aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-09-14qemu-char: avoid segfault if user lacks of permisson of a given logfileLin Ma
Function qemu_chr_alloc returns NULL if it failed to open logfile by any reason, says no write permission. For backends tty, stdio and msmouse, They need to check this return value to avoid segfault in this case. Signed-off-by: Lin Ma <lma@suse.com> Cc: qemu-stable <qemu-stable@nongnu.org> Message-Id: <20160914062250.22226-1-lma@suse.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14build-sys: add make 'help' targetMarc-André Lureau
Add a make 'help', to print a summary of the main Makefile targets. The format is loosely inspired by Linux make 'help' output. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20160913142033.7705-1-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14linux-user: complete omission of removing uses of strdupWei Jiangang
The 900cfbc just removed two unchecked uses of strdup in fill_psinfo and missed the rest in core_dump_filename. This patch fixes it. Signed-off-by: Wei Jiangang <weijg.fnst@cn.fujitsu.com> Message-Id: <1459997185-15669-2-git-send-email-weijg.fnst@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14target-i386: fix ordering of fields in CPUX86StatePaolo Bonzini
Make sure reset zeroes TSC_AUX, XCR0, PKRU. Move XSTATE_BV from the "vmstate only" section to the "KVM only" section. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14pc: apic: fix touch LAPIC when irqchip is splitWanpeng Li
Add -kernel_irqchip=split ./x86-run x86/eventinj.flat qemu-system-x86_64 -enable-kvm -machine kernel_irqchip=split -cpu host -device pc-testdev -device isa-debug-exit,iobase=0xf4,iosize=0x4 -vnc none -serial stdio -device pci-testdev -kernel x86/eventinj.flat enabling apic paging enabled cr0 = 80010011 cr3 = 7fff000 cr4 = 20 Sending vec 33 and 62 and mask one with TPR irq1 running irq1 running After 33/62 TPR test FAIL: TPR irq0 running irq0 running Both irq1 and irq0 are executing twice. kvm_entry: vcpu 0 kvm_exit: reason MSR_WRITE rip 0x401f33 info 0 0 kvm_apic: apic_write APIC_EOI = 0x0 kvm_eoi: apicid 0 vector 62 kvm_msr: msr_write 80b = 0x0 kvm_entry: vcpu 0 kvm_exit: reason PENDING_INTERRUPT rip 0x401f35 info 0 0 kvm_userspace_exit: reason KVM_EXIT_IRQ_WINDOW_OPEN (7) kvm_inj_virq: irq 62 kvm_entry: vcpu 0 kvm_exit: reason IO_INSTRUCTION rip 0x4016ec info 3fd0008 0 From the trace we can see there is an interrupt window exit after the first interrupt EOI(irq 62), and the same irq(62) is injected duplicately after the interrupt window. QEMU does KVM_INTERRUPT(62) ioctl after KVM exits with KVM_EXIT_IRQ_WINDOW_OPEN, which QEMU requested while the guest was printing. The printing calls serial_update_irq() -> qemu_irq_lower() -> qemu_set_irq() -> gsi_handler() -> qemu_set_irq() -> pic_irq_request() -> apic_deliver_pic_intr() -> kvm_handle_interrupt() kvm_handle_interrupt() does interrupt_request |= CPU_INTERRUPT_HARD which later calls cpu_get_pic_interrupt() in kvm_arch_pre_run(), but that function uses stale information from APIC and injects 62 again. If we synchronized the APIC, then the test would #GP, because there would be no injectable interrupt in LAPIC or PIC, so pic_read_irq() would return 15, thinking it was spurious. This patch fix it by don't touch LAPIC if LAPIC is in kernel. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Suggested-by: Radim Krčmář <rkrcmar@redhat.com> Cc: qemu-stable@nongnu.org Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Radim Krčmář <rkrcmar@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com> Message-Id: <1473832464-3478-1-git-send-email-wanpeng.li@hotmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14scsi: pvscsi: limit process IO loop to ring sizePrasad J Pandit
Vmware Paravirtual SCSI emulator while processing IO requests could run into an infinite loop if 'pvscsi_ring_pop_req_descr' always returned positive value. Limit IO loop to the ring size. Cc: qemu-stable@nongnu.org Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1473845952-30785-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14memory: remove memory_region_destructor_rom_devicePaolo Bonzini
It is equivalent to memory_region_destructor_ram, use that one. Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14Change net/socket.c to use socket_*() functionsMarc-André Lureau
Use socket_*() functions from include/qemu/sockets.h instead of listen()/bind()/connect()/parse_host_port(). socket_*() fucntions are QAPI based and this patch performs this api conversion since everything will be using QAPI based sockets in the future. Also add a helper function socket_address_to_string() in util/qemu-sockets.c which returns the string representation of socket address. The task was listed on http://wiki.qemu.org/BiteSizedTasks page. Signed-off-by: Ashijeet Acharya <ashijeetacharya@gmail.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14cutils: Rewrite x86 buffer zero checkingRichard Henderson
Handle alignment of buffers, so that the vector paths can be used more often. Signed-off-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1473800239-13841-1-git-send-email-rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14scsi: mptsas: use g_new0 to allocate MPTSASRequest objectLi Qiang
When processing IO request in mptsas, it uses g_new to allocate a 'req' object. If an error occurs before 'req->sreq' is allocated, It could lead to an OOB write in mptsas_free_request function. Use g_new0 to avoid it. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1473684251-17476-1-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14virtio-scsi: Don't abort when media is ejectedFam Zheng
