summary refs log tree commit diff stats
path: root/hw/core/qdev-properties-system.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2017-02-12qemu-img: Use qemu_strtoul() rather than raw strtoul()Peter Maydell1-16/+16
Some of the argument parsing in qemu-img uses strtoul() to parse integer arguments. This is tricky to get correct and in fact the code does not get it right, because it assigns the result of strtoul() to an 'int' variable and then tries to check for > INT_MAX. Coverity correctly complains that the comparison is always false. Rewrite to use qemu_strtoul(), which has a saner convention for reporting conversion failures. (Fixes CID 1356421, CID 1356422, CID 1356423.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1486744104-15590-2-git-send-email-peter.maydell@linaro.org Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12qemu-io: don't allow I/O operations larger than BDRV_REQUEST_MAX_BYTESAlberto Garcia1-7/+13
Passing a request size larger than BDRV_REQUEST_MAX_BYTES to any of the I/O commands results in an error. While 'read' and 'write' handle the error correctly, 'aio_read' and 'aio_write' hit an assertion: blk_aio_read_entry: Assertion `rwco->qiov->size == acb->bytes' failed. The reason is that the QEMU I/O code cannot handle request sizes larger than BDRV_REQUEST_MAX_BYTES, so this patch makes qemu-io check that all values are within range. Signed-off-by: Alberto Garcia <berto@igalia.com> Message-id: 79f66648c685929a144396bda24d13a207131dcf.1485878688.git.berto@igalia.com [mreitz: Use BDRV_REQUEST_MAX_BYTES instead of INT_MAX] Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12qcow2: Optimize the refcount-block overlap checkAlberto Garcia3-1/+25
The metadata overlap checks introduced in a40f1c2add help detect corruption in the qcow2 image by verifying that data writes don't overlap with existing metadata sections. The 'refcount-block' check in particular iterates over the refcount table in order to get the addresses of all refcount blocks and check that none of them overlap with the region where we want to write. The problem with the refcount table is that since it always occupies complete clusters its size is usually very big. With the default values of cluster_size=64KB and refcount_bits=16 this table holds 8192 entries, each one of them enough to map 2GB worth of host clusters. So unless we're using images with several TB of allocated data this table is going to be mostly empty, and iterating over it is a waste of CPU. If the storage backend is fast enough this can have an effect on I/O performance. This patch keeps the index of the last used (i.e. non-zero) entry in the refcount table and updates it every time the table changes. The refcount-block overlap check then uses that index instead of reading the whole table. In my tests with a 4GB qcow2 file stored in RAM this doubles the amount of write IOPS. Signed-off-by: Alberto Garcia <berto@igalia.com> Message-id: 20170201123828.4815-1-berto@igalia.com Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12qemu-io: Add failure regression testsNir Soffer3-0/+67
Add regression tests checking that qemu-io fails with non-zero exit code when reading non-existing file or using the wrong image format. Signed-off-by: Nir Soffer <nirsof@gmail.com> Message-id: 20170201003120.23378-4-nirsof@gmail.com Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12qemu-iotests: Add _unsupported_fmt helperNir Soffer1-0/+11
This helper allows adding tests supporting any format expect the specified formats. This may be useful to test that many formats behave in a common way. Signed-off-by: Nir Soffer <nirsof@gmail.com> Message-id: 20170201003120.23378-3-nirsof@gmail.com Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12qemu-io: Return non-zero exit code on failureNir Soffer13-84/+6
The result of openfile was not checked, leading to failure deep in the actual command with confusing error message, and exiting with exit code 0. Here is a simple example - trying to read with the wrong format: $ touch file $ qemu-io -f qcow2 -c 'read -P 1 0 1024' file; echo $? can't open device file: Image is not in qcow2 format no file open, try 'help open' 0 With this patch, we fail earlier with exit code 1: $ ./qemu-io -f qcow2 -c 'read -P 1 0 1024' file; echo $? can't open device file: Image is not in qcow2 format 1 Failing earlier, we don't log this error now: no file open, try 'help open' But some tests expected it; the line was removed from the test output. Signed-off-by: Nir Soffer <nirsof@gmail.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 20170201003120.23378-2-nirsof@gmail.com Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12block/nfs: fix naming of runtime optsPeter Lieven1-23/+23
