- 08 5月, 2014 10 次提交
-
-
由 Stefan Weil 提交于
This fixes a warning from the static code analysis (smatch). Signed-off-by: NStefan Weil <sw@weilnetz.de> Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
-
由 Stefan Weil 提交于
There was already a forward declaration using 'static', but the attribute was missing in the implementation. This fixes a warning from the static code analysis (smatch). Signed-off-by: NStefan Weil <sw@weilnetz.de> Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
-
由 Stefan Weil 提交于
This fixes a warning from the static code analysis (smatch). Signed-off-by: NStefan Weil <sw@weilnetz.de> Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
-
由 Stefan Weil 提交于
Signed-off-by: NStefan Weil <sw@weilnetz.de> Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
-
由 Stefan Weil 提交于
This fixes a warning from the static code analysis (smatch). Signed-off-by: NStefan Weil <sw@weilnetz.de> Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru> Acked-by: NAurelien Jarno <aurelien@aurel32.net>
-
由 Stefan Weil 提交于
Signed-off-by: NStefan Weil <sw@weilnetz.de> Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
-
由 Chen Gang 提交于
When DPRINTF() has effect, the original author wants to print all ram_load() calling results. So need use 'goto' instead of 'return' within ram_load(), just like other areas have done. Signed-off-by: NChen Gang <gang.chen.5i5j@gmail.com> Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
-
由 Peter Maydell 提交于
The test_path binary is (unlike the other test binaries in tests/tcg) actually intended to be compiled with the same compiler used to build the main QEMU executables. It actually #includes a number of the QEMU source files in an attempt to unit-test the util/path.c functions, and so if it is not compiled with the same compiler used by configure to set CONFIG_ settings then it is liable to fail to build. Fix the makefile to build it with the default C compiler rules, not CC_I386, and fix the test itself not to include a lot of unnecessary trace related source files which cause the build to fail if the trace backend is anything other than 'simple'. Signed-off-by: NPeter Maydell <peter.maydell@linaro.org> Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
-
由 Stefan Weil 提交于
Signed-off-by: NStefan Weil <sw@weilnetz.de> Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
-
由 Michael Tokarev 提交于
Commit e26110cf added a check for shacmd to create a hash for modules. This check in configure is using bash construct &> to redirect both stdout and stderr, which does fun things on some shells. Get rid of it, use standard redirection instead. Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru> Reviewed-by: NFam Zheng <famz@redhat.com>
-
- 07 5月, 2014 6 次提交
-
-
由 Peter Maydell 提交于
Some improvements for s390. Two patches deal with address translation, one fixes a problem in the channel subsystem code. # gpg: Signature made Wed 07 May 2014 09:29:30 BST using RSA key ID C6F02FAF # gpg: Can't check signature: public key not found * remotes/cohuck/tags/s390x-20140507: s390x/css: Don't save orb in subchannel. s390x/helper: Added format control bit to MMU translation s390x/helper: Fixed real-to-absolute address translation Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 Peter Maydell 提交于
migration/next for 20140505 # gpg: Signature made Mon 05 May 2014 21:27:24 BST using RSA key ID 5872D723 # gpg: Can't check signature: public key not found * remotes/juanquintela/tags/migration/20140505: (36 commits) migration: expose xbzrle cache miss rate migration: expose the bitmap_sync_count to the end migration: Add counts of updating the dirty bitmap XBZRLE: Fix one XBZRLE corruption issues migration: remove duplicate code Coverity: Fix failure path for qemu_accept in migration Init the XBZRLE.lock in ram_mig_init Provide init function for ram migration Count used RAMBlock pages for migration_dirty_pages Make qemu_peek_buffer loop until it gets it's data Disallow outward migration while awaiting incoming migration virtio: validate config_len on load virtio-net: out-of-bounds buffer write on load openpic: avoid buffer overrun on incoming migration ssi-sd: fix buffer overrun on invalid state load savevm: Ignore minimum_version_id_old if there is no load_state_old usb: sanity check setup_index+setup_len in post_load vmstate: s/VMSTATE_INT32_LE/VMSTATE_INT32_POSITIVE_LE/ virtio-scsi: fix buffer overrun on invalid state load zaurus: fix buffer overrun on invalid state load ... Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 Peter Maydell 提交于
