summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-08-15Update VERSION for 2.0.1 releasev2.0.1Michael Roth1-1/+1
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-07mirror: Fix qiov size for short requestsKevin Wolf3-3/+10
When mirroring an image of a size that is not a multiple of the mirror job granularity, the last request would have the right nb_sectors argument, but a qiov that is rounded up to the next multiple of the granularity. Don't do this. This fixes a segfault that is caused by raw-posix being confused by this and allocating a buffer with request length, but operating on it with qiov length. [s/Driver/Drive/ in qemu-iotests 041 as suggested by Eric --Stefan] Reported-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Tested-by: Eric Blake <eblake@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 5a0f6fd5c84573387056e0464a7fc0c6fb70b2dc) Conflicts: tests/qemu-iotests/041.out *updated 041.out to reflect tests missing from 2.0 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-07qemu-iotests: Test 0-length image for mirrorFam Zheng2-5/+10
All behavior and invariant should hold for images with 0 length, so add a class to repeat all the tests in TestSingleDrive. Hide two unapplicable test methods that would fail with 0 image length because it's also used as cluster size. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 3b9f27d2b34cb8c5cc6cec993712c7e1943e9de9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-07block: make 'top' argument to block-commit optionalJeff Cody4-17/+39
Now that active layer block-commit is supported, the 'top' argument no longer needs to be mandatory. Change it to optional, with the default being the active layer in the device chain. [kwolf: Rebased and resolved conflict in tests/qemu-iotests/040] Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Benoit Canet <benoit@irqsave.net> Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 7676e2c597000eff3a7233b40cca768b358f9bc9) Conflicts: qapi/block-core.json *removed dependency on 1ad166b6 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-07qemu-iotests: Test BLOCK_JOB_READY event for 0Kb image active commitFam Zheng2-5/+11
There should be a BLOCK_JOB_READY event with active commit, regardless of image length. Let's test the 0 length image case, and make sure it goes through the ready->complete process. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 8b9a30ca5bc10545637429486836f3c206c39fab) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-07mirror: Go through ready -> complete process for 0 len imageFam Zheng1-1/+10
When mirroring or active committing a zero length image, BLOCK_JOB_READY is not reported now, instead the job completes because we short circuit the mirror job loop. This is inconsistent with non-zero length images, and only confuses management software. Let's do the same thing when seeing a 0-length image: report ready immediately; wait for block-job-cancel or block-job-complete; clear the cancel flag as existing non-zero image synced case (cancelled after ready); then jump to the exit. Reported-by: Eric Blake <eblake@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 9e48b025400b2d284e17860862b0a4aa02c6032d) *removed dependency on bcada37b Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-07blockjob: Add block_job_yield()Fam Zheng2-0/+22
This will unset busy flag and put coroutine to sleep, can be used to wait for QMP complete/cancel. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit dc71ce45ded4e872e25c2de32d5e7a71842b0985) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-07mirror: Fix resource leak when bdrv_getlength failsFam Zheng1-2/+2
The direct return will skip releasing of all the resouces at immediate_exit, don't miss that. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 373df5b135b4a54e0abb394e9e703fef3ded093c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06hw/arm/boot: Set PC correctly when loading AArch64 ELF filesPeter Maydell1-2/+6
