aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-08-03migration: Fix global state with Xen.Anthony PERARD
When doing migration via the QMP command xen_save_devices_state, the current runstate is not store into the global state section. Also the current runstate is not the one we want on the receiver side. During migration, the Xen toolstack paused QEMU before save the devices state. Also, the toolstack expect QEMU to autostart when the migration is finished. So this patch store "running" as it's current runstate. Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2015-08-03configure: Drop vnc-ws feature from help textAndreas Färber
Commit 8e9b0d2 (ui: convert VNC websockets to use crypto APIs) dropped the --enable-vnc-ws option but forgot to update the help text. Fix this. Cc: Daniel P. Berrange <berrange@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 1437749257-3313-1-git-send-email-afaerber@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-03Merge remote-tracking branch ↵Peter Maydell
'remotes/stefanha/tags/rtl8139-cplus-tx-input-validation-pull-request' into staging Pull request # gpg: Signature made Mon Aug 3 13:08:25 2015 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/rtl8139-cplus-tx-input-validation-pull-request: rtl8139: check TCP Data Offset field (CVE-2015-5165) rtl8139: skip offload on short TCP header (CVE-2015-5165) rtl8139: check IP Total Length field (CVE-2015-5165) rtl8139: check IP Header Length field (CVE-2015-5165) rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165) rtl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165) rtl8139: avoid nested ifs in IP header parsing (CVE-2015-5165) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-03rtl8139: check TCP Data Offset field (CVE-2015-5165)Stefan Hajnoczi
The TCP Data Offset field contains the length of the header. Make sure it is valid and does not exceed the IP data length. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03rtl8139: skip offload on short TCP header (CVE-2015-5165)Stefan Hajnoczi
TCP Large Segment Offload accesses the TCP header in the packet. If the packet is too short we must not attempt to access header fields: tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen); int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr); Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03rtl8139: check IP Total Length field (CVE-2015-5165)Stefan Hajnoczi
The IP Total Length field includes the IP header and data. Make sure it is valid and does not exceed the Ethernet payload size. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03rtl8139: check IP Header Length field (CVE-2015-5165)Stefan Hajnoczi
The IP Header Length field was only checked in the IP checksum case, but is used in other cases too. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)Stefan Hajnoczi
Transmit offload features access Ethernet and IP headers the packet. If the packet is too short we must not attempt to access header fields: int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12)); ... eth_payload_data = saved_buffer + ETH_HLEN; ... ip = (ip_header*)eth_payload_data; if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) { Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03rtl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165)Stefan Hajnoczi
The previous patch stopped using the ip pointer as an indicator that the IP header is present. When we reach the if (ip) {...} statement we know ip is always non-NULL. Remove the if statement to reduce nesting. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03rtl8139: avoid nested ifs in IP header parsing (CVE-2015-5165)Stefan Hajnoczi
Transmit offload needs to parse packet headers. If header fields have unexpected values the offload processing is skipped. The code currently uses nested ifs because there is relatively little input validation. The next patches will add missing input validation and a goto label is more appropriate to avoid deep if statement nesting. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03Merge remote-tracking branch ↵Peter Maydell
'remotes/aurel/tags/pull-tcg-mips-s390-20150803' into staging TCG MIPS and S390 fixes for 2.4. # gpg: Signature made Mon Aug 3 09:09:59 2015 BST using RSA key ID 1DDD8C9B # gpg: Good signature from "Aurelien Jarno <aurelien@aurel32.net>" # gpg: aka "Aurelien Jarno <aurelien@jarno.fr>" # gpg: aka "Aurelien Jarno <aurel32@debian.org>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 7746 2642 A9EF 94FD 0F77 196D BA9C 7806 1DDD 8C9B * remotes/aurel/tags/pull-tcg-mips-s390-20150803: tcg/mips: fix add2 tcg/s390x: Mask TCGMemOp appropriately for indexing tcg/mips: Mask TCGMemOp appropriately for indexing tcg/mips: fix TLB loading for BE host with 32-bit guests Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-03Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into stagingPeter Maydell