QOM/QTest infrastructure fixes and device conversions * -device / device_add assertion fix * QEMUMachine conversion to MachineClass * Device error handling improvements * QTest cleanups and test cases for some more PCI devices * PortIO memory leak fixes # gpg: Signature made Mon 05 May 2014 19:59:16 BST using RSA key ID 3E7E013F # gpg: Good signature from "Andreas Färber <afaerber@suse.de>" # gpg: aka "Andreas Färber <afaerber@suse.com>" * remotes/afaerber/tags/qom-devices-for-peter: PortioList: Store PortioList in device state tests: Add EHCI qtest tests: Add ioh3420 qtest tests: Add intel-hda qtests tests: Add es1370 qtest tests: Add ac97 qtest qtest: Be paranoid about accept() addrlen argument qtest: Add error reporting to socket_accept() qtest: Assure that init_socket()'s listen() does not fail MAINTAINERS: Document QOM arm: Clean up fragile use of error_is_set() in realize() methods qom: Clean up fragile use of error_is_set() in set() methods hw: Consistently name Error ** objects errp, and not err hw: Consistently name Error * objects err, and not errp machine: Remove QEMUMachine indirection from MachineClass machine: Replace QEMUMachine by MachineClass in accelerator configuration vl.c: Replace QEMUMachine with MachineClass in QEMUMachineInitArgs machine: Copy QEMUMachine's fields to MachineClass machine: Remove obsoleted field from QEMUMachine qdev: Fix crash by validating the object type Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 Cornelia Huck 提交于
Current css code saves the operation request block (orb) in the subchannel structure for later consumption by the start function handler. This might make sense for asynchronous execution of the start function (which qemu doesn't support), but not in our case; it would even be wrong since orb contains a reference to a local variable in the base ssch handler. Let's just pass the orb through the start function call chain for ssch; for rsch, we can pass NULL as the backend function does not use any information passed via the orb there. Acked-by: NChristian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>
-
由 Thomas Huth 提交于
With the EDAT-1 facility, the MMU translation can stop at the segment table already, pointing to a 1 MB block. And while we're at it, move the page table entry handling to a separate function, too, as suggested by Alexander Graf. Acked-by: NAlexander Graf <agraf@suse.de> Signed-off-by: NThomas Huth <thuth@linux.vnet.ibm.com> Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>
-
由 Thomas Huth 提交于
The real-to-absolute address translation in mmu_translate() was missing the second part for translating the page at the prefix address back to the 0 page. And while we're at it, also moved the code into a separate helper function since this might come in handy for other parts of the code, too. Signed-off-by: NThomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: NDavid Hildenbrand <dahi@linux.vnet.ibm.com> Reviewed-by: NAlexander Graf <agraf@suse.de> Signed-off-by: NJens Freimann <jfrei@linux.vnet.ibm.com> Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>
-
- 06 5月, 2014 24 次提交
-
-
由 Peter Maydell 提交于
ohci live migration. mtp bugfixes. # gpg: Signature made Mon 05 May 2014 12:08:48 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-usb-6: usb: mtp: reply INCOMPLETE_TRANSFER on read errors usb: mtp: fix possible buffer overflow usb: mtp: drop data-out hexdump usb: mtp: avoid empty description string usb: mtp: fix error path memory leak usb: mtp: fix serial (must be exact 32 chars) usb: mtp: fix version (is decimal not bcd) usb: mtp: fix usb_mtp_add_u64 usb: mtp: replace debug printfs with trace points usb-ohci: Add vmstate descriptor Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 Peter Maydell 提交于
smbios: make qemu generate smbios tables. # gpg: Signature made Mon 05 May 2014 12:20:27 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-smbios-2: SMBIOS: Build aggregate smbios tables and entry point SMBIOS: Use bitmaps to prevent incompatible comand line options SMBIOS: Use macro to set smbios defaults SMBIOS: Update header file definitions SMBIOS: Rename symbols to better reflect future use E820: Add interface for accessing e820 table pc: add 2.1 machine type Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 Peter Maydell 提交于
* remotes/rth/tgt-axp: target-alpha: Fix RDUSP Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 Peter Maydell 提交于
* remotes/riku/linux-user-for-upstream: linux-user: fix getrusage and wait4 failures with invalid rusage struct linux-user/elfload.c: Support ARM HWCAP2 flags linux-user/elfload.c: Fix A64 code which was incorrectly acting like A32 linux-user/elfload.c: Update ARM HWCAP bits linux-user/elfload.c: Fix incorrect ARM HWCAP bits linux-user: remove configure option for setting uname release linux-user: move uname functions to uname.c linux-user: rename cpu-uname -> uname linux-user/signal.c: Set fault address in AArch64 signal info linux-user: avoid using glibc internals in _syscall5 and in definition of target_sigevent struct linux-user: Handle arches with llseek instead of _llseek linux-user: Add support for SCM_CREDENTIALS. linux-user: Move if-elses to a switch statement. linux-user: Assert stack used for auxvec, envp, argv linux-user: Add /proc/self/exe open forwarding Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 ChenLiang 提交于
