aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-09-19kvm: require JOIN_MEMORY_REGIONS_WORKSDavid Hildenbrand
We already require DESTROY_MEMORY_REGION_WORKS, JOIN_MEMORY_REGIONS_WORKS was added just half a year later. In addition, with flatview overlapping memory regions are first removed before adding the changed one. So we can't really detect joining memory regions this way. Let's just get rid of this special handling. Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20170911174933.20789-2-david@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19multiboot: validate multiboot header address valuesPrasad J Pandit
While loading kernel via multiboot-v1 image, (flags & 0x00010000) indicates that multiboot header contains valid addresses to load the kernel image. These addresses are used to compute kernel size and kernel text offset in the OS image. Validate these address values to avoid an OOB access issue. This is CVE-2017-14167. Reported-by: Thomas Garnier <thgarnie@google.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <20170907063256.7418-1-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19scsi/esp: Rename the ESP macro to ESP_STATEKamil Rytarowski
SunOS defines ESP (x86 register) in <sys/regset.h> as 7. This fixes build on SmartOS (Joyent). Signed-off-by: Kamil Rytarowski <n54@gmx.com> Message-Id: <20170909142116.26816-1-n54@gmx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19memory: Rename queue to mrqueue (memory region queue)Kamil Rytarowski
SunOS declares struct queue in <netinet/in.h>. This fixes build on SmartOS (Joyent). Patch cherry-picked from pkgsrc by jperkin (Joyent). Signed-off-by: Kamil Rytarowski <n54@gmx.com> Message-Id: <20170903163304.17919-1-n54@gmx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19MAINTAINERS: update email, add missing test entry for megasasPhilippe Mathieu-Daudé
and update maintainer email address Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20170910171557.12689-1-f4bug@amsat.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19i386/kvm: advertise Hyper-V frequency MSRsLadi Prosek
As of kernel commit eb82feea59d6 ("KVM: hyperv: support HV_X64_MSR_TSC_FREQUENCY and HV_X64_MSR_APIC_FREQUENCY"), KVM supports two new MSRs which are required for nested Hyper-V to read timestamps with RDTSC + TSC page. This commit makes QEMU advertise the MSRs with CPUID.40000003H:EAX[11] and CPUID.40000003H:EDX[8] as specified in the Hyper-V TLFS and experimentally verified on a Hyper-V host. The feature is enabled with the existing hv-time CPU flag, and only if the TSC frequency is stable across migrations and known. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20170807085703.32267-5-lprosek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19i386/kvm: introduce tsc_is_stable_and_known()Ladi Prosek
Move the "is TSC stable and known" condition to a reusable helper. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20170807085703.32267-4-lprosek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19i386/kvm: set tsc_khz before configuring Hyper-V CPUIDLadi Prosek
Timing-related Hyper-V enlightenments will benefit from knowing the final tsc_khz value. This commit just moves the code in preparation for further changes. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-Id: <20170807085703.32267-3-lprosek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19i386/kvm: use a switch statement for MSR detectionLadi Prosek
Switch is easier on the eye and might lead to better codegen. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20170807085703.32267-2-lprosek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19MAINTAINERS: update mail address for NVDIMMXiao Guangrong
My Intel mail account will be disabled soon, update the mail info to my private mail Signed-off-by: Xiao Guangrong <xiaoguangrong.eric@gmail.com> Message-Id: <1490074437-17059-1-git-send-email-guangrong.xiao@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19scsi: move block/scsi.h to include/scsi/constants.hPaolo Bonzini
Complete the transition by renaming this header, which was shared by block/iscsi.c and the SCSI emulation code. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19scsi: introduce sg_io_sense_from_errnoPaolo Bonzini
Move more knowledge of SG_IO out of hw/scsi/scsi-generic.c, for reusability. Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19scsi: introduce scsi_build_sensePaolo Bonzini
Move more knowledge of sense data format out of hw/scsi/scsi-bus.c for reusability. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19scsi: move non-emulation specific code to scsi/Paolo Bonzini
