aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-06-25target-i386: Fix ucomis and comis memory accessRichard Henderson
We were loading 16 bytes for both single and double-precision scalar comparisons. Reported-by: Alexander Bluhm <bluhm@openbsd.org> Signed-off-by: Richard Henderson <rth@twiddle.net> (cherry picked from commit cb48da7f8140b5cbb648d990876720da9cd04d8f) Conflicts: target-i386/translate.c *removed dependency on 323d1876 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-06-25target-i386: Fix CC_OP_CLR vs PFRichard Henderson
Parity should be set for a zero result. Cc: qemu-stable@nongnu.org Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Richard Henderson <rth@twiddle.net> (cherry picked from commit d2fe51bda8adf33d07c21e034fdc13a1e1fa4e19) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-06-25s390x/virtio-hcall: Add range check for hypervisor callThomas Huth
The handler for diag 500 did not check whether the requested function was in the supported range, so illegal values could crash QEMU in the worst case. Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> CC: qemu-stable@nongnu.org (cherry picked from commit f2c55d1735175ab37ab9f69854460087112d2756) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-06-25block/iscsi: fix deadlock on scsi check conditionPeter Lieven
the retry logic was broken because the complete status of the task structure was not reset. this resulted in an infinite loop retrying the command over and over. CC: qemu-stable@nongnu.org Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 837c390137193e715fee20b35c0ddb164b1c4fa4) Conflicts: block/iscsi.c *only modified retry clauses present before 063c3378 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-06-25scsi-bus: Fix transfer length for VERIFY with BYTCHK=11bMarkus Armbruster
The transfer length depends on field BYTCHK, which is encoded in byte 1, bits 1..2. However, the guard for for case BYTCHK=11b doesn't work, and we get case 01b instead. Fix it. Note that since emulated scsi-hd fails the command outright, it takes SCSI passthrough of a device that actually implements VERIFY with BYTCHK=11b to make the bug bite. Screwed up in commit d12ad44. Spotted by Coverity. Cc: qemu-stable@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 7ef8cf9a0861b6f67f5e57428478c31bfd811651) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-06-20char: restore read callback on a reattached (hotplug) chardevGal Hammer
Fix a bug that was introduced in commit 386a5a1e. A removal of a device set the chr handlers to NULL. However when the device is plugged back, its read callback is not restored so data can't be transferred from the host to the guest (e.g. via the virtio-serial port). https://bugzilla.redhat.com/show_bug.cgi?id=1027181 Signed-off-by: Gal Hammer <ghammer@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit ac1b84dd1e020648db82a99260891aa982d1142c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-03-03Update VERSION for 1.7.1 releasev1.7.1Michael Roth
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-27KVM: Use return value for error printAlexander Graf
Commit 94ccff13 introduced a more verbose failure message and retry operations on KVM VM creation. However, it ended up using a variable for its failure message that hasn't been initialized yet. Fix it to use the value it meant to set. Cc: qemu-stable@nongnu.org Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 521f438e36b0265d66862e9cd35e4db82686ca9f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-27hw/intc/arm_gic: Fix GIC_SET_LEVELChristoffer Dall
The GIC_SET_LEVEL macro unfortunately overwrote the entire level bitmask instead of just or'ing on the necessary bits, causing active level PPIs on a core to clear PPIs on other cores. Cc: qemu-stable@nongnu.org Reported-by: Rob Herring <rob.herring@linaro.org> Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org> Message-id: 1393031030-8692-1-git-send-email-christoffer.dall@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 6453fa998a11e133e673c0a613b88484a8231d1d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-27hw/arm/musicpal: Remove nonexistent CDTP2, CDTP3 registersPeter Maydell
The ethernet device in the musicpal only has two tx queues, but we modelled it with four CTDP registers, presumably a cut and paste from the rx queue registers. Since the tx_queue[] array is only 2 entries long this allowed a guest to overrun this buffer. Remove the nonexistent registers. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1392737293-10073-1-git-send-email-peter.maydell@linaro.org Acked-by: Jan Kiszka <jan.kiszka@web.de> Cc: qemu-stable@nongnu.org (cherry picked from commit cf143ad35018c5fc1da6365b45acda2b34aba90a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-27hw/intc/exynos4210_combiner: Don't overrun output_irq array in initPeter Maydell