With an ejected block backend, blk_get_aio_context() would return qemu_aio_context. In this case don't assert. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1473848224-24809-3-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14scsi-disk: Cleaning up around tray open stateFam Zheng
Even if tray is not open, it can be empty (blk_is_inserted() == false). Handle both cases correctly by replacing the s->tray_open checks with blk_is_available(), which is an AND of the two. Also simplify successive checks of them into blk_is_available(), in a couple cases. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1473848224-24809-2-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13cutils: Add generic prefetchRichard Henderson
There's no real knowledge of the cacheline size, just prefetching one loop ahead. Signed-off-by: Richard Henderson <rth@twiddle.net> Message-Id: <1472496380-19706-7-git-send-email-rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13cutils: Add SSE4 versionPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13cutils: Add test for buffer_is_zeroRichard Henderson
Signed-off-by: Richard Henderson <rth@twiddle.net> Message-Id: <1472496380-19706-6-git-send-email-rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13cutils: Remove ppc buffer zero checkingRichard Henderson
For ppc64le, gcc6 does extremely poorly with the Altivec code. Moreover, on POWER7 and POWER8, a hand-optimized Altivec version turns out to be no faster than the revised integer version, and therefore not worth the effort. Signed-off-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13cutils: Remove aarch64 buffer zero checkingRichard Henderson
The revised integer version is 4 times faster than the neon version on an AppliedMicro Mustang. Even with hand scheduling and additional unrolling I cannot make any neon version run as fast as the integer. Signed-off-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13cutils: Rearrange buffer_is_zero accelerationRichard Henderson
Allow selection of several acceleration functions based on the size and alignment of the buffer. Do not require ifunc support for AVX2 acceleration. Signed-off-by: Richard Henderson <rth@twiddle.net> Message-Id: <1472496380-19706-5-git-send-email-rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13cutils: Export only buffer_is_zeroRichard Henderson
Since the two users don't make use of the returned offset, beyond ensuring that the entire buffer is zero, consider the can_use_buffer_find_nonzero_offset and buffer_find_nonzero_offset functions internal. Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Richard Henderson <rth@twiddle.net> Message-Id: <1472496380-19706-4-git-send-email-rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13cutils: Remove SPLAT macroRichard Henderson
This is unused and complicates the vector interface. Signed-off-by: Richard Henderson <rth@twiddle.net> Message-Id: <1472496380-19706-3-git-send-email-rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13cutils: Move buffer_is_zero and subroutines to a new fileRichard Henderson
Signed-off-by: Richard Henderson <rth@twiddle.net> Message-Id: <1472496380-19706-2-git-send-email-rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13ppc: do not redefine CPUPPCStatePaolo Bonzini
Just include the file that is supposed to bring it in. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13x86/lapic: Load LAPIC state at post_loadDr. David Alan Gilbert
Load the LAPIC state during post_load (rather than when the CPU starts). This allows an interrupt to be delivered from the ioapic to the lapic prior to cpu loading, in particular the RTC that starts ticking as soon as we load it's state. Fixes a case where Windows hangs after migration due to RTC interrupts disappearing. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13optionrom: do not rely on compiler's bswap optimizationPaolo Bonzini
Recent compilers can detect and inline manually-written bswap code, but GCC 4.2.1 (the last GPLv2 version) cannot and generates really awful code. Depending on how the compiler is configured, it might also not want to generate bswap because it was not in i386. Using asm is fine because TCG knows about bswap and all processors with virtualization extensions also do. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13checkpatch: Fix whitespace checks for documentation code blocksLluís Vilanova
Prevent blank lines in documentation code blocks to be signalled as incorrect trailing whitespace. Code blocks in documentation are 4-column aligned, and blank lines in them should have exactly 4 columns of trailing whitespace to prevent QEMU's wiki to render them as separate code blocks. Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu> Message-Id: <147325254382.22644.5531276787733455773.stgit@fimbulvetr.bsc.es> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu>
2016-09-13atomics: Use __atomic_*_n() variant primitivesPranith Kumar
Use the __atomic_*_n() primitives which take the value as argument. It is not necessary to store the value locally before calling the primitive, hence saving us a stack store and load. Signed-off-by: Pranith Kumar <bobby.prani@gmail.com> Message-Id: <20160829171701.14025-1-bobby.prani@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13atomics: Remove redundant barrier()'sPranith Kumar
