Michael Roth [Wed, 22 May 2013 16:32:51 +0000 (11:32 -0500)]
wdt_i6300esb: fix vmstate versioning
When this VMSD was introduced it's version fields were set to
sizeof(I6300State), making them essentially random from build to build,
version to version.
To fix this, we lock in a high version id and low minimum version id to
support old->new migration from all prior versions of this device's
state. This should work since the device state has not changed since
its introduction.
The potentially breaks migration from 1.5+ to 1.5, but since the
versioning was essentially random prior to this patch, new->old
migration was not consistently functional to begin with.
Reported-by: Nicholas Thomas <nick@bytemark.co.uk> Suggested-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit c1990468d5a13c8f1d9111fcca0a78a6adad062b)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
CC: qemu-stable@nongnu.org Signed-off-by: Cole Robinson <crobinso@redhat.com> Acked-by: Amit Shah <amit.shah@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Message-id: bf4505014a0a941dbd3c62068f3cf2c496b69e6a.1370023944.git.crobinso@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 5b456438f5bb395ed6b1eec95e18ce7a7a884a0a)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Paolo Bonzini [Fri, 31 May 2013 11:47:08 +0000 (13:47 +0200)]
iscsi: simplify freeing of tasks
Always free them in the iscsi_aio_*_acb functions and remove the
checks in their callers. Remove ifs when the task struct was
previously dereferenced (spotted by Coverity).
Coverity picked up a copy-paste bug. In vhost_scsi_start() we check for
!k->set_guest_notifiers and error out. The check probably got copied
but instead of erroring we actually use the function pointer!
Cc: Nicholas Bellinger <nab@linux-iscsi.org> Cc: Asias He <asias@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 0e22a2d18998fd183c8181663981eb681ca977e9)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Pavel Hrdina [Wed, 29 May 2013 13:47:23 +0000 (15:47 +0200)]
scsi-disk: scsi-block device for scsi pass-through should not be removable
This patch adds a new SCSI_DISK_F_NO_REMOVABLE_DEVOPS feature. By this
feature we can set that the scsi-block (scsi pass-through) device will still
be removable from the guest side, but from monitor it cannot be removed.
Cc: qemu-stable@nongnu.org Signed-off-by: Pavel Hrdina <phrdina@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 18e673b8f350e1d789b8a50d209eb4a4252ebbda)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Pavel Hrdina [Wed, 29 May 2013 12:12:10 +0000 (14:12 +0200)]
scsi-generic: check the return value of bdrv_aio_ioctl in execute_command
This fixes the bug introduced by this commit ad54ae80c73f.
The bdrv_aio_ioctl() still could return null and we should return an error
in that case.
Cc: qemu-stable@nongnu.org Signed-off-by: Pavel Hrdina <phrdina@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit d836f8d35dc418e24c3b11e2ea67d361b867b650)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Paolo Bonzini [Tue, 21 May 2013 12:08:53 +0000 (14:08 +0200)]
scsi-generic: fix sign extension of READ CAPACITY(10) data
Issuing the READ CAPACITY(10) command in the guest will cause QEMU
to update its knowledge of the maximum accessible LBA in the disk.
The recorded maximum LBA will be wrong if the disk is bigger than
1TB, because ldl_be_p returns a signed int.
When this is fixed, a latent bug will be unmasked. If the READ
CAPACITY(10) command reported an overflow (0xFFFFFFFF), we must
not overwrite the previously-known maximum accessible LBA, or the guest
will fail to access the disk above the first 2TB.
Pavel Hrdina [Mon, 20 May 2013 11:06:47 +0000 (13:06 +0200)]
scsi: reset cdrom tray statuses on scsi_disk_reset
Tray statuses should be also reset. Some guests may lock the tray and
right after resetting the guest it should be unlocked and closed. This
is done on power-on, reset and resume from suspend/hibernate on bare-metal.
Test results on bare-metal:
- on reset/power-on the CD-ROM tray is closed even before the monitor
is turned on
- on resume from suspend/hibernate the tray is also closed before
the monitor is turned on
From test results it seems that this behavior is OS and probably BIOS
independent.
