summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2013-12-09Update VERSION for 1.6.2 releasev1.6.2Michael Roth1-1/+1
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09scsi_target_send_command(): amend stable-1.6 port of the CVE-2013-4344 fixLaszlo Ersek1-1/+2
The originally suggested fix for CVE-2013-4344 introduced a regression in scsi_target_send_command() / REQUEST_SENSE; the third argument passed to scsi_device_get_sense() -- for the "len" parameter -- ignored the possibility of the guest SCSI driver requesting truncated (or shorter than full) sense data. This could result in (r->len > req->cmd.xfer) on return, which is not valid SCSI. The problem was addressed in the second round, and the commit on the master branch (84642435) is correct. However the stable-1.6 branch (the v1.6.1 release) has the original, regressive fix (commit fdcbe7d5); let's update it. Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09qemu-ga: execute fsfreeze-freeze in reverse order of mountsTomoki Sekiyama1-2/+2
Currently, fsfreeze-freeze may cause deadlock if a guest has loopback mounts of image files in its disk; e.g.: # mount | grep ^/ /dev/vda1 / type ext4 (rw,noatime,seclabel,data=ordered) /tmp/disk.img on /mnt type ext4 (rw,relatime,seclabel) To avoid the deadlock, this freezes filesystems in reverse order of mounts. Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com> Reviewed-by: Eric Blake <eblake@redhat.com> *fix up commit msg Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> (cherry picked from commit e5d9adbdab972a2172815c1174aed3fabcc448f1) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09target-mips: fix 64-bit FPU config for user-mode emulationPetar Jovanovic1-2/+5
FR bit should be initialized to 1 for MIPS64, under condition that this bit is writable and that CPU has an FPU unit. It should be initialized to zero for MIPS32. This fixes different MIPS32 issues with FPU instructions whose behaviour defaulted to 64-bit FPU mode. Signed-off-by: Petar Jovanovic <petar.jovanovic@imgtec.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 4d66261f71f2efa31e1052e4041c5ee505572fe5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09seccomp: add kill() to the syscall whitelistPaul Moore1-0/+1
The kill() syscall is triggered with the following command: # qemu -sandbox on -monitor stdio \ -device intel-hda -device hda-duplex -vnc :0 The resulting syslog/audit message: # ausearch -m SECCOMP ---- time->Wed Nov 20 09:52:08 2013 type=SECCOMP msg=audit(1384912328.482:6656): auid=0 uid=0 gid=0 ses=854 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=12087 comm="qemu-kvm" sig=31 syscall=62 compat=0 ip=0x7f7a1d2abc67 code=0x0 # scmp_sys_resolver 62 kill Reported-by: CongLi <coli@redhat.com> Tested-by: CongLi <coli@redhat.com> Signed-off-by: Paul Moore <pmoore@redhat.com> Acked-by: Eduardo Otubo <otubo@linux.vnet.ibm.com> (cherry picked from commit e9eecb5bf82a71564bf018fcbbfc6cda19cab6c2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09vmdk: Fix creating big description fileFam Zheng3-31/+2060
The buffer for description file was 4096 which only covers a few hundred of extents. This changes the buffer to dynamic allocated with g_strdup_printf in order to support bigger cases. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit af057fe74092df2e7a576448ddbdc0daac1370bf) Conflicts: block/vmdk.c tests/qemu-iotests/059 tests/qemu-iotests/059.out *removed dependencies on 4823970b and 4f6fd349 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09qcow2: Zero-initialise first cluster for new imagesKevin Wolf1-16/+20
Strictly speaking, this is only required for has_zero_init() == false, but it's easy enough to just do a cluster-aligned write that is padded with zeros after the header. This fixes that after 'qemu-img create' header extensions are attempted to be parsed that are really just random leftover data. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit f8413b3c23b08a547ce18609acc6fae5fd04ed5c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09vfio-pci: Release all MSI-X vectors when disabledAlex Williamson1-0/+12
We were relying on msix_unset_vector_notifiers() to release all the vectors when we disable MSI-X, but this only happens when MSI-X is still enabled on the device. Perform further cleanup by releasing any remaining vectors listed as in-use after this call. This caused a leak of IRQ routes on hotplug depending on how the guest OS prepared the device for removal. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Cc: qemu-stable@nongnu.org (cherry picked from commit 3e40ba0faf0822fa78336fe6cd9d677ea9b14f1b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09rng-egd: offset the point when repeatedly read from the bufferAmos Kong1-1/+3
