summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tcg: Increase the highwater reservationRichard Henderson2015-12-011-1/+5
| | | | | | | | | | | | If there are a lot of guest memory ops in the TB, the amount of code generated by tcg_out_tb_finalize could be well more than 1k. In the short term, increase the reservation larger than any TB seen in practice. Reported-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Richard Henderson <rth@twiddle.net>
* Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.5-20151130' ↵Peter Maydell2015-11-306-79/+41
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging ppc patch queue for qemu-2.5 20151130 target-ppc and related bugfix patches for qemu-2.5 I don't have the facilities to test the Macintosh and BookE related patches. I've sanity checked them (inspection + make check), but I'm otherwise relying on the submitters. # gpg: Signature made Mon 30 Nov 2015 08:42:01 GMT using RSA key ID 20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.5-20151130: target-ppc/fpu_helper: fix FPSCR_FX bit shift operation target-ppc: Move the FPSCR bit update macros to cpu.h hw/ppc/ppc405_boards: Fix infinite recursion by converting taihu_cpld from old_mmio hw/ppc/spapr: Remove duplicated "pseries" alias mac_dbdma: always initialize channel field in DBDMA_channel Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target-ppc/fpu_helper: fix FPSCR_FX bit shift operationMadhavan Srinivasan2015-11-301-11/+11
| | | | | | | | | | | | | | | | | | | | | | Currently in TCG mode, updating floating exception summary bit (FPSCR_FX) in fpscr also updates the upper 32bits of fpscr with all 1s. Modify the bit shift operation statement to use 1ULL instead. Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
| * target-ppc: Move the FPSCR bit update macros to cpu.hMadhavan Srinivasan2015-11-302-21/+21
| | | | | | | | | | | | | | | | Move the FPSCR bit update macros defined in dfp_helper to cpu.h. This way, fpu_helper functions can also use them Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
| * hw/ppc/ppc405_boards: Fix infinite recursion by converting taihu_cpld from ↵Peter Maydell2015-11-301-44/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | old_mmio The taihu_cpld_writel() function had an obvious typo that meant that if it was ever called it would go into an infinite recursion. Newer versions of clang will detect and warn about this: hw/ppc/ppc405_boards.c:481:1: warning: all paths through this function will call itself [-Winfinite-recursion] Fix this by converting taihu_cpld from the legacy old_mmio accessors to new-style ones, with an impl {} declaration to cause the core memory code to do the splitting of 16 bit and 32 bit accesses into multiple 8-bit accesses. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
| * hw/ppc/spapr: Remove duplicated "pseries" aliasThomas Huth2015-11-301-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | The "pseries" alias is currently set twice, one time for the pseries-2.4 machine and one time for the "pseries-2.5" machine. To avoid confusion with the alias, let's remove the one from the older machine class. And while we're at it, also remove the "is_default = 0" there since the is_default variable should be set to zero by default already. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
| * mac_dbdma: always initialize channel field in DBDMA_channelHervé Poussineau2015-11-301-1/+1
| | | | | | | | | | | | | | | | | | | | dbdma_from_ch() uses channel field to return the right DBDMA object. Previous code was working if guest OS was only using registered DMA channels. However, it lead to QEMU crashes if guest OS was using unregistered DMA channels. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | Merge remote-tracking branch 'remotes/weil/tags/pull-wxx-20151130' into stagingPeter Maydell2015-11-304-3/+6
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | wxx patch queue # gpg: Signature made Mon 30 Nov 2015 05:48:33 GMT using RSA key ID 677450AD # gpg: Good signature from "Stefan Weil <sw@weilnetz.de>" # gpg: aka "Stefan Weil <stefan.weil@weilnetz.de>" # gpg: aka "Stefan Weil <stefan.weil@bib.uni-mannheim.de>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 4923 6FEA 75C9 5D69 8EC2 B78A E08C 21D5 6774 50AD * remotes/weil/tags/pull-wxx-20151130: w32: Use gcc option -mthreads oslib-win32: Change return type of function getpagesize trace/simple: Fix warning and wrong trace file name for MinGW Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * w32: Use gcc option -mthreadsStefan Weil2015-11-301-0/+2
| | | | | | | | | | | | | | QEMU uses threads / coroutines, therefore support for thread local storage and thread safe libraries (-D_MT) must be enabled by using -mthreads. Signed-off-by: Stefan Weil <sw@weilnetz.de>
| * oslib-win32: Change return type of function getpagesizeStefan Weil2015-11-302-2/+2
| | | | | | | | | | | | | | | | | | | | getpagesize on Linux returns an int. Fix QEMU's implementation for Windows to return an int (instead of size_t), too. This fixes a compiler warning which was introduced recently (commit 093e3c42). Signed-off-by: Stefan Weil <sw@weilnetz.de>
| * trace/simple: Fix warning and wrong trace file name for MinGWStefan Weil2015-11-301-1/+2
