parallels: Sanity check for s->tracks (CVE-2014-0142)

This avoids a possible division by zero.

Convert s->tracks to unsigned as well because it feels better than
surviving just because the results of calculations with s->tracks are
converted to unsigned anyway.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

parallels: Fix catalog size integer overflow (CVE-2014-0143)

The first test case would cause a huge memory allocation, leading to a
qemu abort; the second one to a too small malloc() for the catalog
(smaller than s->catalog_size), which causes a read-only out-of-bounds
array access and on big endian hosts an endianess conversion for an
undefined memory area.

The sample image used here is not an original Parallels image. It was
created using an hexeditor on the basis of the struct that qemu uses.
Good enough for trying to crash the driver, but not for ensuring
compatibility.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Limit snapshot table size

Even with a limit of 64k snapshots, each snapshot could have a filename
and an ID with up to 64k, which would still lead to pretty large
allocations, which could potentially lead to qemu aborting. Limit the
total size of the snapshot table to an average of 1k per entry when
the limit of 64k snapshots is fully used. This should be plenty for any
reasonable user.

This also fixes potential integer overflows of s->snapshot_size.

Suggested-by: Max Reitz <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Check maximum L1 size in qcow2_snapshot_load_tmp() (CVE-2014-0143)

This avoids an unbounded allocation.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Fix L1 allocation size in qcow2_snapshot_load_tmp() (CVE-2014-0145)

For the L1 table to loaded for an internal snapshot, the code allocated
only enough memory to hold the currently active L1 table. If the
snapshot's L1 table is actually larger than the current one, this leads
to a buffer overflow.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Fix NULL dereference in qcow2_open() error path (CVE-2014-0146)

The qcow2 code assumes that s->snapshots is non-NULL if s->nb_snapshots
!= 0. By having the initialisation of both fields separated in
qcow2_open(), any error occuring in between would cause the error path
to dereference NULL in qcow2_free_snapshots() if the image had any
snapshots.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Fix copy_sectors() with VM state

bs->total_sectors is not the highest possible sector number that could
be involved in a copy on write operation: VM state is after the end of
the virtual disk. This resulted in wrong values for the number of
sectors to be copied (n).

The code that checks for the end of the image isn't required any more
because the code hasn't been calling the block layer's bdrv_read() for a
long time; instead, it directly calls qcow2_readv(), which doesn't error
out on VM state sector numbers.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

block: Limit request size (CVE-2014-0143)

Limiting the size of a single request to INT_MAX not only fixes a
direct integer overflow in bdrv_check_request() (which would only
trigger bad behaviour with ridiculously huge images, as in close to
2^64 bytes), but can also prevent overflows in all block drivers.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

block: vdi bounds check qemu-io tests

This test checks for proper bounds checking of some VDI input
headers.  The following is checked:

1. Max image size (1024TB) with the appropriate Blocks In Image
   value (0x3fffffff) is detected as valid.

2. Image size exceeding max (1024TB) is seen as invalid

3. Valid image size but with Blocks In Image value that is too
   small fails

4. Blocks In Image size exceeding max (0x3fffffff) is seen as invalid

5. 64MB image, with 64 Blocks In Image, and 1MB Block Size is seen
   as valid

6. Block Size < 1MB not supported

7. Block Size > 1MB not supported

[Max Reitz <[email protected]> pointed out that "1MB + 1" in the test
case is wrong.  Change to "1MB + 64KB" to match the 0x110000 value.
--Stefan]

Signed-off-by: Jeff Cody <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

dmg: prevent chunk buffer overflow (CVE-2014-0145)

Both compressed and uncompressed I/O is buffered.  dmg_open() calculates
the maximum buffer size needed from the metadata in the image file.

There is currently a buffer overflow since ->lengths[] is accounted
against the maximum compressed buffer size but actually uses the
uncompressed buffer:

  switch (s->types[chunk]) {
  case 1: /* copy */
      ret = bdrv_pread(bs->file, s->offsets[chunk],
                       s->uncompressed_chunk, s->lengths[chunk]);

We must account against the maximum uncompressed buffer size for type=1
chunks.

This patch fixes the maximum buffer size calculation to take into
account the chunk type.  It is critical that we update the correct
maximum since there are two buffers ->compressed_chunk and
->uncompressed_chunk.

Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

dmg: use uint64_t consistently for sectors and lengths

The DMG metadata is stored as uint64_t, so use the same type for
sector_num.  int was a particularly poor choice since it is only 32-bit
and would truncate large values.

Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

dmg: sanitize chunk length and sectorcount (CVE-2014-0145)

Chunk length and sectorcount are used for decompression buffers as well
as the bdrv_pread() count argument.  Ensure that they have reasonable
values so neither memory allocation nor conversion from uint64_t to int
will cause problems.

Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

dmg: use appropriate types when reading chunks

Use the right types instead of signed int:

  size_t new_size;

  This is a byte count for g_realloc() that is calculated from uint32_t
  and size_t values.

  uint32_t chunk_count;

  Use the same type as s->n_chunks, which is used together with
  chunk_count.

This patch is a cleanup and does not fix bugs.

Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

dmg: drop broken bdrv_pread() loop

It is not necessary to check errno for EINTR and the block layer does
not produce short reads.  Therefore we can drop the loop that attempts
to read a compressed chunk.

The loop is buggy because it incorrectly adds the transferred bytes
twice:

  do {
      ret = bdrv_pread(...);
      i += ret;
  } while (ret >= 0 && ret + i < s->lengths[chunk]);

Luckily we can drop the loop completely and perform a single
bdrv_pread().

Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

dmg: prevent out-of-bounds array access on terminator

When a terminator is reached the base for offsets and sectors is stored.
The following records that are processed will use this base value.

If the first record we encounter is a terminator, then calculating the
base values would result in out-of-bounds array accesses.  Don't do
that.

Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

dmg: coding style and indentation cleanup

Clean up the mix of tabs and spaces, as well as the coding style
violations in block/dmg.c.  There are no semantic changes since this
patch simply reformats the code.

This patch is necessary before we can make meaningful changes to this
file, due to the inconsistent formatting and confusing indentation.

Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Fix new L1 table size check (CVE-2014-0143)

The size in bytes is assigned to an int later, so check that instead of
the number of entries.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Protect against some integer overflows in bdrv_check

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Fix types in qcow2_alloc_clusters and alloc_clusters_noref

In order to avoid integer overflows.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Check new refcount table size on growth

If the size becomes larger than what qcow2_open() would accept, fail the
growing operation.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Avoid integer overflow in get_refcount (CVE-2014-0143)

This ensures that the checks catch all invalid cluster indexes
instead of returning the refcount of a wrong cluster.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Don't rely on free_cluster_index in alloc_refcount_block() (CVE-2014-0147)

free_cluster_index is only correct if update_refcount() was called from
an allocation function, and even there it's brittle because it's used to
protect unfinished allocations which still have a refcount of 0 - if it
moves in the wrong place, the unfinished allocation can be corrupted.

So not using it any more seems to be a good idea. Instead, use the
first requested cluster to do the calculations. Return -EAGAIN if
unfinished allocations could become invalid and let the caller restart
its search for some free clusters.

The context of creating a snapsnot is one situation where
update_refcount() is called outside of a cluster allocation. For this
case, the change fixes a buffer overflow if a cluster is referenced in
an L2 table that cannot be represented by an existing refcount block.
(new_table[refcount_table_index] was out of bounds)

[Bump the qemu-iotests 026 refblock_alloc.write leak count from 10 to
11.
--Stefan]

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Fix backing file name length check

len could become negative and would pass the check then. Nothing bad
happened because bdrv_pread() happens to return an error for negative
length values, but make variables for sizes unsigned anyway.

This patch also changes the behaviour to error out on invalid lengths
instead of silently truncating it to 1023.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Validate active L1 table offset and size (CVE-2014-0144)

This avoids an unbounded allocation.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Validate snapshot table offset/size (CVE-2014-0144)

This avoid unbounded memory allocation and fixes a potential buffer
overflow on 32 bit hosts.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Validate refcount table offset

The end of the refcount table must not exceed INT64_MAX so that integer
overflows are avoided.

Also check for misaligned refcount table. Such images are invalid and
probably the result of data corruption. Error out to avoid further
corruption.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Check refcount table size (CVE-2014-0144)

Limit the in-memory reference count table size to 8 MB, it's enough in
practice. This fixes an unbounded allocation as well as a buffer
overflow in qcow2_refcount_init().

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Check backing_file_offset (CVE-2014-0144)

Header, header extension and the backing file name must all be stored in
the first cluster. Setting the backing file to a much higher value
allowed header extensions to become much bigger than we want them to be
(unbounded allocation).