The code in do_cpu_reset() correctly handled AArch64 CPUs when running Linux kernels, but was missing code in the branch of the if() that deals with loading ELF files. Correctly jump to the ELF entry point on reset rather than leaving the reset PC at zero. Reported-by: Christopher Covington <cov@codeaurora.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Christopher Covington <cov@codeaurora.org> Cc: qemu-stable@nongnu.org (cherry picked from commit a9047ec3f6ab56295cba5b07e0d46cded9e2a7ff) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06hw/misc/imx_ccm.c: Add missing VMState list terminatorPeter Maydell1-0/+1
The VMStateDescription for the imx_ccm device was missing its terminator. Found by static search of the codebase using a regex based on one suggested by Ian Jackson: pcregrep -rMi '(?s)VMStateField(?:(?!END_OF_LIST).)*?;' $(git grep -l 'VMStateField\[\]') Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org (cherry picked from commit ef493d5c291e4689d64ff4973915a7442109a5c5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06vmstate_xhci_event: fix unterminated field listLaszlo Ersek1-0/+1
"vmstate_xhci_event" was introduced in commit 37352df3 ("xhci: add live migration support"), and first released in v1.6.0. The field list in this VMSD is not terminated with the VMSTATE_END_OF_LIST() macro. During normal use (ie. migration), the issue is practically invisible, because the "vmstate_xhci_event" object (with the unterminated field list) is only ever referenced -- via "vmstate_xhci_intr" -- if xhci_er_full() returns true, for the "ev_buffer" test. Since that field_exists() check (apparently) almost always returns false, we almost never traverse "vmstate_xhci_event" during migration, which hides the bug. However, Amit's vmstate checker forces recursion into this VMSD as well, and the lack of VMSTATE_END_OF_LIST() breaks the field list terminator check (field->name != NULL) in dump_vmstate_vmsd(). The result is undefined behavior, which in my case translates to infinite recursion (because the loop happens to overflow into "vmstate_xhci_intr", which then links back to "vmstate_xhci_event"). Add the missing terminator. Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 3afca1d6d413592c2b78cf28f52fa24a586d8f56) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06kvm-all: Use 'tmpcpu' instead of 'cpu' in sub-looping to avoid 'cpu' be NULLChen Gang1-2/+3
If kvm_arch_remove_sw_breakpoint() in CPU_FOREACH() always be fail, it will let 'cpu' NULL. And the next kvm_arch_remove_sw_breakpoint() in QTAILQ_FOREACH_SAFE() will get NULL parameter for 'cpu'. And kvm_arch_remove_sw_breakpoint() can assumes 'cpu' must never be NULL, so need define additional temporary variable for 'cpu' to avoid the case. Cc: qemu-stable@nongnu.org Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit dc54e2525389e903cee2b847cf761b5d857f75cb) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06cadence_uart: check for serial backend before using it.KONRAD Frederic1-4/+11
This checks that s->chr is not NULL before using it. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit af52fe862fba686713044efdf9158195f84535ab) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06s390x/kvm: synchronize guest floating point registersJason J. Herne1-0/+23
Add code to kvm_arch_get_registers and kvm_arch_put_registers to save/restore floating point registers. This missing sync was unnoticed until migration of userspace that uses fprs. Signed-off-by: Jason J. Herne <jjherne@us.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> [Update patch to latest upstream] Cc: qemu-stable@nongnu.org Reviewed-by: Alexander Graf <agraf@suse.de> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> (cherry picked from commit 85ad6230b3af048109b3e949ca95ade4dd9a0bfa) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06disas/libvixl: prepend the include path of libvixl header filesStefano Stabellini2-2/+2
Currently the Makefile of disas/libvixl appends -I$(SRC_PATH)/disas/libvixl to QEMU_CFLAGS. As a consequence C++ files that #include "utils.h", such as disas/libvixl/a64/instructions-a64.cc, are going to look for utils.h on all the other include paths first. When building QEMU as part of the Xen make system, another unrelated utils.h file is going to be chosen for inclusion, causing a build failure: In file included from disas/libvixl/a64/instructions-a64.cc:27:0: /qemu/disas/libvixl/a64/instructions-a64.h:88:64: error: 'rawbits_to_float' was not declared in this scope const float kFP32PositiveInfinity = rawbits_to_float(0x7f800000); Fix the problem by prepending (rather than appending) the libvixl include path to QEMU_CFLAGS. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 834fb1b269f4c9eb0ffc058fd6ab5a018c3bce1f) *added 2.0-specific fixup from Stefano in disas/Makefile.obj due to lack of 849d8284 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06mc146818rtc: register the clock reset notifier on the right clockPaolo Bonzini1-1/+1