Cc: qemu-stable@nongnu.org Signed-off-by: Pavel Hrdina <phrdina@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 7721c7f7c272fd2ed9d58500b7e99c33ab8a1af1)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 23307908790cd8fad91220863d7712c571ddc977)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Stefan Hajnoczi [Mon, 10 Jun 2013 09:07:33 +0000 (11:07 +0200)]
vmdk: byteswap VMDK4Header.desc_offset field
Remember to byteswap VMDK4Header.desc_offset on big-endian machines.
Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 5a394b9e96eb3c39676353bdf8a230180ae8d6f4)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Since for PC in current implementation id should be in range [0...maxcpus)
and maxcpus is already checked, add check for lower bound and error out
on incorrect value.
Signed-off-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
(cherry picked from commit 8de433cb0820dc1f387a2d580d255744aacd60cc)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Anton Blanchard [Sun, 2 Jun 2013 12:30:18 +0000 (22:30 +1000)]
tcg-ppc64: rotr_i32 rotates wrong amount
rotr_i32 calculates the amount to left shift and puts it into a
temporary, but then doesn't use it when doing the shift.
Cc: qemu-stable@nongnu.org Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
(cherry picked from commit d1bdd3af49f227dd4a4b03b90cb020c55cbed440)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Anton Blanchard [Sun, 2 Jun 2013 12:29:39 +0000 (22:29 +1000)]
tcg-ppc64: Fix add2_i64
add2_i64 was adding the lower double word to the upper double word
of each input. Fix this so we add the lower double words, then the
upper double words with carry propagation.
Cc: qemu-stable@nongnu.org Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
(cherry picked from commit 84247357104044b8c4ec4a634e84769f432cbe52)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Anton Blanchard [Sun, 2 Jun 2013 12:28:27 +0000 (22:28 +1000)]
tcg-ppc64: bswap64 rotates output 32 bits
If our input and output is in the same register, bswap64 tries to
undo a rotate of the input. This just ends up rotating the output.
Cc: qemu-stable@nongnu.org Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
(cherry picked from commit 82e0f9170ac9307de4fc15bfb4d12d5534550322)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Anton Blanchard [Tue, 11 Jun 2013 11:19:35 +0000 (21:19 +1000)]
tcg-ppc64: Fix RLDCL opcode
The rldcl instruction doesn't have an sh field, so the minor opcode
is shifted 1 bit. We were using the XO30 macro which shifted the
minor opcode 2 bits.
Remove XO30 and add MD30 and MDS30 macros which match the
Power ISA categories.
Cc: qemu-stable@nongnu.org Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
(cherry picked from commit 8a94cfb05ea9a8991c832236b4174d354025a7b7)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Stefan Hajnoczi [Mon, 3 Jun 2013 08:58:31 +0000 (10:58 +0200)]
ivshmem: add missing error exit(2)
If the user fails to specify 'chardev' or 'shm' then we cannot continue.
Exit right away so that we don't invoke shm_open(3) with a NULL pointer.
It would be nice to replace exit(1) with error returns in the PCI device
.init() function, but leave that for another patch since exit(1) is
currently used elsewhere.
Spotted by Coverity.
Cc: Cam Macdonell <cam@cs.ualberta.ca> Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit baefb8bf8e4a708c601bbab898a6039cd9cd12e3)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Andreas Färber [Tue, 11 Jun 2013 11:13:58 +0000 (13:13 +0200)]
Makefile: Install qemu-img and qemu-nbd man pages only if built
When splitting openSUSE's qemu and qemu-linux-user packages we noticed
that for linux-user-only builds unrelated man pages got installed.
It's surely possible to delete them before packaging, but not installing
them in the first place seems more logical.
Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit 8a3e8f7fd8144343f6c83e810b988c1e8a99d50a)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Jason Wang [Tue, 4 Jun 2013 05:18:17 +0000 (13:18 +0800)]
tap: fix NULL dereference when passing invalid parameters to tap
This patch forbid the following invalid parameters to tap:
1) fd and vhostfds were specified but vhostfd were not specified
2) vhostfds were specified but fds were not specified
3) fds and vhostfd were specified
For 1 and 2, net_init_tap_one() will still pass NULL as vhostfdname to
monitor_handle_fd_param(), which may crash the qemu.
Also remove the unnecessary has_fd check.
Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Stefan Hajnoczi <shajnocz@redhat.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit c87826a878be05208c3906eb9d5e1f37cff5e98e)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Michael Tokarev [Wed, 5 Jun 2013 14:44:54 +0000 (18:44 +0400)]
create qemu_openpty_raw() helper function and move it to a separate file
In two places qemu uses openpty() which is very system-dependent,
and in both places the pty is switched to raw mode as well.