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: Check header_length (CVE-2014-0144)

This fixes an unbounded allocation for s->unknown_header_fields.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

curl: check data size before memcpy to local buffer. (CVE-2014-0144)

curl_read_cb is callback function for libcurl when data arrives. The
data size passed in here is not guaranteed to be within the range of
request we submitted, so we may overflow the guest IO buffer. Check the
real size we have before memcpy to buffer to avoid overflow.

Signed-off-by: Fam Zheng <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

vhdx: Bounds checking for block_size and logical_sector_size (CVE-2014-0148)

Other variables (e.g. sectors_per_block) are calculated using these
variables, and if not range-checked illegal values could be obtained
causing infinite loops and other potential issues when calculating
BAT entries.

The 1.00 VHDX spec requires BlockSize to be min 1MB, max 256MB.
LogicalSectorSize is required to be either 512 or 4096 bytes.

Reported-by: Kevin Wolf <[email protected]>
Signed-off-by: Jeff Cody <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

vdi: add bounds checks for blocks_in_image and disk_size header fields (CVE-2014-0144)

The maximum blocks_in_image is 0xffffffff / 4, which also limits the
maximum disk_size for a VDI image to 1024TB.  Note that this is the maximum
size that QEMU will currently support with this driver, not necessarily the
maximum size allowed by the image format.

This also fixes an incorrect error message, a bug introduced by commit
5b7aa9b56d1bfc79916262f380c3fc7961becb50 (Reported by Stefan Weil)

Signed-off-by: Jeff Cody <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

vpc: Validate block size (CVE-2014-0142)

This fixes some cases of division by zero crashes.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

vpc/vhd: add bounds check for max_table_entries and block_size (CVE-2014-0144)

This adds checks to make sure that max_table_entries and block_size
are in sane ranges.  Memory is allocated based on max_table_entries,
and block_size is used to calculate indices into that allocated
memory, so if these values are incorrect that can lead to potential
unbounded memory allocation, or invalid memory accesses.

Also, the allocation of the pagetable is changed from g_malloc0()
to qemu_blockalign().

Signed-off-by: Jeff Cody <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

bochs: Fix bitmap offset calculation

32 bit truncation could let us access the wrong offset in the image.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

bochs: Check extent_size header field (CVE-2014-0142)

This fixes two possible division by zero crashes: In bochs_open() and in
seek_to_sector().

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

bochs: Check catalog_size header field (CVE-2014-0143)

It should neither become negative nor allow unbounded memory
allocations. This fixes aborts in g_malloc() and an s->catalog_bitmap
buffer overflow on big endian hosts.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

bochs: Use unsigned variables for offsets and sizes (CVE-2014-0147)

Gets us rid of integer overflows resulting in negative sizes which
aren't correctly checked.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

bochs: Unify header structs and make them QEMU_PACKED

This is an on-disk structure, so offsets must be accurate.

Before this patch, sizeof(bochs) != sizeof(header_v1), which makes the
memcpy() between both invalid. We're lucky enough that the destination
buffer happened to be the larger one, and the memcpy size to be taken
from the smaller one, so we didn't get a buffer overflow in practice.

This patch unifies the both structures, eliminating the need to do a
memcpy in the first place. The common fields are extracted to the top
level of the struct and the actually differing part gets a union of the
two versions.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qemu-iotests: Support for bochs format

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

block/cloop: fix offsets[] size off-by-one

cloop stores the number of compressed blocks in the n_blocks header
field.  The file actually contains n_blocks + 1 offsets, where the extra
offset is the end-of-file offset.

The following line in cloop_read_block() results in an out-of-bounds
offsets[] access:

    uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num];

This patch allocates and loads the extra offset so that
cloop_read_block() works correctly when the last block is accessed.

Notice that we must free s->offsets[] unconditionally now since there is
always an end-of-file offset.

Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

block/cloop: refuse images with bogus offsets (CVE-2014-0144)

The offsets[] array allows efficient seeking and tells us the maximum
compressed data size.  If the offsets are bogus the maximum compressed
data size will be unrealistic.

This could cause g_malloc() to abort and bogus offsets mean the image is
broken anyway.  Therefore we should refuse such images.

Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

block/cloop: refuse images with huge offsets arrays (CVE-2014-0144)

Limit offsets_size to 512 MB so that:

1. g_malloc() does not abort due to an unreasonable size argument.

2. offsets_size does not overflow the bdrv_pread() int size argument.

This limit imposes a maximum image size of 16 TB at 256 KB block size.

Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

block/cloop: prevent offsets_size integer overflow (CVE-2014-0143)

The following integer overflow in offsets_size can lead to out-of-bounds
memory stores when n_blocks has a huge value:

    uint32_t n_blocks, offsets_size;
    [...]
    ret = bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4);
    [...]
    s->n_blocks = be32_to_cpu(s->n_blocks);

    /* read offsets */
    offsets_size = s->n_blocks * sizeof(uint64_t);
    s->offsets = g_malloc(offsets_size);

    [...]

    for(i=0;i<s->n_blocks;i++) {
        s->offsets[i] = be64_to_cpu(s->offsets[i]);

offsets_size can be smaller than n_blocks due to integer overflow.
Therefore s->offsets[] is too small when the for loop byteswaps offsets.

This patch refuses to open files if offsets_size would overflow.

Note that changing the type of offsets_size is not a fix since 32-bit
hosts still only have 32-bit size_t.

Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

block/cloop: validate block_size header field (CVE-2014-0144)

Avoid unbounded s->uncompressed_block memory allocation by checking that
the block_size header field has a reasonable value.  Also enforce the
assumption that the value is a non-zero multiple of 512.

These constraints conform to cloop 2.639's code so we accept existing
image files.

Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qemu-iotests: add cloop input validation tests

Add a cloop format-specific test case.  Later patches add tests for
input validation to the script.

Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qemu-iotests: add ./check -cloop support

Add the cloop block driver to qemu-iotests.

Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qcow2: fix two memory leaks in qcow2_open error code path

Signed-off-by: Prasad Joshi <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

vvfat: Fix :floppy: option to suppress partition table

Regressed in commit 7ad9be6, v1.5.0.

Reported-by: Kiyokazu SUTO <[email protected]>
Signed-off-by: Markus Armbruster <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

qemu-img: Release reference to BlockDriverState

Signed-off-by: Prasad Joshi <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

configure: add option to disable -fstack-protector flags

The -fstack-protector flag family is useful for ensuring safety and for
debugging, but has a performance impact. Here are some boot time comparisons of
the various versions of -fstack-protector using qemu-system-arm on an x86_64
host:

    # -fstack-protector-all
    Startup finished in 1.810s (kernel) + 12.331s (initrd) + 49.016s (userspace) = 1min 3.159s
    Startup finished in 1.801s (kernel) + 12.287s (initrd) + 47.925s (userspace) = 1min 2.013s
    Startup finished in 1.812s (kernel) + 12.302s (initrd) + 47.995s (userspace) = 1min 2.111s

    # -fstack-protector-strong
    Startup finished in 1.744s (kernel) + 11.223s (initrd) + 44.688s (userspace) = 57.657s
    Startup finished in 1.721s (kernel) + 11.222s (initrd) + 44.194s (userspace) = 57.138s
    Startup finished in 1.693s (kernel) + 11.250s (initrd) + 44.426s (userspace) = 57.370s

    # -fstack-protector
    Startup finished in 1.705s (kernel) + 11.409s (initrd) + 43.563s (userspace) = 56.677s
    Startup finished in 1.877s (kernel) + 11.137s (initrd) + 43.719s (userspace) = 56.734s
    Startup finished in 1.708s (kernel) + 11.141s (initrd) + 43.628s (userspace) = 56.478s

    # no stack protector
    Startup finished in 1.743s (kernel) + 11.190s (initrd) + 43.709s (userspace) = 56.643s
    Startup finished in 1.763s (kernel) + 11.216s (initrd) + 43.767s (userspace) = 56.747s
    Startup finished in 1.711s (kernel) + 11.283s (initrd) + 43.878s (userspace) = 56.873s

This patch introduces a configure option to disable the stack protector
entirely, and conditional stack protector flag selection (in order,
based on availability): -fstack-protector-strong, -fstack-protector-all,
no stack protector.

Signed-off-by: Steven Noonan <[email protected]>
Cc: Anthony Liguori <[email protected]>
Reviewed-by: Stefan Weil <[email protected]>
[Prefer -fstack-protector-all to -fstack-protector, suggested by
 Laurent Desnogues. - Paolo]
Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>

pci: Fix clearing IRQs on reset

irq_state is cleared before calling pci_device_deassert_intx, but the
latter misbehaves if the former isn't accurate. In this case, any raised
IRQs are not cleared, which hits an assertion in pcibus_reset:

qemu-system-x86_64: hw/pci/pci.c:250: pcibus_reset: Assertion
`bus->irq_count[i] == 0' failed.

pci_device_deassert_intx should clear irq_state anyways, so add
an assert.

This fixes migration with usb2 + usb-tablet.