Commit 884f17c (aio / timers: Convert rtc_clock to be a QEMUClockType, 2013-08-21) erroneously changed an occurrence of rtc_clock to QEMU_CLOCK_REALTIME, which broke the RTC reset notifier in mc146818rtc. Fix this. I redid the patch myself since the original reporter did not sign off on his. Cc: qemu-stable@nongnu.org Reported-by: Lb peace <peaceustc@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 13c0cbaec5698f3984606e52bfcfb63ddfc29f00) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06pci: assign devfn to pci_dev before calling pci_device_iommu_address_space()Le Tan1-1/+1
In function do_pci_register_device() in file hw/pci/pci.c, move the assignment of pci_dev->devfn to the position before the call to pci_device_iommu_address_space(pci_dev) which will use the value of pci_dev->devfn. Fixes: 9eda7d373e9c691c070eddcbe3467b991f67f6bd pci: Introduce helper to retrieve a PCI device's DMA address space Cc: qemu-stable@nongnu.org Signed-off-by: Le Tan <tamlokveer@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit efc8188e9398e54567b238b756eec2cc746cd2a4) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06Allow mismatched virtio config-lenDr. David Alan Gilbert1-5/+11
Commit 'virtio: validate config_len on load' restricted config_len loaded from the wire to match the config_len that the device had. Unfortunately, there are cases where this isn't true, the one we found it on was the wce addition in virtio-blk. Allow mismatched config-lengths: *) If the version on the wire is shorter then fine *) If the version on the wire is longer, load what we have space for and skip the rest. (This is mst@redhat.com's rework of what I originally posted) Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 2f5732e9648fcddc8759a8fd25c0b41a38352be6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06virtio: validate config_len on loadMichael S. Tsirkin1-1/+7
Malformed input can have config_len in migration stream exceed the array size allocated on destination, the result will be heap overflow. To fix, that config_len matches on both sides. CVE-2014-0182 Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> -- v2: use %ix and %zx to print config_len values Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit a890a2f9137ac3cf5b607649e66a6f3a5512d8dc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06virtio: out-of-bounds buffer write on invalid state loadMichael S. Tsirkin1-1/+7
CVE-2013-4151 QEMU 1.0 out-of-bounds buffer write in virtio_load@hw/virtio/virtio.c So we have this code since way back when: num = qemu_get_be32(f); for (i = 0; i < num; i++) { vdev->vq[i].vring.num = qemu_get_be32(f); array of vqs has size VIRTIO_PCI_QUEUE_MAX, so on invalid input this will write beyond end of buffer. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit cc45995294b92d95319b4782750a3580cabdbc0c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06hw: Fix qemu_allocate_irqs() leaksAndreas Färber14-29/+28
Replace qemu_allocate_irqs(foo, bar, 1)[0] with qemu_allocate_irq(foo, bar, 0). This avoids leaking the dereferenced qemu_irq *. Cc: Markus Armbruster <armbru@redhat.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andreas Färber <afaerber@suse.de> [PC Changes: * Applied change to instance in sh4/sh7750.c ] Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Kirill Batuzov <batuzovk@ispras.ru> [AF: Fix IRQ index in sh4/sh7750.c] Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit f3c7d0389fe8a2792fd4c1cf151b885de03c8f62) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06sdhci: Fix misuse of qemu_free_irqs()Andreas Färber1-2/+2
It does a g_free() on the pointer, so don't pass a local &foo reference. Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit 127a4e1a51c038ec9167083b65d376dddcc64530) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-06pc: make isapc and pc-0.10 to pc-0.13 have 1.7.0 memory layoutDon Slutz1-0/+6
