Select Git revision
Search by author
- Any Author
- authors
-
Adrien Ricciardi
RICCIARDI-Adrien-BayLibre
-
Alexandre Bailon abailon
-
Andrew Stubbs
ams
-
Anne Françoise Gros afgros
-
BayLibreCI baylibreCI
-
Bernhard Rosenkränzer
bero
-
Carlo Caione carlo.caione
-
Christophe Baylibre
BLChristopheCBO
-
Drew Fustini dfustini
-
Guillaume LA ROQUE glaroque
-
Guillaume Pain gpain
-
Guillaume Ranquet granquet
-
Jeremy Robinson jrobinson
-
Jerome Brunet
jbrunet
-
Julien Masson
JulienMasson
-
Julien Morin
jmorin2
-
Julien Stephan jstephan
-
Jérémie Garcia jgarcia
-
Kevin Hilman khilman
-
Markus Schneider-Pargmann msp8
- Dec 10, 2013
-
-
Michael Roth authored
Signed-off-by:Michael Roth <mdroth@linux.vnet.ibm.com>
-
- Dec 09, 2013
-
-
Laszlo Ersek authored
The originally suggested fix for CVE-2013-4344 introduced a regression in scsi_target_send_command() / REQUEST_SENSE; the third argument passed to scsi_device_get_sense() -- for the "len" parameter -- ignored the possibility of the guest SCSI driver requesting truncated (or shorter than full) sense data. This could result in (r->len > req->cmd.xfer) on return, which is not valid SCSI. The problem was addressed in the second round, and the commit on the master branch (84642435) is correct. However the stable-1.6 branch (the v1.6.1 release) has the original, regressive fix (commit fdcbe7d5); let's update it. Signed-off-by:
Laszlo Ersek <lersek@redhat.com> Reviewed-by:
Paolo Bonzini <pbonzini@redhat.com> Signed-off-by:
-
Tomoki Sekiyama authored
Currently, fsfreeze-freeze may cause deadlock if a guest has loopback mounts of image files in its disk; e.g.: # mount | grep ^/ /dev/vda1 / type ext4 (rw,noatime,seclabel,data=ordered) /tmp/disk.img on /mnt type ext4 (rw,relatime,seclabel) To avoid the deadlock, this freezes filesystems in reverse order of mounts. Signed-off-by:Tomoki Sekiyama <tomoki.sekiyama@hds.com> Reviewed-by:
Eric Blake <eblake@redhat.com> *fix up commit msg Signed-off-by:
-
Petar Jovanovic authored
FR bit should be initialized to 1 for MIPS64, under condition that this bit is writable and that CPU has an FPU unit. It should be initialized to zero for MIPS32. This fixes different MIPS32 issues with FPU instructions whose behaviour defaulted to 64-bit FPU mode. Signed-off-by:
Petar Jovanovic <petar.jovanovic@imgtec.com> Signed-off-by:
Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 4d66261f) Signed-off-by:
-
Paul Moore authored
The kill() syscall is triggered with the following command: # qemu -sandbox on -monitor stdio \ -device intel-hda -device hda-duplex -vnc :0 The resulting syslog/audit message: # ausearch -m SECCOMP ---- time->Wed Nov 20 09:52:08 2013 type=SECCOMP msg=audit(1384912328.482:6656): auid=0 uid=0 gid=0 ses=854 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=12087 comm="qemu-kvm" sig=31 syscall=62 compat=0 ip=0x7f7a1d2abc67 code=0x0 # scmp_sys_resolver 62 kill Reported-by:CongLi <coli@redhat.com> Tested-by:
Paul Moore <pmoore@redhat.com> Acked-by:
Eduardo Otubo <otubo@linux.vnet.ibm.com> (cherry picked from commit e9eecb5b) Signed-off-by:
-
Fam Zheng authored
The buffer for description file was 4096 which only covers a few hundred of extents. This changes the buffer to dynamic allocated with g_strdup_printf in order to support bigger cases. Signed-off-by:
Fam Zheng <famz@redhat.com> Signed-off-by:
Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit af057fe7) Conflicts: block/vmdk.c tests/qemu-iotests/059 tests/qemu-iotests/059.out *removed dependencies on 4823970b and 4f6fd349 Signed-off-by:
-
Kevin Wolf authored
Strictly speaking, this is only required for has_zero_init() == false, but it's easy enough to just do a cluster-aligned write that is padded with zeros after the header. This fixes that after 'qemu-img create' header extensions are attempted to be parsed that are really just random leftover data. Cc: qemu-stable@nongnu.org Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
-
Alex Williamson authored
