Commit Graph

29160 Commits

Author SHA1 Message Date
Anthony Liguori
e8f2f59aaf Merge remote-tracking branch 'amit/char-remove-watch-on-unplug' into staging
# By Amit Shah
# Via Amit Shah
* amit/char-remove-watch-on-unplug:
  char: remove watch callback on chardev detach from frontend
  char: use common function to disable callbacks on chardev close
  char: move backends' io watch tag to CharDriverState

Message-id: 20131004154802.GA25646@grmbl.mre
Signed-off-by: Anthony Liguori <aliguori@amazon.com>
2013-10-10 13:16:02 -07:00
Anthony Liguori
88b70e56b9 Merge remote-tracking branch 'otubo/seccomp' into staging
# By Eduardo Otubo
# Via Eduardo Otubo
* otubo/seccomp:
  seccomp: fine tuning whitelist by adding times()

Message-id: 1380047458-21673-1-git-send-email-otubo@linux.vnet.ibm.com
Signed-off-by: Anthony Liguori <aliguori@amazon.com>
2013-10-10 13:15:46 -07:00
Anthony Liguori
e572398de1 Merge remote-tracking branch 'mcayland/qemu-openbios' into staging
* mcayland/qemu-openbios:
  Update OpenBIOS images

Signed-off-by: Anthony Liguori <aliguori@amazon.com>
2013-10-10 13:00:03 -07:00
Mark Wu
0106dc4f05 qemu-ga: Extend 'guest-info' command to expose flag 'success-response'
Now we have several qemu-ga commands not returning response on success.
It has been documented in qga/qapi-schema.json already. This patch exposes
the 'success-response' flag by extending 'guest-info' command. With this
change, the clients can handle the command response more flexibly.

Signed-off-by: Mark Wu <wudxw@linux.vnet.ibm.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
*fixed up commit subject
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-10-10 14:52:37 -05:00
Mark Wu
8dc4d915dd qemu-ga: Add interface to traverse the qmp command list by QmpCommand
In the original code, qmp_get_command_list is used to construct
a list of all commands' name. To get the information of all qga
commands, it traverses the name list and search the command info
with its name.  So it can cause O(n^2) in the number of commands.

This patch adds an interface to traverse the qmp command list by
QmpCommand to replace qmp_get_command_list. It can decrease the
complexity from O(n^2) to O(n).

Signed-off-by: Mark Wu <wudxw@linux.vnet.ibm.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
*fix up commit subject
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-10-10 14:52:37 -05:00
Tomoki Sekiyama
e5d9adbdab qemu-ga: execute fsfreeze-freeze in reverse order of mounts
Currently, fsfreeze-freeze may cause deadlock if a guest has loopback mounts
of image files in its disk; e.g.:

    # mount | grep ^/
    /dev/vda1 / type ext4 (rw,noatime,seclabel,data=ordered)
    /tmp/disk.img on /mnt type ext4 (rw,relatime,seclabel)

To avoid the deadlock, this freezes filesystems in reverse order of mounts.

Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
*fix up commit msg
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-10-10 14:52:37 -05:00
Richard Henderson
6c5f4ead64 tcg: Add TCGMemOp
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 12:20:59 -07:00
Richard Henderson
ec9135cd6e configure: Remove CONFIG_QEMU_LDST_OPTIMIZATION
No longer used.

Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 11:44:26 -07:00
Richard Henderson
9ecefc84dd tcg: Add tcg-be-ldst.h
Move TCGLabelQemuLdst and related stuff out of tcg.h.

Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 11:44:26 -07:00
Richard Henderson
3cf246f0d4 tcg: Add tcg-be-null.h
This is a no-op backend data implementation, for those targets that
are not currently using the load/store optimization path.

This is prepatory to always requiring these functions in all backends.

Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 11:44:26 -07:00
Richard Henderson
dbdbe0cd31 exec: Delete is_tcg_gen_code and GETRA_EXT
All implementations now boil down to GETRA.

Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 11:44:25 -07:00
Richard Henderson
023261ef85 tcg-aarch64: Update to helper_ret_*_mmu routines
A minimal update to use the new helpers with the return address argument.