QEMU 2.0 changed memory layout for isapc and pc-0.10 to pc-0.13. This prevents migration from QEMU 1.7.0 for these machine types when -m 3.5G is specified. Paolo Bonzini asked that: smbios_legacy_mode = true; has_reserved_memory = false; option_rom_has_mr = true; rom_file_has_mr = false; also be done. Cc: qemu-stable@nongnu.org Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Don Slutz <dslutz@verizon.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Fixes: https://bugs.launchpad.net/qemu/+bug/1334307 Tested-by: "Slutz, Donald Christopher" <dslutz@verizon.com> (cherry picked from commit 5f8632d3c3d7bc5ef24166ba7cf90fcfb2adbf7d) Conflicts: hw/i386/pc_piix.c *removed dependency on c97294ec: smbios_legacy_mode always true pre-2.1.0 *removed dependency on de268e13: has_reserved_memory always false pre-2.1.0 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05SMBIOS: Rename symbols to better reflect future useGabriel L. Somlo5-22/+28
Rename the following symbols: - smbios_set_type1_defaults() to the more general smbios_set_defaults(); - bool smbios_type1_defaults to the more general smbios_defaults; - smbios_get_table() to smbios_get_table_legacy(); This patch contains no functional changes. Signed-off-by: Gabriel Somlo <somlo@cmu.edu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit e6667f719caa7b5edcb491f61a7744f6a6affd27) Conflicts: hw/i386/pc_piix.c hw/i386/pc_q35.c *removed dependency on 3458b2b0 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05nbd: Shutdown socket before closing.Hani Benhabiles2-0/+2
This forces finishing data sending to client before closing the socket like in exports listing or replying with NBD_REP_ERR_UNSUP cases. Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 27e5eae4577316f7e86a56eb7363d4e78f79e3e5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05nbd: Close socket on negotiation failure.Hani Benhabiles2-3/+5
Otherwise, the nbd client may hang waiting for the server response. Signed-off-by: Hani Benhabiles <hani@linux.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 36af599417dde11747a27dc8550ff2281657a8ff) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05nbd: Don't validate from and len in NBD_CMD_DISC.Hani Benhabiles1-3/+4
These values aren't used in this case. Currently, the from field in the request sent by the nbd kernel module leading to a false error message when ending the connection with the client. $ qemu-nbd some.img -v // After nbd-client -d /dev/nbd0 nbd.c:nbd_trip():L1031: From: 18446744073709551104, Len: 0, Size: 20971520, Offset: 0 nbd.c:nbd_trip():L1032: requested operation past EOF--bad client? nbd.c:nbd_receive_request():L638: read failed Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 8c5d1abbb79193dca8e4823ef53d8d1e650362ae) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05nbd: Don't export a block device with no medium.Hani Benhabiles1-0/+4
The device is exported with erroneous values and can't be read. Before the patch: $ sudo nbd-client localhost -p 10809 /dev/nbd0 -name floppy0 Negotiation: ..size = 17592186044415MB bs=1024, sz=18446744073709547520 bytes $ sudo mount /dev/nbd0 /mnt/tmp/ mount: block device /dev/nbd0 is write-protected, mounting read-only mount: /dev/nbd0: can't read superblock After the patch: (qemu) nbd_server_add ide0-hd0 (qemu) nbd_server_add floppy0 Device 'floppy0' has no medium Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 60fe4fac22895576973e317d7148b084c31cc64c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05virtio-serial: don't migrate the config spaceAlexander Graf1-10/+6
The device configuration is set at realize time and never changes. It should not be migrated as it is done today. For the sake of compatibility, let's just skip them at load time. Signed-off-by: Alexander Graf <agraf@suse.de> [ added missing casts to uint16_t *, added From, SoB and commit message, Greg Kurz <gkurz@linux.vnet.ibm.com> ] Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit e38e943a1fa20d04deb1899be19b12aadec7a585) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05virtio-net: byteswap virtio-net headerCédric Le Goater1-0/+17