expose xbzrle cache miss rate Signed-off-by: NChenLiang <chenliang88@huawei.com> Signed-off-by: NGonglei <arei.gonglei@huawei.com> Reviewed-by: NEric Blake <eblake@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 ChenLiang 提交于
expose the count that logs the times of updating the dirty bitmap to end user. Signed-off-by: NChenLiang <chenliang88@huawei.com> Signed-off-by: NGonglei <arei.gonglei@huawei.com> Reviewed-by: NEric Blake <eblake@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 ChenLiang 提交于
Add counts to log the times of updating the dirty bitmap. Signed-off-by: NChenLiang <chenliang88@huawei.com> Signed-off-by: NGonglei <arei.gonglei@huawei.com> Reviewed-by: NEric Blake <eblake@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 ChenLiang 提交于
The page may not be inserted into cache after executing save_xbzrle_page. In case of failure to insert, the original page should be sent rather than the page in the cache. Signed-off-by: NChenLiang <chenliang88@huawei.com> Signed-off-by: NGonglei <arei.gonglei@huawei.com> Reviewed-by: NJuan Quintela <quintela@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 ChenLiang 提交于
version_id is checked twice in the ram_load. Signed-off-by: NChenLiang <chenliang88@huawei.com> Signed-off-by: NGonglei <arei.gonglei@huawei.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Dr. David Alan Gilbert 提交于
Coverity defects 1005733 & 1005734 complain about passing a negative value to closesocket in the error paths on incoming migration. Stash the error value and print it in the message (previously we gave no indication of the reason for the failure) Use error_report Signed-off-by: NDr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: NMarkus Armbruster <armbru@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Dr. David Alan Gilbert 提交于
Initialising the XBZRLE.lock earlier simplifies the lock use. Based on Markus's patch in: http://lists.gnu.org/archive/html/qemu-devel/2014-03/msg03879.htmlSigned-off-by: NDr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: NGonglei <arei.gonglei@huawei.com> Reviewed-by: NMarkus Armbruster <armbru@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Dr. David Alan Gilbert 提交于
Provide ram_mig_init (like blk_mig_init) for vl.c to initialise stuff to do with ram migration (currently in arch_init.c). Signed-off-by: NDr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: NGonglei <arei.gonglei@huawei.com> Reviewed-by: NMarkus Armbruster <armbru@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Dr. David Alan Gilbert 提交于
This is a fix for a bug* triggered by a migration after hot unplugging a few virtio-net NICs, that caused migration never to converge, because 'migration_dirty_pages' is incorrectly initialised. 'migration_dirty_pages' is used as a tally of the number of outstanding dirty pages, to give the migration code an idea of how much more data will need to be transferred, and thus whether it can end the iterative phase. It was initialised to the total size of the RAMBlock address space, however hotunplug can leave this space sparse, and hence migration_dirty_pages ended up too large. Signed-off-by: NDr. David Alan Gilbert <dgilbert@redhat.com> (* https://bugzilla.redhat.com/show_bug.cgi?id=1074913 ) Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Dr. David Alan Gilbert 提交于
Make qemu_peek_buffer repeatedly call fill_buffer until it gets all the data it requires, or until there is an error. At the moment, qemu_peek_buffer will try one qemu_fill_buffer if there isn't enough data waiting, however the kernel is entitled to return just a few bytes, and still leave qemu_peek_buffer with less bytes than it needed. I've seen this fail in a dev world, and I think it could theoretically fail in the peeking of the subsection headers in the current world. Comment qemu_peek_byte to point out it's not guaranteed to work for non-continuous peeks Signed-off-by: NDr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: NChenLiang <chenliang0016@icloud.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Dr. David Alan Gilbert 提交于