util/scsi.c includes some SCSI code that is shared by block/iscsi.c and hw/scsi, but the introduction of the persistent reservation helper will add many more instances of this. There is also include/block/scsi.h, which actually is not part of the core block layer. The persistent reservation manager will also need a home. A scsi/ directory provides one for both the aforementioned shared code and the PR manager code. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19scsi: rename scsi_build_sense to scsi_convert_sensePaolo Bonzini
After introducing the scsi/ subdirectory, there will be a scsi_build_sense function that is the same as scsi_req_build_sense but without needing a SCSIRequest. The existing scsi_build_sense function gets in the way, remove it. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19scsi-block: Support rerror/werrorFam Zheng
This makes the werror/rerror options available on the scsi-block device, to allow user specify error handling policy similar to scsi-hd. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170821141008.19383-5-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19scsi: Introduce scsi_sense_buf_to_errnoFam Zheng
This recognizes the "fixed" and "descriptor" format sense data, extracts the sense key/asc/ascq fields then converts them to an errno. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170821141008.19383-4-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19scsi: Improve scsi_sense_to_errnoFam Zheng
Tweak the errno mapping to return more accurate/appropriate values. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170821141008.19383-3-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19scsi: Refactor scsi sense interpreting codeFam Zheng
So that it can be reused outside of iscsi.c. Also update MAINTAINERS to include the new files in SCSI section. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170821141008.19383-2-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19scsi-bus: correct responses for INQUIRY and REQUEST SENSEHannes Reinecke
According to SPC-3 INQUIRY and REQUEST SENSE should return GOOD even on unsupported LUNS. Signed-off-by: Hannes Reinecke <hare@suse.com> Message-Id: <1503049022-14749-1-git-send-email-hare@suse.de> Reported-by: Laszlo Ersek <lersek@redhat.com> Fixes: ded6ddc5a7b95217557fa360913d1213e12d4a6d Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hannes Reinecke <hare@suse.de>
2017-09-19virtio-scsi: Add virtqueue_size parameter allowing virtqueue size to be set.Richard W.M. Jones
Since Linux switched to blk-mq as the default in Linux commit 5c279bd9e406 ("scsi: default to scsi-mq"), virtio-scsi LUNs consume about 10x as much guest kernel memory. This commit allows you to choose the virtqueue size for each virtio-scsi-pci controller like this: -device virtio-scsi-pci,id=scsi,virtqueue_size=16 The default is still 128 as before. Using smaller virtqueue_size allows many more disks to be added to small memory virtual machines. For a 1 vCPU, 500 MB, no swap VM I observed: With scsi-mq enabled (upstream kernel): 175 disks -"- ditto -"- virtqueue_size=64: 318 disks -"- ditto -"- virtqueue_size=16: 775 disks With scsi-mq disabled (kernel before 5c279bd9e406): 1755 disks Note that to have any effect, this requires a kernel patch: https://lkml.org/lkml/2017/8/10/689 Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Message-Id: <20170810165255.20865-1-rjones@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19target/i386: fix phminposuw in-place operationJoseph Myers
The SSE4.1 phminposuw instruction finds the minimum 16-bit element in the source vector, putting the value of that element in the low 16 bits of the destination vector, the index of that element in the next three bits and zeroing the rest of the destination. The helper for this operation fills the destination from high to low, meaning that when the source and destination are the same register, the minimum source element can be overwritten before it is copied to the destination. This patch fixes it to fill the destination from low to high instead, so the minimum source element is always copied first. This fixes one gcc test failure in my GCC 6-based testing (and so concludes the present sequence of patches, as I don't have any further gcc test failures left in that testing that I attribute to QEMU bugs). Signed-off-by: Joseph Myers <joseph@codesourcery.com> Message-Id: <alpine.DEB.2.20.1708111422580.11919@digraph.polyomino.org.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19target/i386: fix pcmpxstrx substring searchJoseph Myers
