[Qemu-commits] [qemu/qemu] 029eae: configure: Fix CONFIG_QEMU_HELPERDIR generation

[GitHub]

  Branch: refs/heads/stable-1.2
  Home:   https://github.com/qemu/qemu
  Commit: 029eae1a7575bcb163f23a3676df1d1c7f7eb709
      
https://github.com/qemu/qemu/commit/029eae1a7575bcb163f23a3676df1d1c7f7eb709
  Author: Jan Kiszka <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M configure

  Log Message:
  -----------
  configure: Fix CONFIG_QEMU_HELPERDIR generation

We need to evaluate $libexecdir in configure, otherwise we literally end
up with "${prefix}/libexec" instead of the absolute path as
CONFIG_QEMU_HELPERDIR.

Signed-off-by: Jan Kiszka <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit 38f419f35225decdbaea9fe1fd00218f8924ce84)

Conflicts:

        configure

Signed-off-by: Michael Roth <address@hidden>


  Commit: 5a99c8ca011b10bc80f2f91a864e28cdd800e005
      
https://github.com/qemu/qemu/commit/5a99c8ca011b10bc80f2f91a864e28cdd800e005
  Author: Michael Tokarev <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M configure

  Log Message:
  -----------
  fix CONFIG_QEMU_HELPERDIR generation again

commit 38f419f35225 fixed a breakage with CONFIG_QEMU_HELPERDIR
which has been introduced by 8bf188aa18ef7a8.  But while techinically
that fix has been correct, all other similar variables are handled
differently.  Make it consistent, and let scripts/create_config
expand and capitalize the variable properly like for all other
qemu_*dir variables.

Signed-off-by: Michael Tokarev <address@hidden>
(cherry picked from commit f354b1a1ee7a1c72d51b42808724a2b10eec315f)

Conflicts:

        configure

Signed-off-by: Michael Roth <address@hidden>


  Commit: 0ae18b369cbd7c8bae26193349878bab4c12c3d1
      
https://github.com/qemu/qemu/commit/0ae18b369cbd7c8bae26193349878bab4c12c3d1
  Author: Joel Martin <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M ui/vnc.c

  Log Message:
  -----------
  ui/vnc: Only report/use TIGHT_PNG encoding if enabled.

If TIGHT_PNG is not enabled by the --enable-vnc-png configure flag
then do not report to the client that it is supported.

Also, since TIGHT_PNG is the same as the TIGHT encoding but with the
filter/copy replaced with PNG data, adding it to the supported
encodings list when it is disabled will cause the TIGHT encoding to be
used even though the client requested TIGHT_PNG.

Signed-off-by: Joel Martin <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit fe3e7f2dc05225cdd2ba40defcd4e2581bebc5e0)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 5af7caaadd1d11c7f061c914e34a5d917015b733
      
https://github.com/qemu/qemu/commit/5af7caaadd1d11c7f061c914e34a5d917015b733
  Author: Paolo Bonzini <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M ui/vnc.c

  Log Message:
  -----------
  vnc: fix "info vnc" with "-vnc ..., reverse=on"

When reverse connection is in use, there is no active VNC server
socket.  Because of this, getsockopt(-1, ...) is attempted and
the following error is emitted:

    $ socat TCP-LISTEN:5900,reuseaddr TCP-LISTEN:5901,reuseaddr &
    $ x86_64-softmmu/qemu-system-x86_64 -vnc localhost:5900,reverse -monitor 
stdio
    QEMU 1.2.50 monitor - type 'help' for more information
    (qemu) info vnc
    An undefined error has occurred

Because however the host, family, service and auth fields are
optional, we can just exit if there is no active server socket.

