Skip to main content

Browse the archive

https://github.com/qemu/qemu
20 August 2024, 08:47:43 UTC
sort by:
Revision Author Date Message Commit Date
2d69736 Peter Maydell 05 August 2015, 16:02:58 UTC Update version for v2.4.0-rc4 release Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 05 August 2015, 16:02:58 UTC
0175409 Peter Maydell 05 August 2015, 15:02:00 UTC Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging virtio fix for 2.4 Fixes migration in virtio 1 mode. We still have a known bug with memory hotplug, it doesn't look like we can fix that in time for 2.4. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 05 Aug 2015 15:57:39 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: virtio: fix 1.0 virtqueue migration Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 05 August 2015, 15:02:00 UTC
e94867e Sascha Silbe 04 August 2015, 14:48:25 UTC block: don't register quorum driver if SHA256 support is unavailable Commit 488981a4 [block: convert quorum blockdrv to use crypto APIs] broke qemu-iotest 041 on hosts with GnuTLS < 2.10.0. It converted a compile-time check to a run-time check at device open time. The result is that we now advertise a feature (the quorum block driver) that will never work (on those hosts). There's no way (short of parsing human-readable error messages) for qemu-iotests or any other API consumer to recognise that the quorum block driver isn't _actually_ available and shouldn't be used or tested. Move the run-time check to bdrv_quorum_init() to avoid registering the quorum block driver if we know it cannot work. This way API consumers can recognise it's unavailable. Fixes: 488981a4af396551a3178d032cc2b41d9553ada2 Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Message-id: 1438699705-21761-1-git-send-email-silbe@linux.vnet.ibm.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 05 August 2015, 14:19:32 UTC
74aae7b Jason Wang 05 August 2015, 09:50:07 UTC virtio: fix 1.0 virtqueue migration 1.0 does not requires physically-contiguous pages layout for a virtqueue. So we could not infer avail and used from desc. This means we need to migrate vring.avail and vring.used when host support virtio 1.0. This fixes malfunction of virtio 1.0 device after migration. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> 05 August 2015, 13:56:34 UTC
2be4f24 Peter Maydell 04 August 2015, 15:51:24 UTC Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging X86 queue, 2015-08-04 # gpg: Signature made Tue 04 Aug 2015 16:49:42 BST using RSA key ID 984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/x86-pull-request: target-i386: fix IvyBridge xlevel in PC_COMPAT_2_3 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 04 August 2015, 15:51:24 UTC
27751aa Radim Krčmář 04 August 2015, 14:17:21 UTC target-i386: fix IvyBridge xlevel in PC_COMPAT_2_3 Previous patch changed xlevel and missed the compatibility code. Fixes: 3046bb5debc8 ("target-i386: emulate CPUID level of real hardware") Signed-off-by: Radim Krčmář <rkrcmar@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> 04 August 2015, 15:49:32 UTC
426d0e7 Peter Maydell 04 August 2015, 11:57:06 UTC Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150804' into staging MIPS patches 2015-08-04 Changes: * fix semihosting for microMIPS R6 * fix an abort when booting mips64 kernel with --enable-tcg-debug # gpg: Signature made Tue 04 Aug 2015 12:32:17 BST using RSA key ID 0B29DA6B # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4 4FC0 5211 8E3C 0B29 DA6B * remotes/lalrae/tags/mips-20150804: target-mips: Copy restrictions from ext/ins to dext/dins target-mips: fix semihosting for microMIPS R6 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 04 August 2015, 11:57:06 UTC
b7f26e5 Richard Henderson 03 August 2015, 19:35:53 UTC target-mips: Copy restrictions from ext/ins to dext/dins The checks in dins is required to avoid triggering an assertion in tcg_gen_deposit_tl. The check in dext is just for completeness. Fold the other D cases in via fallthru. In this case the errant dins appears to be data, not code, as translation failed to stop after a break insn. Signed-off-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Leon Alrae <leon.alrae@imgtec.com> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com> 04 August 2015, 10:53:15 UTC
060ebfe Leon Alrae 03 August 2015, 12:01:19 UTC target-mips: fix semihosting for microMIPS R6 In semihosting mode the SDBBP 1 instructions should trigger UHI syscall, but in QEMU this does not happen for recently added microMIPS R6. Consequently bare metal microMIPS R6 programs supporting UHI will not run. Signed-off-by: Leon Alrae <leon.alrae@imgtec.com> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> 04 August 2015, 10:10:20 UTC
260425a Peter Maydell 03 August 2015, 17:52:55 UTC Merge remote-tracking branch 'remotes/sstabellini/tags/cve-2015-5166-tag' into staging cve-2015-5166 # gpg: Signature made Mon 03 Aug 2015 15:27:44 BST using RSA key ID 70E1AE90 # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>" * remotes/sstabellini/tags/cve-2015-5166-tag: Fix release_drive on unplugged devices (pci_piix3_xen_ide_unplug) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 03 August 2015, 17:52:55 UTC
e95edef Peter Maydell 03 August 2015, 16:33:35 UTC Merge remote-tracking branch 'remotes/sstabellini/tags/xen-migration-2.4-tag' into staging xen-migration-2.4 # gpg: Signature made Mon 03 Aug 2015 17:18:36 BST using RSA key ID 70E1AE90 # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>" * remotes/sstabellini/tags/xen-migration-2.4-tag: migration: Fix regression for xenfv and pc,accel=xen machine. migration: Fix global state with Xen. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 03 August 2015, 16:33:35 UTC
8c6dc68 Anthony PERARD 03 August 2015, 14:29:21 UTC migration: Fix regression for xenfv and pc,accel=xen machine. This fix migration from the same QEMU version and from previous QEMU version. >From the global state section, we don't need runstate with Xen. Right now, the way the Xen toolstack knows when QEMU is ready is when QEMU reach "running" runstate. The configuration section and the section footers are not going to be present in previous version of QEMU with xenfv machine, so we skip them. The Xen toolstack libxenlight does not specify a particular version of the 'pc' machine, so migration from older version of QEMU used by Xen to newer one would break due to missing "configuration" section and section footers. Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> 03 August 2015, 16:13:40 UTC