The buffer content might be read out more than once, currently we just repeatedly read the first data block, buffer offset is missing. Cc: qemu-stable@nongnu.org Signed-off-by: Amos Kong <akong@redhat.com> Message-id: 1385023371-8198-3-git-send-email-akong@redhat.com Signed-off-by: Anthony Liguori <aliguori@amazon.com> (cherry picked from commit 1eb1bd9eafa890f1f4d16ef5cb8b9239a86874d9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09pci: unregister vmstate_pcibus on unplugBandan Das1-0/+8
PCIBus registers a vmstate during init. Unregister it upon removal/unplug. Signed-off-by: Bandan Das <bsd@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 5c397242d5d53c1adecce31817bb439383cf8228) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09qdev-monitor: Unref device when device_add failsStefan Hajnoczi1-0/+2
qdev_device_add() leaks the created device upon failure. I suspect this problem crept in because qdev_free() unparents the device but does not drop a reference - confusing name. Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit ee6abeb6ec08473713848ce9028110f1684853b7) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09qdev-monitor: Fix crash when device_add is called with abstract driverIgor Mammedov1-0/+6
User is able to crash running QEMU when following monitor command is called: device_add intel-hda-generic Crash is caused by assertion in object_initialize_with_type() when type is abstract. Checking if type is abstract before instance is created in qdev_device_add() allows to prevent crash on incorrect user input. Cc: qemu-stable@nongnu.org Signed-off-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit 2fa4e56d88aa0039062bbc7f9a88e9f90c77ed94) Conflicts: qdev-monitor.c *updated to reflect different 1.6 variable names Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09qom: Fix memory leak in object_property_set_link()Vlad Yasevich1-2/+3
Save the result of the call to object_get_canonical_path() so we can free it. Cc: qemu-stable@nongnu.org Signed-off-by: Vlad Yasevich <vyasevic@redhat.com> Reviewed-by: Amos Kong <akong@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit 2d3aa28cc2cf382aa04cd577e0be542175eea9bd) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09virtio-net: fix the memory leak in rxfilter_notify()Amos Kong1-4/+4
object_get_canonical_path() returns a gchar*, it should be freed by the caller. Signed-off-by: Amos Kong <akong@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Vlad Yasevich <vyasevic@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 96e35046e4a97df5b4e1e24e217eb1e1701c7c71) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09vfio-pci: Fix multifunction=onAlex Williamson1-0/+7
When an assigned device is initialized it copies the device config space into the emulated config space. Unfortunately multifunction is setup prior to the device initfn and gets clobbered. We need to restore it just like pci-assign does. Cc: qemu-stable@nongnu.org Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 8d07d6c46597a885eb38d99cc6fff399ce69cd21) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09qcow2: fix possible corruption when reading multiple clustersPeter Lieven1-1/+1
if multiple sectors spanning multiple clusters are read the function count_contiguous_clusters should ensure that the cluster type should not change between the clusters. Especially the for-loop should break when we have one or more normal clusters followed by a compressed cluster. Unfortunately the wrong macro was used in the mask to compare the flags. This was discovered while debugging a data corruption issue when converting a compressed qcow2 image to raw. qemu-img reads 2MB chunks which span multiple clusters. CC: qemu-stable@nongnu.org Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 78a52ad5acca7053b774fcc80290e7b7e224c80a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09qcow2: count_contiguous_clusters and compressionMax Reitz1-2/+5
The function is not intended to be used on compressed clusters and will not work correctly, if used anyway, since L2E_OFFSET_MASK is not the right mask for determining the offset of compressed clusters. Therefore, assert that the first cluster is not compressed and always include the compression flag in the mask of significant flags, i.e., stop the search as soon as a compressed cluster occurs. Signed-off-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 15684a474286cc2c6106c756ddd095a21d058970) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-09Fix pc migration from qemu <= 1.5Cole Robinson4-3/+25