    $ x86_64-softmmu/qemu-system-x86_64 -vnc localhost:5900,reverse -monitor 
stdio
    QEMU 1.2.50 monitor - type 'help' for more information
    (qemu) info vnc
    Server:
    Client:
   address: 127.0.0.1:5900
      x509_dname: none
  username: none

Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 417b0b88904fe1dd8c41bff8092dfbab0134d9cb)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 85c91ea7e2500d44a8381a6018f3f7e9aab1abe6
      
https://github.com/qemu/qemu/commit/85c91ea7e2500d44a8381a6018f3f7e9aab1abe6
  Author: Hans de Goede <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M hw/usb/hcd-uhci.c

  Log Message:
  -----------
  uhci: Raise interrupt when requested even for non active tds

According to the spec we must raise an interrupt when one is requested
even for non active tds.

Linux depends on this, for bulk transfers it runs an inactivity timer
to work around a bug in early uhci revisions, when we take longer then
200 ms to process a packet, this timer goes of, and as part of the
handling Linux then unlinks the qh, and relinks it after the frindex
has increased by atleast 1, the problem is Linux only checks for the
frindex increases on an interrupt, and we don't send that, causing
the qh to go inactive for more then 32 frames, at which point we
consider the packet cancelled.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 883bca776daa43111e9c39008f0038f7c62ae723)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 472da83043f72e1730fe93332c55eca357bb6982
      
https://github.com/qemu/qemu/commit/472da83043f72e1730fe93332c55eca357bb6982
  Author: Alon Levy <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M hw/qxl.c

  Log Message:
  -----------
  hw/qxl: qxl_dirty_surfaces: use uintptr_t

As suggested by Paolo Bonzini, to avoid possible integer overflow issues.

Signed-off-by: Alon Levy <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit c5825ac6c861bfe1a4adfa27517931b56079e298)

Signed-off-by: Michael Roth <address@hidden>


  Commit: a106eaa3a6e6303fba80d763e806102fec28c943
      
https://github.com/qemu/qemu/commit/a106eaa3a6e6303fba80d763e806102fec28c943
  Author: Gerd Hoffmann <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M hw/qxl-render.c

  Log Message:
  -----------
  qxl: always update displaysurface on resize

Don't try to be clever and skip displaysurface reinitialization in case
the size hasn't changed.  Other parameters might have changed
nevertheless, for example depth or stride, resulting in rendering being
broken then.

Trigger: boot linux guest with vesafb, start X11, make sure both vesafb
and X11 use the display same resolution.  Then watch X11 screen being
upside down.

Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 0ec8df3974d2a4ff95b5fd4785b9bd3def7252f3)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 4843c928f92f6658e71bc100662be9bb585c7d1b
      
https://github.com/qemu/qemu/commit/4843c928f92f6658e71bc100662be9bb585c7d1b
  Author: Paolo Bonzini <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M cutils.c
    M tests/rtc-test.c

  Log Message:
  -----------
  rtc: fix overflow in mktimegm

When setting a date in 1980, Linux is actually disregarding the century
byte and setting the year to 2080.  This causes a year-2038 overflow
in mktimegm.  Fix this by doing the days-to-seconds computation in
64-bit math.

Reported-by: Lucas Meneghel Rodrigues <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit b6db4aca20e9af4f62c9c9e08b9b9672a6ed3390)

Signed-off-by: Michael Roth <address@hidden>


  Commit: eb63b0c2da53caf1681ca0123a4e0aa893ffe238
      
https://github.com/qemu/qemu/commit/eb63b0c2da53caf1681ca0123a4e0aa893ffe238
  Author: Stefan Weil <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M hw/nand.c
    M hw/onenand.c
    M hw/sd.c

  Log Message:
  -----------
  hw: Fix return value check for bdrv_read, bdrv_write

Those functions return -errno in case of an error.
The old code would typically only detect EPERM (1) errors.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 7a608f562ebd91e811ed0b725e528c894e4f19c4)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 3dfbc51e787bbe150273595ef526167842fd94ec
      
https://github.com/qemu/qemu/commit/3dfbc51e787bbe150273595ef526167842fd94ec
  Author: Don Slutz <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M target-i386/cpu.c

  Log Message:
  -----------
  target-i386: Allow tsc-frequency to be larger then 2.147G

The check using INT_MAX (2147483647) is wrong in this case.