c69adea Anthony PERARD 03 August 2015, 14:29:19 UTC migration: Fix global state with Xen. When doing migration via the QMP command xen_save_devices_state, the current runstate is not store into the global state section. Also the current runstate is not the one we want on the receiver side. During migration, the Xen toolstack paused QEMU before save the devices state. Also, the toolstack expect QEMU to autostart when the migration is finished. So this patch store "running" as it's current runstate. Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> 03 August 2015, 16:13:23 UTC
f60c871 Andreas Färber 24 July 2015, 14:47:37 UTC configure: Drop vnc-ws feature from help text Commit 8e9b0d2 (ui: convert VNC websockets to use crypto APIs) dropped the --enable-vnc-ws option but forgot to update the help text. Fix this. Cc: Daniel P. Berrange <berrange@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 1437749257-3313-1-git-send-email-afaerber@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 03 August 2015, 14:32:17 UTC
6cd3878 Stefano Stabellini 03 August 2015, 13:56:57 UTC Fix release_drive on unplugged devices (pci_piix3_xen_ide_unplug) pci_piix3_xen_ide_unplug should completely unhook the unplugged IDEDevice from the corresponding BlockBackend, otherwise the next call to release_drive will try to detach the drive again. Suggested-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> 03 August 2015, 14:27:12 UTC
2a3612c Peter Maydell 03 August 2015, 12:09:10 UTC Merge remote-tracking branch 'remotes/stefanha/tags/rtl8139-cplus-tx-input-validation-pull-request' into staging Pull request # gpg: Signature made Mon Aug 3 13:08:25 2015 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/rtl8139-cplus-tx-input-validation-pull-request: rtl8139: check TCP Data Offset field (CVE-2015-5165) rtl8139: skip offload on short TCP header (CVE-2015-5165) rtl8139: check IP Total Length field (CVE-2015-5165) rtl8139: check IP Header Length field (CVE-2015-5165) rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165) rtl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165) rtl8139: avoid nested ifs in IP header parsing (CVE-2015-5165) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 03 August 2015, 12:09:10 UTC
8357946 Stefan Hajnoczi 15 July 2015, 16:39:29 UTC rtl8139: check TCP Data Offset field (CVE-2015-5165) The TCP Data Offset field contains the length of the header. Make sure it is valid and does not exceed the IP data length. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 03 August 2015, 12:08:10 UTC
4240be4 Stefan Hajnoczi 15 July 2015, 16:36:15 UTC rtl8139: skip offload on short TCP header (CVE-2015-5165) TCP Large Segment Offload accesses the TCP header in the packet. If the packet is too short we must not attempt to access header fields: tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen); int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr); Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 03 August 2015, 12:08:07 UTC
c6296ea Stefan Hajnoczi 15 July 2015, 16:34:40 UTC rtl8139: check IP Total Length field (CVE-2015-5165) The IP Total Length field includes the IP header and data. Make sure it is valid and does not exceed the Ethernet payload size. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 03 August 2015, 12:08:06 UTC
03247d4 Stefan Hajnoczi 15 July 2015, 16:32:32 UTC rtl8139: check IP Header Length field (CVE-2015-5165) The IP Header Length field was only checked in the IP checksum case, but is used in other cases too. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 03 August 2015, 12:08:03 UTC
e1c120a Stefan Hajnoczi 15 July 2015, 13:30:37 UTC rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165) Transmit offload features access Ethernet and IP headers the packet. If the packet is too short we must not attempt to access header fields: int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12)); ... eth_payload_data = saved_buffer + ETH_HLEN; ... ip = (ip_header*)eth_payload_data; if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) { Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 03 August 2015, 12:08:00 UTC
d6812d6 Stefan Hajnoczi 15 July 2015, 16:17:28 UTC rtl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165) The previous patch stopped using the ip pointer as an indicator that the IP header is present. When we reach the if (ip) {...} statement we know ip is always non-NULL. Remove the if statement to reduce nesting. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 03 August 2015, 12:07:54 UTC
39b8e7d Stefan Hajnoczi 15 July 2015, 16:13:32 UTC rtl8139: avoid nested ifs in IP header parsing (CVE-2015-5165) Transmit offload needs to parse packet headers. If header fields have unexpected values the offload processing is skipped. The code currently uses nested ifs because there is relatively little input validation. The next patches will add missing input validation and a goto label is more appropriate to avoid deep if statement nesting. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 03 August 2015, 12:06:59 UTC
bd80b59 Peter Maydell 03 August 2015, 10:44:07 UTC Merge remote-tracking branch 'remotes/aurel/tags/pull-tcg-mips-s390-20150803' into staging TCG MIPS and S390 fixes for 2.4. # gpg: Signature made Mon Aug 3 09:09:59 2015 BST using RSA key ID 1DDD8C9B # gpg: Good signature from "Aurelien Jarno <aurelien@aurel32.net>" # gpg: aka "Aurelien Jarno <aurelien@jarno.fr>" # gpg: aka "Aurelien Jarno <aurel32@debian.org>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 7746 2642 A9EF 94FD 0F77 196D BA9C 7806 1DDD 8C9B * remotes/aurel/tags/pull-tcg-mips-s390-20150803: tcg/mips: fix add2 tcg/s390x: Mask TCGMemOp appropriately for indexing tcg/mips: Mask TCGMemOp appropriately for indexing tcg/mips: fix TLB loading for BE host with 32-bit guests Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 03 August 2015, 10:44:07 UTC
ff90f84 Peter Maydell 03 August 2015, 09:44:23 UTC Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging # gpg: Signature made Fri Jul 31 23:24:06 2015 BST using RSA key ID AAFC390E # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: FAEB 9711 A12C F475 812F 18F2 88A9 064D 1835 61EB # Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76 CBD0 7DEF 8106 AAFC 390E * remotes/jnsnow/tags/ide-pull-request: ahci: fix ICC mask definition macio: re-add TRIM support Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 03 August 2015, 09:44:23 UTC
c99d696 Aurelien Jarno 31 July 2015, 14:38:25 UTC tcg/mips: fix add2 The add2 code in the tcg_out_addsub2 function doesn't take into account the case where rl == al == bl. In that case we can't compute the carry after the addition. As it corresponds to a multiplication by 2, the carry bit is the bit 31. While this is a corner case, this prevents x86-64 guests to boot on a MIPS host. Cc: qemu-stable@nongnu.org Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> 01 August 2015, 07:39:50 UTC
