[Qemu-commits] [qemu/qemu] 8a5956: rcu tests: fix compilation on 32-bit ppc

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 8a5956ad6392f115521dad774055c737c49fb0dd
      
https://github.com/qemu/qemu/commit/8a5956ad6392f115521dad774055c737c49fb0dd
  Author: Paolo Bonzini <address@hidden>
  Date:   2015-03-25 (Wed, 25 Mar 2015)

  Changed paths:
    M tests/rcutorture.c
    M tests/test-rcu-list.c

  Log Message:
  -----------
  rcu tests: fix compilation on 32-bit ppc

32-bit PPC cannot do atomic operations on long long.  Inside the loops,
we are already using local counters that are summed at the end of
the run---with some exceptions (rcu_stress_count for rcutorture,
n_nodes for test-rcu-list): fix them to use the same technique.
For test-rcu-list, remove the mostly unused member "val" from the
list.  Then, use a mutex to protect the global counts.

Performance does not matter there because every thread will only enter
the critical section once.

Remaining uses of atomic instructions are for ints or pointers.

Reported-by: Andreas Faerber <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 3a5c76baf312d83cb77c8faa72c5f7a477effed0
      
https://github.com/qemu/qemu/commit/3a5c76baf312d83cb77c8faa72c5f7a477effed0
  Author: Gabriel L. Somlo <address@hidden>
  Date:   2015-03-25 (Wed, 25 Mar 2015)

  Changed paths:
    M hw/i386/pc.c
    M hw/nvram/fw_cfg.c
    M hw/ppc/mac_newworld.c
    M hw/ppc/mac_oldworld.c
    M hw/sparc/sun4m.c
    M hw/sparc64/sun4u.c

  Log Message:
  -----------
  fw_cfg: factor out initialization of FW_CFG_ID (rev. number)

The fw_cfg documentation says this of the revision key (0x0001, FW_CFG_ID):

> A 32-bit little-endian unsigned int, this item is used as an interface
> revision number, and is currently set to 1 by all QEMU architectures
> which expose a fw_cfg device.

arm/virt doesn't.  It could be argued that that's an error in
"hw/arm/virt.c"; on the other hand, all of the other fw_cfg providing
boards set the interface version to 1 manually, despite the device
coming from the same, shared implementation. Therefore, instead of
adding

    fw_cfg_add_i32(fw_cfg, FW_CFG_ID, 1);

to arm/virt, consolidate all such existing calls in the fw_cfg
initialization code.

Signed-off-by: Gabriel Somlo <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Laszlo Ersek <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 06b82e2d8ead4d1f9441dbf2b03c31369a8f27bd
      
https://github.com/qemu/qemu/commit/06b82e2d8ead4d1f9441dbf2b03c31369a8f27bd
  Author: David Gibson <address@hidden>
  Date:   2015-03-25 (Wed, 25 Mar 2015)

  Changed paths:
    M hw/watchdog/wdt_i6300esb.c

  Log Message:
  -----------
  i6300esb: Correct endiannness

The IO operations for the i6300esb watchdog timer are marked as
DEVICE_NATIVE_ENDIAN.  This is not correct, and - as a PCI device - should
be DEVICE_LITTLE_ENDIAN.

This allows i6300esb to work on ppc targets (yes, using an Intel ICH
derived device on ppc is a bit odd, but the driver exists on the guest
and there's no more obviously suitable watchdog device).

Signed-off-by: David Gibson <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 4bc7b4d56657ebf75b986ad46e959cf7232ff26a
      
https://github.com/qemu/qemu/commit/4bc7b4d56657ebf75b986ad46e959cf7232ff26a
  Author: David Gibson <address@hidden>
  Date:   2015-03-25 (Wed, 25 Mar 2015)

  Changed paths:
    M hw/watchdog/wdt_i6300esb.c

  Log Message:
  -----------
  i6300esb: Fix signed integer overflow

If the guest programs a sufficiently large timeout value an integer
overflow can occur in i6300esb_restart_timer().  e.g. if the maximum
possible timer preload value of 0xfffff is programmed then we end up with
the calculation:

timeout = get_ticks_per_sec() * (0xfffff << 15) / 33000000;

get_ticks_per_sec() returns 1000000000 (10^9) giving:

     10^9 * (0xfffff * 2^15) == 0x1dcd632329b000000 (65 bits)

Obviously the division by 33MHz brings it back under 64-bits, but the
overflow has already occurred.