Signed-off-by: Fred Oliveira <address@hidden>
Signed-off-by: Don Slutz <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 2e84849aa2cc7f220d3b3668f5f7e3c57bb1b590)

Signed-off-by: Michael Roth <address@hidden>


  Commit: e16d81df85ec6e66364770cdb5e2737b0586961c
      
https://github.com/qemu/qemu/commit/e16d81df85ec6e66364770cdb5e2737b0586961c
  Author: Dmitry Fleytman <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M hw/e1000.c

  Log Message:
  -----------
  e1000: drop check_rxov, always treat RX ring with RDH == RDT as empty

Real HW always treats RX ring with RDH == RDT as empty.
Emulation is supposed to behave the same.

Reported-by: Chris Webb <address@hidden>
Reported-by: Richard Davies <address@hidden>
Signed-off-by: Dmitry Fleytman <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit e5b8b0d4ba29fe1268ba049519a1b0cf8552a21a)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 0dfd8215c2d7023436e4bd25b68d6f00d83702e6
      
https://github.com/qemu/qemu/commit/0dfd8215c2d7023436e4bd25b68d6f00d83702e6
  Author: Avi Kivity <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M memory.c

  Log Message:
  -----------
  memory: fix rendering of a region obscured by another

The memory core drops regions that are hidden by another region (for example,
during BAR sizing), but it doesn't do so correctly if the lower address of the
existing range is below the lower address of the new range.

Example (qemu-system-mips -M malta -kernel vmlinux-2.6.32-5-4kc-malta
   -append "console=ttyS0"  -nographic -vga cirrus):

Existing range: 10000000-107fffff
New range:      100a0000-100bffff

Correct behaviour: drop new range
Incorrect behaviour: add new range

Fix by taking this case into account (previously we only considered
equal lower boundaries).

Tested-by: Aurelien Jarno <address@hidden>
Signed-off-by: Avi Kivity <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit d26a8caea3f160782841efb87b5e8bea606b512b)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 7817b8d858852adb2ae93f2af8c7f2a1198f4f61
      
https://github.com/qemu/qemu/commit/7817b8d858852adb2ae93f2af8c7f2a1198f4f61
  Author: Alexander Graf <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M hw/s390-virtio.c

  Log Message:
  -----------
  s390x: fix -initrd in virtio machine

When using -initrd in the virtio machine, we need to indicate the initrd
start and size inside the kernel image. These parameters need to be stored
in native endianness.

Signed-off-by: Alexander Graf <address@hidden>
Acked-by: Richard Henderson <address@hidden>
Acked-by: Christian Borntraeger <address@hidden>
(cherry picked from commit 235a3f0bed3584fe65079ffa07c7a842971f261e)

Signed-off-by: Michael Roth <address@hidden>


  Commit: db6e5ab78efd1d0c07945fcff6f42e9acb8929ed
      
https://github.com/qemu/qemu/commit/db6e5ab78efd1d0c07945fcff6f42e9acb8929ed
  Author: Alexander Graf <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M hw/ppc440_bamboo.c

  Log Message:
  -----------
  PPC: Bamboo: Fix memory size DT property

Device tree properties need to be specified in big endian. Fix the
bamboo memory size property accordingly.

Signed-off-by: Alexander Graf <address@hidden>
CC: address@hidden
(cherry picked from commit 5232fa59b17b45c04bd24e0d38224964816bf391)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 03e044136ae6c595fec63dd21be39dbf12a24eca
      
https://github.com/qemu/qemu/commit/03e044136ae6c595fec63dd21be39dbf12a24eca
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M default-configs/sparc64-softmmu.mak

  Log Message:
  -----------
  target-sparc64: disable VGA cirrus

OpenBIOS on sparc64 only support Standard VGA and not Cirrus VGA. Don't
build Cirrus VGA support so that it can't be selected.