The Exynos4210 combiner has IIC_NIRQ inputs and IIC_NGRP outputs; use the correct constant in the loop initializing our output sysbus IRQs so that we don't overrun the output_irq[] array. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1392659611-8439-1-git-send-email-peter.maydell@linaro.org Reviewed-by: Andreas Färber <afaerber@suse.de> Cc: qemu-stable@nongnu.org (cherry picked from commit fce0a826083e0416981e2ea9518ce5faa75b81a3) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-27hw/timer/arm_timer: Avoid array overrun for bad addressesPeter Maydell
The integrator's timer read/write functions log an error for bad addresses in guest accesses, but were falling through and using an out of bounds array index rather than returning early. Fix this. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Message-id: 1392647854-8067-4-git-send-email-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org (cherry picked from commit cba933b2257ef0ad241756a0ff86bc0acda685ca) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-27hw/misc/arm_sysctl: Fix bad boundary check on mb clock accessesPeter Maydell
Fix incorrect use of sizeof() rather than ARRAY_SIZE() to guard accesses into the mb_clock[] array, which was allowing a malicious guest to overwrite the end of the array. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Message-id: 1392647854-8067-2-git-send-email-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org (cherry picked from commit ec1efab95767312ff4afb816d0d4b548e093b031) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-25qga: Fix memory allocation pastoMarkus Armbruster
qmp_guest_file_seek() allocates memory for a GuestFileRead object instead of the GuestFileSeek object it actually uses. Harmless, because the GuestFileRead is slightly larger. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> (cherry picked from commit 10b7c5dd0da1a92182e87f5fc1887d779ad1a9e8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-25qga: vss-win32: Fix interference with snapshot deletion by other VSS requestTomoki Sekiyama
When a VSS requester such as vshadow.exe or diskshadow.exe requests to delete snapshots, qemu-ga VSS provider's DeleteSnapshots() is also called and returns E_NOTIMPL, that makes the deletion fail. To avoid this issue, return S_OK and set values that represent no snapshots are deleted by qemu-ga VSS provider. Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com> Reviewed-by: Gal Hammer <ghammer@redhat.com> Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> (cherry picked from commit d9e1f574cb6eac0a3a2f97b67d2e7a3ad9c1dc95) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-25qga: vss-win32: Fix interference with snapshot creation by other VSS requestersTomoki Sekiyama
When a VSS requester such as vshadow.exe or diskshadow.exe requests to create disk snapshots, Windows may choose qemu-ga VSS provider if it is only provider registered on the system. However, because it provides only a function to freeze the filesystem, the snapshotting fails. This patch adds a check into CQGAVssProvider::IsVolumeSupported() to reject the request from other VSS requesters, so that the other provider is chosen. The check of requester is done by confirming event channels between qemu-ga's requester and provider established. To ensure that the events are initialized when CQGAVssProvider::IsVolumeSupported() is called, it moves the initialization earlier. Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com> Reviewed-by: Gal Hammer <ghammer@redhat.com> Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> (cherry picked from commit ff8adbcfdbbd9c0f2b01ff8a32bc75082fdd9844) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-25qga: vss-win32: Use NULL as an invalid pointer for OpenEvent and CreateEventTomoki Sekiyama
OpenEvent and CreateEvent WinAPI return NULL when failed to open/create events handles, instead of INVALID_HANDLE_VALUE (although their return types are HANDLE). This replaces INVALID_HANDLE_VALUE related to event handles with NULL. Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com> Reviewed-by: Gal Hammer <ghammer@redhat.com> Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> (cherry picked from commit 4c1b8f1e8357d85c613d779596e4079cc581d74f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21adlib: fix patching of port I/O addressesPaolo Bonzini
Commit 2b21fb5 (adlib: sort offsets in portio registration, 2013-08-14) fixed the offsets in adlib_portio_list, but forgot the matching indices in adlib_realizefn. Reported at http://virtuallyfun.superglobalmegacorp.com/?p=3616 by "neozeed". Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 7f0ba7bb4378f22b017e08947219a352d491bac4) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21tcg-arm: The shift count of op_rotl_i32 is in args[2] not args[1].Huw Davies