TCP connectivity fails when the guest has a different endianness. The packets are silently dropped on the host by the tap backend when they are read from user space because the endianness of the virtio-net header is in the wrong order. These lines may appear in the guest console: [ 454.709327] skbuff: bad partial csum: csum=8704/4096 len=74 [ 455.702554] skbuff: bad partial csum: csum=8704/4096 len=74 The issue that got first spotted with a ppc64le PowerKVM guest, but it also exists for the less common case of a x86_64 guest run by a big-endian ppc64 TCG hypervisor. Signed-off-by: Cédric Le Goater <clg@fr.ibm.com> [ Ported from PowerKVM, Greg Kurz <gkurz@linux.vnet.ibm.com> ] Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 032a74a1c0fcdd5fd1c69e56126b4c857ee36611) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05target-i386: Filter FEAT_7_0_EBX TCG features tooEduardo Habkost1-1/+2
The TCG_7_0_EBX_FEATURES macro was defined but never used (it even had a typo that was never noticed). Make the existing TCG feature filtering code use it. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit d0a70f46fa9a3257089a56f2f620b0eff868557f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05target-i386: Make TCG feature filtering more readableEduardo Habkost1-6/+10
Instead of an #ifdef in the middle of the code, just set TCG_EXT2_FEATURES to a different value depending on TARGET_X86_64. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit a42d9938a162c3e3c9e441d1927dca5bd59167d9) Conflicts: target-i386/cpu.c *removed dependency on 77549a78 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05hw/xtensa/xtfpga: fix FLASH mapping to boot region for KC705Max Filippov1-3/+5
On KC705 bootloader area is located at FLASH offset 0x06000000, not 0 as on older xtfpga boards. Cc: qemu-stable@nongnu.org Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> (cherry picked from commit 37ed7c4b24f265c2a8c7248666544c9755514ec2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05coroutine-win32.c: Add noinline attribute to work around gcc bugPeter Maydell1-2/+11
A gcc codegen bug in x86_64-w64-mingw32-gcc (GCC) 4.6.3 means that non-debug builds of QEMU for Windows tend to assert when using coroutines. Work around this by marking qemu_coroutine_switch as noinline. If we allow gcc to inline qemu_coroutine_switch into coroutine_trampoline, then it hoists the code to get the address of the TLS variable "current" out of the while() loop. This is an invalid transformation because the SwitchToFiber() call may be called when running thread A but return in thread B, and so we might be in a different thread context each time round the loop. This can happen quite often. Typically. a coroutine is started when a VCPU thread does bdrv_aio_readv: VCPU thread main VCPU thread coroutine I/O coroutine bdrv_aio_readv -----> start I/O operation thread_pool_submit_co <------------ yields back to emulation Then I/O finishes and the thread-pool.c event notifier triggers in the I/O thread. event_notifier_ready calls thread_pool_co_cb, and the I/O coroutine now restarts *in another thread*: iothread main iothread coroutine I/O coroutine (formerly in VCPU thread) event_notifier_ready thread_pool_co_cb -----> current = I/O coroutine; call AIO callback But on Win32, because of the bug, the "current" being set here the current coroutine of the VCPU thread, not the iothread. noinline is a good-enough workaround, and quite unlikely to break in the future. (Thanks to Paolo Bonzini for assistance in diagnosing the problem and providing the detailed example/ascii art quoted above.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1403535303-14939-1-git-send-email-peter.maydell@linaro.org Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <rth@twiddle.net> (cherry picked from commit ff4873cb8c81db89668d8b56e19e57b852edb5f5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05q35: Use PC_Q35_COMPAT_1_4 on pc-q35-1.4 compat_propsEduardo Habkost1-1/+1
pc-q35-1.4 was incorrectly using PC_COMPAT_1_4 instead of PC_Q35_COMPAT_1_4. The only side-effect was that the hpet compat property (inherited from PC_Q35_COMPAT_1_7) was missing. Without this patch, pc-q35-1.4 inicorrectly initializes hpet-intcap to 0xff0104 (behavior introduced in QEMU 2.0, by commit 7a10ef51c2397ac4323bc786af02c58b413b5cd2). Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> (cherry picked from commit 48cb7f3c1526b4632bd63d945cac80d26616d6f5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05KVM: Fix GSI number space limitAlexander Graf1-1/+1