Tested-by: Claudio Fontana <claudio.fontana@linaro.org>
Reviewed-by: Claudio Fontana <claudio.fontana@linaro.org>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 11:44:25 -07:00
Richard Henderson
84fd9dd3f7 tcg: Merge tcg_register_helper into tcg_context_init
Eliminates the repeated checks for having created
the s->helpers hash table.

Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 11:44:25 -07:00
Richard Henderson
4953ee6271 tcg: Add tcg-runtime.c helpers to all_helpers
For the few targets that actually use these, we'd not report
them symbolicly in the tcg opcode logs.

Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 11:44:25 -07:00
Richard Henderson
100b5e0170 tcg: Put target helper data into an array.
One call inside of a loop to tcg_register_helper instead of hundreds
of sequential calls.

Presumably more icache and branch prediction friendly; resulting binary
size mostly unchanged on x86_64, as we're trading 32-bit rip-relative
references in .text for full 64-bit pointers in .rodata.

Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 11:44:25 -07:00
Richard Henderson
f5daeec412 tcg: Remove stray semi-colons from target-*/helper.h
During GEN_HELPER=1, these are actually stray top-level semi-colons
which are technically invalid ISO C, but GCC accepts as an extension.
If we added enough __extension__ markers that we could dare use
-Wpedantic, we'd see

  warning: ISO C does not allow extra ‘;’ outside of a function

This will become a hard error in the next patch, wherein those ; will
appear in the middle of a data structure.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 11:43:37 -07:00
Richard Henderson
5cd8f6210f tcg: Move helper registration into tcg_context_init
No longer needs to be done on a per-target basis.

Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 11:43:37 -07:00
Richard Henderson
e5e84d22a3 target-m68k: Rename helpers.h to helper.h
This brings the m68k target in line with all other targets.

Reviewed-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 11:41:54 -07:00
Richard Henderson
6e085f72c6 tcg: Use a GHashTable for tcg_find_helper
Slightly changes the interface, in that we now return name
instead of a TCGHelperInfo structure, which goes away.

Reviewed-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 11:41:36 -07:00
Richard Henderson
7c57df0d85 tcg: Delete tcg_helper_get_name declaration
The function was deleted in 4dc81f2822.

Reviewed-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 11:41:15 -07:00
Richard Henderson
802b508123 tcg-hppa: Remove tcg backend
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-10-10 11:31:06 -07:00
Anthony Liguori
f2c6bcfc2e Merge remote-tracking branch 'sstabellini/xen-2013-10-10' into staging
# By Matthew Daley (1) and Roger Pau Monné (1)
# Via Stefano Stabellini
* sstabellini/xen-2013-10-10:
  qemu/xen: make use of xenstore relative paths
  xen_disk: mark ioreq as mapped before unmapping in error case
2013-10-10 10:03:38 -07:00
Anthony Liguori
634ebf4b17 Merge remote-tracking branch 'bonzini/scsi-next' into staging
# By Asias He (1) and Peter Lieven (1)
# Via Paolo Bonzini
* bonzini/scsi-next:
  scsi: Allocate SCSITargetReq r->buf dynamically [CVE-2013-4344]
  block/iscsi: reenable iscsi_co_get_block_status

Message-id: 1381332391-8781-1-git-send-email-pbonzini@redhat.com
Signed-off-by: Anthony Liguori <aliguori@amazon.com>
2013-10-10 10:03:00 -07:00
Anthony Liguori
c4ca690158 Update email address
Amazon is now funding my work as QEMU maintainer so update addresses
accordingly.

Signed-off-by: Anthony Liguori <aliguori@amazon.com>
2013-10-10 09:56:25 -07:00
Roger Pau Monné
33876dfad6 qemu/xen: make use of xenstore relative paths
Qemu has several hardcoded xenstore paths that are only valid on Dom0.
Attempts to launch a Qemu instance (to act as a userspace backend for
PV disks) will fail because Qemu is not able to access those paths
when running on a domain different than Dom0.