Make a wrapper function which does both steps, and move all the
system-dependent complexity into a separate file, together
with static/local implementations of openpty() and cfmakeraw()
from qemu-char.c.
It is in a separate file, not part of oslib-posix.c, because
openpty() often resides in -lutil which is not linked to
every program qemu builds.
This change removes #including of <pty.h>, <termios.h>
and other rather specific system headers out of qemu-common.h,
which isn't a place for such specific headers really.
This version has been verified to build correctly on Linux,
OpenBSD, FreeBSD and OpenIndiana. On the latter it lets qemu
to be built with gtk gui which were not possible there due to
missing openpty() and cfmakeraw().
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Tested-by: Andreas Färber <andreas.faerber@web.de>
(cherry picked from commit 4efeabbbe8441cc327052304976c7b9b86309d72)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Without this patch the guest pauses due to ENOMEDIUM. The guest is
stuck in a continuous pause loop since the I/O request is retried and
fails immediately again when the guest is resumed.
With this patch the error is reported to the guest.
Note that this scenario actually happens sometimes during libvirt disk
hot unplug, where device_del is followed by drive_del. I/O may still be
submitted to the drive after drive_del if the guest does not process the
PCI hot unplug notification.
Reported-by: Dafna Ron <dron@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 293c51a6ee369228633a8428ab689f14c045ff98)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
PCI host bridges need to set fw_name to be discoverable
by bios for boot device selection.
In particular, seabios expects root device to be called
"/pci/@i0cf8", so let's set it up like that for Q35.
Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Amos Kong <akong@redhat.com>
(cherry picked from commit 68c0e134a090666246b467deaf9046e573b089f2)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
target-i386: Fix aflag logic for CODE64 and the 0x67 prefix
The code reorganization in commit 4a6fd938 broke handling of PREFIX_ADR.
While fixing this, tidy and comment the code so that it's more obvious
what's going on in setting both aflag and dflag.
The TARGET_X86_64 ifdef can be eliminated because CODE64 expands to the
constant zero when TARGET_X86_64 is undefined.
Cc: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1369855851-21400-1-git-send-email-rth@twiddle.net Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit dec3fc9657e0682637de4d5a29d947284d01985c)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Which we basically used to print out a greeting/prompt for the
monitor.
AFAICT the only reason this was ever done in a BH was because in
some cases we'd modify the chr_write handler for a new chardev
backend *after* the site where we issued the reset (see:
86e94d:qemu_chr_open_stdio())
At some point this event was renamed to CHR_EVENT_OPENED, and we've
maintained the use of this BH ever since.
However, due to 9f939df955a4152aad69a19a77e0898631bb2c18, we schedule
the BH via g_idle_add(), which is causing events to sometimes be
delivered after we've already begun processing data from backends,
leading to:
known bugs:
QMP:
session negotation resets with OPENED event, in some cases this
is causing new sessions to get sporadically reset
potential bugs:
hw/usb/redirect.c:
can_read handler checks for dev->parser != NULL, which may be
true if CLOSED BH has not been executed yet. In the past, OPENED
quiesced outstanding CLOSED events prior to us reading client
data. If it's delayed, our check may allow reads to occur even
though we haven't processed the OPENED event yet, and when we
do finally get the OPENED event, our state may get reset.
qtest.c:
can begin session before OPENED event is processed, leading to
a spurious reset of the system and irq_levels
gdbstub.c:
may start a gdb session prior to the machine being paused
To fix these, let's just drop the BH.
Since the initial reasoning for using it still applies to an extent,
work around that by deferring the delivery of CHR_EVENT_OPENED until
after the chardevs have been fully initialized, toward the end of
qmp_chardev_add() (or some cases, qemu_chr_new_from_opts()). This
defers delivery long enough that we can be assured a CharDriverState
is fully initialized before CHR_EVENT_OPENED is sent.
Also, rather than requiring each chardev to do an explicit open, do it
automatically, and allow the small few who don't desire such behavior to
suppress the OPENED-on-init behavior by setting a 'explicit_be_open'
flag.
We additionally add missing OPENED events for stdio backends on w32,
which were previously not being issued, causing us to not recieve the
banner and initial prompts for qmp/hmp.