Signed-off-by: Cole Robinson <[email protected]>
Message-id: 7da1ad94ce027183b4049c2de370cb191b0073c1.1396290569[email protected]
Reviewed-by: Paolo Bonzini <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>

Merge remote-tracking branch 'remotes/afaerber/tags/qom-cpu-for-2.0' into staging

QOM CPUState refactorings / X86CPU

* X86CPU IA32e 1GB paging support
* Performance quickfix for CPU() cast macro

# gpg: Signature made Mon 31 Mar 2014 18:33:27 BST using RSA key ID 3E7E013F
# gpg: Good signature from "Andreas Färber <[email protected]>"
# gpg:                 aka "Andreas Färber <[email protected]>"

* remotes/afaerber/tags/qom-cpu-for-2.0:
  cpu: Avoid QOM casts for CPU()
  target-i386: x86_cpu_get_phys_page_debug(): support 1GB page translation

Signed-off-by: Peter Maydell <[email protected]>

cpu: Avoid QOM casts for CPU()

CPU address spaces touching load and store helpers as well as the
movement of (almost) all fields from CPU_COMMON to CPUState have led to
a noticeable increase of CPU() usage in "hot" paths for both TCG and KVM.

While CPU()'s OBJECT_CHECK() might help detect development errors, i.e.
in form of crashes due to QOM vs. non-QOM mismatches rather than QOM
type mismatches, it is not really needed at runtime since mostly used in
CPU-specific paths, coming from a target-specific CPU subtype. If that
pointer is damaged, other errors are highly likely to occur elsewhere
anyway.

Keep the CPU() macro for a consistent developer experience and for
flexibility to exchange its implementation, but turn it into a pure,
unchecked C cast for now.

Compare commit 6e42be7cd10260fd3a006d94f6c870692bf7a2c0.

Reported-by: Laurent Desnogues <[email protected]>
Suggested-by: Paolo Bonzini <[email protected]>
Signed-off-by: Andreas Färber <[email protected]>

target-i386: x86_cpu_get_phys_page_debug(): support 1GB page translation

Linux guests, when using more than 4GB of RAM, may end up using 1GB pages
to store (kernel) data. When this happens, we're unable to debug a running
Linux kernel with GDB:

(gdb) p node_data[0]->node_id
Cannot access memory at address 0xffff88013fffd3a0
(gdb)

GDB returns this error because x86_cpu_get_phys_page_debug() doesn't support
translating 1GB pages in IA-32e paging mode and returns an error to GDB.

This commit adds support for 1GB page translation for IA32e paging.

Signed-off-by: Luiz Capitulino <[email protected]>
Reviewed-by: Paolo Bonzini <[email protected]>
Reviewed-by: Jan Kiszka <[email protected]>
Signed-off-by: Andreas Färber <[email protected]>

make-release: Record SeaBIOS version

Before deleting .git, determine the version and save it in .version file.

Cc: Gerd Hoffmann <[email protected]>
Signed-off-by: Andreas Färber <[email protected]>
Message-id: 1395277315[email protected]
Reviewed-by: Gerd Hoffmann <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>

Merge remote-tracking branch 'remotes/rth/tcg-arm-unaligned' into staging

* remotes/rth/tcg-arm-unaligned:
  tcg-arm: Avoid ldrd/strd for user-only emulation

Signed-off-by: Peter Maydell <[email protected]>

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

acpi,pc,build bug fixes

Here are some bugfixes for 2.0.

A bugfix for acpi for pci bridges, and a build fix for
old systems without pthread_setname_np: both fix regressions
so we definitely want to include them.
HPET fix is not for a regression but looks very safe,
fixes a nasty bug and has been on list for a while.

Signed-off-by: Michael S. Tsirkin <[email protected]>
# gpg: Signature made Fri 28 Mar 2014 12:00:12 GMT using RSA key ID D28D5469
# gpg: Good signature from "Michael S. Tsirkin <[email protected]>"
# gpg:                 aka "Michael S. Tsirkin <[email protected]>"

* remotes/mst/tags/for_upstream:
  acpi: fix ACPI generation for pci bridges
  Don't enable a HPET timer if HPET is disabled
  Detect pthread_setname_np at configure time

Signed-off-by: Peter Maydell <[email protected]>

acpi: fix ACPI generation for pci bridges

Commit 8dcf525abc5dff785251a881f9764dd961065c0d
    acpi-build: append description for non-hotplug
appended description for all occupied non hotpluggable PCI slots.
However the bridge devices are already added to SSDT,
adding them again will create an incorrect SSDT table.