One of the cases of the SSE4.2 pcmpestri / pcmpestrm / pcmpistri / pcmpistrm instructions does a substring search. The implementation of this case in the pcmpxstrx helper is incorrect. The operation in this case is a search for a string (argument d to the helper) in another string (argument s to the helper); if a copy of d at a particular position would run off the end of s, the resulting output bit should be 0 whether or not the strings match in the region where they overlap, but the QEMU implementation was wrongly comparing only up to the point where s ends and counting it as a match if an initial segment of d matched a terminal segment of s. Here, "run off the end of s" means that some byte of d would overlap some byte outside of s; thus, if d has zero length, it is considered to match everywhere, including after the end of s. This patch fixes the implementation to correspond with the proper instruction semantics. This fixes four gcc test failures in my GCC 6-based testing. Signed-off-by: Joseph Myers <joseph@codesourcery.com> Message-Id: <alpine.DEB.2.20.1708102139310.8101@digraph.polyomino.org.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19target/i386: fix packusdw in-place operationJoseph Myers
The SSE4.1 packusdw instruction combines source and destination vectors of signed 32-bit integers into a single vector of unsigned 16-bit integers, with unsigned saturation. When the source and destination are the same register, this means each 32-bit element of that register is used twice as an input, to produce two of the 16-bit output elements, and so if the operation is carried out element-by-element in-place, no matter what the order in which it is applied to the elements, the first element's operation will overwrite some future input. The helper for packssdw avoids this issue by computing the result in a local temporary and copying it to the destination at the end; this patch fixes the packusdw helper to do likewise. This fixes three gcc test failures in my GCC 6-based testing. Signed-off-by: Joseph Myers <joseph@codesourcery.com> Message-Id: <alpine.DEB.2.20.1708100023050.9262@digraph.polyomino.org.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19target/i386: set rip_offset for further SSE instructionsJoseph Myers
It turns out that my recent fix to set rip_offset when emulating some SSE4.1 instructions needs generalizing to cover a wider class of instructions. Specifically, every instruction in the sse_op_table7 table, coming from various instruction set extensions, has an 8-bit immediate operand that comes after any memory operand, and so needs rip_offset set for correctness if there is a memory operand that is rip-relative, and my patch only set it for a subset of those instructions. This patch moves the rip_offset setting to cover the wider class of instructions, so fixing 9 further gcc testsuite failures in my GCC 6-based testing. (I do not know whether there might be still further classes of instructions missing this setting.) Signed-off-by: Joseph Myers <joseph@codesourcery.com> Message-Id: <alpine.DEB.2.20.1708082350340.23380@digraph.polyomino.org.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19target/i386: fix pmovsx/pmovzx in-place operationsJoseph Myers
The SSE4.1 pmovsx* and pmovzx* instructions take packed 1-byte, 2-byte or 4-byte inputs and sign-extend or zero-extend them to a wider vector output. The associated helpers for these instructions do the extension on each element in turn, starting with the lowest. If the input and output are the same register, this means that all the input elements after the first have been overwritten before they are read. This patch makes the helpers extend starting with the highest element, not the lowest, to avoid such overwriting. This fixes many GCC test failures (161 in the gcc testsuite in my GCC 6-based testing) when testing with a default CPU setting enabling those instructions. Signed-off-by: Joseph Myers <joseph@codesourcery.com> Message-Id: <alpine.DEB.2.20.1708082018390.23380@digraph.polyomino.org.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-09-19Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into stagingPeter Maydell