Since signed integer overflow has undefined behaviour in C, in theory this
could be arbitrarily bad.  In practice, the overflowed value wraps around
to something negative, causing the watchdog to immediately expire, killing
the guest, which is still fairly bad.

The bug can be triggered by running a Linux guest, loading the i6300esb
driver with parameter "heartbeat=2046" and opening /dev/watchdog.  The
watchdog will trigger as soon as the device is opened.

This patch corrects the problem by using muldiv64(), which effectively
allows a 128-bit intermediate value between the multiplication and
division.

Signed-off-by: David Gibson <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: bdd459a00a206772185970efbc38c455dc43167e
      
https://github.com/qemu/qemu/commit/bdd459a00a206772185970efbc38c455dc43167e
  Author: Peter Crosthwaite <address@hidden>
  Date:   2015-03-25 (Wed, 25 Mar 2015)

  Changed paths:
    M cpus.c

  Log Message:
  -----------
  cpus: Don't kick un-realized cpus.

following a464982499b2f637f6699e3d03e0a9d2e0b5288b, it's now possible for
there to be attempts to take the BQL before CPUs have been realized in
cases where a machine model inits peripherals before the first CPU.

BQL lock aquisition kicks the first_cpu, leading to a segfault if this
happens pre-realize. Guard the CPU kick routine to perform no action for
a CPU that doesn't exist or doesn't have a thread yet.

There was a fix to this with commit
6b49809c597331803ea941eadda813e5bb4e8fe2, but the check there misses
the case where the CPU has been inited and not realized. Strengthen the
check to make sure that the first_cpu has a thread (i.e. it is
realized) before allowing the kick.

Signed-off-by: Peter Crosthwaite <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 16578c6ffe8c4ee5207ccb9b0c994c1b18bb322d
      
https://github.com/qemu/qemu/commit/16578c6ffe8c4ee5207ccb9b0c994c1b18bb322d
  Author: Paolo Bonzini <address@hidden>
  Date:   2015-03-25 (Wed, 25 Mar 2015)

  Changed paths:
    M hw/scsi/megasas.c

  Log Message:
  -----------
  megasas: use PCI DMA APIs

It is wrong to use address_space_memory directly, because there could be an
IOMMU in the middle.

Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 0dc40f28518dee8aa95abd330a53f06179e71995
      
https://github.com/qemu/qemu/commit/0dc40f28518dee8aa95abd330a53f06179e71995
  Author: Paolo Bonzini <address@hidden>
  Date:   2015-03-25 (Wed, 25 Mar 2015)

  Changed paths:
    M hw/scsi/vmw_pvscsi.c

  Log Message:
  -----------
  vmw_pvscsi: use PCI DMA APIs

It is wrong to use address_space_memory directly, because there could be an
IOMMU in the middle.  Passing the entire PVSCSIRingInfo to RS_GET_FIELD
and RS_SET_FIELD makes it easy to go back to the PVSCSIState.

Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 78fa62ff1bc0d66f0115b7147c4eb260ad22022a
      
https://github.com/qemu/qemu/commit/78fa62ff1bc0d66f0115b7147c4eb260ad22022a
  Author: Markus Armbruster <address@hidden>
  Date:   2015-03-25 (Wed, 25 Mar 2015)

  Changed paths:
    M blockdev-nbd.c

  Log Message:
  -----------
  nbd: Fix up comment after commit e140177

Signed-off-by: Markus Armbruster <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 1d5bfde1b978b57156d851d140b99eac8b2adbe4
      
https://github.com/qemu/qemu/commit/1d5bfde1b978b57156d851d140b99eac8b2adbe4
  Author: Dirk Müller <address@hidden>
  Date:   2015-03-25 (Wed, 25 Mar 2015)