3c8691f Aurelien Jarno 30 July 2015, 20:13:26 UTC tcg/s390x: Mask TCGMemOp appropriately for indexing Commit 2b7ec66f fixed TCGMemOp masking following the MO_AMASK addition, but two cases were forgotten in the TCG S390 backend. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> 01 August 2015, 07:39:37 UTC
4214a8c Aurelien Jarno 30 July 2015, 20:11:51 UTC tcg/mips: Mask TCGMemOp appropriately for indexing Commit 2b7ec66f fixed TCGMemOp masking following the MO_AMASK addition, but two cases were forgotten in the TCG MIPS backend. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> 01 August 2015, 07:39:33 UTC
e72c4fb Aurelien Jarno 30 July 2015, 21:39:34 UTC tcg/mips: fix TLB loading for BE host with 32-bit guests For 32-bit guest, we load a 32-bit address from the TLB, so there is no need to compensate for the low or high part. This fixes 32-bit guests on big-endian hosts. Cc: qemu-stable@nongnu.org Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> 01 August 2015, 07:38:36 UTC
91ced51 John Snow 21 July 2015, 18:02:01 UTC ahci: fix ICC mask definition There are likely others that could be updated, but we'll go with a light touch for 2.4 for now. Without the Unsigned specifier, this shifts bits into the signed bit, which makes clang unhappy and could cause unwanted behavior. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1437501721-24495-1-git-send-email-jsnow@redhat.com 31 July 2015, 20:39:20 UTC
0e826a0 Aurelien Jarno 29 July 2015, 19:27:48 UTC macio: re-add TRIM support Commit bd4214fc dropped TRIM support by mistake. Given it is still advertised to the host when using a drive with discard=on, this cause the IDE bus to hang when the host issues a TRIM command. This patch fixes that by re-adding the TRIM code, ported to the new new DMA implementation. Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Cc: John Snow <jsnow@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 1438198068-32428-1-git-send-email-aurelien@aurel32.net Signed-off-by: John Snow <jsnow@redhat.com> 31 July 2015, 20:38:50 UTC
cb48f67 Richard Henderson 29 July 2015, 18:40:52 UTC bsd-user: Fix operand to cpu_x86_exec Signed-off-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1438195252-21968-1-git-send-email-rth@twiddle.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 30 July 2015, 11:38:49 UTC
7008d58 Peter Maydell 29 July 2015, 17:50:11 UTC Update version for v2.4.0-rc3 release Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 29 July 2015, 17:50:11 UTC
46739a2 Peter Maydell 29 July 2015, 16:08:38 UTC Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging Pull request These fixes make dataplane work again after the notify_me optimization was added. They also solve QEMUBH memory leaks and fix a bug in dataplane's cleanup code. # gpg: Signature made Wed Jul 29 14:50:26 2015 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/block-pull-request: AioContext: force event loop iteration using BH AioContext: avoid leaking BHs on cleanup virtio-blk-dataplane: delete bottom half before the AioContext is freed Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 29 July 2015, 16:08:38 UTC
ca96ac4 Stefan Hajnoczi 28 July 2015, 16:34:09 UTC AioContext: force event loop iteration using BH The notify_me optimization introduced in commit eabc97797310 ("AioContext: fix broken ctx->dispatching optimization") skips event_notifier_set() calls when the event loop thread is not blocked in ppoll(2). This optimization causes a deadlock if two aio_context_acquire() calls race. notify_me = 0 during the race so the winning thread can enter ppoll(2) unaware that the other thread is waiting its turn to acquire the AioContext. This patch forces ppoll(2) to return by scheduling a BH instead of calling aio_notify(). The following deadlock with virtio-blk dataplane is fixed: qemu ... -object iothread,id=iothread0 \ -drive if=none,id=drive0,file=test.img,... \ -device virtio-blk-pci,iothread=iothread0,drive=drive0 This command-line results in a hang early on without this patch. Thanks to Paolo Bonzini <pbonzini@redhat.com> for investigating this bug with me. Cc: Christian Borntraeger <borntraeger@de.ibm.com> Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1438101249-25166-4-git-send-email-pbonzini@redhat.com Message-Id: <1438014819-18125-3-git-send-email-stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 29 July 2015, 09:02:06 UTC
a076972 Stefan Hajnoczi 28 July 2015, 16:34:08 UTC AioContext: avoid leaking BHs on cleanup BHs are freed during aio_bh_poll(). This leads to memory leaks if there is no aio_bh_poll() between qemu_bh_delete() and aio_ctx_finalize(). Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1438101249-25166-3-git-send-email-pbonzini@redhat.com Message-Id: <1438014819-18125-2-git-send-email-stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 29 July 2015, 09:02:06 UTC
fed105e Paolo Bonzini 28 July 2015, 16:34:07 UTC virtio-blk-dataplane: delete bottom half before the AioContext is freed Other uses of aio_bh_new are safe as long as all scheduled bottom halves are run before an iothread is destroyed, which bdrv_drain will ensure: - archipelago_finish_aiocb: BH deletes itself - inject_error: BH deletes itself - blkverify_aio_bh: BH deletes itself - abort_aio_request: BH deletes itself - curl_aio_readv: BH deletes itself - gluster_finish_aiocb: BH deletes itself - bdrv_aio_rw_vector: BH deletes itself - bdrv_co_maybe_schedule_bh: BH deletes itself - iscsi_schedule_bh, iscsi_co_generic_cb: BH deletes itself - laio_attach_aio_context: deleted in laio_detach_aio_context, called through bdrv_detach_aio_context before deleting the iothread - nfs_co_generic_cb: BH deletes itself - null_aio_common: BH deletes itself - qed_aio_complete: BH deletes itself - rbd_finish_aiocb: BH deletes itself - dma_blk_cb: BH deletes itself - virtio_blk_dma_restart_cb: BH deletes itself - qemu_bh_new: main loop AioContext is never destroyed - test-aio.c: bh_delete_cb deletes itself, otherwise deleted in the same function that calls aio_bh_new Reported-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1438101249-25166-2-git-send-email-pbonzini@redhat.com Message-Id: <1438086628-13000-1-git-send-email-pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 29 July 2015, 09:02:06 UTC