commit 94d6a7a accidentally left the naming of runtime opts and QAPI scheme inconsistent. As one consequence passing of parameters in the URI is broken. Sync the naming of the runtime opts to the QAPI scheme. Please note that this is technically backwards incompatible with the 2.8 release, but the 2.8 release is the only version that had the wrong naming. Furthermore release 2.8 suffered from a NULL pointer dereference during URI parsing. Fixes: 94d6a7a76e9df9919629428f6c598e2b97d9426c Cc: qemu-stable@nongnu.org Signed-off-by: Peter Lieven <pl@kamp.de> Message-id: 1485942829-10756-3-git-send-email-pl@kamp.de [mreitz: Fixed commit message] Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12block/nfs: fix NULL pointer dereference in URI parsingPeter Lieven1-1/+2
parse_uint_full wants to put the parsed value into the variable passed via its second argument which is NULL. Fixes: 94d6a7a76e9df9919629428f6c598e2b97d9426c Cc: qemu-stable@nongnu.org Signed-off-by: Peter Lieven <pl@kamp.de> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1485942829-10756-2-git-send-email-pl@kamp.de Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12block: bdrv_invalidate_cache: invalidate children firstVladimir Sementsov-Ogievskiy1-6/+5
Current implementation invalidates firstly parent bds and then its children. This leads to the following bug: after incoming migration, in bdrv_invalidate_cache_all: 1. invalidate parent bds - reopen it with BDRV_O_INACTIVE cleared 2. child is not yet invalidated 3. parent check that its BDRV_O_INACTIVE is cleared 4. parent writes to child 5. assert in bdrv_co_pwritev, as BDRV_O_INACTIVE is set for child This patch fixes it by just changing invalidate sequence: invalidate children first. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-id: 20170131112308.54189-1-vsementsov@virtuozzo.com Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12block/qapi: reduce the execution time of qmp_query_blockstatsDou Liyang1-44/+29
In order to reduce the execution time, this patch optimize the qmp_query_blockstats(): Remove the next_query_bds function. Remove the bdrv_query_stats function. Remove some judgement sentence. The original qmp_query_blockstats calls next_query_bds to get the next objects in each loops. In the next_query_bds, it checks the query_nodes and blk. It also call bdrv_query_stats to get the stats, In the bdrv_query_stats, it checks blk and bs each times. This waste more times, which may stall the main loop a bit. And if the disk is too many and donot use the dataplane feature, this may affect the performance in main loop thread. This patch removes that two functions, and makes the structure clearly. Signed-off-by: Dou Liyang <douly.fnst@cn.fujitsu.com> Message-id: 1484467275-27919-3-git-send-email-douly.fnst@cn.fujitsu.com Reviewed-by: Markus Armbruster <armbru@redhat.com> [mreitz: Removed duplicate info->value assignment] Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12block/qapi: reduce the coupling between the bdrv_query_stats and ↵Dou Liyang1-12/+14
bdrv_query_bds_stats The bdrv_query_stats and bdrv_query_bds_stats functions need to call each other, that increases the coupling. it also makes the program complicated and makes some unnecessary tests. Remove the call from bdrv_query_bds_stats to bdrv_query_stats, just take some recursion to make it clearly. Avoid testing whether the blk is NULL during querying the bds stats. It is unnecessary. Signed-off-by: Dou Liyang <douly.fnst@cn.fujitsu.com> Message-id: 1484467275-27919-2-git-send-email-douly.fnst@cn.fujitsu.com Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12qemu-iotest: test to lookup protocol-based image with relative backingJeff Cody3-0/+110
This test uses NFS and block-stream to force a lookup of a backing image that has a relative filename, but a full backing image name with the protocol path intact. Signed-off-by: Jeff Cody <jcody@redhat.com> Message-id: 1a7a3d6e6d8af36cd5b47ed6ea93b5a9ededf81b.1485392617.git.jcody@redhat.com Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12qemu-iotests: Don't create fifos / pidfiles with protocol pathsJeff Cody3-10/+12
Trying to create, use, and remove fifos and pidfiles on protocol paths (e.g. nfs://localhost/scratch/qemu-nbd.pid) is obviously broken. Use the local $TEST_DIR path before it is 'protocolized' for these files. Signed-off-by: Jeff Cody <jcody@redhat.com> Message-id: bb4a731a35bc4ac81fe3db17479dd686315317c7.1485392617.git.jcody@redhat.com Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12block: check full backing filename when searching protocol filenamesJeff Cody1-0/+13