  Changed paths:
    M hw/m68k/an5206.c
    M hw/m68k/dummy_m68k.c
    M hw/m68k/mcf5208.c

  Log Message:
  -----------
  m68k: memory: Replace memory_region_init_ram with 
memory_region_allocate_system_memory

Commit 0b183fc871:"memory: move mem_path handling to
memory_region_allocate_system_memory" split memory_region_init_ram and
memory_region_init_ram_from_file. Also it moved mem-path handling a step
up from memory_region_init_ram to memory_region_allocate_system_memory.

Therefore for any board that uses memory_region_init_ram directly,
-mem-path is not supported.

Fix this by replacing memory_region_init_ram with
memory_region_allocate_system_memory.

Signed-off-by: Dirk Mueller <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Andreas Färber <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 6a926fbc6fff58598cce9404019204090a8e8361
      
https://github.com/qemu/qemu/commit/6a926fbc6fff58598cce9404019204090a8e8361
  Author: Dirk Müller <address@hidden>
  Date:   2015-03-25 (Wed, 25 Mar 2015)

  Changed paths:
    M hw/mips/mips_fulong2e.c
    M hw/mips/mips_jazz.c
    M hw/mips/mips_malta.c
    M hw/mips/mips_mipssim.c
    M hw/mips/mips_r4k.c

  Log Message:
  -----------
  mips: memory: Replace memory_region_init_ram with 
memory_region_allocate_system_memory

Commit 0b183fc871:"memory: move mem_path handling to
memory_region_allocate_system_memory" split memory_region_init_ram and
memory_region_init_ram_from_file. Also it moved mem-path handling a step
up from memory_region_init_ram to memory_region_allocate_system_memory.

Therefore for any board that uses memory_region_init_ram directly,
-mem-path is not supported.

Fix this by replacing memory_region_init_ram with
memory_region_allocate_system_memory.

Signed-off-by: Dirk Mueller <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Andreas Färber <address@hidden>
Acked-by: Leon Alrae <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 8e7ba4ed3a0b68ab35736c7859fd950f6705e0cf
      
https://github.com/qemu/qemu/commit/8e7ba4ed3a0b68ab35736c7859fd950f6705e0cf
  Author: Dirk Müller <address@hidden>
  Date:   2015-03-25 (Wed, 25 Mar 2015)

  Changed paths:
    M hw/sparc/leon3.c
    M hw/sparc/sun4m.c

  Log Message:
  -----------
  sparc: memory: Replace memory_region_init_ram with 
memory_region_allocate_system_memory

Commit 0b183fc871:"memory: move mem_path handling to
memory_region_allocate_system_memory" split memory_region_init_ram and
memory_region_init_ram_from_file. Also it moved mem-path handling a step
up from memory_region_init_ram to memory_region_allocate_system_memory.

Therefore for any board that uses memory_region_init_ram directly,
-mem-path is not supported.

Fix this by replacing memory_region_init_ram with
memory_region_allocate_system_memory.

Signed-off-by: Dirk Mueller <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Andreas Färber <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: f18c69cfc554cf9776eb3c35b7510e17541afacb
      
https://github.com/qemu/qemu/commit/f18c69cfc554cf9776eb3c35b7510e17541afacb
  Author: Paolo Bonzini <address@hidden>
  Date:   2015-03-26 (Thu, 26 Mar 2015)

  Changed paths:
    M exec.c

  Log Message:
  -----------
  exec: avoid possible overwriting of mmaped area in qemu_ram_remap

It is not necessary to munmap an area before remapping it with MAP_FIXED;
if the memory region specified by addr and len overlaps pages of any
existing mapping, then the overlapped part of the existing mapping will
be discarded.

On the other hand, if QEMU does munmap the pages, there is a small
probability that another mmap sneaks in and catches the just-freed
portion of the address space.  In effect, munmap followed by
mmap(MAP_FIXED) is a use-after-free error, and Coverity flags it
as such.  Fix it.