Remove the redundant barrier() after the fence as agreed in previous discussion here: https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg00489.html Signed-off-by: Pranith Kumar <bobby.prani@gmail.com> Message-Id: <20160824204424.14041-3-bobby.prani@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13kvm-all: drop kvm_setup_guest_memoryCao jin
kvm_setup_guest_memory only does "madvise to QEMU_MADV_DONTFORK" and is only called by ram_block_add, which actually is duplicate code. Bonus: add simple comment for kvm_has_sync_mmu to make life easier. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Message-Id: <1473662096-32598-1-git-send-email-caoj.fnst@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13i8257: Make device "i8257" unavailable with -deviceMarkus Armbruster
The ISA DMA controller needs to be wired up to the ISA bus by isa_bus_dma() to actually work. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1472660151-19517-1-git-send-email-armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13Revert "megasas: remove useless check for cmd->frame"Paolo Bonzini
This reverts commit 8cc46787b5b58f01a11c919c7ff939ed009e27fc. It turns out that cmd->frame can be NULL and thus the commit can cause a SIGSEGV Reported-by: Holger Schranz <holger@fam-schranz.de> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13char: convert qemu_chr_fe_write to qemu_chr_fe_write_allDaniel P. Berrange
The mux chardev was not checking the return value of any qemu_chr_fe_write() call so would silently loose data on EAGAIN. Similarly the qemu_chr_fe_printf method would not check errors and was not in a position to retry even if it could check. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1473170165-540-5-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13hw: replace most use of qemu_chr_fe_write with qemu_chr_fe_write_allDaniel P. Berrange
The qemu_chr_fe_write method will return -1 on EAGAIN if the chardev backend write would block. Almost no callers of the qemu_chr_fe_write() method check the return value, instead blindly assuming data was successfully sent. In most cases this will lead to silent data loss on interactive consoles, but in some cases (eg RNG EGD) it'll just cause corruption of the protocol being spoken. We unfortunately can't fix the virtio-console code, due to a bug in the Linux guest drivers, which would cause the entire Linux kernel to hang if we delay processing of the incoming data in any way. Fixing this requires first fixing the guest driver to not hold spinlocks while writing to the hvc device backend. Fixes bug: https://bugs.launchpad.net/qemu/+bug/1586756 Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1473170165-540-4-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13sclpconsolelm: remove bogus check for -EAGAINDaniel P. Berrange
The write_console_data() method in sclpconsole-lm.c checks whether the return value of qemu_chr_fe_write() has the value of -EAGAIN and if so then increments the buffer offset by the value of EAGAIN. Fortunately qemu_chr_fe_write() will never return EAGAIN directly, rather it returns -1 with errno set to EAGAIN, so this broken code path was not reachable. The behaviour on EAGAIN was stil bad though, causing the write_console_data() to busy_wait repeatedly calling qemu_chr_fe_write() with no sleep between iters. Just remove all this loop logic and replace with a call to qemu_chr_fe_write_all(). Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1473170165-540-3-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13ipmi: check return of qemu_chr_fe_write() for errorsDaniel P. Berrange
The continue_send() method in ipmi_bmc_extern.c directly assigns the return value of qemu_chr_fe_write() to the variable tracking the I/O buffer offset. This ignores the possibility that the return value could be -1 and so will cause I/O go backwards on EAGAIN. Fortunately 'outpos' is unsigned, so can't go negative - it will become MAX_INT which will cause the loop to stop, and avoid an accidental out of bounds array access. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1473170165-540-2-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13default-configs: remove CONFIG_PIIX_PCIDaniel P. Berrange
The CONFIG_PIIX_PCI=y setting was added in commit 70615c38ded2a20ad8282b7dcde95482fc0a7744 Author: Blue Swirl <blauwirbel@gmail.com> Date: Mon Mar 22 20:18:40 2010 +0000 Compile sound devices only once but nothing in that commit, nor anything pre-existing, ever referenced CONFIG_PIIX_PCI. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1473096320-1638-4-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13default-configs: removed obsolete CONFIG_ISA_MMIODaniel P. Berrange
The use of the CONFIG_ISA_MMIO setting was removed in commit 61fcb628627ea464dc1954f615ae13edfefd284f Author: Paolo Bonzini <pbonzini@redhat.com> Date: Mon Jul 22 15:54:24 2013 +0200 isa_mmio: delete but this commit only removed it from some of the default config files. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1473096320-1638-3-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13default-configs: remove CONFIG_PAMDaniel P. Berrange
The CONFIG_PAM=y setting was added in commit c0907c9e6417cb959dfd9ef6873221536ec91351 Author: Paolo Bonzini <pbonzini@redhat.com> Date: Tue Feb 5 15:06:20 2013 +0100 hw: move PCI bridges to hw/pci-* or hw/ARCH but nothing in that commit, nor anything pre-existing, ever referenced CONFIG_PAM. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1473096320-1638-2-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi: pvscsi: limit loop to fetch SG listPrasad J Pandit