# gpg: Signature made Tue 19 Sep 2017 01:10:40 BST # gpg: using RSA key 0x7DEF8106AAFC390E # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" # Primary key fingerprint: FAEB 9711 A12C F475 812F 18F2 88A9 064D 1835 61EB # Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76 CBD0 7DEF 8106 AAFC 390E * remotes/jnsnow/tags/ide-pull-request: hw/block/fdc: Convert to realize hw/ide: Convert DeviceClass init to realize AHCI: remove DPRINTF macro AHCI: pretty-print FIS to buffer instead of stderr AHCI: Rework IRQ constants AHCI: Replace DPRINTF with trace-events IDE: replace DEBUG_AIO with trace events ATAPI: Replace DEBUG_IDE_ATAPI with tracing events IDE: add tracing for data ports IDE: Add register hints to tracing IDE: replace DEBUG_IDE with tracing system hw/ide/microdrive: Mark the dscm1xxxx device with user_creatable = false ide: ahci: unparent children buses before freeing their memory Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-09-18hw/block/fdc: Convert to realizeMao Zhongyi
Convert floppy_drive_init() to realize and rename it to floppy_drive_realize(). Cc: John Snow <jsnow@redhat.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: Max Reitz <mreitz@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 87119b34f32e2acf7166165fb5d8e6fca787b3bc.1505737465.git.maozy.fnst@cn.fujitsu.com Signed-off-by: John Snow <jsnow@redhat.com>
2017-09-18hw/ide: Convert DeviceClass init to realizeMao Zhongyi
Replace init with realize in IDEDeviceClass, which has errp as a parameter. So all the implementations now use error_setg instead of error_report for reporting error. Cc: John Snow <jsnow@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: Max Reitz <mreitz@redhat.com> Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: c4d27b4b5d9e37468e63e35214ce4833ca271542.1505737465.git.maozy.fnst@cn.fujitsu.com Signed-off-by: John Snow <jsnow@redhat.com>
2017-09-18AHCI: remove DPRINTF macroJohn Snow
Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20170901001502.29915-10-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2017-09-18AHCI: pretty-print FIS to buffer instead of stderrJohn Snow
The current FIS printing routines dump the FIS to screen. adjust this such that it dumps to buffer instead, then use this ability to have FIS dump mechanisms via trace-events instead of compiled defines. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20170901001502.29915-9-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2017-09-18AHCI: Rework IRQ constantsJohn Snow
Create a new enum so that we can name the IRQ bits, which will make debugging them a little nicer if we can print them out. Not handled in this patch, but this will make it possible to get a nice debug printf detailing exactly which status bits are set, as it can be multiple at any given time. As a consequence of this patch, it is no longer possible to set multiple IRQ codes at once, but nothing was utilizing this ability anyway. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20170901001502.29915-8-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2017-09-18AHCI: Replace DPRINTF with trace-eventsJohn Snow
There are a few hangers-on that will be dealt with individually in forthcoming patches. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20170901001502.29915-7-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2017-09-18IDE: replace DEBUG_AIO with trace eventsJohn Snow
Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20170901001502.29915-6-jsnow@redhat.com [Edited enum conditional for Clang --js] Signed-off-by: John Snow <jsnow@redhat.com>
2017-09-18ATAPI: Replace DEBUG_IDE_ATAPI with tracing eventsJohn Snow
As part of the ongoing effort to modernize the tracing facilities for the IDE family of devices, remove PRINTFs in the ATAPI device with actual tracing events. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20170901001502.29915-5-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2017-09-18IDE: add tracing for data portsJohn Snow
To be used sparingly, but still interesting in the case of small firmwares designed to reproduce bugs in QEMU IDE. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20170901001502.29915-4-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2017-09-18IDE: Add register hints to tracingJohn Snow
Name the registers for tracing purposes. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20170901001502.29915-3-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2017-09-18IDE: replace DEBUG_IDE with tracing systemJohn Snow
Remove the DEBUG_IDE preprocessor definition with something more appropriately flexible, using the trace-events subsystem. This will be less prone to bitrot and will more effectively allow us to target just the functions we care about. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20170901001502.29915-2-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2017-09-18hw/ide/microdrive: Mark the dscm1xxxx device with user_creatable = falseThomas Huth