Fixed by skipping the pci bridge devices, marking them as 'system'.

Signed-off-by: Marcel Apfelbaum <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>

tcg-arm: Avoid ldrd/strd for user-only emulation

The arm ldrd/strd insns must cause alignment traps, whereas
at least for armv7 ldr/str must handle unaligned operations.

While this is hardly the only problem facing user-only emu,
this solves one problem for i386 on armv7 emulation.

Reviewed-by: Peter Maydell <[email protected]>
Reported-by: Huw Davies <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

Merge remote-tracking branch 'remotes/afaerber/tags/ppc-for-2.0' into staging

PowerPC queue for 2.0

* OpenPIC fix
* MSR fixes for POWER7 upwards
* TCG instruction set support fix for POWER8

# gpg: Signature made Thu 27 Mar 2014 16:12:12 GMT using RSA key ID 3E7E013F
# gpg: Good signature from "Andreas Färber <[email protected]>"
# gpg:                 aka "Andreas Färber <[email protected]>"

* remotes/afaerber/tags/ppc-for-2.0:
  target-ppc: MSR_POW not supported on POWER7/7+/8
  target-ppc: POWER7+ supports the MSR_VSX bit
  target-ppc: POWER8 supports isel
  target-ppc: POWER8 supports the MSR_LE bit
  intc/openpic_kvm: Fix MemListener delete region callback function

Signed-off-by: Peter Maydell <[email protected]>

Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-03-27' into staging

trivial patches for 2014-03-27

# gpg: Signature made Thu 27 Mar 2014 15:23:53 GMT using RSA key ID 74F0C838
# gpg: Good signature from "Michael Tokarev <[email protected]>"
# gpg:                 aka "Michael Tokarev <[email protected]>"
# gpg:                 aka "Michael Tokarev <[email protected]>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D  4324 457C E0A0 8044 65C5
#      Subkey fingerprint: E190 8639 3B10 B51B AC2C  8B73 5253 C5AD 74F0 C838

* remotes/mjt/tags/trivial-patches-2014-03-27: (23 commits)
  linux-user: remove duplicate statement
  hw/timer/grlib_gptimer: remove unnecessary assignment
  hw/pci-host/apb.c: Avoid shifting left into sign bit
  hw/intc/xilinx_intc: Avoid shifting left into sign bit
  hw/intc/slavio_intctl: Avoid shifting left into sign bit
  tests/libqos/pci-pc: Avoid shifting left into sign bit
  hw/ppc: Avoid shifting left into sign bit
  hw/intc/openpic: Avoid shifting left into sign bit
  hw/usb/hcd-ohci.c: Avoid shifting left into sign bit
  target-mips: Avoid shifting left into sign bit
  hw/i386/acpi_build.c: Avoid shifting left into sign bit
  hw/pci/pci_host.c: Avoid shifting left into sign bit
  hw/intc/apic.c: Use uint32_t for mask word in foreach_apic
  target-i386: Avoid shifting left into sign bit
  CODING_STYLE: Section about mixed declarations
  doc: update default PowerPC framebuffer settings
  doc: update sun4m documentation
  fix return check for KVM_GET_DIRTY_LOG ioctl
  target-i386: Add missing 'static' and 'const' attributes
  util: Add 'static' attribute to function implementation
  ...

Signed-off-by: Peter Maydell <[email protected]>

Don't enable a HPET timer if HPET is disabled

A HPET timer can be started when HPET is not yet
enabled. This will not generate an interrupt
to the guest, but causes problems when HPET is later
enabled.

A timer that is created and expires at least once before
HPET is enabled will have an initialized comparator based
on a hpet_offset of 0 (uninitialized). When HPET is
enabled, hpet_set_timer() is called a second time, which
modifies the timer expiry to a time based on the
difference between current ticks (measured with the
newly initialized hpet_offset) and the timer's
comparator (which was generated before hpet_offset was
initialized). This results in a long period of no HPET
timer ticks.

When this occurs with a CentOS 5.x guest, the guest
may not receive timer interrupts during its narrow
timer check window and panic on boot.

Signed-off-by: Matt Lupfer <[email protected]>
Acked-by: Michael S. Tsirkin <[email protected]>
Reviewed-by: Paolo Bonzini <[email protected]>

Detect pthread_setname_np at configure time

Warn if no way of setting thread name is available.