In PVSCSI paravirtual SCSI bus, pvscsi_convert_sglist can take a very long time or go into an infinite loop due to two different bugs: 1) the request descriptor data length is defined to be 64 bit. While building SG list from a request descriptor, it gets truncated to 32bit in routine 'pvscsi_convert_sglist'. This could lead to an infinite loop situation large 'dataLen' values when data_length is cast to uint32_t and chunk_size becomes always zero. Fix this by removing the incorrect cast. 2) pvscsi_get_next_sg_elem can be called arbitrarily many times if the element has a zero length. Get out of the loop early when this happens, by introducing an upper limit on the number of SG list elements. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1473108643-12983-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13MAINTAINERS: Add some header files to the PC chipset sectionThomas Huth
These header files obviously belong to the PC chipset (since their names match the other .c files in this section). Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <1473111075-25311-1-git-send-email-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13MAINTAINERS: Fix wildcard for scsi headersThomas Huth
get_maintainer.pl currently thinks that the scsi headers are currrently unmaintained. So let's fix the corresponding wildcard expression. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <1473106301-23102-1-git-send-email-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13chardev: Add 'help' option to print all available chardev backend typesLin Ma
Signed-off-by: Lin Ma <lma@suse.com> Message-Id: <20160816171352.17021-1-lma@suse.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13doc/rcu: fix typoCao jin
Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Message-Id: <1472696479-3619-1-git-send-email-caoj.fnst@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13vmxcap: Add TSC scaling bitEduardo Habkost
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <1472181025-10889-3-git-send-email-ehabkost@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13vmxcap: Show raw MSR valueEduardo Habkost
This will be helpful to allow checking of bits that are not in the 'bits' table yet. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <1472181025-10889-2-git-send-email-ehabkost@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi: mptconfig: fix misuse of MPTSAS_CONFIG_PACKPaolo Bonzini
These issues cause respectively a QEMU crash and a leak of 2 bytes of stack. They were discovered by VictorV of 360 Marvel Team. Reported-by: Tom Victor <i-tangtianwen@360.cm> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi: mptconfig: fix an assert expressionPrasad J Pandit
When LSI SAS1068 Host Bus emulator builds configuration page headers, mptsas_config_pack() should assert that the size fits in a byte. However, the size is expressed in 32-bit units, so up to 1020 bytes fit. The assertion was only allowing replies up to 252 bytes, so fix it. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1472645167-30765-2-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13vmw_pvscsi: check page count while initialising descriptor ringsPrasad J Pandit
Vmware Paravirtual SCSI emulation uses command descriptors to process SCSI commands. These descriptors come with their ring buffers. A guest could set the page count for these rings to an arbitrary value, leading to infinite loop or OOB access. Add check to avoid it. Reported-by: Tom Victor <vv474172261@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1472626169-12989-1-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi-disk: change disk serial length from 20 to 36Rony Weng
Openstack Cinder assigns volume a 36 characters uuid as serial. QEMU will shrinks the uuid to 20 characters, which does not match the original uuid. Note that there is no limit to the length of the serial number in the SCSI spec. 20 was copy-pasted from virtio-blk which in turn was copy-pasted from ATA; 36 is even more arbitrary. However, bumping it up too much might cause issues (e.g. 252 seems to make sense because then the maximum amount of returned data is 256; but who knows there's no off-by-one somewhere for such a nicely rounded number). Signed-off-by: Rony Weng <ronyweng@synology.com> Message-Id: <1472457138-23386-1-git-send-email-ronyweng@synology.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13MAINTAINERS: add myself as stubs maintainersPaolo Bonzini
Let's just remove some files from the pool of unmaintained files. I am obviously not going to send pull requests only for stubs/, but I will ack them if maintainers want that. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13lsi: never set DMA FIFO Empty (DFE) bit in DSTAT registerHervé Poussineau
53C895A datasheet says: "This bit (DFE) is a pure status bit and will not cause an interrupt" This bit is already auto-generated in lsi_read_reg when reading the DSTAT register. This fixes IBM RS/6000 7020 firmware, which is: - resetting the adapter - enabling all interrupt sources (including DIP, ie interrupts from DSTAT) - waiting for ISTAT0 to become 0 (including DIP=0, ie no interrupt coming from DSTAT) Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1471505489-1221-5-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-12 05:14:26 +0000