It's this that should be subtracted from 0x20 when converting to a right rotate. Cc: qemu-stable@nongnu.org Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Richard Henderson <rth@twiddle.net> (cherry picked from commit 7a3a00979d9dfe2aaa66ce5fc68cd161b4f900ba) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21memory: fix limiting of translation at a page boundaryPaolo Bonzini
Commit 360e607 (address_space_translate: do not cross page boundaries, 2014-01-30) broke MMIO accesses in cases where the section is shorter than the full register width. This can happen for example with the Bochs DISPI registers, which are 16 bits wide but have only a 1-byte long MemoryRegion (if you write to the "second byte" of the register your access is discarded; it doesn't write only to half of the register). Restrict the action of commit 360e607 to direct RAM accesses. This is enough for Xen, since MMIO will not go through the mapcache. Reported-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit a87f39543a9259f671c5413723311180ee2ad2a8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21Update OpenBIOS imagesMark Cave-Ayland
Update OpenBIOS images to SVN r1246 built from submodule. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> (cherry picked from commit fbb9c590cacf1cefb516f523427a920c2fe8c135) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21linux-user: Fix trampoline code for CRISStefan Weil
__put_user can write bytes, words (2 bytes) or longwords (4 bytes). Here obviously words should have been written, but bytes were written, so values like 0x9c5f were truncated to 0x5f. Fix this by changing retcode from uint8_t to to uint16_t in target_signal_frame and also in the unused rt_signal_frame. This problem was reported by static code analysis (smatch). Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Weil <sw@weilnetz.de> Acked-by: Riku Voipio <riku.voipio@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> (cherry picked from commit 8cfc114a2f293c40077d1bdb7500b29db359ca22) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21i386: Add missing include file for QEMU_PACKEDStefan Weil
Instead of packing BiosLinkerLoaderEntry, an unused global variable called QEMU_PACKED was created (detected by smatch static code analysis). Including qemu-common.h gets the right definition and also includes some standard include files which now can be removed here. Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit c428c5a21ce9a9861839ee544afd10638016e3f5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21KVM: Retry KVM_CREATE_VM on EINTRthomas knych
Upstreaming this change from Android (https://android-review.googlesource.com/54211). On heavily loaded machines with many VM instances we see KVM_CREATE_VM failing with EINTR on this path: kvm_dev_ioctl_create_vm -> kvm_create_vm -> kvm_init_mmu_notifier -> mmu_notifier_register -> do_mmu_notifier_register -> mm_take_all_locks which checks if any signals have been raised while it was attaining locks and returns EINTR. Retrying the system call greatly improves reliability. Cc: qemu-stable@nongnu.org Signed-off-by: thomas knych <thomaswk@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 94ccff133820552a859c0fb95e33a539e0b90a75) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21virtio-scsi: Prevent assertion on missed eventsEric Farman
In some cases, an unplug can cause events to be dropped, which leads to an assertion failure when preparing to notify the guest kernel. Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 49fb65c7f985baa56d2964e0a85c1f098e3e2a9d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21virtio-scsi: Cleanup of I/Os that never startedEric Farman
There is still a small window that occurs when a cancel I/O affects an asynchronous I/O operation that hasn't started. In other words, when the residual data length equals the expected data length. Today, the routine virtio_scsi_command_complete fails because the VirtIOSCSIReq pointer (from the hba_private field in SCSIRequest) was cleared earlier when virtio_scsi_complete_req was called by the virtio_scsi_request_cancelled routine. As a result, the virtio_scsi_command_complete routine needs to simply return when it is processing a SCSIRequest block that was marked canceled. Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit e9c0f0f58ad0a41c3c4b19e1911cfe095afc09ca) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21scsi: Assign cancel_io vector for scsi_disk_emulate_opsPaolo Bonzini
Some emulated disk operations (MODE SELECT, UNMAP, WRITE SAME) can trigger asynchronous I/Os. Provide the cancel_io callback to ensure that AIOCBs are properly cleaned up. Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com> Cc: qemu-stable@nongnu.org [Tweak commit message. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 33325a53f15ab5370e1917b2a11cadffc77c5a52) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21scsi: Support TEST UNIT READY in the dummy LUN0Paolo Bonzini