Reported-by: Stefan Priebe <s.priebe@profihost.ag> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Message-id: 1370636393-21044-1-git-send-email-mdroth@linux.vnet.ibm.com Cc: qemu-stable@nongnu.org Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit bd5c51ee6c4f1c79cae5ad2516d711a27b4ea8ec)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Wendy Liang [Fri, 7 Jun 2013 03:05:38 +0000 (13:05 +1000)]
xilinx_axidma: Do not set DMA .notify to NULL after notify
If a stream notify function is not ready, it may re-populate the notify call-
back to indicate it should be re-polled later. This break in this usage, as
immediately following the notify() call, .notify is set to NULL. reverse the
ordering of the notify call and NULL assignment accordingly.
[PC: Reworked commit message]
Signed-off-by: Wendy Liang <jliang@xilinx.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
(cherry picked from commit 4f293bd6e53739e089f33b458f70a9c4ac136b92)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Cornelia Huck [Wed, 5 Jun 2013 15:13:05 +0000 (17:13 +0200)]
virtio-ccw: Fix unsetting of indicators.
Interpretation of the ccws to register (configuration) indicators contained
a thinko: We want to disallow reading from 0, but setting the indicator
pointer to 0 is fine.
Let's fix the handling for CCW_CMD_SET{,_CONF}_IND.
Stefan Hajnoczi [Tue, 4 Jun 2013 12:47:26 +0000 (14:47 +0200)]
vmxnet3: fix NICState cleanup
Use qemu_del_nic() instead of qemu_del_net_client() to correctly free
the entire NICState.
Cc: qemu-stable@nongnu.org Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 3ffee3cd5fb29de2115bdcbde0a02f47ce69a24c)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Amos Kong [Wed, 29 May 2013 07:56:42 +0000 (15:56 +0800)]
qdev: fix get_fw_dev_path to support to add nothing to fw_dev_path
Recent virtio refactoring in QEMU made virtio-bus become the parent bus
of scsi-bus, and virtio-bus doesn't have get_fw_dev_path implementation,
typename will be added to fw_dev_path by default, the new fw_dev_path
could not be identified by seabios. It causes that bootindex parameter
of scsi device doesn't work.
This patch implements get_fw_dev_path() in BusClass, it will be called
if bus doesn't implement the method, tyename will be added to
fw_dev_path. If the implemented method returns NULL, nothing will be
added to fw_dev_path.
It also implements virtio_bus_get_fw_dev_path() to return NULL. Then
QEMU will still pass original style of fw_dev_path to seabios.
Signed-off-by: Amos Kong <akong@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 1369814202-10346-1-git-send-email-akong@redhat.com
--
v2: only add nothing to fw_dev_path when get_fw_dev_path() is
implemented and returns NULL. then it will not effect other devices
don't have get_fw_dev_path() implementation.
v3: implement default get_fw_dev_path() in BusClass Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit bbfa18fca4e44ff9c23d36b50d8a998af9c9e9fc)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
xen: start PCI hole at 0xe0000000 (same as pc_init1 and qemu-xen-traditional)
We are currently setting the PCI hole to start at HVM_BELOW_4G_RAM_END,
that is 0xf0000000.
Start the PCI hole at 0xe0000000 instead, that is the same value used by
pc_init1 and qemu-xen-traditional.
Luiz Capitulino [Tue, 28 May 2013 18:19:22 +0000 (14:19 -0400)]
target-i386: fix abort on bad PML4E/PDPTE/PDE/PTE addresses
The code used to walk IA-32e page-tables, and possibly PAE page-tables,
uses the bit mask ~0xfff to get the next PML4E/PDPTE/PDE/PTE address.
However, as we use a uint64_t to store the resulting address, that mask
gets expanded to 0xfffffffffffff000 which not only ends up selecting
reserved bits but also selects the XD bit (execute-disable) which
happens to be enabled by Windows 8, causing qemu_get_ram_ptr() to abort.
This commit fixes that problem by replacing ~0xfff by a correct mask
that only selects the address bit range (ie. bits 51:12).
Andreas Färber [Wed, 5 Jun 2013 13:17:57 +0000 (15:17 +0200)]
ide: Set BSY bit during FLUSH
The implementation of the ATA FLUSH command invokes a flush at the block
layer, which may on raw files on POSIX entail a synchronous fdatasync().
