summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* block/raw-posix: avoid bogus fixup for cylinders on DASD disksChristian Borntraeger2016-03-171-7/+0
| | | | | | | | | | | | | | | | large volume DASD that have > 64k cylinders do claim to have 0xFFFE cylinders as special value in the old 16 bit field. We want to pass this "token" along to the guest, instead of calculating the real number. Otherwise qemu might fail with "cyls must be between 1 and 65535" Cc: qemu-stable@nongnu.org Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 972b543c6b63579aee590b738d21af09f01569f7) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* ehci: update irq on resetGerd Hoffmann2016-03-171-0/+1
| | | | | | | | | | | | | | | | After clearing the status register we also have to update the irq line status. Otherwise a irq which happends to be pending at reset time causes a interrupt storm. And the guest can't stop as the status register doesn't indicate any pending interrupt. Both NetBSD and FreeBSD hang on shutdown because of that. Cc: qemu-stable@nongnu.org Reported-by: Andrey Korolyov <andrey@xdel.ru> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1453203884-4125-1-git-send-email-kraxel@redhat.com (cherry picked from commit 5a8660741a8aa19fbf8a5e8a2b3aac88664f4e66) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* net: set endianness on all backend devicesLaurent Vivier2016-03-171-12/+11
| | | | | | | | | | | | | | | | | | | | commit 5be7d9f1b1452613b95c6ba70b8d7ad3d0797991 vhost-net: tell tap backend about the vnet endianness makes vhost net to set the endianness of the device, but only for the first device. In case of multiqueue, we have multiple devices... This patch sets the endianness for all the devices of the interface. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit a407644079c8639002e7ea635d851953b10a38c3) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* net: ne2000: check ring buffer control registersPrasad J Pandit2016-03-171-0/+4
| | | | | | | | | | | | | | | Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152) bytes to process network packets. Registers PSTART & PSTOP define ring buffer size & location. Setting these registers to invalid values could lead to infinite loop or OOB r/w access issues. Add check to avoid it. Reported-by: Yang Hongke <yanghongke@huawei.com> Tested-by: Yang Hongke <yanghongke@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit 415ab35a441eca767d033a2702223e785b9d5190) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* net/filter: fix nf->netdev_id leakLi Zhijian2016-03-171-0/+1
| | | | | | | | | Cc: Jason Wang <jasowang@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com> Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit 671f66f87fbf6cc6a3879f3055f16347b1db91e9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* net/dump: fix nfds->filename leakLi Zhijian2016-03-171-0/+8
| | | | | | | | | Cc: Jason Wang <jasowang@redhat.com> Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com> Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit b50c7d452f5aef52cc9e7461f215cab87c3f3b03) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* blockdev: Fix 'change' for slot devicesMax Reitz2016-03-172-4/+30
| | | | | | | | | | | | | | | | | | | | | 'change' and related operations did not work when used on guest devices featuring removable media but no actual tray, because blk_dev_is_tray_open() always returned false for them and the blockdev-{insert,remove}-medium commands required it to return true. Fix this by making blockdev-{insert,remove}-medium work on tray-less devices. Also, blockdev-{open,close}-tray are now explicitly no-ops when invoked on such devices, and blk_dev_change_media_cb() is instead called by blockdev-{insert,remove}-medium (for tray-less devices only). Reported-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable <qemu-stable@nongnu.org> Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Message-id: 1454096953-31773-3-git-send-email-mreitz@redhat.com Reviewed-by: Eric Blake <eblake@redhat.com> (cherry picked from commit 12c7ec87a7d88919b23736176eba3118d1521372) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* block: Add blk_dev_has_tray()Max Reitz2016-03-172-1/+10
| | | | | | | | | | | | | | | Pull out the check whether a block device has a tray from blk_dev_is_tray_open() into its own function so both attributes (whether there is a tray vs. whether that tray is open) can be queried independently. Cc: qemu-stable <qemu-stable@nongnu.org> Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Message-id: 1454096953-31773-2-git-send-email-mreitz@redhat.com (cherry picked from commit 8f3a73bc57ea83e5b3930d14fc596ea51859987a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* net: rocker: fix an incorrect array bounds checkPrasad J Pandit2016-03-151-4/+4