The following commit introduced a migration incompatibility: commit 568f0690fd9aa4d39d84b04c1a5dbb53a915c3fe Author: David Gibson <david@gibson.dropbear.id.au> Date: Thu Jun 6 18:48:49 2013 +1000 pci: Replace pci_find_domain() with more general pci_root_bus_path() The issue is that i440fx savevm idstr went from 0000:00:00.0/I440FX to 0000:00.0/I440FX. Unfortunately we are stuck with the breakage for 1.6 machine types. Add a compat property to maintain the busted idstr for the 1.6 machine types, but revert to the old style format for 1.7+, and <= 1.5. Tested with migration from qemu 1.5, qemu 1.6, and qemu.git. Cc: qemu-stable@nongnu.org Signed-off-by: Cole Robinson <crobinso@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 04c7d8b8dea724f1007f0f6e76047ff03b4cb24f) Conflicts: include/hw/i386/pc.h *removed 1.6 compat properties *enabled short_root_bus by default to enable for 1.6 (no 1.6 compat fields to do so in 1.6.x) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-03exec: fix breakpoint_invalidate when pc may not be translatedMax Filippov1-2/+4
This fixes qemu abort with the following message: include/qemu/int128.h:22: int128_get64: Assertion `!a.hi' failed. which happens due to attempt to invalidate breakpoint by virtual address for which get_phys_page_debug couldn't find mapping. For more details see http://lists.nongnu.org/archive/html/qemu-devel/2013-09/msg04582.html Cc: qemu-stable@nongnu.org Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit e8262a1b5b7cfbcbc80c46e4ce6ff7c517b7b2f6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-03virtio-net: only delete bh that existedJason Wang1-1/+1
We delete without check whether it existed during exit. This will lead NULL pointer deference since it was created conditionally depends on guest driver status and features. So add a check of existence before trying to delete it. Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1383728288-28469-1-git-send-email-jasowang@redhat.com Signed-off-by: Anthony Liguori <aliguori@amazon.com> (cherry picked from commit fe2dafa02de4f80ab36f6e0f4ddfcd6418c03c49) Conflicts: hw/net/virtio-net.c *modified to reflect timer function names for 1.6 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-03linux-user: Fix stat64 syscall for SPARC64Stefan Weil2-3/+17
Some targets use a stat64 structure for the stat64 syscall while others use a stat structure. SPARC64 used the wrong kind. Instead of extending the conditional compilation in syscall.c, now a macro TARGET_HAS_STRUCT_STAT64 is defined whenever a target has a target_stat64. Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Erik de Castro Lopo <erikd@mega-nerd.com> (cherry picked from commit 20d155bc902f41c5b354937e730ad85b43614ae9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-03configure: Explicitly set ARFLAGS so we can build with GNU Make 4.0Peter Maydell1-0/+5
Our rules.mak adds '-rR' to MAKEFLAGS to indicate that we will be explicitly specifying everything and not relying on any default variables or rules. However we were accidentally relying on the default ARFLAGS ("rv"). This went unnoticed because of a bug in GNU Make 3.82 and earlier which meant that adding -rR to MAKEFLAGS only affected submakes, not the currently running instance. Explicitly set ARFLAGS in config-host.mak, in the same way we handle CFLAGS and LDFLAGS; this will allow us to work with Make 4.0. Thanks to Paul Smith for analyzing this bug for us. Cc: qemu-stable@nongnu.org Reported-by: Ken Moffat <zarniwhoop@ntlworld.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 45d285abd7028ac72418c1a22f9298bb898fbfb8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-03tests: fix memleak in error path test for input visitorWenchao Xia1-0/+1
Signed-off-by: Wenchao Xia <xiawenc@linux.vnet.ibm.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1383676551-18806-3-git-send-email-xiawenc@linux.vnet.ibm.com Cc: qemu-stable@nongnu.org Signed-off-by: Anthony Liguori <aliguori@amazon.com> (cherry picked from commit 8aa15b6e527f234e491a6d354bed4d10da3a01a7) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-03qapi: fix memleak by adding implict struct functions in dealloc visitorWenchao Xia1-0/+20
Otherwise member "base" is leaked in a qapi_free_STRUCTURE() call. Signed-off-by: Wenchao Xia <xiawenc@linux.vnet.ibm.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1383676551-18806-2-git-send-email-xiawenc@linux.vnet.ibm.com Cc: qemu-stable@nongnu.org Signed-off-by: Anthony Liguori <aliguori@amazon.com> (cherry picked from commit 3dce9cad5a6c0b0dbe0830973b270c9466c8ab4b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-03configure: detect endian via compile testMike Frysinger1-26/+14
This avoids needing to execute a program and keeping an (incomplete) list when cross-compiling. Signed-off-by: Mike Frysinger <vapier@gentoo.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Tested-by: James Hogan <james.hogan@imgtec.com> [mips] Message-id: 1372649418-4987-1-git-send-email-vapier@gentoo.org Signed-off-by: Anthony Liguori <aliguori@amazon.com> (cherry picked from commit 61cc919f73ea7ca134c0ac41b748981ad63a253b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-03Adjust qapi-visit for python-2.4.3Richard Henderson1-3/+14