This fixes the breakage introduced by commit f2898771.

Reported-by: Richard Henderson <address@hidden>
Cc: Blue Swirl <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Tested-by: Richard Henderson <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit 0356404b0f1da939657cad1efeb556745cd430d5)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 3dd59b4dc77847d78d04c4cfe03d9bd574ff5918
      
https://github.com/qemu/qemu/commit/3dd59b4dc77847d78d04c4cfe03d9bd574ff5918
  Author: Gerd Hoffmann <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M hw/usb/hcd-xhci.c

  Log Message:
  -----------
  xhci: fix usb name in caps

Used to be "UTB" not "USB".

Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 0ebfb144e8ad3f2da436d630fdcc5aa9ab646341)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 5c0d5aebd5c9cf445fb71e01ee56efad094248f5
      
https://github.com/qemu/qemu/commit/5c0d5aebd5c9cf445fb71e01ee56efad094248f5
  Author: Paolo Bonzini <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M qemu-img.c
    M qemu-io.c

  Log Message:
  -----------
  tools: initialize main loop before block layer

Tools were broken because they initialized the block layer while
qemu_aio_context was still NULL.

Reported-by: malc <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: malc <address@hidden>
(cherry picked from commit 2592c59a66d456fe98fe96cb5787b356c40ee66f)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 382a582c1f4c1877968d73751dd2f1206547eda4
      
https://github.com/qemu/qemu/commit/382a582c1f4c1877968d73751dd2f1206547eda4
  Author: Meador Inge <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M target-m68k/m68k-semi.c

  Log Message:
  -----------
  m68k: Return semihosting errno values correctly

Fixing a simple typo, s/errno/err/, that caused
the error status from GDB semihosted system calls
to be returned incorrectly.

Signed-off-by: Meador Inge <address@hidden>
Reviewed-by: Andreas Färber <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit aed91c1bff5e568c7b0fbd0e1e7e2f9e62409e73)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 879c2648038863c30587411f90b142de05e12a3b
      
https://github.com/qemu/qemu/commit/879c2648038863c30587411f90b142de05e12a3b
  Author: Paolo Bonzini <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M nbd.c

  Log Message:
  -----------
  nbd: fixes to read-only handling

We do not need BLKROSET if the kernel supports setting flags.
Also, always do BLKROSET even for a read-write export, otherwise
the read-only state remains "sticky" after the invocation of
"qemu-nbd -r".

Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit c8969eded252058e90e91f12f75f32aceae46ec9)

Signed-off-by: Michael Roth <address@hidden>


  Commit: f6b803df744f3b8fafd69fa8e8e0588ffd75f4ac
      
https://github.com/qemu/qemu/commit/f6b803df744f3b8fafd69fa8e8e0588ffd75f4ac
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M hw/mips_malta.c

  Log Message:
  -----------
  mips/malta: fix CBUS UART interrupt pin

According to the MIPS Malta Developement Platform User's Manual, the
i8259 interrupt controller is supposed to be connected to the hardware
IRQ0, and the CBUS UART to the hardware interrupt 2.

In QEMU they are both connected to hardware interrupt 0, the CBUS UART
interrupt being wrong. This patch fixes that. It should be noted that
the irq array in QEMU includes the software interrupts, hence
env->irq[2] is the first hardware interrupt.