| | | | | | | | | | | | | | While processing transmit(tx) descriptors in 'tx_consume' routine the switch emulator suffers from an off-by-one error, if a descriptor was to have more than allowed(ROCKER_TX_FRAGS_MAX=16) fragments. Fix an incorrect bounds check to avoid it. Reported-by: Qinghao Tang <luodalongde@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit 007cd223de527b5f41278f2d886c1a4beb3e67aa) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* ivshmem: remove redundant assignment, fix crash with msi=offMarc-André Lureau2016-03-151-3/+0
| | | | | | | | | | Fix crash when msi=false introduced in 660c97ee (msi_vectors is NULL in this case) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> (cherry picked from commit 47213eb1104709bf238c8d16db20aa47d37b1c59) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* ivshmem: no need for opaque argumentMarc-André Lureau2016-03-151-2/+2
| | | | | | | | Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> (cherry picked from commit 2c64846972897fc3aec4072f849fae2b00322f8b) *context dependency for 47213eb Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* scsi: initialise info object with appropriate sizeP J P2016-03-151-1/+1
| | | | | | | | | | | | | | | While processing controller 'CTRL_GET_INFO' command, the routine 'megasas_ctrl_get_info' overflows the '&info' object size. Use its appropriate size to null initialise it. Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <alpine.LFD.2.20.1512211501420.22471@wniryva> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: P J P <ppandit@redhat.com> (cherry picked from commit 36fef36b91f7ec0435215860f1458b5342ce2811) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* virtio-9p: use accessor to get thread_poolGreg Kurz2016-03-151-1/+1
| | | | | | | | | | | | | | | The aio_context_new() function does not allocate a thread pool. This is deferred to the first call to the aio_get_thread_pool() accessor. It is hence forbidden to access the thread_pool field directly, as it may be NULL. The accessor *must* be used always. Fixes: ebac1202c95a4f1b76b6ef3f0f63926fa76e753e Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Tested-by: Michael Tokarev <mjt@tls.msk.ru> Cc: qemu-stable@nongnu.org Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> (cherry picked from commit 4b3a4f2d458ca5a7c6c16ac36a8d9ac22cc253d6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* xenfb: avoid reading twice the same fields from the shared pageStefano Stabellini2016-03-151-4/+6
| | | | | | | | | | | | | Reading twice the same field could give the guest an attack of opportunity. In the case of event->type, gcc could compile the switch statement into a jump table, effectively ending up reading the type field multiple times. This is part of XSA-155. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> (cherry picked from commit 7ea11bf376aea4bf8340eb363de9777c7f93e556) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* xen/blkif: Avoid double access to src->nr_segmentsStefano Stabellini2016-03-151-4/+8
| | | | | | | | | | | | | | | src is stored in shared memory and src->nr_segments is dereferenced twice at the end of the function. If a compiler decides to compile this into two separate memory accesses then the size limitation could be bypassed. Fix it by removing the double access to src->nr_segments. This is part of XSA-155. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> (cherry picked from commit f9e98e5d7a67367b862941e339a98b8322fa0cea) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* configure: Fix shell syntax to placate OpenBSD's pdkshPeter Maydell2016-03-151-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Unfortunately the OpenBSD pdksh does not like brackets inside the right part of a ${variable+word} parameter expansion: $ echo "${a+($b)}" ksh: ${a+($b)}": bad substitution though both bash and dash accept them. In any case this line was causing odd output in the case where nettle is not present: nettle no () (because if nettle is not present then $nettle will be "no", not a null string or unset). Rewrite it to just use an if. This bug was originally introduced in becaeb726 and was present in the 2.4.0 release. Fixes: https://bugs.launchpad.net/qemu/+bug/1525682 Reported-by: Dmitrij D. Czarkoff Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1450105357-8516-1-git-send-email-peter.maydell@linaro.org (cherry picked from commit 18f49881cf8359e89396aac12f5d3cf3f8a632ba) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* target-ppc: kvm: fix floating point registers sync on little-endian hostsGreg Kurz2016-03-151-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On VSX capable CPUs, the 32 FP registers are mapped to the high-bits of the 32 first VSX registers. So if you have: VSR31 = (uint128) 0x0102030405060708090a0b0c0d0e0f00 then FPR31 = (uint64) 0x0102030405060708 The kernel stores the VSX registers in the fp_state struct following the host endian element ordering. On big-endian: fp_state.fpr[31][0] = 0x0102030405060708 fp_state.fpr[31][1] = 0x090a0b0c0d0e0f00 On little-endian: fp_state.fpr[31][0] = 0x090a0b0c0d0e0f00 fp_state.fpr[31][1] = 0x0102030405060708 The KVM_GET_ONE_REG and KVM_SET_ONE_REG ioctls preserve this ordering, but QEMU considers it as big-endian and always copies element [0] to the fpr[] array and element [1] to the vsr[] array. This does not work with little-endian hosts, and you will get: (qemu) p $f31 0x90a0b0c0d0e0f00 instead of: (qemu) p $f31 0x102030405060708 This patch fixes the element ordering for little-endian hosts. Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> (cherry picked from commit 3a4b791b4c13e02537a5cc572fa3de70bc5f68da) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* net: vmxnet3: avoid memory leakage in activate_deviceP J P2016-03-151-8/+16