We say we support python 2.4, but python 2.4.3 does not support the "expr if test else expr" syntax used here. This allows QEMU to compile on RHEL 5.3, the last release for ia64. Signed-off-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com> (cherry picked from commit 7b75d9d61bf9b7b43f6df2fb2fbfc38c4eb9d2e9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-03memory: fix 128 arithmetic in info mtreeAlexey Kardashevskiy1-1/+3
mtree_print_mr() calls int128_get64() in 3 places but only 2 places handle 2^64 correctly. This fixes the third call of int128_get64(). Cc: qemu-stable@nongnu.org Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit a66670c79c5c7d530d818430ffcdaa25cbf2c2ab) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-03monitor: eliminate monitor_event_state_lockPaolo Bonzini1-6/+0
This lock does not protect anything that the BQL does not already protect. Furthermore, with -nodefaults and no monitor, the mutex is not initialized but monitor_protocol_event_queue is called anyway, which causes a crash under mingw (and only works by luck. under Linux or other POSIX OSes). Reported-by: Orx Goshen <orx.goshen@intel.com> Cc: Daniel Berrange <berrange@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com> (cherry picked from commit c20b7fa4b2fedd979bcb0cc974bb5d08a10e3448) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-03audio: honor QEMU_AUDIO_TIMER_PERIOD instead of waking up every *nano* secondHans de Goede1-1/+2
Now that we no longer have MIN_REARM_TIMER_NS a bug in the audio subsys has clearly shown it self by trying to make a timer fire every nano second. Note we have a similar problem in 1.6, 1.5 and older but there MIN_REARM_TIMER_NS limits the wakeups caused by audio being active to 4000 times / second. This still causes a host cpu load of 50 % for simply playing audio, where as with this patch git master is at 13%, so we should backport this to 1.5 and 1.6 too. Note this will not apply to 1.5 and 1.6 as is. Cc: qemu-stable@nongnu.org Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit b4350deed67b95651896ddb60cf9f765093a4848) Conflicts: audio/audio.c *fixed to reflect 1.6 timer function/clock names Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-03vmdk: Fix vmdk_parse_extentsFam Zheng1-2/+5
An extra 'p++' after while loop when *p == '\n' will move p to unknown data position, risking parsing junk data or memory access violation. Cc: qemu-stable@nongnu.org Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 899f1ae219d5eaa96a53c996026cb0178d62a86d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-03xen_disk: mark ioreq as mapped before unmapping in error caseMatthew Daley1-0/+1
Commit 4472beae modified the semantics of ioreq_{un,}map so that they are idempotent if called when they're not needed (ie., twice in a row). However, it neglected to handle the case where batch mapping is not being used (the default), and one of the grants fails to map. In this case, ioreq_unmap will be called to unwind and unmap any mappings already performed, but ioreq_unmap simply returns due to the aforementioned change (the ioreq has not already been marked as mapped). The frontend user can therefore force xen_disk to leak grant mappings, a per-domain limited resource. Fix by marking the ioreq as mapped before calling ioreq_unmap in this situation. Signed-off-by: Matthew Daley <mattjd@gmail.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> (cherry picked from commit a76f48e53382e6f039db6278443e3ce437653302) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-02qemu-char: Fix potential out of bounds access to local arraysStefan Weil1-2/+2
Latest gcc-4.8 supports a new option -fsanitize=address which activates an AddressSanitizer. This AddressSanitizer stops the QEMU system emulation very early because two character arrays of size 8 are potentially written with 9 bytes. Commit 6ea314d91439741e95772dfbab98b4135e04bebb added the code. There is no obvious reason why width or height could need 8 characters, so reduce it to 7 characters which together with the terminating '\0' fit into the arrays. Cc: qemu-stable <qemu-stable@nongnu.org> Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Alex Bennée <alex@bennee.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 49aa4058ac6dd0081aaa45776f07c98df397ca5e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-02misc: Use new rotate functionsStefan Weil3-13/+9