In bdrv_find_backing_image(), if we are searching an image for a backing file that contains a protocol, we currently only compare unmodified paths. However, some management software will change the backing filename to be a relative filename in a path. QEMU is able to handle this fine, because internally it will use path_combine to put together the full protocol URI. However, this can lead to an inability to match an image during a QAPI command that needs to use bdrv_find_backing_image() to find the image, when it is searched by the full URI. When searching for a protocol filename, if the straight comparison fails, this patch will also compare against the full backing filename to see if that is a match. Signed-off-by: Jeff Cody <jcody@redhat.com> Message-id: c2d025adca8a2b665189e6f4cf080f44126d0b6b.1485392617.git.jcody@redhat.com Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12block/vmdk: Fix the endian problem of buf_len and lbaQingFeng Hao1-2/+2
The problem was triggered by qemu-iotests case 055. It failed when it was comparing the compressed vmdk image with original test.img. The cause is that buf_len in vmdk_write_extent wasn't converted to little-endian before it was stored to disk. But later vmdk_read_extent read it and converted it from little-endian to cpu endian. If the cpu is big-endian like s390, the problem will happen and the data length read by vmdk_read_extent will become invalid! The fix is to add the conversion in vmdk_write_extent, meanwhile, repair the endianness problem of lba field which shall also be converted to little-endian before storing to disk. Cc: qemu-stable@nongnu.org Signed-off-by: QingFeng Hao <haoqf@linux.vnet.ibm.com> Signed-off-by: Jing Liu <liujbjl@linux.vnet.ibm.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 20161216052040.53067-2-haoqf@linux.vnet.ibm.com Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12iotests: record separate timings per format,protocol pairDaniel P. Berrange3-7/+9
The 'check' program records timings for each test that is run. These timings are only valid, however, for a particular format/protocol combination. So if frequently running 'check' with a variety of different formats or protocols, the times printed can be very misleading. Instead of having a single 'check.time' file, maintain multiple 'check.time-$IMGPROTO-$IMGFMT' files. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20170103160556.9895-1-berrange@redhat.com Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12iotests: Fix reference output for 059Fam Zheng1-1/+1
It was broken by efaa7c4eeb7 when it dropped the device name "image" from BB API. Now this error message text is updated again, sync it up. Signed-off-by: Fam Zheng <famz@redhat.com> Message-id: 20170119130759.28319-3-famz@redhat.com Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12qapi: Tweak error message of bdrv_query_image_infoFam Zheng1-2/+2
@bs doesn't always have a device name, such as when it comes from "qemu-img info". Report file name instead. Signed-off-by: Fam Zheng <famz@redhat.com> Message-id: 20170119130759.28319-2-famz@redhat.com Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12qemu-img: Improve commit invalid base messageMax Reitz1-1/+3
When trying to invoke qemu-img commit with a base image file name that is not part of the top image's backing chain, the user receives a rather plain "Base not found" error message. This is not really helpful because it does not explain what "not found" means, potentially leaving the user wondering why qemu cannot find a file despite it clearly existing in the file system. Improve the error message by clarifying that "not found" means "not found in the top image's backing chain". Reported-by: Ala Hino <ahino@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com> Message-id: 20161201020508.24417-1-mreitz@redhat.com Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-12iotests: Fix a problem in common.filterQingFeng Hao1-1/+1
If TEST_DIR is set to /tmp, test case 144 will fail. The reason is that TEST_DIR resembles 144's test image name tmp.qcow2. When 144 is testing $TEST_DIR/tmp.qcow2, it wants to replace $TEST_DIR/tmp.qcow2 to TEST_DIR/tmp.qcow2, but actually it will fail and get TEST_DIRTEST_DIR.qcow2 in this case. The fix is just to modify the code to replace $TEST_DIR/ with TEST_DIR/. Signed-off-by: QingFeng Hao <haoqf@linux.vnet.ibm.com> Message-id: 20161216054723.96055-2-haoqf@linux.vnet.ibm.com Reviewed-by: Eric Blake <eblake@redhat.com> [mreitz: Fixed commit message and dropped superfluous escaping] Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-02-10hw/vfio: Add CONFIG switches for calxeda-xgmac and amd-xgbeThomas Huth2-2/+4
Both devices seem to be specific to the ARM platform. It's confusing for the users if they show up on other target architectures, too (e.g. when the user runs QEMU with "-device ?" to get a list of supported devices). Thus let's introduce proper configuration switches so that the devices are only compiled and included when they are really required. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2017-02-10hw/vfio/pci-quirks: Set category of the "vfio-pci-igd-lpc-bridge" deviceThomas Huth1-0/+1