b83d017 Peter Maydell 28 July 2015, 18:02:04 UTC Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging Pull request These two .can_receive() are now reviewed. The net subsystem queue for 2.4 is now empty. # gpg: Signature made Tue Jul 28 13:26:03 2015 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/net-pull-request: xen: Drop net_rx_ok hw/net: handle flow control in mcf_fec driver receiver Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 28 July 2015, 18:02:04 UTC
170f209 Peter Maydell 28 July 2015, 16:09:56 UTC Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging virtio fixes for 2.4 Mostly virtio 1 spec compliance fixes. We are unlikely to make it perfectly compliant in the first release, but it seems worth it to try. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon Jul 27 21:55:48 2015 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: virtio: minor cleanup acpi: fix pvpanic device is not shown in ui virtio-blk: only clear VIRTIO_F_ANY_LAYOUT for legacy device virtio-blk: fail get_features when both scsi and 1.0 were set virtio: get_features() can fail virtio-pci: fix memory MR cleanup for modern virtio: set any_layout in virtio core virtio-9p: fix any_layout virtio-serial: fix ANY_LAYOUT virtio: hide legacy features from modern guests Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 28 July 2015, 16:09:56 UTC
8b89b3a Peter Maydell 28 July 2015, 14:25:24 UTC Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150728' into staging MIPS patches 2015-07-28 Changes: * net/dp8393x fixes * Vectored Interrupts bug fix * fix for a bug in machine.c which was provoking a warning on FreeBSD # gpg: Signature made Tue Jul 28 10:47:19 2015 BST using RSA key ID 0B29DA6B # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4 4FC0 5211 8E3C 0B29 DA6B * remotes/lalrae/tags/mips-20150728: net/dp8393x: do not use memory_region_init_rom_device with NULL net/dp8393x: remove check of runt packets net/dp8393x: disable user creation target-mips: fix offset calculation for Interrupts target-mips: fix passing incompatible pointer type in machine.c Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 28 July 2015, 14:25:24 UTC
5e868d2 Peter Maydell 28 July 2015, 13:19:16 UTC Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging * crypto fixes * megasas SIGSEGV fix * memory refcount change to fix virtio hot-unplug # gpg: Signature made Tue Jul 28 08:29:07 2015 BST using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: memory: do not add a reference to the owner of aliased regions megasas: Add write function to handle write access to PCI BAR 3 crypto: extend unit tests to cover decryption too crypto: fix built-in AES decrypt function Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 28 July 2015, 13:19:16 UTC
9f8c5b6 Peter Maydell 28 July 2015, 12:22:57 UTC Merge remote-tracking branch 'remotes/cody/tags/jtc-for-upstream-pull-request' into staging # gpg: Signature made Tue Jul 28 05:22:29 2015 BST using RSA key ID C0DE3057 # gpg: Good signature from "Jeffrey Cody <jcody@redhat.com>" # gpg: aka "Jeffrey Cody <jeff@codyprime.org>" # gpg: aka "Jeffrey Cody <codyprime@gmail.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 9957 4B4D 3474 90E7 9D98 D624 BDBE 7B27 C0DE 3057 * remotes/cody/tags/jtc-for-upstream-pull-request: block/ssh: Avoid segfault if inet_connect doesn't set errno. sheepdog: serialize requests to overwrapping area Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 28 July 2015, 12:22:57 UTC
7bba83b Fam Zheng 28 July 2015, 09:52:56 UTC xen: Drop net_rx_ok Let net_rx_packet() (which checks the same conditions) drops the packet if the device is not ready. Drop net_xen_info.can_receive and update the return value for the buffer full case. We rely on the qemu_flush_queued_packets() in net_event() to wake up the peer when the buffer becomes available again. Signed-off-by: Fam Zheng <famz@redhat.com> Message-id: 1438077176-378-1-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 28 July 2015, 10:35:54 UTC
776f878 Peter Maydell 28 July 2015, 10:28:44 UTC Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-07-27' into staging trivial patches for 2015-07-27 # gpg: Signature made Mon Jul 27 20:50:14 2015 BST using RSA key ID A4C3D7DB # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" * remotes/mjt/tags/pull-trivial-patches-2015-07-27: gdbstub: Set current CPU on interruptions qapi: add missing @ Fix Cortex-A9 global timer gitignore: Ignore shader generated files vmstate: remove unused declaration make: Clean build messages qemu-common.h: Document cutils.c string functions device_tree: Fix a typo hw/acpi/ich9: clean up stale comment about KVM not supporting SMM hw/acpi/ich9: clear smi_en on reset Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 28 July 2015, 10:28:44 UTC
ff1d2ac Greg Ungerer 28 July 2015, 01:02:54 UTC hw/net: handle flow control in mcf_fec driver receiver The network mcf_fec driver emulated receive side method is not dealing with network queue flow control properly. Modify the receive side to check if we have enough space in the descriptors to store the current packet. If not we process none of it and return 0. When the guest frees up some buffers through its descriptors we signal the qemu net layer to send more packets. [Fixed coding style: 4-space indent and curly braces on if statement. --Stefan] Signed-off-by: Greg Ungerer <gerg@uclinux.org> Message-id: 1438045374-10358-1-git-send-email-gerg@uclinux.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 28 July 2015, 10:27:53 UTC
52579c6 Hervé Poussineau 26 July 2015, 20:32:55 UTC net/dp8393x: do not use memory_region_init_rom_device with NULL Replace memory_region_init_rom_device() with memory_region_init_ram() and memory_region_set_readonly(). This fixes a guest-triggerable QEMU crash when guest tries to write to PROM. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> [leon.alrae@imgtec.com: shorten subject length] Signed-off-by: Leon Alrae <leon.alrae@imgtec.com> 28 July 2015, 08:30:10 UTC
30dfa9a Hervé Poussineau 24 July 2015, 18:42:23 UTC net/dp8393x: remove check of runt packets Ethernet requires that messages are at least 64 bytes on the wire. This limitation does not exist on emulation (no wire message), so remove the check. Netcard is now able to receive small network packets. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com> 28 July 2015, 08:30:09 UTC
f635128 Hervé Poussineau 24 July 2015, 18:42:21 UTC net/dp8393x: disable user creation Netcard needs an address space to write data to, which can't be specified on command line. This fixes a crash when user starts QEMU with "-device dp8393x" Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com> 28 July 2015, 08:29:25 UTC