Signed-off-by: Stefan Weil <sw@weilnetz.de> (cherry picked from commit 3df2b8fde949be86d8a78923c992fdd698d4ea4c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-02bitops: Add rotate functions (rol8, ror8, ...)Stefan Weil1-0/+80
These functions were copies from include/linux/bitopts.h. Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Richard Henderson <rth@twiddle.net> (cherry picked from commit 6aa25b4a7bb10c48c3054f268d5be98e42ea42c0) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-02tci: Add implementation of rotl_i64, rotr_i64Stefan Weil2-2/+9
It is used by qemu-ppc64 when running Debian's busybox-static. Cc: qemu-stable <qemu-stable@nongnu.org> Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Richard Henderson <rth@twiddle.net> (cherry picked from commit d285bf784b6234e994ce73c05c82c9fb6429df00) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-02tests: Update .gitignore for test-int128 and test-bitopsMarkus Armbruster1-0/+2
Forgotten in commit 6046c62 and 3464700. Cc: qemu-stable@nongnu.org Reviewed-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 9dbb52e862458935c250bac9e71d5a87da4e33e9) Conflicts: tests/.gitignore *removed post-1.6 additions from diff Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-02tests: Fix schema parser test for in-tree buildMarkus Armbruster2-4/+5
Commit 4f193e3 added the test, but screwed up in-tree builds (SRCDIR=.): the tests's output overwrites the expected output, and is thus compared to itself. Cc: qemu-stable@nongnu.org Reported-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit d8039e58b1ecfdc9af171502c83e3949f6dafb95) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-02char: remove watch callback on chardev detach from frontendAmit Shah1-0/+3
If a frontend device releases the chardev (via unplug), the chr handlers are set to NULL via qdev's exit callbacks invoking qemu_chr_add_handlers(). If the chardev had a pending operation, a callback will be invoked, which will try to access data in the just-released frontend, causing a segfault. Ensure the callbacks are disabled when frontends release chardevs. This was seen when a virtio-serial port was unplugged when heavy guest->host IO was in progress (causing a callback to be registered). In the window in which the throttling was active, unplugging ports caused a qemu segfault. https://bugzilla.redhat.com/show_bug.cgi?id=985205 CC: <qemu-stable@nongnu.org> Reported-by: Sibiao Luo <sluo@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com> (cherry picked from commit 386a5a1e0057e220f79c48fe3689e3dfb17f1b09) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-02char: use common function to disable callbacks on chardev closeAmit Shah1-43/+19
This deduplicates code used a lot of times. CC: <qemu-stable@nongnu.org> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com> (cherry picked from commit 26da70c72524eb22c946ab19ec98a217b8252f7e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-12-02char: move backends' io watch tag to CharDriverStateAmit Shah2-38/+40
All the backends implement an io watcher tag for callbacks. Move it to CharDriverState from each backend's struct to make accessing the tag from backend-neutral functions easier. This will be used later to cancel a callback on chardev detach from a frontend. CC: <qemu-stable@nongnu.org> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com> (cherry picked from commit 7ba9addc165b37b764baa08c02518b15b2361707) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-10-04Update VERSION for 1.6.1 releasev1.6.1Michael Roth1-1/+1
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-10-04scsi: Allocate SCSITargetReq r->buf dynamicallyAsias He2-11/+35
BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1007330 Brew: https://brewweb.devel.redhat.com/taskinfo?taskID=6282465 This is the backport of the following commit. The patch is not sent public since it is a embargoed bug. r->buf is hardcoded to 2056 which is (256 + 1) * 8, allowing 256 luns at most. If more than 256 luns are specified by user, we have buffer overflow in scsi_target_emulate_report_luns. To fix, we allocate the buffer dynamically. Signed-off-by: Asias He <asias@redhat.com> Signed-off-by: Asias He <asias@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> *s/&r->buf/r->buf/ due to type change Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-10-01qemu: Add qemu xen logic for Xen HVM S3 resumeLiu, Jinsong1-0/+9
This patch is qemu patch 2 to fix Xen HVM S3 bug, adding qemu xen logic. When qemu wakeup, qemu xen logic is notified and hypercall to xen hypervisor to unpause domain. Signed-off-by: Liu Jinsong <jinsong.liu@intel.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> (cherry picked from commit 11addd0ab9371af2b6ec028c7fe4e4c4992252fc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-10-01qemu: Adjust qemu wakeupLiu, Jinsong3-10/+12