Instead make the xenstore paths relative to the domain where Qemu is
actually running.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>
Cc: xen-devel@lists.xenproject.org
Cc: Anthony PERARD <anthony.perard@citrix.com>
2013-10-10 14:25:52 +00:00
Matthew Daley
a76f48e533 xen_disk: mark ioreq as mapped before unmapping in error case
Commit 4472beae modified the semantics of ioreq_{un,}map so that they are
idempotent if called when they're not needed (ie., twice in a row). However,
it neglected to handle the case where batch mapping is not being used (the
default), and one of the grants fails to map. In this case, ioreq_unmap will
be called to unwind and unmap any mappings already performed, but ioreq_unmap
simply returns due to the aforementioned change (the ioreq has not already
been marked as mapped).

The frontend user can therefore force xen_disk to leak grant mappings, a
per-domain limited resource.

Fix by marking the ioreq as mapped before calling ioreq_unmap in this
situation.

Signed-off-by: Matthew Daley <mattjd@gmail.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2013-10-10 14:23:45 +00:00
Asias He
846424350b scsi: Allocate SCSITargetReq r->buf dynamically [CVE-2013-4344]
r->buf is hardcoded to 2056 which is (256 + 1) * 8, allowing 256 luns at
most. If more than 256 luns are specified by user, we have buffer
overflow in scsi_target_emulate_report_luns.

To fix, we allocate the buffer dynamically.

Signed-off-by: Asias He <asias@redhat.com>
Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-10-09 17:24:18 +02:00
Anthony Liguori
a107170537 Merge remote-tracking branch 'stefanha/block' into staging
# By Max Reitz (5) and others
# Via Stefan Hajnoczi
* stefanha/block:
  block: use correct filename
  qemu-iotests: Correct 026 output
  qcow2: Free allocated L2 cluster on error
  qcow2: Switch L1 table in a single sequence
  block: vhdx - add migration blocker
  block: use correct filename for error report
  qcow2: CHECK_OFLAG_COPIED is obsolete
  qcow2: Correct endianness in overlap check

Message-id: 1381145289-6591-1-git-send-email-stefanha@redhat.com
Signed-off-by: Anthony Liguori <anthony@codemonkey.ws>
2013-10-09 07:54:42 -07:00
Anthony Liguori
80dfc87394 Merge remote-tracking branch 'mjt/trivial-patches' into staging
# By Stefan Weil (5) and others
# Via Michael Tokarev
* mjt/trivial-patches:
  migration: Fix compiler warning ('caps' may be used uninitialized)
  util/path: Fix type which is longer than 8 bit for MinGW
  hw/9pfs: Fix errno value for xattr functions
  vl: Clean up unnecessary boot_order complications
  qemu-char: Fix potential out of bounds access to local arrays
  pci-ohci: Add missing 'break' in ohci_service_td
  sh4: Fix serial line access for Linux kernels later than 3.2
  hw/alpha: Fix compiler warning (integer constant is too large)
  target-i386: Fix compiler warning (integer constant is too large)
  block: Remove unused assignment (fixes warning from clang)
  exec: cleanup DEBUG_SUBPAGE
  tests: Fix schema parser test for in-tree build
  tests: Update .gitignore for test-int128 and test-bitops
  .gitignore: ignore tests/qemu-iotests/socket_scm_helper

Message-id: 1381051979-25742-1-git-send-email-mjt@msgid.tls.msk.ru
Signed-off-by: Anthony Liguori <anthony@codemonkey.ws>
2013-10-09 07:54:21 -07:00
Anthony Liguori
576e81be39 Merge remote-tracking branch 'rth/tcg-arm-pull' into staging
# By Richard Henderson
# Via Richard Henderson
* rth/tcg-arm-pull:
  tcg-arm: Move the tlb addend load earlier
  tcg-arm: Remove restriction on qemu_ld output register
  tcg-arm: Return register containing tlb addend
  tcg-arm: Move load of tlb addend into tcg_out_tlb_read
  tcg-arm: Use QEMU_BUILD_BUG_ON to verify constraints on tlb
  tcg-arm: Use strd for tcg_out_arg_reg64
  tcg-arm: Rearrange slow-path qemu_ld/st
  tcg-arm: Use ldrd/strd for appropriate qemu_ld/st64