84a29c7 Peter Maydell 28 July 2015, 08:11:48 UTC Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging Block layer patches for 2.4.0-rc3 # gpg: Signature made Mon Jul 27 16:19:17 2015 BST using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: block: qemu-iotests - add check for multiplication overflow in vpc block: vpc - prevent overflow if max_table_entries >= 0x40000000 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 28 July 2015, 08:11:48 UTC
da52a4d Yongbok Kim 10 July 2015, 11:10:02 UTC target-mips: fix offset calculation for Interrupts Correct computation of vector offsets for EXCP_EXT_INTERRUPT. For instance, if Cause.IV is 0 the vector offset should be 0x180. Simplify the finding vector number logic for the Vectored Interrupts. Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com> Reviewed-by: Leon Alrae <leon.alrae@imgtec.com> [leon.alrae@imgtec.com: cosmetic changes] Signed-off-by: Leon Alrae <leon.alrae@imgtec.com> 28 July 2015, 07:57:51 UTC
8bcbb83 Leon Alrae 22 July 2015, 13:59:23 UTC target-mips: fix passing incompatible pointer type in machine.c Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com> 28 July 2015, 07:57:50 UTC
325e390 Richard W.M. Jones 22 July 2015, 13:27:47 UTC block/ssh: Avoid segfault if inet_connect doesn't set errno. On some (but not all) systems: $ qemu-img create -f qcow2 overlay -b ssh://xen/ Segmentation fault It turns out this happens when inet_connect returns -1 in the following code, but errno == 0. s->sock = inet_connect(s->hostport, errp); if (s->sock < 0) { ret = -errno; goto err; } In the test case above, no host called "xen" exists, so getaddrinfo fails. On Fedora 22, getaddrinfo happens to set errno = ENOENT (although it is *not* documented to do that), so it doesn't segfault. On RHEL 7, errno is not set by the failing getaddrinfo, so ret = -errno = 0, so the caller doesn't know there was an error and continues with a half-initialized BDRVSSHState struct, and everything goes south from there, eventually resulting in a segfault. Fix this by setting ret to -EIO (same as block/nbd.c and block/sheepdog.c). The real error is saved in the Error** errp struct, so it is printed correctly: $ ./qemu-img create -f qcow2 overlay -b ssh://xen/ qemu-img: overlay: address resolution failed for xen:22: No address associated with hostname Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Reported-by: Jun Li BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1147343 Signed-off-by: Jeff Cody <jcody@redhat.com> 28 July 2015, 04:19:05 UTC
6a55c82 Hitoshi Mitake 17 July 2015, 16:44:24 UTC sheepdog: serialize requests to overwrapping area Current sheepdog driver only serializes create requests in oid unit. This mechanism isn't enough for handling requests to overwrapping area spanning multiple oids, so it can result bugs like below: https://bugs.launchpad.net/sheepdog-project/+bug/1456421 This patch adds a new serialization mechanism for the problem. The difference from the old one is: 1. serialize entire aiocb if their targetting areas overwrap 2. serialize all requests (read, write, and discard), not only creates This patch also removes the old mechanism because the new one can be an alternative. Cc: Kevin Wolf <kwolf@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Cc: Teruaki Ishizaki <ishizaki.teruaki@lab.ntt.co.jp> Cc: Vasiliy Tolstov <v.tolstov@selfip.ru> Signed-off-by: Hitoshi Mitake <mitake.hitoshi@lab.ntt.co.jp> Tested-by: Vasiliy Tolstov <v.tolstov@selfip.ru> Signed-off-by: Jeff Cody <jcody@redhat.com> 28 July 2015, 04:16:57 UTC
52c91da Paolo Bonzini 27 July 2015, 14:29:56 UTC memory: do not add a reference to the owner of aliased regions Very often the owner of the aliased region is the same as the owner of the alias region itself. When this happens, the reference count can never go back to 0 and the owner is leaked. This is for example breaking hot-unplug of virtio-pci devices (the device cannot be plugged back again with the same id). Another common use for alias is to transform the system I/O address space into an MMIO regions; in this case the aliased region never dies, so there is no problem. Otherwise the owner is always the same for aliasing and aliased region. I checked all calls to memory_region_init_alias introduced after commit dfde4e6 (memory: add ref/unref calls, 2013-05-06) and they do not need the reference in order to keep the owner of the aliased region alive. Reported-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 July 2015, 21:05:49 UTC
55875fc Salva Peiró 27 July 2015, 08:51:52 UTC megasas: Add write function to handle write access to PCI BAR 3 This patch fixes a QEMU SEGFAULT when a write operation is performed on the memory region of the PCI BAR 3 (base address space). When a writeb(0xe0000000) is performed the .write function is invoked to handle the write access, however, since the .write is not initialised, the call to 0, causes QEMU to SEGFAULT. Signed-off-by: Salva Peiró <speirofr@gmail.com> Acked-by: Hannes Reinecke <hare@suse.com> Message-Id: <1437987112-24744-1-git-send-email-speirofr@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 July 2015, 21:05:49 UTC
c147b51 Michael S. Tsirkin 27 July 2015, 15:39:37 UTC virtio: minor cleanup There's no need for blk to set ANY_LAYOUT, it's done by virtio core as necessary. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> 27 July 2015, 20:55:27 UTC
8ef3ea2 Gal Hammer 26 July 2015, 08:00:51 UTC acpi: fix pvpanic device is not shown in ui Commit 2332333c added a _STA method that hides the device. The fact that the device is not shown in the gui make it harder to install its Windows' device. https://bugzilla.redhat.com/show_bug.cgi?id=1238141 Signed-off-by: Gal Hammer <ghammer@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> 27 July 2015, 20:55:27 UTC
226d007 Jan Kiszka 24 July 2015, 16:52:31 UTC gdbstub: Set current CPU on interruptions gdb expects that the thread ID for c and g-class operations is set to the CPU we provide when reporting VM stop conditions. If the stub is still tuned to a different CPU, the wrong information is delivered to the gdb frontend. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> 27 July 2015, 19:46:16 UTC
801db5e Marc-André Lureau 03 July 2015, 09:51:01 UTC qapi: add missing @ Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> 27 July 2015, 19:44:47 UTC
786f9ce Johannes Schlatow 29 June 2015, 15:45:41 UTC Fix Cortex-A9 global timer The auto increment bit of the timer control register was wrongly defined. See Cortex-A9 MPcore Technical Reference Manual, Section 4.4.2. Signed-off-by: Johannes Schlatow <schlatow@ida.ing.tu-bs.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> 27 July 2015, 19:44:47 UTC