# gpg: Signature made Fri Jul 31 23:24:06 2015 BST using RSA key ID AAFC390E # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: FAEB 9711 A12C F475 812F 18F2 88A9 064D 1835 61EB # Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76 CBD0 7DEF 8106 AAFC 390E * remotes/jnsnow/tags/ide-pull-request: ahci: fix ICC mask definition macio: re-add TRIM support Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-01tcg/mips: fix add2Aurelien Jarno
The add2 code in the tcg_out_addsub2 function doesn't take into account the case where rl == al == bl. In that case we can't compute the carry after the addition. As it corresponds to a multiplication by 2, the carry bit is the bit 31. While this is a corner case, this prevents x86-64 guests to boot on a MIPS host. Cc: qemu-stable@nongnu.org Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2015-08-01tcg/s390x: Mask TCGMemOp appropriately for indexingAurelien Jarno
Commit 2b7ec66f fixed TCGMemOp masking following the MO_AMASK addition, but two cases were forgotten in the TCG S390 backend. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2015-08-01tcg/mips: Mask TCGMemOp appropriately for indexingAurelien Jarno
Commit 2b7ec66f fixed TCGMemOp masking following the MO_AMASK addition, but two cases were forgotten in the TCG MIPS backend. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2015-08-01tcg/mips: fix TLB loading for BE host with 32-bit guestsAurelien Jarno
For 32-bit guest, we load a 32-bit address from the TLB, so there is no need to compensate for the low or high part. This fixes 32-bit guests on big-endian hosts. Cc: qemu-stable@nongnu.org Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2015-07-31ahci: fix ICC mask definitionJohn Snow
There are likely others that could be updated, but we'll go with a light touch for 2.4 for now. Without the Unsigned specifier, this shifts bits into the signed bit, which makes clang unhappy and could cause unwanted behavior. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1437501721-24495-1-git-send-email-jsnow@redhat.com
2015-07-31macio: re-add TRIM supportAurelien Jarno
Commit bd4214fc dropped TRIM support by mistake. Given it is still advertised to the host when using a drive with discard=on, this cause the IDE bus to hang when the host issues a TRIM command. This patch fixes that by re-adding the TRIM code, ported to the new new DMA implementation. Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Cc: John Snow <jsnow@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 1438198068-32428-1-git-send-email-aurelien@aurel32.net Signed-off-by: John Snow <jsnow@redhat.com>
2015-07-30bsd-user: Fix operand to cpu_x86_execRichard Henderson
Signed-off-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1438195252-21968-1-git-send-email-rth@twiddle.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-07-29Update version for v2.4.0-rc3 releasev2.4.0-rc3Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-07-29Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging Pull request These fixes make dataplane work again after the notify_me optimization was added. They also solve QEMUBH memory leaks and fix a bug in dataplane's cleanup code. # gpg: Signature made Wed Jul 29 14:50:26 2015 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/block-pull-request: AioContext: force event loop iteration using BH AioContext: avoid leaking BHs on cleanup virtio-blk-dataplane: delete bottom half before the AioContext is freed Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-07-29AioContext: force event loop iteration using BHStefan Hajnoczi
The notify_me optimization introduced in commit eabc97797310 ("AioContext: fix broken ctx->dispatching optimization") skips event_notifier_set() calls when the event loop thread is not blocked in ppoll(2). This optimization causes a deadlock if two aio_context_acquire() calls race. notify_me = 0 during the race so the winning thread can enter ppoll(2) unaware that the other thread is waiting its turn to acquire the AioContext. This patch forces ppoll(2) to return by scheduling a BH instead of calling aio_notify(). The following deadlock with virtio-blk dataplane is fixed: qemu ... -object iothread,id=iothread0 \ -drive if=none,id=drive0,file=test.img,... \ -device virtio-blk-pci,iothread=iothread0,drive=drive0 This command-line results in a hang early on without this patch. Thanks to Paolo Bonzini <pbonzini@redhat.com> for investigating this bug with me. Cc: Christian Borntraeger <borntraeger@de.ibm.com> Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1438101249-25166-4-git-send-email-pbonzini@redhat.com Message-Id: <1438014819-18125-3-git-send-email-stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-07-29AioContext: avoid leaking BHs on cleanupStefan Hajnoczi