| | | | | | | | | | | | | | | | Vmxnet3 device emulator does not check if the device is active before activating it, also it did not free the transmit & receive buffers while deactivating the device, thus resulting in memory leakage on the host. This patch fixes both these issues to avoid host memory leakage. Reported-by: Qinghao Tang <luodalongde@gmail.com> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit aa4a3dce1c88ed51b616806b8214b7c8428b7470) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* ehci: make idt processing more robustGerd Hoffmann2016-03-151-2/+3
| | | | | | | | | | | | | | | | Make ehci_process_itd return an error in case we didn't do any actual iso transfer because we've found no active transaction. That'll avoid ehci happily run in circles forever if the guest builds a loop out of idts. This is CVE-2015-8558. Cc: qemu-stable@nongnu.org Reported-by: Qinghao Tang <luodalongde@gmail.com> Tested-by: P J P <ppandit@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 156a2e4dbffa85997636a7a39ef12da6f1b40254) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* Update version for v2.5.0 releasePeter Maydell2015-12-161-1/+1
| | | | Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Update version for v2.5.0-rc4 releasePeter Maydell2015-12-111-1/+1
| | | | Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* blockdev: Mark {insert, remove}-medium experimentalMax Reitz2015-12-115-33/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | While in the long term we want throttling to be its own block filter BDS, in the short term we want it to be part of the BB instead of a BDS; even in the long term we may want legacy throttling to be automatically tied to the BB. blockdev-insert-medium and blockdev-remove-medium do not retain throttling information in the BB (deliberately so). Therefore, using them means tying this information to a BDS, which would break the model described above. (The same applies to other flags such as detect_zeroes.) We probably want to move this information to the BB or its own filter BDS before blockdev-{insert,remove}-medium can be considered completely stable. Therefore, mark these functions experimental for the time being. Suggested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com> Acked-by: Markus Armbruster <armbru@redhat.com> Acked-by: Kevin Wolf <kwolf@redhat.com> Message-id: 1449847385-13986-2-git-send-email-mreitz@redhat.com Reviewed-by: Eric Blake <eblake@redhat.com> [PMM: fixed format nit (underlining) in qmp-commands.hx] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Fix xbzrle vs last_sent_block updateDr. David Alan Gilbert2015-12-111-1/+10
| | | | | | | | | | | | | | | | | | | | | My fix (84e7b80a) replaced the last_sent_block update that I'd removed earlier; however it was too aggressive in the xbzrle case. save_xbzrle_page might return '0' to mean that the page didn't need sending since it was the same as the last sent version; in this case we can't update 'last_sent_block' since we didn't actually send it. Symptom: 'Illegal RAM offset 1018000' as we try and send a page to the wrong RAMBlock; potentially that could be a data corruption if you were really unlucky. Fixes: 84e7b80a05c0c44b90533c6cd2f1db5c932ccf77 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-id: 1449765106-6528-1-git-send-email-dgilbert@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Update language files for QEMU 2.5.0Peter Maydell2015-12-107-127/+127
| | | | | | | | Update translation files (change created via 'make -C po update'). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Stefan Weil <sw@weilnetz.de> Message-id: 1449754467-3496-1-git-send-email-peter.maydell@linaro.org
* sparc: allow CASA with ASI 0xa from user spaceAlex Zuepke2015-12-101-1/+2
| | | | | | | | | LEON3 allows the CASA instruction to be used from user space if the ASI is set to 0xa (user data). Signed-off-by: Alex Zuepke <azu@sysgo.de> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* MAINTAINERS: add maintainer to virtio-9pGreg Kurz2015-12-101-0/+1
| | | | | | | | | As suggested by Paolo, I add myself as maintainer for virtio-9p. Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Acked-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Message-id: 20151130154016.20108.79073.stgit@bahia.huguette.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* virtio-9p-device: add minimal unrealize handlerGreg Kurz2015-12-101-0/+12