7e71e11 Michal Privoznik 23 June 2015, 12:30:20 UTC gitignore: Ignore shader generated files As of d98bc0b65 there are two files that are automatically generated: ui/shader/texture-blit-frag.h and /ui/shader/texture-blit-vert.h. None of them is wanted to be tracked by git. Put them into the ignore file then. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> 27 July 2015, 19:44:47 UTC
7155f2c Marc-André Lureau 23 June 2015, 16:41:27 UTC vmstate: remove unused declaration Since 38e0735e, register_device_unmigratable() has been removed Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> 27 July 2015, 19:44:47 UTC
f6288b9 Stefan Weil 18 July 2015, 14:54:32 UTC make: Clean build messages We want to have uniform build messages, so fix some messages which did not follow the standard pattern. Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> 27 July 2015, 19:44:47 UTC
ab60366 Peter Maydell 19 July 2015, 20:34:22 UTC qemu-common.h: Document cutils.c string functions Add documentation comments for various utility string functions which we have implemented in util/cutils.c: pstrcpy() strpadcpy() pstrcat() strstart() stristart() qemu_strnlen() qemu_strsep() Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> 27 July 2015, 19:44:47 UTC
cc47a16 Kamalesh Babulal 24 July 2015, 08:18:13 UTC device_tree: Fix a typo Fix spelling of 'allocting' -> 'allocating'. Signed-off-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> 27 July 2015, 19:44:47 UTC
f3c30ae Laszlo Ersek 24 July 2015, 18:16:01 UTC hw/acpi/ich9: clean up stale comment about KVM not supporting SMM Commit fba72476c6 ("ich9: add smm_enabled field and arguments") detached SMM availability from kvm_enabled(). However, the comment in pm_reset() was not updated; let's do it now. Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: qemu-trivial@nongnu.org Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> 27 July 2015, 19:44:47 UTC
be66680 Laszlo Ersek 24 July 2015, 18:16:00 UTC hw/acpi/ich9: clear smi_en on reset Otherwise on reboot firmware might think (due to APMC_EN remaining set from the previous boot) that SMI support is absent. Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: qemu-trivial@nongnu.org Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> 27 July 2015, 19:44:47 UTC
f8787f8 Peter Maydell 27 July 2015, 18:37:09 UTC Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150727' into staging Fix buglets for 2.4 # gpg: Signature made Mon Jul 27 15:26:48 2015 BST using RSA key ID 4DD0279B # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>" # gpg: aka "Richard Henderson <rth@redhat.com>" # gpg: aka "Richard Henderson <rth@twiddle.net>" * remotes/rth/tags/pull-tcg-20150727: tcg: mark temps as mem_coherent = 0 for mov with a constant tcg: correctly mark dead inputs for mov with a constant Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 27 July 2015, 18:37:09 UTC
edec47c Paolo Bonzini 24 July 2015, 11:42:55 UTC main-loop: fix qemu_notify_event for aio_notify optimization aio_notify can be optimized away, and in fact almost always will. However, qemu_notify_event is used in places where this is incorrect---most notably, when handling SIGTERM. When aio_notify is optimized away, it is possible that QEMU enters a blocking ppoll immediately afterwards and stays there, without reaching main_loop_should_exit(). Fix this by using a bottom half. The bottom half can be optimized too, but scheduling it is enough for the ppoll not to block. The hang is thus avoided. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1437738175-23624-1-git-send-email-pbonzini@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 27 July 2015, 16:12:19 UTC
77c102c Jeff Cody 24 July 2015, 14:26:52 UTC block: qemu-iotests - add check for multiplication overflow in vpc This checks that VPC is able to successfully fail (without segfault) on an image file with a max_table_entries that exceeds 0x40000000. This table entry is within the valid range for VPC (although too large for this sample image). Cc: qemu-stable@nongnu.org Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 27 July 2015, 15:19:07 UTC
b15deac Jeff Cody 24 July 2015, 14:26:51 UTC block: vpc - prevent overflow if max_table_entries >= 0x40000000 When we allocate the pagetable based on max_table_entries, we multiply the max table entry value by 4 to accomodate a table of 32-bit integers. However, max_table_entries is a uint32_t, and the VPC driver accepts ranges for that entry over 0x40000000. So during this allocation: s->pagetable = qemu_try_blockalign(bs->file, s->max_table_entries * 4); The size arg overflows, allocating significantly less memory than expected. Since qemu_try_blockalign() size argument is size_t, cast the multiplication correctly to prevent overflow. The value of "max_table_entries * 4" is used elsewhere in the code as well, so store the correct value for use in all those cases. We also check the Max Tables Entries value, to make sure that it is < SIZE_MAX / 4, so we know the pagetable size will fit in size_t. Cc: qemu-stable@nongnu.org Reported-by: Richard W.M. Jones <rjones@redhat.com> Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> 27 July 2015, 15:19:06 UTC
3737129 Peter Maydell 24 July 2015, 17:28:08 UTC configure: Work around broken static pkg-config info for Ubuntu gnutls Unfortunately Ubuntu's pkg-config information for gnutls is broken for the static linking case, and outputs --libs options which the compiler does not recognize. Work around this problem by testing that the --cflags/--libs output will at least allow compilation before enabling gnutls support. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 1437758888-22486-1-git-send-email-peter.maydell@linaro.org 27 July 2015, 15:15:32 UTC
c9b11f9 Jason Wang 27 July 2015, 09:49:21 UTC virtio-blk: only clear VIRTIO_F_ANY_LAYOUT for legacy device Chapter 6.3 of spec said " Transitional devices MUST offer, and if offered by the device transitional drivers MUST accept the following: VIRTIO_F_ANY_LAYOUT (27) " So this patch only clear VIRTIO_F_LAYOUT for legacy device. Cc: Stefan Hajnoczi <stefanha@redhat.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: qemu-block@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> 27 July 2015, 15:11:53 UTC
efb8206 Jason Wang 27 July 2015, 09:49:20 UTC virtio-blk: fail get_features when both scsi and 1.0 were set SCSI passthrough was no longer supported in virtio 1.0, so this patch fail the get_features() when both 1.0 and scsi is set. And also only advertise VIRTIO_BLK_F_SCSI for legacy virtio-blk device. Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> 27 July 2015, 15:11:53 UTC
9d5b731 Jason Wang 27 July 2015, 09:49:19 UTC virtio: get_features() can fail Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> 27 July 2015, 15:11:53 UTC