QEMU will assert if you attempt to start an outgoing migration on a QEMU that's sitting waiting for an incoming migration (started with -incoming), so disallow it with a proper error. (This is a fix for https://bugzilla.redhat.com/show_bug.cgi?id=1086987 ) Signed-off-by: NDr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: NAndreas Färber <afaerber@suse.de> Reviewed-by: NEric Blake <eblake@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Michael S. Tsirkin 提交于
Malformed input can have config_len in migration stream exceed the array size allocated on destination, the result will be heap overflow. To fix, that config_len matches on both sides. CVE-2014-0182 Reported-by: N"Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com> -- v2: use %ix and %zx to print config_len values Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Michael S. Tsirkin 提交于
CVE-2013-4149 QEMU 1.3.0 out-of-bounds buffer write in virtio_net_load()@hw/net/virtio-net.c > } else if (n->mac_table.in_use) { > uint8_t *buf = g_malloc0(n->mac_table.in_use); We are allocating buffer of size n->mac_table.in_use > qemu_get_buffer(f, buf, n->mac_table.in_use * ETH_ALEN); and read to the n->mac_table.in_use size buffer n->mac_table.in_use * ETH_ALEN bytes, corrupting memory. If adversary controls state then memory written there is controlled by adversary. Reviewed-by: NMichael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Michael Roth 提交于
CVE-2013-4534 opp->nb_cpus is read from the wire and used to determine how many IRQDest elements to read into opp->dst[]. If the value exceeds the length of opp->dst[], MAX_CPU, opp->dst[] can be overrun with arbitrary data from the wire. Fix this by failing migration if the value read from the wire exceeds MAX_CPU. Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com> Reviewed-by: NAlexander Graf <agraf@suse.de> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Michael S. Tsirkin 提交于
CVE-2013-4537 s->arglen is taken from wire and used as idx in ssi_sd_transfer(). Validate it before access. Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Peter Maydell 提交于
At the moment we require vmstate definitions to set minimum_version_id_old to the same value as minimum_version_id if they do not provide a load_state_old handler. Since the load_state_old functionality is required only for a handful of devices that need to retain migration compatibility with a pre-vmstate implementation, this means the bulk of devices have pointless boilerplate. Relax the definition so that minimum_version_id_old is ignored if there is no load_state_old handler. Note that under the old scheme we would segfault if the vmstate specified a minimum_version_id_old that was less than minimum_version_id but did not provide a load_state_old function, and the incoming state specified a version number between minimum_version_id_old and minimum_version_id. Under the new scheme this will just result in our failing the migration. Signed-off-by: NPeter Maydell <peter.maydell@linaro.org> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Michael S. Tsirkin 提交于
CVE-2013-4541 s->setup_len and s->setup_index are fed into usb_packet_copy as size/offset into s->data_buf, it's possible for invalid state to exploit this to load arbitrary data. setup_len and setup_index should be checked to make sure they are not negative. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Reviewed-by: NGerd Hoffmann <kraxel@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Michael S. Tsirkin 提交于
As the macro verifies the value is positive, rename it to make the function clearer. Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Michael S. Tsirkin 提交于
CVE-2013-4542 hw/scsi/scsi-bus.c invokes load_request. virtio_scsi_load_request does: qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem)); this probably can make elem invalid, for example, make in_num or out_num huge, then: virtio_scsi_parse_req(s, vs->cmd_vqs[n], req); will do: if (req->elem.out_num > 1) { qemu_sgl_init_external(req, &req->elem.out_sg[1], &req->elem.out_addr[1], req->elem.out_num - 1); } else { qemu_sgl_init_external(req, &req->elem.in_sg[1], &req->elem.in_addr[1], req->elem.in_num - 1); } and this will access out of array bounds. Note: this adds security checks within assert calls since SCSIBusInfo's load_request cannot fail. For now simply disable builds with NDEBUG - there seems to be little value in supporting these. Cc: Andreas Färber <afaerber@suse.de> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Michael S. Tsirkin 提交于
CVE-2013-4540 Within scoop_gpio_handler_update, if prev_level has a high bit set, then we get bit > 16 and that causes a buffer overrun. Since prev_level comes from wire indirectly, this can happen on invalid state load. Similarly for gpio_level and gpio_dir. To fix, limit to 16 bit. Reported-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Reviewed-by: NDr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-