Cc: Ralf Baechle <address@hidden>
Reviewed-by: Eric Johnson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit 68d001928b151a0c50f367c0bdca645b3d5e9ed3)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 357414daa4915fb2312fff2af2d4ef28147f3eeb
      
https://github.com/qemu/qemu/commit/357414daa4915fb2312fff2af2d4ef28147f3eeb
  Author: 陳韋任 (Wei-Ren Chen) <address@hidden>
  Date:   2012-11-30 (Fri, 30 Nov 2012)

  Changed paths:
    M target-mips/translate.c

  Log Message:
  -----------
  target-mips: fix wrong microMIPS opcode encoding

While reading microMIPS decoding, I found a possible wrong opcode
encoding. According to [1] page 166, the bits 13..12 for MULTU is
0x01 rather than 0x00. Please review, thanks.

[1] MIPS Architecture for Programmers VolumeIV-e: The MIPS DSP
    Application-Specific Extension to the microMIPS32 Architecture

Signed-off-by: Chen Wei-Ren <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit 6801038bc52d61f81ac8a25fbe392f1bad982887)

Signed-off-by: Michael Roth <address@hidden>


  Commit: ac914c1fc2f6981282e179f408d5e6af589595b8
      
https://github.com/qemu/qemu/commit/ac914c1fc2f6981282e179f408d5e6af589595b8
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M tcg/arm/tcg-target.c

  Log Message:
  -----------
  tcg/arm: fix TLB access in qemu-ld/st ops

The TCG arm backend considers likely that the offset to the TLB
entries does not exceed 12 bits for mem_index = 0. In practice this is
not true for at least the MIPS target.

The current patch fixes that by loading the bits 23-12 with a separate
instruction, and using loads with address writeback, independently of
the value of mem_idx. In total this allow a 24-bit offset, which is a
lot more than needed.

Cc: Andrzej Zaborowski <address@hidden>
Cc: Peter Maydell <address@hidden>
Cc: address@hidden
Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit d17bd1d8cc27f8c1a24c65f555a77a661c332b7f)

Signed-off-by: Michael Roth <address@hidden>


  Commit: ede76edace43dcc940e1dfaa3f5be5fe485b7254
      
https://github.com/qemu/qemu/commit/ede76edace43dcc940e1dfaa3f5be5fe485b7254
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M tcg/arm/tcg-target.c

  Log Message:
  -----------
  tcg/arm: fix cross-endian qemu_st16

The bswap16 TCG opcode assumes that the high bytes of the temp equal
to 0 before calling it. The ARM backend implementation takes this
assumption to slightly optimize the generated code.

The same implementation is called for implementing the cross-endian
qemu_st16 opcode, where this assumption is not true anymore. One way to
fix that would be to zero the high bytes before calling it. Given the
store instruction just ignore them, it is possible to provide a slightly
more optimized version. With ARMv6+ the rev16 instruction does the work
correctly. For lower ARM versions the patch provides a version which
behaves correctly with non-zero high bytes, but fill them with junk.

Cc: Andrzej Zaborowski <address@hidden>
Cc: Peter Maydell <address@hidden>
Cc: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit 7aab08aa786e3a8838beac758ee61c5000144937)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 4a8e490cbc15ad3fd88180ebff016cdd56242987
      
https://github.com/qemu/qemu/commit/4a8e490cbc15ad3fd88180ebff016cdd56242987
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M target-openrisc/cpu.h

  Log Message:
  -----------
  target-openrisc: remove conflicting definitions from cpu.h

On an ARM host, the registers definitions from cpu.h clash
with /usr/include/sys/ucontext.h. As there are unused, just remove
them.

Cc: Jia Liu <address@hidden>
Cc: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit 44e04d3b945ba6f5cc87e65192081da4783f73fa)

Signed-off-by: Michael Roth <address@hidden>


  Commit: ea79e157c61eb20e1065836f9d2719ffef91b8cf
      
https://github.com/qemu/qemu/commit/ea79e157c61eb20e1065836f9d2719ffef91b8cf
  Author: Bruce Rogers <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M configure

  Log Message:
  -----------
  configure: avoid compiler warning in pipe2 detection

When building qemu-kvm for openSUSE:Factory, I am getting a
warning in the pipe2 detection performed by configure, which
prevents using --enable-werror.