2746269 Michael S. Tsirkin 27 July 2015, 08:06:17 UTC virtio-pci: fix memory MR cleanup for modern Each memory_region_add_subregion must be paired with memory_region_del_subregion. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> 27 July 2015, 15:11:53 UTC
bbeb823 Aurelien Jarno 27 July 2015, 10:55:58 UTC tcg: mark temps as mem_coherent = 0 for mov with a constant When a constant has to be loaded in a mov op, we fail to set mem_coherent = 0. This patch fixes that. Cc: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Message-Id: <1437994568-7825-3-git-send-email-aurelien@aurel32.net> Signed-off-by: Richard Henderson <rth@twiddle.net> 27 July 2015, 14:25:40 UTC
7df69de Aurelien Jarno 27 July 2015, 10:55:57 UTC tcg: correctly mark dead inputs for mov with a constant When tcg_reg_alloc_mov propagate a constant, we failed to correctly mark a temp as dead if the liveness analysis hints so. This fixes the following assert when configure with --enable-debug-tcg: qemu-x86_64: tcg/tcg.c:1827: tcg_reg_alloc_bb_end: Assertion `ts->val_type == TEMP_VAL_DEAD' failed. Cc: Richard Henderson <rth@twiddle.net> Reported-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Message-Id: <1437994568-7825-2-git-send-email-aurelien@aurel32.net> Signed-off-by: Richard Henderson <rth@twiddle.net> 27 July 2015, 14:25:40 UTC
122e7da Peter Maydell 27 July 2015, 13:53:42 UTC Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging Pull request Here are NIC fixes from Fam Zheng that prevent rx hangs (caused by NIC models where .can_receive() stops rx but qemu_flush_queued_packets() isn't called). # gpg: Signature made Mon Jul 27 14:51:48 2015 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/net-pull-request: axienet: Flush queued packets when rx is done dp8393x: Flush packets when link comes up stellaris_enet: Flush queued packets when read done mipsnet: Flush queued packets when receiving is enabled milkymist-minimac2: Flush queued packets when link comes up mcf_fec: Drop mcf_fec_can_receive etsec: Flush queue when rx buffer is consumed etsec: Move etsec_can_receive into etsec_receive usbnet: Drop usbnet_can_receive eepro100: Drop nic_can_receive pcnet: Drop pcnet_can_receive xgmac: Drop packets with eth_can_rx is false. hw/net: fix mcf_fec driver receiver hw/net: add simple phy support to mcf_fec driver hw/net: add ANLPAR bit definitions to generic mii hw/net: create common collection of MII definitions Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 27 July 2015, 13:53:42 UTC
f9f7492 Fam Zheng 15 July 2015, 10:19:13 UTC axienet: Flush queued packets when rx is done eth_can_rx checks s->rxsize and returns false if it is non-zero. Because of the .can_receive semantics change, this will make the incoming queue disabled by peer, until it is explicitly flushed. So we should flush it when s->rxsize is becoming zero. Squash eth_can_rx semantics into etx_rx and drop .can_receive() callback, also add flush when rx buffer becomes available again after a packet gets queued. The other conditions, "!axienet_rx_resetting(s) && axienet_rx_enabled(s)" are OK because enet_write already calls qemu_flush_queued_packets when the register bits are changed. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1436955553-22791-13-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:18 UTC
4594f93 Fam Zheng 15 July 2015, 10:19:12 UTC dp8393x: Flush packets when link comes up .can_receive callback changes semantics that once return 0, backend will try sending again until explicitly flushed, change the device to meet that. dp8393x_can_receive checks SONIC_CR_RXEN bit in SONIC_CR register and SONIC_ISR_RBE bit in SONIC_ISR register, try flushing the queue when either bit is being updated. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Message-id: 1436955553-22791-12-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:18 UTC
1ef4a60 Fam Zheng 15 July 2015, 10:19:11 UTC stellaris_enet: Flush queued packets when read done If s->np reaches 31, the queue will be disabled by peer when it sees stellaris_enet_can_receive() returns false, until we explicitly flushes it which notifies the peer. Do this when guest is done reading all existing data. Move the semantics to stellaris_enet_receive, by returning 0 when the buffer is full, so that new packets will be queued. In stellaris_enet_read, flush and restart the queue when guest has done reading. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Message-id: 1436955553-22791-11-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:18 UTC
1dd58ae Fam Zheng 15 July 2015, 10:19:10 UTC mipsnet: Flush queued packets when receiving is enabled Drop .can_receive and move the semantics to mipsnet_receive, by returning 0. After 0 is returned, we must flush the queue explicitly to restart it: Call qemu_flush_queued_packets when s->busy or s->rx_count is being updated. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Message-id: 1436955553-22791-10-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:18 UTC
3b7031e Fam Zheng 15 July 2015, 10:19:09 UTC milkymist-minimac2: Flush queued packets when link comes up Drop .can_receive and move the semantics into minimac2_rx, by returning 0. That is once minimac2_rx returns 0, incoming packets will be queued until the queue is explicitly flushed. We do this when s->regs[R_STATE0] or s->regs[R_STATE1] is changed in minimac2_write. Also drop the unused trace point. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1436955553-22791-9-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:18 UTC
e813f0d Fam Zheng 15 July 2015, 10:19:08 UTC mcf_fec: Drop mcf_fec_can_receive The semantics of .can_receive requires us to flush the queue explicitly when s->rx_enabled becomes true after it returns 0, but the packet being queued is not meaningful since the guest hasn't activated the card. Let's just drop the packet in this case. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Message-id: 1436955553-22791-8-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:18 UTC
575bafd Fam Zheng 15 July 2015, 10:19:07 UTC etsec: Flush queue when rx buffer is consumed The BH will be scheduled when etsec->rx_buffer_len is becoming 0, which is the condition of queuing. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1436955553-22791-7-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:18 UTC
b6cb661 Fam Zheng 15 July 2015, 10:19:06 UTC etsec: Move etsec_can_receive into etsec_receive When etsec_reset returns 0, peer would queue the packet as if .can_receive returns false. Drop etsec_can_receive and let etsec_receive carry the semantics. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Message-id: 1436955553-22791-6-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:18 UTC