|/ | | | | | | | | | | | | | | On Windows, getpid() always returns an int value, but pid_t (which is expected by the format string) is either a 32 bit or a 64 bit value. Without a type cast (or a modified format string), the compiler prints a warning when building for 64 bit Windows and the resulting trace_file_name will include a wrong pid: trace/simple.c:332:9: warning: format ‘%lld’ expects argument of type ‘long long int’, but argument 2 has type ‘int’ [-Wformat=] Signed-off-by: Stefan Weil <sw@weilnetz.de>
* Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell2015-11-272-11/+54
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging # gpg: Signature made Fri 27 Nov 2015 02:42:02 GMT using RSA key ID 398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: tap-win32: disable broken async write path tap-win32: skip unexpected nodes during registry enumeration eepro100: Prevent two endless loops Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * tap-win32: disable broken async write pathAndrew Baumann2015-11-271-10/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The code under the TUN_ASYNCHRONOUS_WRITES path makes two incorrect assumptions about the behaviour of the WriteFile API for overlapped file handles. First, WriteFile does not update the lpNumberOfBytesWritten parameter when the write completes asynchronously (the number of bytes written is known only when the operation completes). Second, the buffer shouldn't be touched (or freed) until the operation completes. This led to at least one bug where tap_win32_write returned zero bytes written, which in turn caused further writes ("receives") to be disabled for that device. This change disables the asynchronous write path, while keeping most of the code around in case someone sees value in resurrecting it. It also adds some conditional debug output, similar to the read path. Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Acked-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * tap-win32: skip unexpected nodes during registry enumerationAndrew Baumann2015-11-271-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to find a named tap device, get_device_guid() enumerates children of HKLM\SYSTEM\CCS\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318} (aka NETWORK_CONNECTIONS_KEY). For each child, it then looks for a "Connection" subkey, but if this key doesn't exist, it aborts the entire search. This was observed to fail on at least one Windows 10 machine, where there is an additional child of NETWORK_CONNECTIONS_KEY (named "Descriptions"). Since registry enumeration doesn't guarantee any particular sort order, we should continue to search for matching children rather than aborting the search. Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Reviewed-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * eepro100: Prevent two endless loopsStefan Weil2015-11-271-0/+16
|/ | | | | | | | | | | | | http://lists.nongnu.org/archive/html/qemu-devel/2015-11/msg04592.html shows an example how an endless loop in function action_command can be achieved. During my code review, I noticed a 2nd case which can result in an endless loop. Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Jason Wang <jasowang@redhat.com>
* Update version for v2.5.0-rc2 releasePeter Maydell2015-11-261-1/+1
| | | | Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell2015-11-2612-41/+155
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | vhost, pc: fixes for 2.5 Minor vhost fixes. HW version tweak for PC. Documentation and test updates. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Thu 26 Nov 2015 16:40:25 GMT using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: vhost-user-test: fix migration overlap test Fix memory leak on error Revert "vhost: send SET_VRING_ENABLE at start/stop" tests/vhost-user-bridge: read command line arguments tests/vhost-user-bridge: propose GUEST_ANNOUNCE feature vhost-user: clarify start and enable vhost-user: set link down when the char device is closed pc: Don't set hw_version on pc-*-2.5 osdep: Change default value of qemu_hw_version() to "2.5+" Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * vhost-user-test: fix migration overlap testMichael S. Tsirkin2015-11-261-5/+8
| | | | | | | | | | | | | | | | During migration, source does GET_BASE, destination does SET_BASE. Use that as opposed to fds being configured to detect vhost user running on both source and destination. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * Fix memory leak on errorStefano Dong (董兴水)2015-11-262-0/+2
| | | | | | | | | | | | | | | | | | hw/ppc/spapr.c: Fix memory leak on error, it was introduced in bc09e0611 hw/acpi/memory_hotplug.c: Fix memory leak on error, it was introduced in 34f2af3d Signed-off-by: Stefano Dong (董兴水) <opensource.dxs@aliyun.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * Revert "vhost: send SET_VRING_ENABLE at start/stop"Michael S. Tsirkin2015-11-261-9/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 3a12f32229a046f4d4ab0a3a52fb01d2d5a1ab76. In case of live migration several queues can be enabled and not only the first one. So informing backend that only the first queue is enabled is wrong. Reported-by: Thibaut Collet <thibaut.collet@6wind.com> Cc: Yuanhan Liu <yuanhan.liu@linux.intel.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Yuanhan Liu <yuanhan.liu@linux.intel.com>
| * tests/vhost-user-bridge: read command line argumentsVictor Kaplansky2015-11-251-18/+111