| | | | | | | | | | | | | | | | | | | | | Since commit 4652f1640e029e1f2433fa77ba6af285 "virtio-9p: add savevm handlers", if the user hot-unplugs a quiescent 9p device and live migrates, the source QEMU crashes before migration completetion... This happens because virtio-9p devices have a realize handler which calls virtio_init() and register_savevm(). Both calls store pointers to the device internals, that get dereferenced during migration even if the device got unplugged. This patch simply adds an unrealize handler to perform minimal cleanup and avoid the crash. Hot unplug of non-quiescent 9p devices is still not supported in QEMU, and not supported by linux guests either. Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20151208155457.27775.69441.stgit@bahia.huguette.org [PMM: rewrapped long lines in commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Update version for v2.5.0-rc3 releasePeter Maydell2015-12-071-1/+1
| | | | Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* sd: Mark brittle abuse of blk_attach_dev() FIXMEMarkus Armbruster2015-12-071-0/+1
| | | | | | | | | | | | | | blk_attach_dev() fails here only when we're working for device "sdhci-pci" (which already attached the backend), and then we don't want to attach a second time. If we ever create another failure mode, we're setting up ourselves to using the same backend from multiple frontends, which is likely to end in tears. Can't clean this up this close to the release, so mark it FIXME. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1449503710-3707-3-git-send-email-armbru@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* sdhci: Sanitize "sdhci-pci" properties for future qomificationMarkus Armbruster2015-12-072-3/+8
| | | | | | | | | | | | | | | | | | | | We currently fuse controller and card into a single device model, but we intend qomify things properly and separate the two. The properties that really belong to the card would then have to somehow pass-through to the card's properties. To avoid that complication, either mark them experimental or drop them. Properties "capareg", "maxcurr" and the usual PCI device properties belong to the controller. Property "drive" belongs to the card; rename it to "x-drive". Properties "logical_block_size", "physical_block_size", "min_io_size", "opt_io_size", "discard_granularity" belong to the card, but have no effect; drop them. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1449503710-3707-2-git-send-email-armbru@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* virtio-blk: Drop x-data-plane optionFam Zheng2015-12-073-15/+2
| | | | | | | | | | | | | | | | | | The official way of enabling dataplane is through the "iothread" property that references an iothread object created by "-object iothread". Since the old "x-data-plane=on" way now even crashes, it's probably easier to just drop it: $ qemu-system-x86_64 -drive file=null-co://,id=d0,if=none \ -device virtio-blk-pci,drive=d0,x-data-plane=on ERROR:/home/fam/work/qemu/qom/object.c:1515: object_get_canonical_path_component: assertion failed: (obj->parent != NULL) Aborted Signed-off-by: Fam Zheng <famz@redhat.com> Message-id: 1449485967-19240-1-git-send-email-famz@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell2015-12-074-11/+29
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging # gpg: Signature made Mon 07 Dec 2015 14:06:07 GMT using RSA key ID 398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: lan9118: log and ignore access to invalid registers, rather than aborting lan9118: fix emulation of MAC address loaded bit in E2P_CMD register vmxnet3: silence warning pcnet: fix rx buffer overflow(CVE-2015-7512) net: pcnet: add check to validate receive data size(CVE-2015-7504) e1000: fix hang of win2k12 shutdown with flood ping Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * lan9118: log and ignore access to invalid registers, rather than abortingAndrew Baumann2015-12-071-4/+8
| | | | | | | | | | | | | | | | | | | | | | With this change, access to invalid/unimplemented device registers are logged as a "guest error" rather than aborting qemu with hw_error. This enables drivers for similar devices (e.g. SMSC 9221), by simply ignoring the unimplemented writes. It's also closer to what real hardware does. Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * lan9118: fix emulation of MAC address loaded bit in E2P_CMD registerAndrew Baumann2015-12-071-3/+5
| | | | | | | | | | | | | | | | | | | | There appears to have been a longstanding typo in the implementation of the "MAC address loaded" bit in the E2P_CMD (EEPROM command) register. The code was using 0x10, but the controller spec says it should be bit 8 (0x100). Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * vmxnet3: silence warningMichael S. Tsirkin2015-12-071-1/+0
| | | | | | | | | | | | | | | | | | | | vmxnet3 always produces a warning under qtest. This is not a user error, don't warn. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * pcnet: fix rx buffer overflow(CVE-2015-7512)Jason Wang2015-12-071-0/+6