KVM tells us the number of GSIs it can handle inside the kernel. That value is basically KVM_MAX_IRQ_ROUTES. However when we try to set the GSI mapping table, it checks for r = -EINVAL; if (routing.nr >= KVM_MAX_IRQ_ROUTES) goto out; erroring out even when we're only using all of the GSIs. To make sure we never hit that limit, let's reduce the number of GSIs we get from KVM by one. Cc: qemu-stable@nongnu.org Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 00008418aa22700f6c49e794e79f53aeb157d10f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05usb: Fix usb-bt-dongle initialization.Hani Benhabiles1-8/+16
Due to an incomplete initialization, adding a usb-bt-dongle device through HMP or QMP will cause a segmentation fault. Signed-off-by: Hani Benhabiles <hani@linux.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit c340a284f382a5f40774521f41b4bade76ddfa58) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05virtio-scsi: define dummy handle_output for vhost-scsi vqsMing Lei3-7/+22
vhost userspace needn't to handle vq's notification from guest, so define dummy handle_output callback for all vqs of vhost-scsi. In some corner cases(such as when handling vq's reset from VM), virtio-pci still trys to handle pending virtio-scsi events, then object check failure inside virtio_scsi_handle_event() for vhost-scsi can be triggered. The issue can be reproduced by 'rmmod virtio-scsi', 'system sleep' or reboot inside VM. Cc: qemu-stable@nongnu.org Cc: Anthony Liguori <aliguori@amazon.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 91d670fbf9945ca4ecbd123affb36889e7fe8a5d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05vhost: fix resource leak in error handlingMichael S. Tsirkin1-4/+6
vhost_verify_ring_mappings leaks mappings on error. Fix this up. Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 8617343faae6ba7e916137c6c9e3ef22c00565d8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05scsi-disk: fix bug in scsi_block_new_request() introduced by commit 137745cUlrich Obergfell1-1/+1
This patch fixes a bug in scsi_block_new_request() that was introduced by commit 137745c5c60f083ec982fe9e861e8c16ebca1ba8. If the host cache is used - i.e. if BDRV_O_NOCACHE is _not_ set - the 'break' statement needs to be executed to 'fall back' to SG_IO. Cc: qemu-stable@nongnu.org Signed-off-by: Ulrich Obergfell <uobergfe@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 2fe5a9f73b3446690db2cae8a58473b0b4beaa32) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05qdev: recursively unrealize devices when unrealizing busPaolo Bonzini1-1/+12
When the patch was posted that became 5c21ce7 (qdev: Realize buses on device realization, 2014-03-12), it included recursive realization and unrealization of devices when the bus's "realized" property was toggled. However, due to the same old worries about recursive realization and prerequisites not being realized yet, those hunks were dropped when committing the patch. Unfortunately, this causes a use-after-free bug (easily reproduced by a PCI hot-unplug action). Before the patch, device_unparent behaved as follows: for each child bus unparent bus ----------------------------. | for each child device | | unparent device ---------------. | | | unrealize device | | | | call dc->unparent | | | '------------------------------- | '----------------------------------------' unrealize device After the patch, it behaves as follows instead: unrealize device --------------------. | for each child bus | | unrealize bus (A) | '------------------------------------' for each child bus unparent bus ----------------------. | for each child device | | unrealize device (B) | | call dc->unparent | '----------------------------------' At the step marked (B) the device might use data from the bus that is not available anymore due to step (A). To fix this, we need to unrealize devices before step (A). To sidestep concerns about recursive realization, only do recursive unrealization and leave the "value && !bus->realized" case as it is. The resulting flow is: for each child bus unrealize bus ---------------------. | for each child device | | unrealize device (B) | | call bc->unrealize (A) | '----------------------------------' unrealize device for each child bus unparent bus ----------------------. | for each child device | | unparent device | '----------------------------------' where everything is "powered down" before it is unassembled. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit 5942a19040fed313b316ab7b6e3d2d8e7b1625bb) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05qdev: reorganize error reporting in bus_set_realizedPaolo Bonzini1-13/+5