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Now some vhost-user-bridge parameters can be passed from the command line: Usage: prog [-u ud_socket_path] [-l lhost:lport] [-r rhost:rport] -u path to unix doman socket. default: /tmp/vubr.sock -l local host and port. default: 127.0.0.1:4444 -r remote host and port. default: 127.0.0.1:5555 Signed-off-by: Victor Kaplansky <victork@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * tests/vhost-user-bridge: propose GUEST_ANNOUNCE featureVictor Kaplansky2015-11-251-0/+1
| | | | | | | | | | | | | | | | | | | | The backend has to know whether VIRTIO_NET_F_GUEST_ANNOUNCE was negotiated, so, as a hack we propose the feature by vhost-user-bridge during the feature negotiation. Signed-off-by: Victor Kaplansky <victork@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * vhost-user: clarify start and enableMichael S. Tsirkin2015-11-251-5/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It seems that we currently have some duplication between started and enabled states. The actual reason is that enable is not documented correctly: what it does is connecting ring to the backend. This is important for MQ, because a Linux guest expects TX packets to be completed even if it disables some queues temporarily. Cc: Yuanhan Liu <yuanhan.liu@linux.intel.com> Cc: Victor Kaplansky <victork@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * vhost-user: set link down when the char device is closedWen Congyang2015-11-251-1/+1
| | | | | | | | | | | | | | Signed-off-by: Wen Congyang <wency@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Yuanhan Liu <yuanhan.liu@linux.intel.com>
| * pc: Don't set hw_version on pc-*-2.5Eduardo Habkost2015-11-252-2/+0
| | | | | | | | | | | | | | | | | | | | | | Now that qemu_hw_version() returns a fixed "2.5+" string instead of QEMU_VERSION, we don't need to set hw_version on pc-*-2.5 explicitly. Suggested-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * osdep: Change default value of qemu_hw_version() to "2.5+"Eduardo Habkost2015-11-253-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are two issues with qemu_hw_version() today: 1) If a machine has hw_version set, the value returned by it is not very useful, because it is not the actual QEMU version. 2) If a machine does't set hw_version, the return value of qemu_hw_version() is broken, because it will change when upgrading QEMU. For those reasons, using qemu_hw_version() is strongly discouraged, and should be used only in code that used QEMU_VERSION in the past and needs to keep compatibility. To fix (2), instead of making every machine broken by default unless they set hw_version, make qemu_hw_version() simply return "2.5+" if qemu_set_hw_version() is not called. Suggested-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2015-11-26' ↵Peter Maydell2015-11-2611-314/+225
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging QMP and QObject patches # gpg: Signature made Thu 26 Nov 2015 09:07:18 GMT using RSA key ID EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" * remotes/armbru/tags/pull-monitor-2015-11-26: qjson: Limit number of tokens in addition to total size qjson: surprise, allocating 6 QObjects per token is expensive qjson: store tokens in a GQueue qjson: Convert to parser to recursive descent qjson: replace QString in JSONLexer with GString qjson: Inline token_is_escape() and simplify qjson: Inline token_is_keyword() and simplify qjson: Give each of the six structural chars its own token type qjson: Spell out some silent assumptions check-qjson: Add test for JSON nesting depth limit qjson: Don't crash when input exceeds nesting limit qjson: Apply nesting limit more sanely monitor: Plug memory leak on QMP error Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | qjson: Limit number of tokens in addition to total sizeMarkus Armbruster2015-11-261-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 29c75dd "json-streamer: limit the maximum recursion depth and maximum token count" attempts to guard against excessive heap usage by limiting total token size (it says "token count", but that's a lie). Total token size is a rather imprecise predictor of heap usage: many small tokens use more space than few large tokens with the same input size, because there's a constant per-token overhead: 37 bytes on my system. Tighten this up: limit the token count to 2Mi. Chosen to roughly match the 64MiB total token size limit. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <1448486613-17634-13-git-send-email-armbru@redhat.com>
| * | qjson: surprise, allocating 6 QObjects per token is expensivePaolo Bonzini2015-11-263-78/+63
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace the contents of the tokens GQueue with a simple struct. This cuts the amount of memory allocated by tests/check-qjson from ~500MB to ~20MB, and the execution time from 600ms to 80ms on my laptop. Still a lot (some could be saved by using an intrusive list, such as QSIMPLEQ, instead of the GQueue), but the savings are already massive and the right thing to do would probably be to get rid of json-streamer completely. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1448300659-23559-5-git-send-email-pbonzini@redhat.com> [Straightforwardly rebased on my patches] Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