Message-id: 1380663109-14434-1-git-send-email-rth@twiddle.net
Signed-off-by: Anthony Liguori <anthony@codemonkey.ws>
2013-10-09 07:52:57 -07:00
Anthony Liguori
9e8f8b1cd8 Merge remote-tracking branch 'sweil/mingw' into staging
# By Sebastian Ottlik
# Via Stefan Weil
* sweil/mingw:
  util: call socket_set_fast_reuse instead of setting SO_REUSEADDR
  slirp: call socket_set_fast_reuse instead of setting SO_REUSEADDR
  net: call socket_set_fast_reuse instead of setting SO_REUSEADDR
  gdbstub: call socket_set_fast_reuse instead of setting SO_REUSEADDR
  util: add socket_set_fast_reuse function which will replace setting SO_REUSEADDR

Message-id: 1380735690-24009-1-git-send-email-sw@weilnetz.de
Signed-off-by: Anthony Liguori <anthony@codemonkey.ws>
2013-10-09 07:52:21 -07:00
Anthony Liguori
dfe2279975 Merge remote-tracking branch 'kraxel/chardev.8' into staging
# By Gerd Hoffmann
# Via Gerd Hoffmann
* kraxel/chardev.8:
  chardev: handle qmp_chardev_add(KIND_MUX) failure

Message-id: 1380708925-6721-1-git-send-email-kraxel@redhat.com
Signed-off-by: Anthony Liguori <anthony@codemonkey.ws>
2013-10-09 07:52:11 -07:00
Anthony Liguori
ce079abb41 Merge remote-tracking branch 'sweil/tci' into staging
# By Stefan Weil
# Via Stefan Weil
* sweil/tci:
  misc: Use new rotate functions
  bitops: Add rotate functions (rol8, ror8, ...)
  tci: Add implementation of rotl_i64, rotr_i64

Message-id: 1380137693-3729-1-git-send-email-sw@weilnetz.de
Signed-off-by: Anthony Liguori <anthony@codemonkey.ws>
2013-10-09 07:51:23 -07:00
Peter Lieven
24c7608a5d block/iscsi: reenable iscsi_co_get_block_status
Commit f35c934a accidently disabled iscsi_co_get_block_status for all
libiscsi versions. Its not possible to check for enumeration constants
in the C preprocessor. This patch changes the check to the preprocessor
constant LIBISCSI_FEATURE_IOVECTOR which was introduced shortly after
get_lba_status support was added to libiscsi.

Signed-off-by: Peter Lieven <pl@kamp.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-10-09 10:43:42 +02:00
Dunrong Huang
d4cea8dfb9 block: use correct filename
The content filename point to may be erased by qemu_opts_absorb_qdict()
in raw_open_common() in drv->bdrv_file_open()

So it's better to use bs->filename.

Signed-off-by: Dunrong Huang <riegamaths@gmail.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2013-10-07 13:23:19 +02:00
Max Reitz
5c1fa87708 qemu-iotests: Correct 026 output
Because l2_allocate now frees the unused L2 cluster on error, the
according test cases in 026 don't result in one leaked cluster anymore.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2013-10-07 13:23:19 +02:00
Max Reitz
e3b21ef9e0 qcow2: Free allocated L2 cluster on error
If an error occurs in l2_allocate, the allocated (but unused) L2 cluster
should be freed.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2013-10-07 13:23:19 +02:00
Andreas Färber
51fb256ab5 cpu: Drop cpu_model_str from CPU_COMMON
Since this is only read in cpu_copy() and linux-user has a global
cpu_model, drop the field from generic code.

Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-10-07 11:48:47 +02:00
Andreas Färber
30ba0ee52d cpu: Move cpu_copy() into linux-user
It is only used there and is deemed very fragile if not incorrect in its
current memcpy() form. Moving it into linux-user will allow to move
parts into target_cpu.h headers and only copy what the ABI mandates.

Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-10-07 11:48:39 +02:00
liguang
812586405c cputlb: Remove dead function tlb_update_dirty()
Signed-off-by: liguang <lig.fnst@cn.fujitsu.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-10-07 11:48:03 +02:00
Juergen Lock
6c78f29a24 cpu-exec: Also reload CPUClass *cc after longjmp return in cpu_exec()
Local variable CPUClass *cc needs to be reloaded after return from longjmp,
too.  (This fixes a mips-softmmu crash observed on FreeBSD when QEMU is
built with clang.)