SeaBIOS waits for LUN0 to respond to the TEST UNIT READY command in order to decide whether it should part of the boot sequence. If LUN0 does not respond to the command, boot is delayed by up to 5 seconds. This currently happens when there is no LUN0 on a target. Fix that by adding a trivial implementation of the command. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 1cb27d9233d572826b45bd8498d2fab1b6f01df9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21block/curl: Implement the libcurl timer callback interfacePeter Maydell
libcurl versions 7.16.0 and later have a timer callback interface which must be implemented in order for libcurl to make forward progress (it will sometimes rely on being called back on the timeout if there are no file descriptors registered). Implement the callback, and use a QEMU AIO timer to ensure we prod libcurl again when it asks us to. Based on Peter's original patch plus my fix to add curl_multi_timeout_do. Should compile just fine even on older versions of libcurl. I also tried copy-on-read and streaming: $ ./qemu-img create -f qcow2 -o \ backing_file=http://download.fedoraproject.org/pub/fedora/linux/releases/20/Live/x86_64/Fedora-Live-Desktop-x86_64-20-1.iso \ foo.qcow2 1G $ x86_64-softmmu/qemu-system-x86_64 \ -drive if=none,file=foo.qcow2,copy-on-read=on,id=cd \ -device ide-cd,drive=cd --enable-kvm -m 1024 Direct http usage is probably too slow, but with copy-on-read ultimately the image does boot! After some time, streaming gets canceled by an EIO, which needs further investigation. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 031fd1be5618c347f9aeb44ec294f14a541e42b2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21vfio-pci: Release all MSI-X vectors when disabledAlex Williamson
We were relying on msix_unset_vector_notifiers() to release all the vectors when we disable MSI-X, but this only happens when MSI-X is still enabled on the device. Perform further cleanup by releasing any remaining vectors listed as in-use after this call. This caused a leak of IRQ routes on hotplug depending on how the guest OS prepared the device for removal. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Cc: qemu-stable@nongnu.org (cherry picked from commit 3e40ba0faf0822fa78336fe6cd9d677ea9b14f1b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21migration: qmp_migrate(): keep working after syntax errorLuiz Capitulino
If a user or QMP client enter a bad syntax for the migrate command in QMP/HMP, then the migrate command will never succeed from that point on. For example, if you enter: (qemu) migrate tcp;0:4444 migrate: Parameter 'uri' expects a valid migration protocol Then the migrate command will always fail from now on: (qemu) migrate tcp:0:4444 migrate: There's a migration process in progress The problem is that qmp_migrate() sets the migration status to MIG_STATE_SETUP and doesn't reset it on syntax error. This bug was introduced by commit 29ae8a4133082e16970c9d4be09f4b6a15034617. Reviewed-by: Michael R. Hines <mrhines@us.ibm.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com> (cherry picked from commit c950114286ea358a93ce632db0421945e1008395) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21mainstone: Fix duplicate array values for key 'space'Stefan Weil
cgcc reported a duplicate initialisation. Mainstone includes a matrix keyboard where two different positions map to 'space'. QEMU uses the reversed mapping and does not map 'space' to two different matrix positions. Some other keys are either missing or might be mapped wrongly (cf. Linux kernel code). Don't fix these until someone can test them with real hardware, but add TODO comments. Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 7dbc1158bc63fdbad849d21409eeeb53f5230445) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21seccomp: exit if seccomp_init() failsCorey Bryant
This fixes a bug where we weren't exiting if seccomp_init() failed. Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com> Acked-by: Eduardo Otubo <otubo@linux.vnet.ibm.com> Acked-by: Paul Moore <pmoore@redhat.com> (cherry picked from commit 2a13f991123fa16841e6d94b02a9cc2c76d91725) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21s390x/kvm: Fix diagnose handling.Cornelia Huck
The instruction intercept handler for diagnose used only the displacement when trying to calculate the function code. This is only correct for base 0, however; we need to perform a complete base/displacement address calculation and use bits 48-63 as the function code. Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit 638129ff475dd3b4c0e57e0be598efe41461e9b3) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21qemu_opts_parse(): always check return valueLaszlo Ersek