We were relying on msix_unset_vector_notifiers() to release all the vectors when we disable MSI-X, but this only happens when MSI-X is still enabled on the device. Perform further cleanup by releasing any remaining vectors listed as in-use after this call. This caused a leak of IRQ routes on hotplug depending on how the guest OS prepared the device for removal. Signed-off-by:
Alex Williamson <alex.williamson@redhat.com> Cc: qemu-stable@nongnu.org (cherry picked from commit 3e40ba0f) Signed-off-by:
-
Amos Kong authored
The buffer content might be read out more than once, currently we just repeatedly read the first data block, buffer offset is missing. Cc: qemu-stable@nongnu.org Signed-off-by:
Amos Kong <akong@redhat.com> Message-id: 1385023371-8198-3-git-send-email-akong@redhat.com Signed-off-by:
Anthony Liguori <aliguori@amazon.com> (cherry picked from commit 1eb1bd9e) Signed-off-by:
-
Bandan Das authored
PCIBus registers a vmstate during init. Unregister it upon removal/unplug. Signed-off-by:
Bandan Das <bsd@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by:
Andreas Färber <afaerber@suse.de> Signed-off-by:
Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 5c397242) Signed-off-by:
-
Stefan Hajnoczi authored
qdev_device_add() leaks the created device upon failure. I suspect this problem crept in because qdev_free() unparents the device but does not drop a reference - confusing name. Cc: qemu-stable@nongnu.org Signed-off-by:
-
Igor Mammedov authored
User is able to crash running QEMU when following monitor command is called: device_add intel-hda-generic Crash is caused by assertion in object_initialize_with_type() when type is abstract. Checking if type is abstract before instance is created in qdev_device_add() allows to prevent crash on incorrect user input. Cc: qemu-stable@nongnu.org Signed-off-by:
Igor Mammedov <imammedo@redhat.com> Signed-off-by:
-
Vlad Yasevich authored
Save the result of the call to object_get_canonical_path() so we can free it. Cc: qemu-stable@nongnu.org Signed-off-by:
Vlad Yasevich <vyasevic@redhat.com> Reviewed-by:
-
Amos Kong authored
object_get_canonical_path() returns a gchar*, it should be freed by the caller. Signed-off-by:
-
Alex Williamson authored
When an assigned device is initialized it copies the device config space into the emulated config space. Unfortunately multifunction is setup prior to the device initfn and gets clobbered. We need to restore it just like pci-assign does. Cc: qemu-stable@nongnu.org Signed-off-by:
-
Peter Lieven authored
if multiple sectors spanning multiple clusters are read the function count_contiguous_clusters should ensure that the cluster type should not change between the clusters. Especially the for-loop should break when we have one or more normal clusters followed by a compressed cluster. Unfortunately the wrong macro was used in the mask to compare the flags. This was discovered while debugging a data corruption issue when converting a compressed qcow2 image to raw. qemu-img reads 2MB chunks which span multiple clusters. CC: qemu-stable@nongnu.org Signed-off-by:
Peter Lieven <pl@kamp.de> Signed-off-by:
-
Hanna Reitz authored
The function is not intended to be used on compressed clusters and will not work correctly, if used anyway, since L2E_OFFSET_MASK is not the right mask for determining the offset of compressed clusters. Therefore, assert that the first cluster is not compressed and always include the compression flag in the mask of significant flags, i.e., stop the search as soon as a compressed cluster occurs. Signed-off-by:
Max Reitz <mreitz@redhat.com> Signed-off-by:
-
Cole Robinson authored
The following commit introduced a migration incompatibility: commit 568f0690 Author: David Gibson <david@gibson.dropbear.id.au> Date: Thu Jun 6 18:48:49 2013 +1000 pci: Replace pci_find_domain() with more general pci_root_bus_path() The issue is that i440fx savevm idstr went from 0000:00:00.0/I440FX to 0000:00.0/I440FX. Unfortunately we are stuck with the breakage for 1.6 machine types. Add a compat property to maintain the busted idstr for the 1.6 machine types, but revert to the old style format for 1.7+, and <= 1.5. Tested with migration from qemu 1.5, qemu 1.6, and qemu.git. Cc: qemu-stable@nongnu.org Signed-off-by:
Cole Robinson <crobinso@redhat.com> Reviewed-by:
-
- Dec 04, 2013
-
-
Max Filippov authored
This fixes qemu abort with the following message: include/qemu/int128.h:22: int128_get64: Assertion `!a.hi' failed. which happens due to attempt to invalidate breakpoint by virtual address for which get_phys_page_debug couldn't find mapping. For more details see http://lists.nongnu.org/archive/html/qemu-devel/2013-09/msg04582.html Cc: qemu-stable@nongnu.org Signed-off-by:Max Filippov <jcmvbkbc@gmail.com> Reviewed-by:
-
Jason Wang authored
We delete without check whether it existed during exit. This will lead NULL pointer deference since it was created conditionally depends on guest driver status and features. So add a check of existence before trying to delete it. Cc: qemu-stable@nongnu.org Signed-off-by:
Jason Wang <jasowang@redhat.com> Reviewed-by:
-
Stefan Weil authored
Some targets use a stat64 structure for the stat64 syscall while others use a stat structure. SPARC64 used the wrong kind. Instead of extending the conditional compilation in syscall.c, now a macro TARGET_HAS_STRUCT_STAT64 is defined whenever a target has a target_stat64. Signed-off-by:
Stefan Weil <sw@weilnetz.de> Reviewed-by:
Erik de Castro Lopo <erikd@mega-nerd.com> (cherry picked from commit 20d155bc) Signed-off-by:
-
Peter Maydell authored
Our rules.mak adds '-rR' to MAKEFLAGS to indicate that we will be explicitly specifying everything and not relying on any default variables or rules. However we were accidentally relying on the default ARFLAGS ("rv"). This went unnoticed because of a bug in GNU Make 3.82 and earlier which meant that adding -rR to MAKEFLAGS only affected submakes, not the currently running instance. Explicitly set ARFLAGS in config-host.mak, in the same way we handle CFLAGS and LDFLAGS; this will allow us to work with Make 4.0. Thanks to Paul Smith for analyzing this bug for us. Cc: qemu-stable@nongnu.org Reported-by:Ken Moffat <zarniwhoop@ntlworld.com> Signed-off-by:
Peter Maydell <peter.maydell@linaro.org> Signed-off-by:
-
Wenchao Xia authored
Signed-off-by:
Wenchao Xia <xiawenc@linux.vnet.ibm.com> Reviewed-by:
-
Wenchao Xia authored
Otherwise member "base" is leaked in a qapi_free_STRUCTURE() call. Signed-off-by:
-
Mike Frysinger authored
This avoids needing to execute a program and keeping an (incomplete) list when cross-compiling. Signed-off-by:
Mike Frysinger <vapier@gentoo.org> Reviewed-by:
Richard Henderson <rth@twiddle.net> Tested-by: James Hogan <james.hogan@imgtec.com> [mips] Message-id: 1372649418-4987-1-git-send-email-vapier@gentoo.org Signed-off-by:
-
- Dec 03, 2013
-
-
Richard Henderson authored
We say we support python 2.4, but python 2.4.3 does not support the "expr if test else expr" syntax used here. This allows QEMU to compile on RHEL 5.3, the last release for ia64. Signed-off-by:
Luiz Capitulino <lcapitulino@redhat.com> (cherry picked from commit 7b75d9d6) Signed-off-by:
-
Alexey Kardashevskiy authored
mtree_print_mr() calls int128_get64() in 3 places but only 2 places handle 2^64 correctly. This fixes the third call of int128_get64(). Cc: qemu-stable@nongnu.org Signed-off-by:
Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by:
-
Paolo Bonzini authored
This lock does not protect anything that the BQL does not already protect. Furthermore, with -nodefaults and no monitor, the mutex is not initialized but monitor_protocol_event_queue is called anyway, which causes a crash under mingw (and only works by luck. under Linux or other POSIX OSes). Reported-by:
Orx Goshen <orx.goshen@intel.com> Cc: Daniel Berrange <berrange@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by:
-
Hans de Goede authored
Now that we no longer have MIN_REARM_TIMER_NS a bug in the audio subsys has clearly shown it self by trying to make a timer fire every nano second. Note we have a similar problem in 1.6, 1.5 and older but there MIN_REARM_TIMER_NS limits the wakeups caused by audio being active to 4000 times / second. This still causes a host cpu load of 50 % for simply playing audio, where as with this patch git master is at 13%, so we should backport this to 1.5 and 1.6 too. Note this will not apply to 1.5 and 1.6 as is. Cc: qemu-stable@nongnu.org Signed-off-by:
Hans de Goede <hdegoede@redhat.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit b4350dee) Conflicts: audio/audio.c *fixed to reflect 1.6 timer function/clock names Signed-off-by:
-
Fam Zheng authored
An extra 'p++' after while loop when *p == '\n' will move p to unknown data position, risking parsing junk data or memory access violation. Cc: qemu-stable@nongnu.org Signed-off-by:
-
Matthew Daley authored
Commit 4472beae modified the semantics of ioreq_{un,}map so that they are idempotent if called when they're not needed (ie., twice in a row). However, it neglected to handle the case where batch mapping is not being used (the default), and one of the grants fails to map. In this case, ioreq_unmap will be called to unwind and unmap any mappings already performed, but ioreq_unmap simply returns due to the aforementioned change (the ioreq has not already been marked as mapped). The frontend user can therefore force xen_disk to leak grant mappings, a per-domain limited resource. Fix by marking the ioreq as mapped before calling ioreq_unmap in this situation. Signed-off-by:Matthew Daley <mattjd@gmail.com> Signed-off-by:
Stefano Stabellini <stefano.stabellini@eu.citrix.com> (cherry picked from commit a76f48e5) Signed-off-by:
-
Stefan Weil authored
Latest gcc-4.8 supports a new option -fsanitize=address which activates an AddressSanitizer. This AddressSanitizer stops the QEMU system emulation very early because two character arrays of size 8 are potentially written with 9 bytes. Commit 6ea314d9 added the code. There is no obvious reason why width or height could need 8 characters, so reduce it to 7 characters which together with the terminating '\0' fit into the arrays. Cc: qemu-stable <qemu-stable@nongnu.org> Signed-off-by:
Alex Bennée <alex@bennee.com> Signed-off-by:
Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 49aa4058) Signed-off-by:
-
Stefan Weil authored
Signed-off-by:
-
Stefan Weil authored
These functions were copies from include/linux/bitopts.h. Signed-off-by:
-
Stefan Weil authored
It is used by qemu-ppc64 when running Debian's busybox-static. Cc: qemu-stable <qemu-stable@nongnu.org> Signed-off-by:
-
Markus Armbruster authored
Forgotten in commit 6046c620 and 3464700f. Cc: qemu-stable@nongnu.org Reviewed-by:
Markus Armbruster <armbru@redhat.com> Signed-off-by:
-
Markus Armbruster authored
Commit 4f193e34 added the test, but screwed up in-tree builds (SRCDIR=.): the tests's output overwrites the expected output, and is thus compared to itself. Cc: qemu-stable@nongnu.org Reported-by:
-
Amit Shah authored
If a frontend device releases the chardev (via unplug), the chr handlers are set to NULL via qdev's exit callbacks invoking qemu_chr_add_handlers(). If the chardev had a pending operation, a callback will be invoked, which will try to access data in the just-released frontend, causing a segfault. Ensure the callbacks are disabled when frontends release chardevs. This was seen when a virtio-serial port was unplugged when heavy guest->host IO was in progress (causing a callback to be registered). In the window in which the throttling was active, unplugging ports caused a qemu segfault. https://bugzilla.redhat.com/show_bug.cgi?id=985205 CC: <qemu-stable@nongnu.org> Reported-by:
Sibiao Luo <sluo@redhat.com> Reviewed-by:
Amit Shah <amit.shah@redhat.com> (cherry picked from commit 386a5a1e) Signed-off-by:
-
Amit Shah authored
This deduplicates code used a lot of times. CC: <qemu-stable@nongnu.org> Reviewed-by:
-
Amit Shah authored
All the backends implement an io watcher tag for callbacks. Move it to CharDriverState from each backend's struct to make accessing the tag from backend-neutral functions easier. This will be used later to cancel a callback on chardev detach from a frontend. CC: <qemu-stable@nongnu.org> Reviewed-by:
-