This may in some cases take so long that the SLES 11 SP1 guest driver
reports I/O errors and filesystems get corrupted or remounted read-only.
Avoid this by setting BUSY_STAT, so that the guest is made aware we are
in the middle of an operation and no ATA commands are attempted to be
processed concurrently.
Addresses BNC#637297.
Suggested-by: Gonglei (Arei) <arei.gonglei@huawei.com> Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit f68ec8379e88502b4841a110c070e9b118d3151c)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Gerd Hoffmann [Mon, 27 May 2013 10:41:24 +0000 (12:41 +0200)]
chardev: fix "info chardev" output
Fill unset CharDriverState->filename with the backend name, so
'info chardev' will return at least the chardev type. Don't
touch it in case the chardev init function filled it already,
like the socket+pty chardevs do for example.
target-i386: Attach ICC bus to CPU on its creation
X86CPU should have parent bus so it could provide bus for child APIC.
The commit makes it mandatory to pass a valid ICC bus to cpu_x86_create,
but cpu_x86_init just passes NULL to it.
xen_machine_pv uses cpu_x86_init, therefore it has been broken.
This patch fixes the problem by removing the dummy CPU creation
altogether from xen_init_pv, relying on the fact that QEMU can now cope
with a machine without an emulated CPU.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Andreas Färber <afaerber@suse.de> CC: imammedo@redhat.com CC: qemu-stable@nongnu.org
(cherry picked from commit 58ee9b0ae05d81c74d6869a25ce4263fc22ed809)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
qom/object: Don't poll cast cache for NULL objects
object_dynamic_cast_assert used to be tolerant of NULL objects and not
assert. It's clear from the implementation that this is the expected
behavior.
The preceding check of the cast cache dereferences obj however causing
a segfault. Fix by conditionalizing the cast cache logic on obj being
non-null.
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Anthony Liguori <aliguori@us.ibm.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Message-id: 8e2bef6a55753869c50bfa32226f7fcf0439ca62.1369183592.git.peter.crosthwaite@xilinx.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 95916abcf428fb03644468c7fbce64356c6483c0)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Stefan Hajnoczi [Wed, 22 May 2013 12:50:18 +0000 (14:50 +0200)]
rtl8139: flush queued packets when RxBufPtr is written
Net queues support efficient "receive disable". For example, tap's file
descriptor will not be polled while its peer has receive disabled. This
saves CPU cycles for needlessly copying and then dropping packets which
the peer cannot receive.
rtl8139 is missing the qemu_flush_queued_packets() call that wakes the
queue up when receive becomes possible again.
As a result, the Windows 7 guest driver reaches a state where the
rtl8139 cannot receive packets. The driver has actually refilled the
receive buffer but we never resume reception.
The bug can be reproduced by running a large FTP 'get' inside a Windows
7 guest:
The Linux guest driver does not trigger the bug, probably due to a
different buffer management strategy.
Reported-by: Oliver Francke <oliver.francke@filoo.de> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 00b7ade807b5ce6779ddd86ce29c5521ec5c529a)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
hw/9pfs: use O_NOFOLLOW for mapped readlink operation
With mapped security models like mapped-xattr and mapped-file, we save the
symlink target as file contents. Now if we ever expose a normal directory
with mapped security model and find real symlinks in export path, never
follow them and return proper error.
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
(cherry picked from commit aed858ce10ef09c7bdf03f73e75e772f567c74cd)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
When guest tries to chmod a block or char device file over 9pfs,
the qemu process segfaults. With 9p2000.u protocol we use wstat to
change mode bits and client don't send extension information for
chmod. We need to check for size field to check whether extension
info is present or not.
Reported-by: Michael Tokarev <mjt@tls.msk.ru> Acked-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
(cherry picked from commit c7e587b73ebac05943df78f5f37d80d32ff47d3d)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Hervé Poussineau [Mon, 20 May 2013 10:33:08 +0000 (12:33 +0200)]
osdep: fix qemu_anon_ram_free trace (+ fix compilation on 32 bit hosts)
Commit e7a09b92b70786f9e8c5fbf787e0248c6ebbe707 added a trace at each
memory freeing, but unfortunately inverted size and pointer when printing
them. Fix trace.