Reviewed-by: Gonglei <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: fe75270cb619549b2aa1ba59bd202faf306204a1
      
https://github.com/qemu/qemu/commit/fe75270cb619549b2aa1ba59bd202faf306204a1
  Author: Gonglei <address@hidden>
  Date:   2015-03-26 (Thu, 26 Mar 2015)

  Changed paths:
    M bootdevice.c
    M tests/usb-hcd-ohci-test.c
    M tests/usb-hcd-uhci-test.c
    M tests/usb-hcd-xhci-test.c

  Log Message:
  -----------
  misc: fix typos in copyright declaration

Add a space after comma.

Signed-off-by: Gonglei <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 4020db0475b3e527b3bdc97dff873c2be9da2698
      
https://github.com/qemu/qemu/commit/4020db0475b3e527b3bdc97dff873c2be9da2698
  Author: Ting Wang <address@hidden>
  Date:   2015-03-26 (Thu, 26 Mar 2015)

  Changed paths:
    M hw/scsi/virtio-scsi-dataplane.c

  Log Message:
  -----------
  virtio-scsi-dataplane: fix memory leak for VirtIOSCSIVring

VirtIOSCSIVring which allocated in virtio_scsi_vring_init
should be free when dataplane has been stopped or failed to start.

Signed-off-by: Ting Wang <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: f75d4f82950c9e74c7202081f1cb97ae94b7c7d8
      
https://github.com/qemu/qemu/commit/f75d4f82950c9e74c7202081f1cb97ae94b7c7d8
  Author: Peter Maydell <address@hidden>
  Date:   2015-03-26 (Thu, 26 Mar 2015)

  Changed paths:
    M blockdev-nbd.c
    M bootdevice.c
    M cpus.c
    M exec.c
    M hw/i386/pc.c
    M hw/m68k/an5206.c
    M hw/m68k/dummy_m68k.c
    M hw/m68k/mcf5208.c
    M hw/mips/mips_fulong2e.c
    M hw/mips/mips_jazz.c
    M hw/mips/mips_malta.c
    M hw/mips/mips_mipssim.c
    M hw/mips/mips_r4k.c
    M hw/nvram/fw_cfg.c
    M hw/ppc/mac_newworld.c
    M hw/ppc/mac_oldworld.c
    M hw/scsi/megasas.c
    M hw/scsi/virtio-scsi-dataplane.c
    M hw/scsi/vmw_pvscsi.c
    M hw/sparc/leon3.c
    M hw/sparc/sun4m.c
    M hw/sparc64/sun4u.c
    M hw/watchdog/wdt_i6300esb.c
    M tests/rcutorture.c
    M tests/test-rcu-list.c
    M tests/usb-hcd-ohci-test.c
    M tests/usb-hcd-uhci-test.c
    M tests/usb-hcd-xhci-test.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

Bugfixes and making SCSI adapters IOMMU-friendly.

# gpg: Signature made Thu Mar 26 13:24:05 2015 GMT using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <address@hidden>"
# gpg:                 aka "Paolo Bonzini <address@hidden>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream:
  virtio-scsi-dataplane: fix memory leak for VirtIOSCSIVring
  misc: fix typos in copyright declaration
  exec: avoid possible overwriting of mmaped area in qemu_ram_remap
  sparc: memory: Replace memory_region_init_ram with 
memory_region_allocate_system_memory
  mips: memory: Replace memory_region_init_ram with 
memory_region_allocate_system_memory
  m68k: memory: Replace memory_region_init_ram with 
memory_region_allocate_system_memory
  nbd: Fix up comment after commit e140177
  vmw_pvscsi: use PCI DMA APIs
  megasas: use PCI DMA APIs
  cpus: Don't kick un-realized cpus.
  i6300esb: Fix signed integer overflow
  i6300esb: Correct endiannness
  fw_cfg: factor out initialization of FW_CFG_ID (rev. number)
  rcu tests: fix compilation on 32-bit ppc

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/896848f0d3e2...f75d4f82950c