Currently Xen hvm s3 has a bug coming from the difference between qemu-traditioanl and qemu-xen. For qemu-traditional, the way to resume from hvm s3 is via 'xl trigger' command. However, for qemu-xen, the way to resume from hvm s3 inherited from standard qemu, i.e. via QMP, and it doesn't work under Xen. The root cause is, for qemu-xen, 'xl trigger' command didn't reset devices, while QMP didn't unpause hvm domain though they did qemu system reset. We have two qemu patches and one xl patch to fix Xen hvm s3 bug. This patch is the qemu patch 1. It adjusts qemu wakeup so that Xen s3 resume logic (which will be implemented at qemu patch 2) will be notified after qemu system reset. Signed-off-by: Liu Jinsong <jinsong.liu@intel.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> (cherry picked from commit 4bc78a877252d772b983810a7d2c0be00e9be70e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-09-30coroutine: add ./configure --disable-coroutine-poolStefan Hajnoczi2-15/+43
The 'gthread' coroutine backend was written before the freelist (aka pool) existed in qemu-coroutine.c. This means that every thread is expected to exit when its coroutine terminates. It is not possible to reuse threads from a pool. This patch automatically disables the pool when 'gthread' is used. This allows the 'gthread' backend to work again (for example, tests/test-coroutine completes successfully instead of hanging). I considered implementing thread reuse but I don't want quirks like CPU affinity differences due to coroutine threads being recycled. The 'gthread' backend is a reference backend and it's therefore okay to skip the pool optimization. Note this patch also makes it easy to toggle the pool for benchmarking purposes: ./configure --with-coroutine-backend=ucontext \ --disable-coroutine-pool Reported-by: Gabriel Kerneis <gabriel@kerneis.info> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Gabriel Kerneis <gabriel@kerneis.info> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 70c60c089fdc6bf8a79324e492c13e8c08d55942) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-09-30piix4: disable io on resetMichael S. Tsirkin1-0/+1
io base register at 0x40 is cleared on reset, but io is not disabled until some other event happens to call pm_io_space_update. Invoke pm_io_space_update directly to make this consistent. Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit c046e8c4a26c902ca1b4f5bdf668a2da6bc75f54) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-09-30vmdk: fix cluster size check for flat extentsFam Zheng1-3/+3
We use the extent size as cluster size for flat extents (where no L1/L2 table is allocated so it's safe) reuse sector calculating code with sparse extents. Don't pass in the cluster size for adding flat extent, just set it to sectors later, then the cluster size checking will not fail. The cluster_sectors is changed to int64_t to allow big flat extent. Without this, flat extent opening is broken: # qemu-img create -f vmdk -o subformat=monolithicFlat /tmp/a.vmdk 100G Formatting '/tmp/a.vmdk', fmt=vmdk size=107374182400 compat6=off subformat='monolithicFlat' zeroed_grain=off # qemu-img info /tmp/a.vmdk image: /tmp/a.vmdk file format: raw virtual size: 0 (0 bytes) disk size: 4.0K Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 301c7d38a0c359b91526391d13617386f3d9bb29) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-09-30rbd: avoid qemu_rbd_snap_list() memory leaksStefan Hajnoczi1-1/+2
When there are no snapshots qemu_rbd_snap_list() returns 0 and the snapshot table pointer is NULL. Don't forget to free the snaps buffer we allocated for librbd rbd_snap_list(). When the function succeeds don't forget to free the snaps buffer after calling rbd_snap_list_end(). Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 9e6337d0818650362149b734d53edf9489f3acaa) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-09-26tap: Use numbered tap/tun devices on all *BSD OS'sBrad Smith1-11/+0
The following patch simplifies the *BSD tap/tun code and makes use of numbered tap/tun interfaces on all *BSD OS's. NetBSD has a patch in their pkgsrc tree to make use of this feature and DragonFly also supports this as well. Signed-off-by: Brad Smith <brad@comstyle.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit aa4f082f7526d39dac8e2ca64d192d858014ee10) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2013-09-26iov: avoid "orig_len may be used unitialized" warningMichael Tokarev1-6/+4
Signed-off-by: Wenchao Xia <xiawenc@linux.vnet.ibm.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 2be178a475289286db80de5ddd7830e67e112bdd) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
generated by cgit v1.2.1 (git 2.18.0) at 2024-05-11 12:35:36 +0000