This also led to a compilation error on 32 bit hosts:
In file included from include/trace.h:4:0,
from trace/generated-events.c:3:
./trace/generated-tracers.h: In function ‘trace_qemu_anon_ram_free’:
./trace/generated-tracers.h:64:9: error: format ‘%zu’ expects argument of type
‘size_t’, but argument 3 has type ‘void *’ [-Werror=format]
./trace/generated-tracers.h:64:9: error: format ‘%p’ expects argument of type
‘void *’, but argument 4 has type ‘size_t’ [-Werror=format]
Ed Maste [Thu, 16 May 2013 15:32:28 +0000 (11:32 -0400)]
Rename hexdump to avoid FreeBSD libutil conflict
On FreeBSD libutil is used for openpty(), but it also provides a hexdump()
which conflicts with QEMU's.
Signed-off-by: Ed Maste <emaste@freebsd.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1368718348-15199-1-git-send-email-emaste@freebsd.org Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Reported-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1369046780-17498-1-git-send-email-pbonzini@redhat.com Cc: qemu-stable@nongnu.org Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Lei Li [Mon, 20 May 2013 06:51:03 +0000 (14:51 +0800)]
chardev: Make consistent with udp device for new qapi backend
When register and open a chardev udp, the backend name should be udp
not dgram, and we do not have backend dgram in the chardev list. This
patch makes the new qapi udp backend consistent with the original
udp device.
Signed-off-by: Lei Li <lilei@linux.vnet.ibm.com>
Message-id: 1369032665-18159-2-git-send-email-lilei@linux.vnet.ibm.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Petar Jovanovic [Sat, 18 May 2013 01:53:41 +0000 (03:53 +0200)]
target-mips: fix EXTPDP and setting up pos field in the DSPControl reg
This change makes sure that modifications of pos field in the DSPControl
register do not trash other bits in the register. This bug can be triggered
with the additional test case in mips32-dsp/extpdp.c in this commit.
In addition to this, this change corrects incorrect calculation of the mask
for EXTPDP.
Signed-off-by: Petar Jovanovic <petar.jovanovic@imgtec.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Anthony Liguori [Fri, 17 May 2013 15:00:30 +0000 (10:00 -0500)]
Merge remote-tracking branch 'mdroth/qga-pull-2013-05-13' into staging
* mdroth/qga-pull-2013-05-13:
qga: unlink just created guest-file if fchmod() or fdopen() fails on it
qga: distinguish binary modes in "guest_file_open_modes" map
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Reverting this patch fixes a divide-by-zero error in qemu that can be
fairly reliably triggered by doing block migration. In this case, the
configuration/error was:
This revert potentially re-introduces a bug that was present in 1.4,
but fixes a prevalent issue with block migration so we should revert
it for now and take an updated patch later.
Conflicts:
migration.c
* fixed up to remove logic introduced in 7161082c while leaving
changes in HEAD intact
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Message-id: 1368739544-31021-1-git-send-email-mdroth@linux.vnet.ibm.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
"WSAEventSelect is edge-triggered and the event will not be signaled if
the socket handler does not consume all the data in the socket buffer."
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1368718561-7816-3-git-send-email-stefanha@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
pollfds_fill() and pollfds_poll() translate GPollFD to rfds/wfds/xfds
for sockets on win32. select(2) is the underlying system call which is
used to monitor sockets for activity.
Currently file descriptors that monitor G_IO_ERR will be included in
both rfds and wfds. As a result, select(2) will report writability on
file descriptors where we only really wanted to monitor readability
(with errors).
slirp_pollfds_poll() hit this issue: UDP sockets are blocking sockets so
we hang in sorecvfrom() when G_IO_ERR is set due to the socket being
writable (we only wanted to check for readability).
This patch fixes the slirp_pollfds_poll() hang.
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1368718561-7816-2-git-send-email-stefanha@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Anthony Liguori [Wed, 15 May 2013 19:57:30 +0000 (14:57 -0500)]
Merge remote-tracking branch 'luiz/queue/qmp' into staging
# By Michael Roth (1) and Zhangleiqiang (1)
# Via Luiz Capitulino
* luiz/queue/qmp:
qapi: fix leak in unit tests
qmp: fix handling of cmd with Equals in qmp-shell
Message-id: 1368625179-27962-1-git-send-email-lcapitulino@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Paolo Bonzini [Wed, 15 May 2013 15:46:11 +0000 (17:46 +0200)]
qemu-common: Resolve vector build breakes for AltiVec
On Mac OS X ppc, altivec.h defines "vector", leading to build breakage
when used as variable name, e.g. in tracing code.