The device has "bridge" in its name, so it should obviously be in the category DEVICE_CATEGORY_BRIDGE. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2017-02-10vfio-pci: Fix GTT wrap-around for Skylake+ IGDAlex Williamson1-1/+4
Previous IGD, up through Broadwell, only seem to write GTT values into the first 1MB of space allocated for the BDSM, but clearly the GTT can be multiple MB in size. Our test in vfio_igd_quirk_data_write() correctly filters out indexes beyond 1MB, but given the 1MB mask we're using, we re-apply writes only to the first 1MB of the guest allocated BDSM. We can't assume either the host or guest BDSM is naturally aligned, so we can't simply apply a different mask. Instead, save the host BDSM and do the arithmetic to subtract the host value to get the BDSM offset and add it to the guest allocated BDSM. Reported-by: Alexander Indenbaum <alexander.indenbaum@gmail.com> Tested-by: Alexander Indenbaum <alexander.indenbaum@gmail.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2017-02-10aspeed/smc: use a modulo to check segment limitsCédric Le Goater1-2/+2
The size of a segment is not necessarily a power of 2. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486648058-520-5-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10aspeed/smc: handle dummies only in fast read modeCédric Le Goater1-3/+6
HW works fine in normal read mode with dummy bytes being set. So let's check this case to not transfer bytes. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1486648058-520-4-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10aspeed: remove useless comment on controller segment sizeCédric Le Goater1-5/+3
The flash devices used for the FMC controller (BMC firmware) are well defined for each Aspeed machine and are all smaller than the default mapping window size, at least for CE0 which is the chip the SoC boots from. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486648058-520-3-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10aspeed: check for negative values returned by blk_getlength()Cédric Le Goater1-2/+12
write_boot_rom() does not check for negative values. This is more a problem for coverity than the actual code as the size of the flash device is checked when the m25p80 object is created. If there is anything wrong with the backing file, we should not even reach that path. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1486648058-520-2-git-send-email-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10hw/arm/virt: Declare fwcfg as dma cache coherent in dtAlexander Graf1-0/+1
Fw-cfg recently learned how to directly access guest memory and does so in cache coherent fashion. Tell the guest about that fact when it's using DT. Signed-off-by: Alexander Graf <agraf@suse.de> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org> Message-id: 1486644810-33181-5-git-send-email-agraf@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10hw/arm/virt: Declare fwcfg as dma cache coherent in ACPIAlexander Graf1-0/+1
Fw-cfg recently learned how to directly access guest memory and does so in cache coherent fashion. Tell the guest about that fact when it's using ACPI. Signed-off-by: Alexander Graf <agraf@suse.de> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org> Message-id: 1486644810-33181-4-git-send-email-agraf@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10hw/arm/virt: Declare virtio-mmio as dma cache coherent in ACPIAlexander Graf1-0/+1
Virtio-mmio devices can directly access guest memory and do so in cache coherent fashion. Tell the guest about that fact when it's using ACPI. Signed-off-by: Alexander Graf <agraf@suse.de> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org> Message-id: 1486644810-33181-3-git-send-email-agraf@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10target-arm: Declare virtio-mmio as dma-coherent in dtAlexander Graf2-0/+2
QEMU emulated hardware is always dma coherent with its guest. We do annotate that correctly on the PCI host controller, but left out virtio-mmio. Recent kernels have started to interpret that flag rather than take dma coherency as granted with virtio-mmio. While that is considered a kernel bug, as it breaks previously working systems, it showed that our dt description is incomplete. This patch adds the respective marker that allows guest OSs to evaluate that our virtio-mmio devices are indeed cache coherent. Signed-off-by: Alexander Graf <agraf@suse.de> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Message-id: 1486644810-33181-2-git-send-email-agraf@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10target-arm: Enable vPMU support under TCG modeWei Huang3-8/+3