BHs are freed during aio_bh_poll(). This leads to memory leaks if there is no aio_bh_poll() between qemu_bh_delete() and aio_ctx_finalize(). Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1438101249-25166-3-git-send-email-pbonzini@redhat.com Message-Id: <1438014819-18125-2-git-send-email-stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-07-29virtio-blk-dataplane: delete bottom half before the AioContext is freedPaolo Bonzini
Other uses of aio_bh_new are safe as long as all scheduled bottom halves are run before an iothread is destroyed, which bdrv_drain will ensure: - archipelago_finish_aiocb: BH deletes itself - inject_error: BH deletes itself - blkverify_aio_bh: BH deletes itself - abort_aio_request: BH deletes itself - curl_aio_readv: BH deletes itself - gluster_finish_aiocb: BH deletes itself - bdrv_aio_rw_vector: BH deletes itself - bdrv_co_maybe_schedule_bh: BH deletes itself - iscsi_schedule_bh, iscsi_co_generic_cb: BH deletes itself - laio_attach_aio_context: deleted in laio_detach_aio_context, called through bdrv_detach_aio_context before deleting the iothread - nfs_co_generic_cb: BH deletes itself - null_aio_common: BH deletes itself - qed_aio_complete: BH deletes itself - rbd_finish_aiocb: BH deletes itself - dma_blk_cb: BH deletes itself - virtio_blk_dma_restart_cb: BH deletes itself - qemu_bh_new: main loop AioContext is never destroyed - test-aio.c: bh_delete_cb deletes itself, otherwise deleted in the same function that calls aio_bh_new Reported-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1438101249-25166-2-git-send-email-pbonzini@redhat.com Message-Id: <1438086628-13000-1-git-send-email-pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-07-28Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into ↵Peter Maydell
staging Pull request These two .can_receive() are now reviewed. The net subsystem queue for 2.4 is now empty. # gpg: Signature made Tue Jul 28 13:26:03 2015 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/net-pull-request: xen: Drop net_rx_ok hw/net: handle flow control in mcf_fec driver receiver Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-07-28Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
virtio fixes for 2.4 Mostly virtio 1 spec compliance fixes. We are unlikely to make it perfectly compliant in the first release, but it seems worth it to try. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon Jul 27 21:55:48 2015 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: virtio: minor cleanup acpi: fix pvpanic device is not shown in ui virtio-blk: only clear VIRTIO_F_ANY_LAYOUT for legacy device virtio-blk: fail get_features when both scsi and 1.0 were set virtio: get_features() can fail virtio-pci: fix memory MR cleanup for modern virtio: set any_layout in virtio core virtio-9p: fix any_layout virtio-serial: fix ANY_LAYOUT virtio: hide legacy features from modern guests Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-07-28Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150728' into stagingPeter Maydell
MIPS patches 2015-07-28 Changes: * net/dp8393x fixes * Vectored Interrupts bug fix * fix for a bug in machine.c which was provoking a warning on FreeBSD # gpg: Signature made Tue Jul 28 10:47:19 2015 BST using RSA key ID 0B29DA6B # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4 4FC0 5211 8E3C 0B29 DA6B * remotes/lalrae/tags/mips-20150728: net/dp8393x: do not use memory_region_init_rom_device with NULL net/dp8393x: remove check of runt packets net/dp8393x: disable user creation target-mips: fix offset calculation for Interrupts target-mips: fix passing incompatible pointer type in machine.c Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-07-28Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* crypto fixes * megasas SIGSEGV fix * memory refcount change to fix virtio hot-unplug # gpg: Signature made Tue Jul 28 08:29:07 2015 BST using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: memory: do not add a reference to the owner of aliased regions megasas: Add write function to handle write access to PCI BAR 3 crypto: extend unit tests to cover decryption too crypto: fix built-in AES decrypt function Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-07-28Merge remote-tracking branch ↵Peter Maydell
'remotes/cody/tags/jtc-for-upstream-pull-request' into staging # gpg: Signature made Tue Jul 28 05:22:29 2015 BST using RSA key ID C0DE3057 # gpg: Good signature from "Jeffrey Cody <jcody@redhat.com>" # gpg: aka "Jeffrey Cody <jeff@codyprime.org>" # gpg: aka "Jeffrey Cody <codyprime@gmail.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 9957 4B4D 3474 90E7 9D98 D624 BDBE 7B27 C0DE 3057 * remotes/cody/tags/jtc-for-upstream-pull-request: block/ssh: Avoid segfault if inet_connect doesn't set errno. sheepdog: serialize requests to overwrapping area Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-07-28xen: Drop net_rx_okFam Zheng