QEMU currently aborts with an assertion message when the user is trying to remove a dscm1xxxx again: $ aarch64-softmmu/qemu-system-aarch64 -S -M integratorcp -nographic QEMU 2.9.93 monitor - type 'help' for more information (qemu) device_add dscm1xxxx,id=xyz (qemu) device_del xyz ** ERROR:qemu/qdev-monitor.c:872:qdev_unplug: assertion failed: (hotplug_ctrl) Aborted (core dumped) Looks like this device has to be wired up in code and is not meant to be hot-pluggable, so let's mark it with user_creatable = false. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1503543783-17192-1-git-send-email-thuth@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2017-09-18ide: ahci: unparent children buses before freeing their memoryIgor Mammedov
Fixes read after freeing error reported https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg04243.html Message-Id: <59a56959-ca12-ea75-33fa-ff07eba1b090@redhat.com> ich9-ahci device creates ide buses and attaches them as QOM children at realize time, however it forgets to properly clean them up at unrealize time and frees memory containing these children, with following call-chain: qdev_device_add() object_property_set_bool('realized', true) device_set_realized() ... pci_qdev_realize() -> pci_ich9_ahci_realize() -> ahci_realize() ... s->dev = g_new0(AHCIDevice, ports); ... AHCIDevice *ad = &s->dev[i]; ide_bus_new(&ad->port, sizeof(ad->port), qdev, i, 1); ^^^ creates bus in memory allocated by above gnew() and adds it as child propety to ahci device ... hotplug_handler_plug(); -> goto post_realize_fail; pci_qdev_unrealize() -> pci_ich9_uninit() -> ahci_uninit() ... g_free(s->dev); ^^^ free memory that holds children busses return with error from device_set_realized() As result later when qdev_device_add() tries to unparent ich9-ahci after failed device_set_realized(), object_unparent() -> object_property_del_child() iterates over existing QOM children including buses added by ide_bus_new() and tries to unparent them, which causes access to freed memory where they where located. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1503938085-169486-1-git-send-email-imammedo@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2017-09-18Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/audio-20170918-pull-request' into staging audio: bugfixes for wm8750 and intel-hda. # gpg: Signature made Mon 18 Sep 2017 12:15:26 BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/audio-20170918-pull-request: audio: intel-hda: do not use old_mmio accesses wm8750: add record buffer underrun check Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-09-18audio: intel-hda: do not use old_mmio accessesMatt Parker
intel-hda is currently using the old_mmio accessors for io. This updates the device to use .read and .write accessors instead. Signed-off-by: Matt Parker <mtparkr@gmail.com> Message-id: 20170827192038.28930-1-mtparkr@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-09-18wm8750: add record buffer underrun checkGerd Hoffmann
Reported-by: niuguoxiang@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170901131409.6712-1-kraxel@redhat.com
2017-09-18qemu.py: Fix syntax errorKevin Wolf
Python requires parentheses around multiline expression. This fixes the breakage of all Python-based qemu-iotests cases that was introduced in commit dab91d9aa0. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-id: 20170918052524.4045-1-kwolf@redhat.com Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-09-17Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20170917' into stagingPeter Maydell
tcg queued patches # gpg: Signature made Sun 17 Sep 2017 16:03:28 BST # gpg: using RSA key 0x64DF38E8AF7E215F # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth/tags/pull-tcg-20170917: tcg/mips: Fully convert tcg_target_op_def tcg/sparc: Fully convert tcg_target_op_def tcg/ppc: Fully convert tcg_target_op_def tcg/arm: Fully convert tcg_target_op_def tcg/aarch64: Fully convert tcg_target_op_def tcg: Fix types in tcg_regset_{set,reset}_reg tcg: Remove tcg_regset_set32 tcg: Remove tcg_regset_{or,and,andnot,not} tcg: Remove tcg_regset_set tcg: Remove tcg_regset_clear tcg: Add tcg_op_supported accel/tcg: move USER code to user-exec.c accel/tcg: move atomic_template.h to accel/tcg/ accel/tcg: move tcg-runtime to accel/tcg/ accel/tcg: move user-exec to accel/tcg/ accel/tcg: move softmmu_template.h to accel/tcg/ tcg/ppc: disable atomic write check on ppc32 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-09-17tcg/mips: Fully convert tcg_target_op_defRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2017-09-17tcg/sparc: Fully convert tcg_target_op_defRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2017-09-17tcg/ppc: Fully convert tcg_target_op_defRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2017-09-17tcg/arm: Fully convert tcg_target_op_defRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2017-09-17tcg/aarch64: Fully convert tcg_target_op_defRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-02-01 01:55:05 +0000