9134402 Fam Zheng 15 July 2015, 10:19:05 UTC usbnet: Drop usbnet_can_receive usbnet_receive already drops packet if rndis_state is not RNDIS_DATA_INITIALIZED, and queues packet if in buffer is not available. The only difference is s->dev.config but that is similar to rndis_state. Drop usbnet_can_receive and move these checks to usbnet_receive, so that we don't need to explicitly flush the queue when s->dev.config changes value. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Message-id: 1436955553-22791-5-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:18 UTC
363db4b Fam Zheng 15 July 2015, 10:19:04 UTC eepro100: Drop nic_can_receive nic_receive already checks the conditions and drop packets if false. Due to the new semantics since 6e99c63 ("net/socket: Drop net_socket_can_send"), having .can_receive returning 0 requires us to explicitly flush the queued packets when the conditions are becoming true, but queuing the packets when guest driver is not ready doesn't make much sense. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Message-id: 1436955553-22791-4-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:18 UTC
b0ba0b9 Fam Zheng 15 July 2015, 10:19:03 UTC pcnet: Drop pcnet_can_receive pcnet_receive already checks the conditions and drop packets if false. Due to the new semantics since 6e99c63 ("net/socket: Drop net_socket_can_send"), having .can_receive returning 0 requires us to explicitly flush the queued packets when the conditions are becoming true, but queuing the packets when guest driver is not ready doesn't make much sense. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Message-id: 1436955553-22791-3-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:18 UTC
8c8c460 Fam Zheng 15 July 2015, 10:19:02 UTC xgmac: Drop packets with eth_can_rx is false. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Message-id: 1436955553-22791-2-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:18 UTC
491a1f4 Greg Ungerer 26 June 2015, 05:27:16 UTC hw/net: fix mcf_fec driver receiver The network mcf_fec driver emulated receive side method is returning a result of 0 causing the network layer to disable receive for this emulated device. This results in the guest only ever receiving one packet. Fix the recieve side processing to return the number of bytes that we passed back through to the guest. Signed-off-by: Greg Ungerer <gerg@uclinux.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1435296436-12152-5-git-send-email-gerg@uclinux.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:04 UTC
299f7be Greg Ungerer 26 June 2015, 05:27:15 UTC hw/net: add simple phy support to mcf_fec driver The Linux fec driver needs at least basic phy support to probe and work. The current qemu mcf_fec emulation has no support for the reading or writing of the MDIO lines to access an attached phy. This code adds a very simple set of register results for a fixed phy setup - very similar to that used on an m5208evb board. This is enough to probe and identify an emulated attached phy. Signed-off-by: Greg Ungerer <gerg@uclinux.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1435296436-12152-4-git-send-email-gerg@uclinux.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:04 UTC
3634869 Greg Ungerer 26 June 2015, 05:27:14 UTC hw/net: add ANLPAR bit definitions to generic mii Add a base set of bit definitions for the standard MII phy "Auto-Negotiation Link Partner Ability Register" (ANLPAR). The original definitions moved into mii.h from the allwinner_emac driver did not define these. Signed-off-by: Greg Ungerer <gerg@uclinux.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1435296436-12152-3-git-send-email-gerg@uclinux.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:04 UTC
3e23056 Greg Ungerer 26 June 2015, 05:27:13 UTC hw/net: create common collection of MII definitions Create a common set of definitions of address and register values for ethernet MII phys. A few of the current ethernet drivers have at least a partial set of these definitions. Others just use hard coded raw constant numbers. This initial set is copied directly from the allwinner_emac code. Signed-off-by: Greg Ungerer <gerg@uclinux.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1435296436-12152-2-git-send-email-gerg@uclinux.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 27 July 2015, 13:12:04 UTC
e40db4c Peter Maydell 27 July 2015, 12:10:00 UTC Merge remote-tracking branch 'remotes/jnsnow/tags/cve-2015-5154-pull-request' into staging # gpg: Signature made Mon Jul 27 13:01:10 2015 BST using RSA key ID AAFC390E # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: FAEB 9711 A12C F475 812F 18F2 88A9 064D 1835 61EB # Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76 CBD0 7DEF 8106 AAFC 390E * remotes/jnsnow/tags/cve-2015-5154-pull-request: ide: Clear DRQ after handling all expected accesses ide/atapi: Fix START STOP UNIT command completion ide: Check array bounds before writing to io_buffer (CVE-2015-5154) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> 27 July 2015, 12:10:00 UTC
019c2ab Daniel P. Berrange 21 July 2015, 08:55:02 UTC crypto: extend unit tests to cover decryption too The current unit test only verifies the encryption API, resulting in us missing a recently introduced bug in the decryption API from commit d3462e3. It was fortunately later discovered & fixed by commit bd09594, thanks to the QEMU I/O tests for qcow2 encryption, but we should really detect this directly in the crypto unit tests. Also remove an accidental debug message and simplify some asserts. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1437468902-23230-1-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 July 2015, 10:22:01 UTC
6775e2c Daniel P. Berrange 24 July 2015, 12:23:54 UTC crypto: fix built-in AES decrypt function The qcrypto_cipher_decrypt_aes method was using the wrong key material, and passing the wrong mode. This caused it to incorrectly decrypt ciphertext. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1437740634-6261-1-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 27 July 2015, 10:22:01 UTC
09999a5 Michael S. Tsirkin 22 July 2015, 09:32:25 UTC virtio: set any_layout in virtio core Exceptions: - virtio-blk - compat machine types Signed-off-by: Michael S. Tsirkin <mst@redhat.com> 27 July 2015, 08:24:48 UTC
cd4bfbb Michael S. Tsirkin 23 July 2015, 17:57:53 UTC virtio-9p: fix any_layout virtio pci allows any device to have a modern interface, this in turn requires ANY_LAYOUT support. Fix up ANY_LAYOUT for virtio-9p. Reported-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> 27 July 2015, 08:24:48 UTC
back to top