This patch contains several fixes to enable vPMU under TCG mode. It first removes the checking of kvm_enabled() while unsetting ARM_FEATURE_PMU. With it, the .pmu option can be used to turn on/off vPMU under TCG mode. Secondly the PMU node of DT table is now created under TCG. The last fix is to disable the masking of PMUver field of ID_AA64DFR0_EL1. Signed-off-by: Wei Huang <wei@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1486504171-26807-5-git-send-email-wei@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10target-arm: Add support for PMU register PMINTENSET_EL1Wei Huang2-2/+10
This patch adds access support for PMINTENSET_EL1. Signed-off-by: Wei Huang <wei@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1486504171-26807-4-git-send-email-wei@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10target-arm: Add support for AArch64 PMU register PMXEVTYPER_EL0Wei Huang2-6/+25
In order to support Linux perf, which uses PMXEVTYPER register, this patch adds read/write access support for PMXEVTYPER. The access is CONSTRAINED UNPREDICTABLE when PMSELR is not 0x1f. Additionally this patch adds support for PMXEVTYPER_EL0. Signed-off-by: Wei Huang <wei@redhat.com> Message-id: 1486504171-26807-3-git-send-email-wei@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10target-arm: Add support for PMU register PMSELR_EL0Wei Huang2-6/+22
This patch adds support for AArch64 register PMSELR_EL0. The existing PMSELR definition is revised accordingly. Signed-off-by: Wei Huang <wei@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: Moved #ifndef CONFIG_USER_ONLY to cover new regdefs] Message-id: 1486504171-26807-2-git-send-email-wei@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10ahci: advertise HOST_CAP_64Ladi Prosek1-1/+1
The AHCI emulation code supports 64-bit addressing and should advertise this fact in the Host Capabilities register. Both Linux and Windows drivers test this bit to decide if the upper 32 bits of various registers may be written to, and at least some versions of Windows have a bug where DMA is attempted with an address above 4GB but, in the absence of HOST_CAP_64, the upper 32 bits are left unititialized which leads to a memory corruption. [Maintainer edit: This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1411105, which affects Windows Server 2008 SP2 in some cases.] Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1484305370-6220-1-git-send-email-lprosek@redhat.com [Amended commit message --js] Signed-off-by: John Snow <jsnow@redhat.com>
2017-02-10Revert "cirrus: allow zero source pitch in pattern fill rops"Gerd Hoffmann1-18/+8
This reverts commit 5858dd1801883309bdd208d72ddb81c4e9fee30c. Conflicts: hw/display/cirrus_vga.c Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1486645341-5010-2-git-send-email-kraxel@redhat.com
2017-02-10cirrus: fix patterncopy checksGerd Hoffmann1-6/+30
The blit_region_is_unsafe checks don't work correctly for the patterncopy source. It's a fixed-sized region, which doesn't depend on cirrus_blt_{width,height}. So go do the check in cirrus_bitblt_common_patterncopy instead, then tell blit_is_unsafe that it doesn't need to verify the source. Also handle the case where we blit from cirrus_bitbuf correctly. This patch replaces 5858dd1801883309bdd208d72ddb81c4e9fee30c. Security impact: I think for the most part error on the safe side this time, refusing blits which should have been allowed. Only exception is placing the blit source at the end of the video ram, so cirrus_blt_srcaddr + 256 goes beyond the end of video memory. But even in that case I'm not fully sure this actually allows read access to host memory. To trick the commit 5858dd18 security checks one has to pick very small cirrus_blt_{width,height} values, which in turn implies only a fraction of the blit source will actually be used. Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1486645341-5010-1-git-send-email-kraxel@redhat.com
2017-02-10cirrus: replace debug printf with trace pointsGerd Hoffmann2-6/+11
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486561893-26470-2-git-send-email-kraxel@redhat.com
2017-02-10vga: replace debug printf with trace pointsGerd Hoffmann2-23/+10
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486561893-26470-1-git-send-email-kraxel@redhat.com
2017-02-10virtio-gpu: fix resource leak in virgl_cmd_resource_unrefGerd Hoffmann1-0/+8
When the guest sends VIRTIO_GPU_CMD_RESOURCE_UNREF without detaching the backing storage beforehand (VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING) we'll leak memory. This patch fixes it for 3d mode, simliar to the 2d mode fix in commit "b8e2392 virtio-gpu: call cleanup mapping function in resource destroy". Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485167210-4757-1-git-send-email-kraxel@redhat.com