No semantic change. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit b7b34d055d82abaa511b35c9fc24efbb63dca0b1) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05hw: Consistently name Error ** objects errp, and not errMarkus Armbruster3-14/+14
Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit a7737e4496aa3c1c8c3a4b4b9d5e44875fe21e12) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05rdma: bug fixesMichael R. Hines1-10/+10
1. Fix small memory leak in parsing inet address from command line in data_init() 2. Fix ibv_post_send() return value check and pass error code back up correctly. 3. Fix rdma_destroy_qp() segfault after failure to connect to destination. Reported-by: frank.yangjie@gmail.com Reported-by: dgilbert@redhat.com Signed-off-by: Michael R. Hines <mrhines@us.ibm.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit e325b49a320b493cc5d69e263751ff716dc458fe) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05migration: catch unknown flags in ram_loadPeter Lieven2-20/+24
if a saved vm has unknown flags in the memory data qemu currently simply ignores this flag and continues which yields in an unpredictable result. This patch catches all unknown flags and aborts the loading of the vm. Additionally error reports are thrown if the migration aborts abnormally. Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit db80facefa62dff42bb50c73b0f03eda5f732b49) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05arch_init: Be sure of only one exit entry with DPRINTF() for ram_load()Chen Gang1-4/+8
When DPRINTF() has effect, the original author wants to print all ram_load() calling results. So need use 'goto' instead of 'return' within ram_load(), just like other areas have done. Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 4798fe55c4d539ddf8c7f5befcddfa145b3c6102) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05migration: remove duplicate codeChenLiang1-35/+33
version_id is checked twice in the ram_load. Signed-off-by: ChenLiang <chenliang88@huawei.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 21a246a43b606ee833f907d589d8dcbb54a2761e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05qga: Fix handle fd leak in acquire_privilege()Gonglei1-2/+4
token should be closed in all conditions. So move CloseHandle(token) to "out" branch. Signed-off-by: Wang Rui <moon.wangrui@huawei.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> (cherry picked from commit 374044f08fe18a18469b981812cd8695f5b3569c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05aio: fix qemu_bh_schedule() bh->ctx race conditionStefan Hajnoczi1-4/+10
qemu_bh_schedule() is supposed to be thread-safe at least the first time it is called. Unfortunately this is not quite true: bh->scheduled = 1; aio_notify(bh->ctx); Since another thread may run the BH callback once it has been scheduled, there is a race condition if the callback frees the BH before aio_notify(bh->ctx) has a chance to run. Reported-by: Stefan Priebe <s.priebe@profihost.ag> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Stefan Priebe <s.priebe@profihost.ag> (cherry picked from commit 924fe1293c3e7a3c787bbdfb351e7f168caee3e9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-08-05s390x/css: handle emw correctly for tschCornelia Huck1-4/+20
We should not try to store the emw portion of the irb if extended measurements are not applicable. In particular, we should not surprise the guest by storing a larger irb if it did not enable extended measurements. Cc: qemu-stable@nongnu.org Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Tested-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> (cherry picked from commit f068d320def7fd83bf0fcdca37b305f1c2ac5413) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
generated by cgit v1.2.1 (git 2.18.0) at 2024-05-13 12:27:33 +0000