overrun on invalid state load CVE-2013-4542 hw/scsi/scsi-bus.c invokes load_request. virtio_scsi_load_request does: qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem)); this probably can make elem invalid, for example, make in_num or out_num huge, then: virtio_scsi_parse_req(s, vs->cmd_vqs[n], req); will do: if (req->elem.out_num > 1) { qemu_sgl_init_external(req, &req->elem.out_sg[1], &req->elem.out_addr[1], req->elem.out_num - 1); } else { qemu_sgl_init_external(req, &req->elem.in_sg[1], &req->elem.in_addr[1], req->elem.in_num - 1); } and this will access out of array bounds. Note: this adds security checks within assert calls since SCSIBusInfo's load_request cannot fail. For now simply disable builds with NDEBUG - there seems to be little value in supporting these. Cc: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 3c3ce981423e0d6c18af82ee62f1850c2cda5976) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:05:56 UTC
15c35df Michael S. Tsirkin 03 April 2014, 16:52:25 UTC usb: sanity check setup_index+setup_len in post_load CVE-2013-4541 s->setup_len and s->setup_index are fed into usb_packet_copy as size/offset into s->data_buf, it's possible for invalid state to exploit this to load arbitrary data. setup_len and setup_index should be checked to make sure they are not negative. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 9f8e9895c504149d7048e9fc5eb5cbb34b16e49a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:05:55 UTC
e7ff139 Michael S. Tsirkin 03 April 2014, 16:52:13 UTC zaurus: fix buffer overrun on invalid state load CVE-2013-4540 Within scoop_gpio_handler_update, if prev_level has a high bit set, then we get bit > 16 and that causes a buffer overrun. Since prev_level comes from wire indirectly, this can happen on invalid state load. Similarly for gpio_level and gpio_dir. To fix, limit to 16 bit. Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 52f91c3723932f8340fe36c8ec8b18a757c37b2b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:05:55 UTC
894f179 Michael S. Tsirkin 03 April 2014, 16:52:09 UTC tsc210x: fix buffer overrun on invalid state load CVE-2013-4539 s->precision, nextprecision, function and nextfunction come from wire and are used as idx into resolution[] in TSC_CUT_RESOLUTION. Validate after load to avoid buffer overrun. Cc: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 5193be3be35f29a35bc465036cd64ad60d43385f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:05:55 UTC
2265c71 Michael S. Tsirkin 03 April 2014, 16:52:05 UTC ssd0323: fix buffer overun on invalid state load CVE-2013-4538 s->cmd_len used as index in ssd0323_transfer() to store 32-bit field. Possible this field might then be supplied by guest to overwrite a return addr somewhere. Same for row/col fields, which are indicies into framebuffer array. To fix validate after load. Additionally, validate that the row/col_start/end are within bounds; otherwise the guest can provoke an overrun by either setting the _end field so large that the row++ increments just walk off the end of the array, or by setting the _start value to something bogus and then letting the "we hit end of row" logic reset row to row_start. For completeness, validate mode as well. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit ead7a57df37d2187813a121308213f41591bd811) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:05:55 UTC
95d9149 Michael S. Tsirkin 28 April 2014, 13:08:14 UTC ssi-sd: fix buffer overrun on invalid state load CVE-2013-4537 s->arglen is taken from wire and used as idx in ssi_sd_transfer(). Validate it before access. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit a9c380db3b8c6af19546a68145c8d1438a09c92b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:05:55 UTC
eb55958 Michael S. Tsirkin 03 April 2014, 16:51:57 UTC pxa2xx: avoid buffer overrun on incoming migration CVE-2013-4533 s->rx_level is read from the wire and used to determine how many bytes to subsequently read into s->rx_fifo[]. If s->rx_level exceeds the length of s->rx_fifo[] the buffer can be overrun with arbitrary data from the wire. Fix this by validating rx_level against the size of s->rx_fifo. Cc: Don Koch <dkoch@verizon.com> Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Don Koch <dkoch@verizon.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit caa881abe0e01f9931125a0977ec33c5343e4aa7) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> 21 July 2014, 03:05:55 UTC
back to top