Reported-by: Dimitry Andric <dim@FreeBSD.org>
Signed-off-by: Juergen Lock <nox@jelal.kn-bremen.de>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-10-07 11:46:58 +02:00
Michael Tokarev
387eedebf6 migration: Fix compiler warning ('caps' may be used uninitialized)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
2013-10-05 14:02:29 +04:00
Stefan Weil
ddd23638d7 util/path: Fix type which is longer than 8 bit for MinGW
While dirent->d_type is 8 bit for most systems, it is 32 bit for MinGW.
Reducing it to 8 bit results in a compiler warning because the macro
is_dir_maybe compares that 8 bit value with 32 bit constants.

Using 'unsigned' instead of 'unsigned char' matches the declaration for
MinGW and does not harm the other systems.

MinGW-w64 is not affected: it does not declare d_type.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2013-10-05 14:01:47 +04:00
Daniel P. Berrange
8af0020544 hw/9pfs: Fix errno value for xattr functions
If there is no operation driver for the xattr type the
functions return '-1' and set errno to '-EOPNOTSUPP'.
When the calling code sets 'ret = -errno' this turns
into a large positive number.

In Linux 3.11, the kernel has switched to using 9p
version 9p2000.L, instead of 9p2000.u, which enables
support for xattr operations. This on its own is harmless,
but for another change which makes it request the xattr
with a name 'security.capability'.

The result is that the guest sees a succesful return
of 95 bytes of data, instead of a failure with errno
set to 95. Since the kernel expects a maximum of 20
bytes for an xattr return this gets translated to the
unexpected errno ERANGE.

This all means that when running a binary off a 9p fs
in 3.11 kernels you get a fun result of:

  # ./date
  sh: ./date: Numerical result out of range

The only workaround is to pass 'version=9p2000.u' when
mounting the 9p fs in the guest, to disable all use of
xattrs.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2013-10-05 13:05:28 +04:00
Markus Armbruster
e3fdc535f2 vl: Clean up unnecessary boot_order complications
Messed up in commit 8281abd.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2013-10-05 13:05:28 +04:00
Stefan Weil
49aa4058ac qemu-char: Fix potential out of bounds access to local arrays
Latest gcc-4.8 supports a new option -fsanitize=address which activates
an AddressSanitizer. This AddressSanitizer stops the QEMU system emulation
very early because two character arrays of size 8 are potentially written
with 9 bytes.

Commit 6ea314d914 added the code.

There is no obvious reason why width or height could need 8 characters,
so reduce it to 7 characters which together with the terminating '\0'
fit into the arrays.

Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Alex Bennée <alex@bennee.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2013-10-05 13:05:15 +04:00
Alex Williamson
b1c50c5f24 vfio-pci: Fix endian issues in vfio_pci_size_rom()
VFIO is always little endian so do byte swapping of our mask on the
way in and byte swapping of the size on the way out.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2013-10-04 12:50:51 -06:00
Alex Williamson
64fa25a0ef vfio-pci: Add dummy PCI ROM write accessor
Just to be sure we don't jump off any NULL pointer cliffs.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reported-by: Paolo Bonzini <pbonzini@redhat.com>
2013-10-04 08:51:36 -06:00
Alexey Kardashevskiy
1d5bf692e5 vfio: Fix debug output for int128 values
Memory regions can easily be 2^64 byte long and therefore overflow
for just a bit but that is enough for int128_get64() to assert.

This takes care of debug printing of huge section sizes.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2013-10-03 09:10:09 -06:00
Sebastian Macke
6ef8263ead target-openrisc: Removes a non-conforming behavior for the first page of the memory
Where *software* leaves 0x0000 - 0x2000 unmapped, the hardware should
still allow for this area to be mapped.

Signed-off-by: Sebastian Macke <sebastian@macke.de>
Signed-off-by: Stefan Kristiansson <stefan.kristiansson@saunalahti.fi>
Reviewed-by: Jia Liu <proljc@gmail.com>
2013-10-03 16:24:44 +08:00