Signed-off-by: Dr. David Alan Gilbert <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20140327' into staging

target-arm queue:
 * Don't default to integratorcp board if no machine specified

# gpg: Signature made Thu 27 Mar 2014 14:09:12 GMT using RSA key ID 14360CDE
# gpg: Good signature from "Peter Maydell <[email protected]>"

* remotes/pmaydell/tags/pull-target-arm-20140327:
  vl.c: Improve message when no default machine is found
  hw/arm: Stop specifying integratorcp as the default board

Signed-off-by: Peter Maydell <[email protected]>

linux-user: remove duplicate statement

Signed-off-by: Prasad Joshi <[email protected]>
Acked-by: Riku Voipio <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

hw/timer/grlib_gptimer: remove unnecessary assignment

Signed-off-by: Prasad Joshi <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

hw/pci-host/apb.c: Avoid shifting left into sign bit

Add U suffix to avoid undefined behaviour.

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

hw/intc/xilinx_intc: Avoid shifting left into sign bit

Avoid undefined behaviour shifting left into the sign bit.

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

hw/intc/slavio_intctl: Avoid shifting left into sign bit

Add 'U' suffix to avoid undefined behaviour.

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

tests/libqos/pci-pc: Avoid shifting left into sign bit

Add U suffix when doing "1 << 31" to avoid undefined behaviour.

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

hw/ppc: Avoid shifting left into sign bit

Add U suffix to various places where we were doing "1 << 31",
which is undefined behaviour, and also to other constant
definitions in the same groups, for consistency.

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

hw/intc/openpic: Avoid shifting left into sign bit

Add U suffix to avoid undefined behaviour. This is only strictly
necessary for the 1 << 31 cases; for consistency we extend it
to other constants in the same group.

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

hw/usb/hcd-ohci.c: Avoid shifting left into sign bit

Add U suffix to avoid undefined behaviour. This is only
strictly necessary for the 1<<31 cases, but we add it for the
other constants in these groups for consistency.

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

target-mips: Avoid shifting left into sign bit

Add U suffix to various places where we shift a 1 left by 31,
to avoid undefined behaviour.

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

hw/i386/acpi_build.c: Avoid shifting left into sign bit

Add U suffix to avoid undefined behaviour.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

hw/pci/pci_host.c: Avoid shifting left into sign bit

Add U suffix to avoid undefined behaviour.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

hw/intc/apic.c: Use uint32_t for mask word in foreach_apic

Use unsigned arithmetic for operations on the mask word
in the foreach_apic() macro, to avoid relying on undefined
behaviour when shifting into the sign bit.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Stefan Weil <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

target-i386: Avoid shifting left into sign bit

Add 'U' suffixes where necessary to avoid (1 << 31) which
shifts left into the sign bit, which is undefined behaviour.
Add the suffix also for other constants in the same groupings
even if they don't shift into bit 31, for consistency.

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

CODING_STYLE: Section about mixed declarations

We had an unwritten rule about declarations having to be at beginning of
blocks. Make it a written rule.

Signed-off-by: Eduardo Habkost <[email protected]>
Reviewed-by: Stefan Weil <[email protected]>
Reviewed-by: Markus Armbruster <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

doc: update default PowerPC framebuffer settings

Since 1.7, the default framebuffer settings for PowerPC are 800x600x32.

Signed-off-by: Mark Cave-Ayland <[email protected]>
CC: [email protected]
Signed-off-by: Michael Tokarev <[email protected]>

doc: update sun4m documentation

A few minor tidy-ups, plus add reference to the new -vga tcx and cg3 options.

Signed-off-by: Mark Cave-Ayland <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

fix return check for KVM_GET_DIRTY_LOG ioctl

Fix return condition check from kvm_vm_ioctl(s, KVM_GET_DIRTY_LOG, &d) to
handle internal failures or no support for memory slot dirty bitmap.
Otherwise the ioctl succeeds and continues with migration.
Addresses BUG# 1294227

Signed-off-by: Mario Smarduch <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

target-i386: Add missing 'static' and 'const' attributes

This fixes warnings from the static code analysis (smatch).

Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

util: Add 'static' attribute to function implementation

The static code analyzer smatch complains because of a missing 'static'
attribute:

util/module.c:166:6: warning:
 symbol 'module_load' was not declared. Should it be static?

'static' is used in the forward declaration, but not in the implementation.
Add it there, too.

Signed-off-by: Stefan Weil <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

hw/ide: Add missing 'static' attributes

This fixes a warning from the static code analysis (smatch).

Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

target-arm: Add missing 'static' attribute

This fixes a warning from the static code analysis (smatch).

Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

target-s390x: Add missing 'static' and 'const' attributes

This fixes warnings from the static code analysis (smatch).

Signed-off-by: Stefan Weil <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

target-ppc: MSR_POW not supported on POWER7/7+/8

Remove MSR_POW from the msr_mask for POWER7/7P/8.

Signed-off-by: Anton Blanchard <[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Tested-by: Cédric Le Goater <[email protected]>
Signed-off-by: Andreas Färber <[email protected]>

target-ppc: POWER7+ supports the MSR_VSX bit

Without MSR_VSX we die early during a Linux boot.

Signed-off-by: Anton Blanchard <[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Tested-by: Cédric Le Goater <[email protected]>
Signed-off-by: Andreas Färber <[email protected]>

target-ppc: POWER8 supports isel

Add PPC_ISEL to insns_flags.

Signed-off-by: Anton Blanchard <[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Tested-by: Cédric Le Goater <[email protected]>
Signed-off-by: Andreas Färber <[email protected]>

target-ppc: POWER8 supports the MSR_LE bit

Add MSR_LE to the msr_mask for POWER8.

Signed-off-by: Anton Blanchard <[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Tested-by: Cédric Le Goater <[email protected]>
Signed-off-by: Andreas Färber <[email protected]>

intc/openpic_kvm: Fix MemListener delete region callback function

Fixes d85937e683f6ff4d68293cb24c780fb1f6820d2c.

Signed-off-by: Prasad Joshi <[email protected]>
Signed-off-by: Andreas Färber <[email protected]>

Merge remote-tracking branch 'remotes/amit-migration/tags/for_upstream' into staging

migration: traces

Adds trace messages to migration path.  Patches have been on list for a
while, and have been reviewed by Juan.

# gpg: Signature made Thu 27 Mar 2014 10:44:21 GMT using RSA key ID 854083B6
# gpg: Can't check signature: public key not found

* remotes/amit-migration/tags/for_upstream:
  migration: add more traces
  util: add qemu_ether_ntoa

Signed-off-by: Peter Maydell <[email protected]>

vl.c: Improve message when no default machine is found

Improve the clarity of the message QEMU prints when the user
doesn't specify a machine model to use and there is no default.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Paolo Bonzini <[email protected]>
Reviewed-by: Marcel Apfelbaum <[email protected]>

hw/arm: Stop specifying integratorcp as the default board

Currently for both qemu-system-arm and qemu-system-aarch64
the default board model if the user doesn't specify one
is the 'integratorcp'. This is a totally arbitrary historical
accident since it was the first board to be modelled.
That board is now just one target among many for us, and
is a very poor choice of default:
 * it's an ancient board that is now only found in the
   junkpiles of longtime ARM/Linux hackers, if at all
 * it's an ARMv5 CPU, when most distros are now assuming
   ARMv7
 * it's pretty much unmaintained in QEMU
 * it doesn't even have versatilepb's advantage of
   supporting PCI

Making it or any other board the default serves only
to confuse people new to ARM who expect something more
like the x86 monoculture. Remove the is_default marker
from integratorcp, and don't set it for any other board,
to give users a nudge that they need to think about
which board they want a QEMU model of. (QEMU will produce
the admittedly slightly cryptic error "No machine found.")

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Paolo Bonzini <[email protected]>

Merge remote-tracking branch 'remotes/mcayland/qemu-sparc' into staging

* remotes/mcayland/qemu-sparc:
  target-sparc: fix 32bit integer division overflow

Signed-off-by: Peter Maydell <[email protected]>

migration: add more traces

This replaces DPRINTF macro with tracepoints.

This moves some messages from migration.c to savevm.c.

This adds tracepoint to signal about fileds failed to migrate.

Signed-off-by: Alexey Kardashevskiy <[email protected]>
Reviewed-by: Juan Quintela <[email protected]>
Signed-off-by: Amit Shah <[email protected]>

util: add qemu_ether_ntoa

This adds a helper to format ethernet MAC address.

Signed-off-by: Alexey Kardashevskiy <[email protected]>
Reviewed-by: Juan Quintela <[email protected]>
Signed-off-by: Amit Shah <[email protected]>

target-sparc: fix 32bit integer division overflow

The signed integer division -0x8000_0000_0000_0000 / -1 must be handled
separately to avoid an overflow on the QEMU host.

Negative overflow must be a negative number for correct sign
extension in Sparc64 mode. Use <stdint.h> constants.

Signed-off-by: Olivier Danet <[email protected]>
Signed-off-by: Mark Cave-Ayland <[email protected]>