| | | | | | | | | | | | | | | | | | | | | | Backends could provide a packet whose length is greater than buffer size. Check for this and truncate the packet to avoid rx buffer overflow in this case. Cc: Prasad J Pandit <pjp@fedoraproject.org> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * net: pcnet: add check to validate receive data size(CVE-2015-7504)Prasad J Pandit2015-12-071-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | In loopback mode, pcnet_receive routine appends CRC code to the receive buffer. If the data size given is same as the buffer size, the appended CRC code overwrites 4 bytes after s->buffer. Added a check to avoid that. Reported by: Qinghao Tang <luodalongde@gmail.com> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000: fix hang of win2k12 shutdown with flood pingDenis V. Lunev2015-12-071-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | e1000 driver in Win2k12 is really well rotten. It 100% hangs on shutdown of UP VM under flood ping. The guest checks card state and reinjects itself interrupt in a loop. This is fatal for UP machine. There is no good way to fix this misbehavior but to kludge it. The emulation has interrupt throttling register aka ITR which limits interrupt rate and allows the guest to proceed this phase. There is no problem with this kludge for Linux guests - it adjust the value of it itself. On the other hand according to the initial research in commit e9845f0985f088dd01790f4821026df0afba5795 Author: Vincenzo Maffione <v.maffione@gmail.com> Date: Fri Aug 2 18:30:52 2013 +0200 e1000: add interrupt mitigation support ... Interrupt mitigation boosts performance when the guest suffers from an high interrupt rate (i.e. receiving short UDP packets at high packet rate). For some numerical results see the following link http://info.iet.unipi.it/~luigi/papers/20130520-rizzo-vm.pdf this should also boost performance a bit. See https://bugzilla.redhat.com/show_bug.cgi?id=874406 for additional details. Signed-off-by: Denis V. Lunev <den@openvz.org> CC: Vincenzo Maffione <v.maffione@gmail.com> CC: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' ↵Peter Maydell2015-12-047-22/+34
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging QOM infrastructure fixes and device conversions * Documentation update * qom-test and related fixes # gpg: Signature made Fri 04 Dec 2015 17:54:55 GMT using RSA key ID 3E7E013F # gpg: Good signature from "Andreas Färber <afaerber@suse.de>" # gpg: aka "Andreas Färber <afaerber@suse.com>" * remotes/afaerber/tags/qom-devices-for-peter: qom-test: Fix qmp() leaks tests: Use proper functions types instead of void (*fn) qom: Update documentation comment of struct Object tests: Fix check-report-qtest-% target Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | qom-test: Fix qmp() leaksMarc-André Lureau2015-12-041-7/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before this patch ASAN reported: SUMMARY: AddressSanitizer: 677165875 byte(s) leaked in 1272437 allocation(s) After this patch: SUMMARY: AddressSanitizer: 465 byte(s) leaked in 32 allocation(s) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <1448551895-871-1-git-send-email-marcandre.lureau@redhat.com> [Straightforwardly rebased onto the previous patch] Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
| * | tests: Use proper functions types instead of void (*fn)Markus Armbruster2015-12-044-10/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We have several function parameters declared as void (*fn). This is just a stupid way to write void *, and the only purpose writing it like that could serve is obscuring the sin of bypassing the type system without need. The original sin is commit 49ee359: its qtest_add_func() is a wrapper for g_test_add_func(). Fix the parameter type to match g_test_add_func()'s. This uncovers type errors in ide-test.c; fix them. Commit 7949c0e faithfully repeated the sin for qtest_add_data_func(). Fix it the same way, along with a harmless type error uncovered in vhost-user-test.c. Commit 063c23d repeated it for qtest_add_abrt_handler(). The screwy parameter gets assigned to GHook member func, so change its type to match. Requires wrapping kill_qemu() to keep the type checker happy. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> [AF/armbru: Inline GTestFunc/GTestDataFunc typedef for old GLib] Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
| * | qom: Update documentation comment of struct ObjectCao jin2015-12-031-3/+0
| | | | | | | | | | | | | | | | | | | | | It doesn't have "GSList *interfaces" anymore, drop the paragraph. Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
| * | tests: Fix check-report-qtest-% targetAndreas Färber2015-12-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit e253c28 ("tests: Fix how qom-test is run") introduced $(qtest-generic-y) and used it for check-qtest-% target, but did not update check-report-qtest-%. This causes check-report-qtest-aarch64.xml target to fail with a gtester usage error for lack of test arguments. Fix this by adding $(qtest-generic-y) in check-report-qtest-%. Also add it in check-clean target, spotted by Markus. Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