Let net_rx_packet() (which checks the same conditions) drops the packet if the device is not ready. Drop net_xen_info.can_receive and update the return value for the buffer full case. We rely on the qemu_flush_queued_packets() in net_event() to wake up the peer when the buffer becomes available again. Signed-off-by: Fam Zheng <famz@redhat.com> Message-id: 1438077176-378-1-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-07-28Merge remote-tracking branch ↵Peter Maydell
'remotes/mjt/tags/pull-trivial-patches-2015-07-27' into staging trivial patches for 2015-07-27 # gpg: Signature made Mon Jul 27 20:50:14 2015 BST using RSA key ID A4C3D7DB # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" * remotes/mjt/tags/pull-trivial-patches-2015-07-27: gdbstub: Set current CPU on interruptions qapi: add missing @ Fix Cortex-A9 global timer gitignore: Ignore shader generated files vmstate: remove unused declaration make: Clean build messages qemu-common.h: Document cutils.c string functions device_tree: Fix a typo hw/acpi/ich9: clean up stale comment about KVM not supporting SMM hw/acpi/ich9: clear smi_en on reset Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-07-28hw/net: handle flow control in mcf_fec driver receiverGreg Ungerer
The network mcf_fec driver emulated receive side method is not dealing with network queue flow control properly. Modify the receive side to check if we have enough space in the descriptors to store the current packet. If not we process none of it and return 0. When the guest frees up some buffers through its descriptors we signal the qemu net layer to send more packets. [Fixed coding style: 4-space indent and curly braces on if statement. --Stefan] Signed-off-by: Greg Ungerer <gerg@uclinux.org> Message-id: 1438045374-10358-1-git-send-email-gerg@uclinux.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-07-28net/dp8393x: do not use memory_region_init_rom_device with NULLHervé Poussineau
Replace memory_region_init_rom_device() with memory_region_init_ram() and memory_region_set_readonly(). This fixes a guest-triggerable QEMU crash when guest tries to write to PROM. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> [leon.alrae@imgtec.com: shorten subject length] Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
2015-07-28net/dp8393x: remove check of runt packetsHervé Poussineau
Ethernet requires that messages are at least 64 bytes on the wire. This limitation does not exist on emulation (no wire message), so remove the check. Netcard is now able to receive small network packets. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
2015-07-28net/dp8393x: disable user creationHervé Poussineau
Netcard needs an address space to write data to, which can't be specified on command line. This fixes a crash when user starts QEMU with "-device dp8393x" Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
2015-07-28Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches for 2.4.0-rc3 # gpg: Signature made Mon Jul 27 16:19:17 2015 BST using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: block: qemu-iotests - add check for multiplication overflow in vpc block: vpc - prevent overflow if max_table_entries >= 0x40000000 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-07-28target-mips: fix offset calculation for InterruptsYongbok Kim
Correct computation of vector offsets for EXCP_EXT_INTERRUPT. For instance, if Cause.IV is 0 the vector offset should be 0x180. Simplify the finding vector number logic for the Vectored Interrupts. Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com> Reviewed-by: Leon Alrae <leon.alrae@imgtec.com> [leon.alrae@imgtec.com: cosmetic changes] Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
2015-07-28target-mips: fix passing incompatible pointer type in machine.cLeon Alrae
Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
2015-07-28block/ssh: Avoid segfault if inet_connect doesn't set errno.Richard W.M. Jones
On some (but not all) systems: $ qemu-img create -f qcow2 overlay -b ssh://xen/ Segmentation fault It turns out this happens when inet_connect returns -1 in the following code, but errno == 0. s->sock = inet_connect(s->hostport, errp); if (s->sock < 0) { ret = -errno; goto err; } In the test case above, no host called "xen" exists, so getaddrinfo fails. On Fedora 22, getaddrinfo happens to set errno = ENOENT (although it is *not* documented to do that), so it doesn't segfault. On RHEL 7, errno is not set by the failing getaddrinfo, so ret = -errno = 0, so the caller doesn't know there was an error and continues with a half-initialized BDRVSSHState struct, and everything goes south from there, eventually resulting in a segfault. Fix this by setting ret to -EIO (same as block/nbd.c and block/sheepdog.c). The real error is saved in the Error** errp struct, so it is printed correctly: $ ./qemu-img create -f qcow2 overlay -b ssh://xen/ qemu-img: overlay: address resolution failed for xen:22: No address associated with hostname Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Reported-by: Jun Li BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1147343 Signed-off-by: Jeff Cody <jcody@redhat.com>