| * | qjson: store tokens in a GQueuePaolo Bonzini2015-11-268-65/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Even though we still have the "streamer" concept, the tokens can now be deleted as they are read. While doing so convert from QList to GQueue, since the next step will make tokens not a QObject and we will have to do the conversion anyway. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1448300659-23559-4-git-send-email-pbonzini@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
| * | qjson: Convert to parser to recursive descentMarkus Armbruster2015-11-261-118/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We backtrack in parse_value(), even though JSON is LL(1) and thus can be parsed by straightforward recursive descent. Do exactly that. Based on an almost-correct patch from Paolo Bonzini. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1448486613-17634-10-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
| * | qjson: replace QString in JSONLexer with GStringPaolo Bonzini2015-11-264-22/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | JSONLexer only needs a simple resizable buffer. json-streamer.c can allocate memory for each token instead of relying on reference counting of QStrings. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1448300659-23559-2-git-send-email-pbonzini@redhat.com> [Straightforwardly rebased on my patches, checkpatch made happy] Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
| * | qjson: Inline token_is_escape() and simplifyMarkus Armbruster2015-11-261-17/+15
| | | | | | | | | | | | | | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1448486613-17634-8-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
| * | qjson: Inline token_is_keyword() and simplifyMarkus Armbruster2015-11-261-13/+7
| | | | | | | | | | | | | | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1448486613-17634-7-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
| * | qjson: Give each of the six structural chars its own token typeMarkus Armbruster2015-11-264-47/+42
| | | | | | | | | | | | | | | | | | | | | | | | Simplifies things, because we always check for a specific one. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1448486613-17634-6-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
| * | qjson: Spell out some silent assumptionsMarkus Armbruster2015-11-262-2/+8
| | | | | | | | | | | | | | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1448486613-17634-5-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
| * | check-qjson: Add test for JSON nesting depth limitMarkus Armbruster2015-11-261-0/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | This would have prevented the regression mentioned in the previous commit. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <1448486613-17634-4-git-send-email-armbru@redhat.com>
| * | qjson: Don't crash when input exceeds nesting limitMarkus Armbruster2015-11-261-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We limit nesting depth and input size to defend against input triggering excessive heap or stack memory use (commit 29c75dd json-streamer: limit the maximum recursion depth and maximum token count). However, when the nesting limit is exceeded, parser_context_peek_token()'s assertion fails. Broken in commit 65c0f1e "json-parser: don't replicate tokens at each level of recursion". To reproduce stuff 1025 open braces or brackets into QMP. Fix by taking the error exit instead of the normal one. Reported-by: Eric Blake <eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <1448486613-17634-3-git-send-email-armbru@redhat.com>
| * | qjson: Apply nesting limit more sanelyMarkus Armbruster2015-11-261-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The nesting limit from commit 29c75dd "json-streamer: limit the maximum recursion depth and maximum token count" applies separately to braces and brackets. This makes no sense. Apply it to their sum, because that's actually a measure of recursion depth. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <1448486613-17634-2-git-send-email-armbru@redhat.com>
| * | monitor: Plug memory leak on QMP errorMarkus Armbruster2015-11-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Leak introduced in commit 8a4f501..710aec9, v2.4.0. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1446117309-15322-1-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
* | | Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2015-11-268-34/+47
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Small patches, without the one that introduces -fwrapv. # gpg: Signature made Thu 26 Nov 2015 15:48:53 GMT using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" * remotes/bonzini/tags/for-upstream: target-i386: kvm: Print warning when clearing mcg_cap bits target-i386: kvm: Use env->mcg_cap when setting up MCE target-i386: kvm: Abort if MCE bank count is not supported by host virtio-scsi: don't crash without a valid device target-sparc: fix 32-bit truncation in fpackfix exec: remove warning about mempath and hugetlbfs Revert "exec: silence hugetlbfs warning under qtest" call bdrv_drain_all() even if the vm is stopped MAINTAINERS: Update TCG CPU cores section Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | target-i386: kvm: Print warning when clearing mcg_cap bitsEduardo Habkost2015-11-261-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of silently clearing mcg_cap bits when the host doesn't support them, print a warning when doing that. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> [Avoid \n at end of error_report. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1448471956-66873-10-git-send-email-pbonzini@redhat.com>