* | | Merge remote-tracking branch ↵Peter Maydell2015-12-049-31/+31
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/mjt/tags/pull-trivial-patches-2015-12-04' into staging trivial patches for 2015-12-04 # gpg: Signature made Fri 04 Dec 2015 06:40:23 GMT using RSA key ID A4C3D7DB # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" * remotes/mjt/tags/pull-trivial-patches-2015-12-04: bt: check struct sizes typedefs: Put them back into alphabetical order scsi: remove scsi_req_free prototype gt64xxx: fix decoding of ISD register configure: use appropriate code fragment for -fstack-protector checks crypto: avoid two coverity false positive error reports configure: Diagnose broken linkers directly bt: avoid unintended sign extension util/id: fully allocate names table Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | bt: check struct sizesPaolo Bonzini2015-12-041-17/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | See http://permalink.gmane.org/gmane.linux.bluez.kernel/36505. For historical reasons these do not use sizeof, and Coverity caught a mistake in EVT_ENCRYPT_CHANGE_SIZE. In addition: - remove status from create_conn_cancel_cp; the "status" field is only in rp structs. Note that this means that the OCF_CREATE_CONN_CANCEL could never have worked (it would have failed the LENGTH_CHECK), but I am keeping it anyway. - OCF_READ_LINK_QUALITY similarly could never have worked, but I am fixing read_link_quality_cp anyway. - fix inquiry_info which is shorter by one: the kernel has a struct that is 14 byte long, but not counting the initial num_responses byte which the kernel parses separately; - remove extended_inquiry_info altogether, since it's not used and unlike the other inquiry structs does not have the initial num_responses byte. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| * | | typedefs: Put them back into alphabetical orderMarkus Armbruster2015-12-041-7/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "Please keep this list in alphabetical order" has been more honoured in the breach than in the observance. Clean up. While there, drop a redundant struct declaration. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| * | | scsi: remove scsi_req_free prototypeHervé Poussineau2015-12-041-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Function has been deleted in ad2d30f79d3b0812f02c741be2189796b788d6d7. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| * | | gt64xxx: fix decoding of ISD registerPaolo Bonzini2015-12-041-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The GT64xxx's internal registers can be placed above the first 4 GiB in the address space, but not above the first 64 GiB. Correctly cast the register to a 64-bit integer, and mask away bits above bit 35. Datasheet at http://pdf.datasheetarchive.com/datasheetsmain/Datasheets-33/DSA-655889.pdf (bug reported by Coverity). Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| * | | configure: use appropriate code fragment for -fstack-protector checksRodrigo Rebello2015-12-041-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The check for stack-protector support consisted in compiling and linking the test program below (output by function write_c_skeleton()) with the compiler flag -fstack-protector-strong first and then with -fstack-protector-all if the first one failed to work: int main(void) { return 0; } This caused false positives when using certain toolchains in which the compiler accepted -fstack-protector-strong but no support was provided by the C library, since for this stack-protector variant the compiler emits canary code only for functions that meet specific conditions (local arrays, memory references to local variables, etc.) and the code fragment under test included none of them (hence no stack protection code generated, no link failure). This fix changes the test program used for -fstack-protector checks to include a function that meets conditions which cause the compiler to generate canary code in all variants. Signed-off-by: Rodrigo Rebello <rprebello@gmail.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| * | | crypto: avoid two coverity false positive error reportsDaniel P. Berrange2015-12-042-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In qcrypto_tls_creds_get_path() coverity complains that we are checking '*creds' for NULL, despite having dereferenced it previously. This is harmless bug due to fact that the trace call was too early. Moving it after the cleanup gets the desired semantics. In qcrypto_tls_creds_check_cert_key_purpose() coverity complains that we're passing a pointer to a previously free'd buffer into gnutls_x509_crt_get_key_purpose_oid() This is harmless because we're passing a size == 0, so gnutls won't access the buffer, but rather just report what size it needs to be. We can avoid it though by explicitly setting the buffer to NULL after free'ing it. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
OpenPOWER on IntegriCloud