Fix this by undefining identifiers after altivec.h inclusion.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andreas Färber <andreas.faerber@web.de>
Message-id: 1368632771-4328-1-git-send-email-andreas.faerber@web.de Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Kevin Wolf [Wed, 15 May 2013 13:00:39 +0000 (15:00 +0200)]
ide-test: Fix endianness problems
The test case passes on big endian hosts now (tested on ppc64)
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1368622839-7084-1-git-send-email-kwolf@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Peter Maydell [Tue, 14 May 2013 15:33:36 +0000 (16:33 +0100)]
hw/pci-host/versatile.c: Provide property for forcing broken IRQ mapping
Although we try our best to automatically detect broken versions
of Linux which assume the old broken IRQ mapping we used to implement
for our model of the Versatile PCI controller, it turns out that
some particularly new kernels manage to outwit the autodetection.
We therefore provide a property for enabling the old broken IRQ
mapping, so that if users happen to have such a kernel they can
work around its deficiencies with the command line option:
-global versatile_pci.broken-irq-mapping=1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1368545616-22344-4-git-send-email-peter.maydell@linaro.org Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Peter Maydell [Tue, 14 May 2013 15:33:35 +0000 (16:33 +0100)]
hw/pci-host/versatile.c: Update autodetect to detect newer kernels
Newer versatilepb kernels still don't get the IRQ mapping right
for the PCI controller, but they get it differently wrong (they add
a fixed +64 offset to everything they write to PCI_INTERRUPT_LINE).
Update the autodetection to handle these too, and include a more
detailed comment on the various different behaviours that might
be present.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1368545616-22344-3-git-send-email-peter.maydell@linaro.org Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Peter Maydell [Tue, 14 May 2013 15:33:34 +0000 (16:33 +0100)]
Revert "versatile_pci: Put the host bridge PCI device at slot 29"
This reverts commit 5f37ef92b7690423ac6311d3c597e182fc5f8fe6.
It turns out that some kernels incorrectly depend on the
old QEMU behaviour of not putting the host PCI bridge device
where the hardware puts it, because they use a swizzling IRQ
mapping which is incorrect but happens to match up with old
broken QEMU when the slot number mod 4 is zero. Since we
start PCI devices at 11, if we put the host bridge at 29
then the first real PCI device goes at 11 and doesn't work.
Not putting the host bridge at 29 means it defaults to 11,
so the first real PCI device is at 12 and works.
Since continuing with the old behaviour doesn't cause problems
for kernels which do work with hardware, the simplest fix for
this is to revert the change.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1368545616-22344-2-git-send-email-peter.maydell@linaro.org Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Stefan Weil [Sat, 11 May 2013 19:46:58 +0000 (21:46 +0200)]
w32: Fix configure test for -march=i486
The latest version of MinGW needs a test for __sync_val_compare_and_swap
to fix a missing symbol linker error.
Reported-by: Igor Mitsyanko <i.mitsyanko@gmail.com> Signed-off-by: Stefan Weil <sw@weilnetz.de>
Message-id: 1368301619-32097-2-git-send-email-sw@weilnetz.de Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Peter Maydell [Tue, 14 May 2013 20:36:39 +0000 (21:36 +0100)]
configure: Detect uuid on MacOSX (fixes compile failure)
Commit 7791dba3ec broke compilation on MacOSX, because it introduced
a new include of util.h. On MacOSX this includes pwd.h which in turn
includes the system uuid/uuid.h, which causes a compile failure if
QEMU was configured without CONFIG_UUID due to a conflict between
the system header and our fallback versions:
block/vdi.c:124:20: error: static declaration of 'uuid_generate'
follows non-static declaration
static inline void uuid_generate(uuid_t out)
^
/usr/include/uuid/uuid.h:63:6: note: previous declaration is here
void uuid_generate(uuid_t out);
^
Fix this breakage by improving configure's check for uuid to work on
MacOSX (where there is no need to link in a separate libuuid).