2015-07-28sheepdog: serialize requests to overwrapping areaHitoshi Mitake
Current sheepdog driver only serializes create requests in oid unit. This mechanism isn't enough for handling requests to overwrapping area spanning multiple oids, so it can result bugs like below: https://bugs.launchpad.net/sheepdog-project/+bug/1456421 This patch adds a new serialization mechanism for the problem. The difference from the old one is: 1. serialize entire aiocb if their targetting areas overwrap 2. serialize all requests (read, write, and discard), not only creates This patch also removes the old mechanism because the new one can be an alternative. Cc: Kevin Wolf <kwolf@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Cc: Teruaki Ishizaki <ishizaki.teruaki@lab.ntt.co.jp> Cc: Vasiliy Tolstov <v.tolstov@selfip.ru> Signed-off-by: Hitoshi Mitake <mitake.hitoshi@lab.ntt.co.jp> Tested-by: Vasiliy Tolstov <v.tolstov@selfip.ru> Signed-off-by: Jeff Cody <jcody@redhat.com>
2015-07-27memory: do not add a reference to the owner of aliased regionsPaolo Bonzini
Very often the owner of the aliased region is the same as the owner of the alias region itself. When this happens, the reference count can never go back to 0 and the owner is leaked. This is for example breaking hot-unplug of virtio-pci devices (the device cannot be plugged back again with the same id). Another common use for alias is to transform the system I/O address space into an MMIO regions; in this case the aliased region never dies, so there is no problem. Otherwise the owner is always the same for aliasing and aliased region. I checked all calls to memory_region_init_alias introduced after commit dfde4e6 (memory: add ref/unref calls, 2013-05-06) and they do not need the reference in order to keep the owner of the aliased region alive. Reported-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-27megasas: Add write function to handle write access to PCI BAR 3Salva Peiró
This patch fixes a QEMU SEGFAULT when a write operation is performed on the memory region of the PCI BAR 3 (base address space). When a writeb(0xe0000000) is performed the .write function is invoked to handle the write access, however, since the .write is not initialised, the call to 0, causes QEMU to SEGFAULT. Signed-off-by: Salva Peiró <speirofr@gmail.com> Acked-by: Hannes Reinecke <hare@suse.com> Message-Id: <1437987112-24744-1-git-send-email-speirofr@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-27virtio: minor cleanupMichael S. Tsirkin
There's no need for blk to set ANY_LAYOUT, it's done by virtio core as necessary. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-07-27acpi: fix pvpanic device is not shown in uiGal Hammer
Commit 2332333c added a _STA method that hides the device. The fact that the device is not shown in the gui make it harder to install its Windows' device. https://bugzilla.redhat.com/show_bug.cgi?id=1238141 Signed-off-by: Gal Hammer <ghammer@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2015-07-27gdbstub: Set current CPU on interruptionsJan Kiszka
gdb expects that the thread ID for c and g-class operations is set to the CPU we provide when reporting VM stop conditions. If the stub is still tuned to a different CPU, the wrong information is delivered to the gdb frontend. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-07-27qapi: add missing @Marc-André Lureau
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-07-27Fix Cortex-A9 global timerJohannes Schlatow
The auto increment bit of the timer control register was wrongly defined. See Cortex-A9 MPcore Technical Reference Manual, Section 4.4.2. Signed-off-by: Johannes Schlatow <schlatow@ida.ing.tu-bs.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-07-27gitignore: Ignore shader generated filesMichal Privoznik
As of d98bc0b65 there are two files that are automatically generated: ui/shader/texture-blit-frag.h and /ui/shader/texture-blit-vert.h. None of them is wanted to be tracked by git. Put them into the ignore file then. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-07-27vmstate: remove unused declarationMarc-André Lureau
Since 38e0735e, register_device_unmigratable() has been removed Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-07-27make: Clean build messagesStefan Weil
We want to have uniform build messages, so fix some messages which did not follow the standard pattern. Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
generated by cgit v1.2.3 (git 2.26.2) at 2025-02-08 21:17:10 +0000