qemu_opts_parse() can always return NULL, even if the QemuOptsList.desc in question would be trivial to satisfy (eg. because it's empty). For example: qemu_opts_parse() opts_parse() qemu_opts_create() id_wellformed() In practice: $ .../qemu-system-x86_64 -acpitable id=3 qemu-system-x86_64: -acpitable id=3: Parameter 'id' expects an identifier ** ERROR:vl.c:3491:main: assertion failed: (opts != NULL) Aborted (core dumped) $ .../qemu-system-x86_64 -smbios id=3 qemu-system-x86_64: -smbios id=3: Parameter 'id' expects an identifier Segmentation fault (core dumped) I checked all qemu_opts_parse() invocations (and all drive_def() invocations too, because it blindly forwards the former's retval). Only the two above examples look problematic. Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 1385658779-7529-1-git-send-email-lersek@redhat.com Signed-off-by: Anthony Liguori <aliguori@amazon.com> (cherry picked from commit f46e720a82ccdf1a521cf459448f3f96ed895d43) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21block/iscsi: use a bh to schedule co reentrancePeter Lieven
this fixes a potential segfault and performance regression. If the coroutine is reentered directly in the iscsi_co_generic_cb iscsi_process_{read,write} are interrupted and reentered any time later. One the one hand this could happen after an iscsi_close where the iscsi context is already gone (segfault). On the other hand this limits the number of processed callbacks in each aio_dispatch to one (potential performance regression). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 8b9dfe9098d91e06a3dd6376624307fe5fa13be8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21hpet: fix build with CONFIG_HPET offMichael S. Tsirkin
make hpet_find inline so we don't need to build hpet.c to check if hpet is enabled. Fixes link error with CONFIG_HPET off. Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 142e0950cfaf023a81112dc3cdfa799d769886a4) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21tcg/optimize: fix known-zero bits for right shift opsAurelien Jarno
32-bit versions of sar and shr ops should not propagate known-zero bits from the unused 32 high bits. For sar it could even lead to wrong code being generated. Cc: qemu-stable@nongnu.org Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Richard Henderson <rth@twiddle.net> (cherry picked from commit e46b225a3137e62c975c49aaae7bb5f9583cc428) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21Fix QEMU build on OpenBSD on x86 archsBrad
This resolves the build issue with building the ROMs on OpenBSD on x86 archs. As of OpenBSD 5.3 the compiler builds PIE binaries by default and thus the whole OS/packages and so forth. The ROMs need to have PIE disabled. Check in configure whether the compiler supports the flags for disabling PIE, and if it does then use them for building the ROMs. This fixes the following buildbot failure: >From the OpenBSD buildbots.. Building optionrom/multiboot.img ld: multiboot.o: relocation R_X86_64_16 can not be used when making a shared object; recompile with -fPIC Signed-off by: Brad Smith <brad@comstyle.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 46eef33b89e936ca793e13c4aeea1414e97e8dbb) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-21linux-user: create target_structs header to place ipc_perm and shmid_dsPetar Jovanovic
Creating target_structs header in linux-user/$arch/ and making target_ipc_perm and target_shmid_ds its first inhabitants. The struct defintions may/should be further fine-tuned by arch maintainers. Signed-off-by: Petar Jovanovic <petar.jovanovic@imgtec.com> Signed-off-by: Riku Voipio <riku.voipio@linaro.org> (cherry picked from commit 55a2b1631fb343edac4a2d4596c72e58ee1372b3) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-20linux-user: pass correct parameter to do_shmctl()Petar Jovanovic
Fix shmctl issue by passing correct parameter buf to do_shmctl(). Signed-off-by: Petar Jovanovic <petar.jovanovic@imgtec.com> Signed-off-by: Riku Voipio <riku.voipio@linaro.org> (cherry picked from commit a29267846a52b4ca294ba3a962b74b67df7ce6d2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-20target-mips: fix 64-bit FPU config for user-mode emulationPetar Jovanovic
FR bit should be initialized to 1 for MIPS64, under condition that this bit is writable and that CPU has an FPU unit. It should be initialized to zero for MIPS32. This fixes different MIPS32 issues with FPU instructions whose behaviour defaulted to 64-bit FPU mode. Signed-off-by: Petar Jovanovic <petar.jovanovic@imgtec.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 4d66261f71f2efa31e1052e4041c5ee505572fe5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-20piix: fix 32bit pci holeGerd Hoffmann