2017-02-10virtio-gpu: fix memory leak in set scanoutLi Qiang1-0/+1
In virtio_gpu_set_scanout function, when creating the 'rect' its refcount is set to 2, by pixman_image_create_bits and qemu_create_displaysurface_pixman function. This can lead a memory leak issues. This patch avoid this issue. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 5884626f.5b2f6b0a.1bfff.3037@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-10tests/prom-env: Ease time-out problems on slow hostsThomas Huth1-4/+9
Peter Maydell recently ran into time-out problems with the prom-env test on a rather slow ARM board. To tackle this issue, we can speed up the test by running QEMU with "-nodefaults" for the pseries machine, so that SLOF has less devices to scan during boot, and by using the "nvramrc" environment variable instead of "boot-command", since this variable is evaluated earlier in the boot process. And to be really sure that we do not face such time out problems again, let's also increase the time out value from 100s to 120s instead. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1486739699-1076-1-git-send-email-thuth@redhat.com Tested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-10.travis.yml: split VM based buildsAlex Bennée1-4/+34
The Trusty based builds run a little slower than the main container based ones. This is also true for the latest version of Clang. The builds are getting very close (and occasionally run over) the 50 minute timeout. Rather than partitioning by target I just split them into linux-user and system builds. Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-10.travis.yml: don't specify CONFIG twiceAlex Bennée1-2/+1
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-09ui: add ability to specify multiple VNC listen addressesDaniel P. Berrange1-62/+133
This change allows the listen address and websocket address options for -vnc to be repeated. This causes the VNC server to listen on multiple addresses. e.g. $ $QEMU -vnc vnc=localhost:1,vnc=unix:/tmp/vnc,\ websocket=127.0.0.1:8080,websocket=[::]:8081 results in listening on 127.0.0.1:5901, 127.0.0.1:8080, ::1:5901, :::8081 & /tmp/vnc Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20170203120649.15637-9-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-09util: add iterators for QemuOpts valuesDaniel P. Berrange2-0/+28
To iterate over all QemuOpts currently requires using a callback function which is inconvenient for control flow. Add support for using iterator functions more directly QemuOptsIter iter; QemuOpt *opt; qemu_opts_iter_init(&iter, opts, "repeated-key"); while ((opt = qemu_opts_iter_next(&iter)) != NULL) { ....do something... } Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20170203120649.15637-8-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-09ui: let VNC server listen on all resolved IP addressesDaniel P. Berrange1-9/+43
Remove the limitation that the VNC server can only listen on a single resolved IP address. This uses the new DNS resolver API to resolve a SocketAddress struct into an array of SocketAddress structs containing raw IP addresses. The VNC server will then attempt to listen on all resolved IP addresses. The server must successfully listen on at least one of the resolved IP addresses, otherwise an error will be reported. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20170203120649.15637-7-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-09ui: extract code to connect/listen from vnc_display_openDaniel P. Berrange1-42/+80
The code which takes a SocketAddress and connects/listens on the network is going to get more complicated to deal with multiple listeners. Pull it out into a separate method to avoid making the vnc_display_open method even more complex. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20170203120649.15637-6-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-09ui: refactor code for populating SocketAddress from vnc_display_openDaniel P. Berrange2-105/+189
The code which interprets the CLI args to populate the SocketAddress objects for plain & websockets VNC is quite complex already and will need further enhancements shortly. Refactor it into separate methods to avoid vnc_display_open getting even larger. As a side effect of the refactoring, it is now possible to specify a listen address for the websocket server explicitly. e.g, -vnc localhost:5900,websockets=0.0.0.0:8080 will listen on localhost for the plain VNC server, but expose the websockets VNC server on the public interface. This refactoring also removes the restriction that prevents enabling websockets when the plain VNC server is listening on a UNIX socket. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20170203120649.15637-5-berrange@redhat.com [ kraxel: squashed clang build fix ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>