| * | | target-i386: kvm: Use env->mcg_cap when setting up MCEEduardo Habkost2015-11-262-7/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When setting up MCE, instead of using the MCE_*_DEF macros directly, just filter the existing env->mcg_cap value. As env->mcg_cap is already initialized as MCE_CAP_DEF|MCE_BANKS_DEF at target-i386/cpu.c:mce_init(), this doesn't change any behavior. But it will allow us to change mce_init() in the future, to implement different defaults depending on CPU model, machine-type or command-line parameters. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1448471956-66873-9-git-send-email-pbonzini@redhat.com>
| * | | target-i386: kvm: Abort if MCE bank count is not supported by hostEduardo Habkost2015-11-261-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of silently changing the number of banks in mcg_cap based on kvm_get_mce_cap_supported(), abort initialization if the host doesn't support MCE_BANKS_DEF banks. Note that MCE_BANKS_DEF was always 10 since it was introduced in QEMU, and Linux always returned 32 at KVM_CAP_MCE since KVM_CAP_MCE was introduced, so no behavior is being changed and the error can't be triggered by any Linux version. The point of the new check is to ensure we won't silently change the bank count if we change MCE_BANKS_DEF or make the bank count configurable in the future. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> [Avoid Yoda condition and \n at end of error_report. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1448471956-66873-8-git-send-email-pbonzini@redhat.com>
| * | | virtio-scsi: don't crash without a valid deviceEugene (jno) Dvurechenski2015-11-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure that we actually have a device when checking the aio context. Otherwise guests could trigger QEMU crashes. Signed-off-by: "Eugene (jno) Dvurechenski" <jno@linux.vnet.ibm.com> Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Message-Id: <1448549135-6582-2-git-send-email-jno@linux.vnet.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | | target-sparc: fix 32-bit truncation in fpackfixPaolo Bonzini2015-11-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is reported by Coverity. The algorithm description at ftp://ftp.icm.edu.pl/packages/ggi/doc/hw/sparc/Sparc.pdf suggests that the 32-bit parts of rs2, after the left shift, is treated as a 64-bit integer. Bits 32 and above are used to do the saturating truncation. Message-Id: <1446473134-4330-1-git-send-email-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | | exec: remove warning about mempath and hugetlbfsDaniel P. Berrange2015-11-261-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The gethugepagesize() method in exec.c printed a warning if the file path for "-mem-path" or "-object memory-backend-file" was not on a hugetlbfs filesystem. This warning is bogus, because QEMU functions perfectly well with the path on a regular tmpfs filesystem. Use of hugetlbfs vs tmpfs is a choice for the management application or end user to make as best fits their needs. As such it is inappropriate for QEMU to have an opinion on whether the user's choice is right or wrong in this case. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1448448749-1332-3-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | | Revert "exec: silence hugetlbfs warning under qtest"Daniel P. Berrange2015-11-262-18/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 1c7ba94a184df1eddd589d5400d879568d3e5d08. That commit changed QEMU initialization order from - object-initial, chardev, qtest, object-late to - chardev, qtest, object-initial, object-late This breaks chardev setups which need to rely on objects having been created. For example, when chardevs use TLS encryption in the future, they need to have tls credential objects created first. This revert, restores the ordering introduced in commit f08f9271bfe3f19a5eb3d7a2f48532065304d5c8 Author: Daniel P. Berrange <berrange@redhat.com> Date: Wed May 13 17:14:04 2015 +0100 vl: Create (most) objects before creating chardev backends Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1448448749-1332-2-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | | call bdrv_drain_all() even if the vm is stoppedWen Congyang2015-11-261-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are still I/O operations when the vm is stopped. For example, stop the vm, and do block migration. In this case, we don't drain all I/O operation, and may meet the following problem: qemu-system-x86_64: migration/block.c:731: block_save_complete: Assertion `block_mig_state.submitted == 0' failed. Signed-off-by: Wen Congyang <wency@cn.fujitsu.com> Message-Id: <564EE92E.4070701@cn.fujitsu.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | | MAINTAINERS: Update TCG CPU cores sectionPaolo Bonzini2015-11-251-4/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | These are the people that I think have been touching it lately or reviewing patches. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
OpenPOWER on IntegriCloud