Make the 32bit pci hole start at end of ram, so all possible address space is covered. We used to try and make addresses aligned so they are easier to cover with MTRRs, but since they are cosmetic on KVM, this is probably not worth worrying about. Of course the firmware can use less than that. Leaving space unused is no problem, mapping pci bars outside the hole causes problems though. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit ddaaefb4dd427d6d2e41c1cfbe0cd8d8e8d6aad9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-20pc: map PCI address space as catchall region for not mapped addressesMichael S. Tsirkin
With a help of negative memory region priority PCI address space is mapped underneath RAM regions effectively catching every access to addresses not mapped by any other region. It simplifies PCI address space mapping into system address space. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Igor Mammedov <imammedo@redhat.com> (cherry picked from commit 83d08f2673504a299194dcac1657a13754b5932a) *prereq for ddaaefb backport Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-20exec: separate sections and nodes per address spaceMarcel Apfelbaum
Every address space has its own nodes and sections, but it uses the same global arrays of nodes/section. This limits the number of devices that can be attached to the guest to 20-30 devices. It happens because: - The sections array is limited to 2^12 entries. - The main memory has at least 100 sections. - Each device address space is actually an alias to main memory, multiplying its number of nodes/sections. Remove the limitation by using separate arrays of nodes and sections for each address space. Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 53cb28cbfea038f8ad50132dc8a684e638c7d48b) Conflicts: exec.c *removed dependency on b35ba30 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-20exec: pass hw address to phys_page_findMichael S. Tsirkin
callers always shift by target page bits so let's just do this internally. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 97115a8d4500abeb090b968f01605e0bdafcdfd3) *prereq for 53cb28c backport Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-20exec: replace leaf with skipMichael S. Tsirkin
In preparation for dynamic radix tree depth support, rename is_leaf field to skip, telling us how many bits to skip to next level. Set to 0 for leaf. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 9736e55b78dc49b7f3a265932ab32ed360f633e4) *prereq for 53cb28c backport Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-20split definitions for exec.c and translate-all.c radix treesPaolo Bonzini
The exec.c and translate-all.c radix trees are quite different, and the exec.c one in particular is not limited to the CPU---it can be used also by devices that do DMA, and in that case the address space is not limited to TARGET_PHYS_ADDR_SPACE_BITS bits. We want to make exec.c's radix trees 64-bit wide. As a first step, stop sharing the constants between exec.c and translate-all.c. exec.c gets P_L2_* constants, translate-all.c gets V_L2_*, for consistency with the existing V_L1_* symbols. Though actually in the softmmu case translate-all.c is also indexed by physical addresses... This patch has no semantic change. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 03f4995781a64e106e6f73864a1e9c4163dac53b) *prereq for 53cb28c backport Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-20qdev-monitor: Avoid device_add crashing on non-device driver nameMarkus Armbruster
Watch this: $ upstream-qemu -nodefaults -S -display none -monitor stdio QEMU 1.7.50 monitor - type 'help' for more information (qemu) device_add rng-egd /work/armbru/qemu/qdev-monitor.c:491:qdev_device_add: Object 0x2089b00 is not an instance of type device Aborted (core dumped) Crashes because "rng-egd" exists, but isn't a subtype of TYPE_DEVICE. Broken in commit 18b6dad. Cc: qemu-stable@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit 061e84f7a469ad1f94f3b5f6a5361b346ab990e8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-02-20x86: only allow real mode to access 32bit without LMAAlexander Graf
When we're running in non-64bit mode with qemu-system-x86_64 we can still end up with virtual addresses that are above the 32bit boundary if a segment offset is set up. GNU Hurd does exactly that. It sets the segment offset to 0x80000000 and puts its EIP value to 0x8xxxxxxx to access low memory. This doesn't hit us when we enable paging, as there we just mask away the unused bits. But with real mode, we assume that vaddr == paddr which is wrong in this case. Real hardware wraps the virtual address around at the 32bit boundary. So let's do the same. This fixes booting GNU Hurd in qemu-system-x86_64 for me. Reported-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Alexander Graf <agraf@suse.de> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 33dfdb56f2f3c8686d218395b871ec12fd5bf30b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-15 01:23:31 +0000