Note that if the user explicitly runs configure with '--disable-uuid'
on MacOSX then QEMU will fail to compile.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1368563799-22755-1-git-send-email-peter.maydell@linaro.org Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
KONRAD Frederic [Wed, 15 May 2013 12:12:50 +0000 (14:12 +0200)]
virtio-net-x: forward the netclient name and type.
This forwards the name and the type of virtio-net-x to fix the bad
behaviour of "info network" command.
Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com>
Message-id: 1368619970-23892-3-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
KONRAD Frederic [Wed, 15 May 2013 12:12:49 +0000 (14:12 +0200)]
virtio-net: add virtio_net_set_netclient_name.
This adds virtio_net_set_netclient_name, which is used to set the
name and type shown in "info network" command.
Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com>
Message-id: 1368619970-23892-2-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Michael Roth [Fri, 10 May 2013 02:20:57 +0000 (21:20 -0500)]
qapi: fix leak in unit tests
qmp_output_get_qobject() increments the qobject's reference count. Since
we currently pass this straight into qobject_to_json() so we can feed
the data into a QMP input visitor, we never actually free the underlying
qobject when qmp_output_visitor_cleanup() is called. This causes leaks
on all of the QMP serialization tests.
Fix this by holding a pointer to the qobject and decref'ing it before
returning from qmp_deserialize().
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Zhangleiqiang [Mon, 6 May 2013 08:31:23 +0000 (08:31 +0000)]
qmp: fix handling of cmd with Equals in qmp-shell
qmp: fix handling of cmd with equal mark in qmp-shell
qmp-shell splits the argument and value of input command
by equal mark("="). But there are commands whose values
include equal mark themselves, and the json built by
qmp-shell will not correct. For example, when using NBD as
the target of block-backup command, the input
"block-backup target=nbd+unix:///drive0?socket=/tmp/nbd.sock"
will fail, because the json built will be as follows:
With this patch applied the segfault will be avoided, however the case
will still fail, though gracefully:
$ qemu-img create -f qcow2 /tmp/huge.qcow2 $((1024*1024))T
Formatting 'huge.qcow2', fmt=qcow2 size=1152921504606846976 encryption=off cluster_size=65536 lazy_refcounts=off
qemu-img: The image size is too large for file format 'qcow2'
Note that even long before these overflow checks kick in, you get
insanely high memory usage (up to INT_MAX * sizeof(uint64_t) = 16 GB for
the L1 table), so with somewhat smaller image sizes you'll probably see
qemu aborting for a failed g_malloc().
If you need huge image sizes, you should increase the cluster size to
the maximum of 2 MB in order to get higher limits.
Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Paolo Bonzini [Mon, 13 May 2013 14:19:56 +0000 (16:19 +0200)]
osdep: introduce qemu_anon_ram_free to free qemu_anon_ram_alloc-ed memory
We switched from qemu_memalign to mmap() but then we don't modify
qemu_vfree() to do a munmap() over free(). Which we cannot do
because qemu_vfree() frees memory allocated by qemu_{mem,block}align.
Introduce a new function that does the munmap(), luckily the size is
available in the RAMBlock.
Reported-by: Amos Kong <akong@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Amos Kong <akong@redhat.com>
Message-id: 1368454796-14989-3-git-send-email-pbonzini@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This is preparatory to the introduction of a separate freeing API.
Reported-by: Amos Kong <akong@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Amos Kong <akong@redhat.com>
Message-id: 1368454796-14989-2-git-send-email-pbonzini@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Kevin Wolf [Tue, 14 May 2013 10:15:54 +0000 (12:15 +0200)]
readline: Handle xterm escape sequences for Home/End keys
This fixes the Home/End keys in the monitor using the GTK frontend.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1368526554-15866-1-git-send-email-kwolf@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Paolo Bonzini [Tue, 14 May 2013 12:05:21 +0000 (14:05 +0200)]
portability: pty.h is glibc-specific
This should fix building the GTK+ front-end on BSDs.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1368533121-30796-1-git-send-email-pbonzini@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Paolo Bonzini [Tue, 14 May 2013 12:12:25 +0000 (14:12 +0200)]
spitz: fix compilation failure due to pty.h namespace pollution
pty.h is polluting the global namespace with a CTRL macro. spitz
thus fails compilation with the patch at
http://article.gmane.org/gmane.comp.emulators.qemu/211337 and
this patch fixes it.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1368533545-650-1-git-send-email-pbonzini@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
projects / qemu.git / log