Change detection code to use return value of pipe2.

Signed-off-by: Bruce Rogers <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit 9bca81624ef9299b9a06013fd29cd6899079aab4)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 600a9efdb1ddb749332200cab27d9240fbc0bda1
      
https://github.com/qemu/qemu/commit/600a9efdb1ddb749332200cab27d9240fbc0bda1
  Author: Kevin Wolf <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M block/qcow2-refcount.c

  Log Message:
  -----------
  qcow2: Fix refcount table size calculation

A missing factor for the refcount table entry size in the calculation
could mean that too little memory was allocated for the in-memory
representation of the table, resulting in a buffer overflow.

Signed-off-by: Kevin Wolf <address@hidden>
Reviewed-by: Michael Tokarev <address@hidden>
Tested-by: Michael Tokarev <address@hidden>
(cherry picked from commit a3548077062dd9dc2701ebffd931ba6eaef40bec)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 38c6d17e75f83363ef92582dd366a4b1d936dc2f
      
https://github.com/qemu/qemu/commit/38c6d17e75f83363ef92582dd366a4b1d936dc2f
  Author: Richard Henderson <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M tci.c

  Log Message:
  -----------
  tci: Fix type of tci_read_label

Fixes the pointer truncation that was occurring for branches.

Cc: Stefan Weil <address@hidden>
Cc: Blue Swirl <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>
Reviewed-by: Stefan Weil <address@hidden>
Tested-by: Stefan Weil <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit c6c5063c7a5bb1d3fe6b9931a1ec15294e39b8b1)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 4fb9656b9d62ce348656a7184ac7861d70c490a7
      
https://github.com/qemu/qemu/commit/4fb9656b9d62ce348656a7184ac7861d70c490a7
  Author: Stefan Weil <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M block.c

  Log Message:
  -----------
  block: Fix regression for MinGW (assertion caused by short string)

The local string tmp_filename is passed to function get_tmp_filename
which expects a string with minimum size MAX_PATH for w32 hosts.

MAX_PATH is 260 and PATH_MAX is 259, so tmp_filename was too short.

Commit eba25057b9a5e19d10ace2bc7716667a31297169 introduced this
regression.

Signed-off-by: Stefan Weil <address@hidden>
Reviewed-by: Stefan Hajnoczi <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit 89c9bc3d147fdaa932db99b0463b4af1d3e7cda1)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 5e19e498b4b2a31c985dc96b1aff078c34e40488
      
https://github.com/qemu/qemu/commit/5e19e498b4b2a31c985dc96b1aff078c34e40488
  Author: Paolo Bonzini <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M qom/object.c

  Log Message:
  -----------
  qom: dynamic_cast of NULL is always NULL

Trying to cast a NULL value will cause a crash.  Returning
NULL is also sensible, and it is also what the type-unsafe
DO_UPCAST macro does.

Reported-by: Markus Armbruster <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit b7f43fe46029d8fd0594cd599fa2599dcce0f553)

Signed-off-by: Michael Roth <address@hidden>


  Commit: a99cb0d20a4868a31f294f5d1fd4fa3225ea70ab
      
https://github.com/qemu/qemu/commit/a99cb0d20a4868a31f294f5d1fd4fa3225ea70ab
  Author: Paolo Bonzini <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M hw/pci-hotplug.c

  Log Message:
  -----------
  hmp: do not crash on invalid SCSI hotplug

Commit 0d93692 (qdev: Convert busses to QEMU Object Model, 2012-05-02)
removed a check on the type of the bus where a SCSI disk is hotplugged.
However, hot-plugging to the wrong kind of device now causes a crash
due to either a NULL pointer dereference (avoided by the previous patch)
or a failed QOM cast.

Instead, in this case we need to use object_dynamic_cast and check for
the result, similar to what was done before that commit.

Reported-by: Markus Armbruster <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit b5007bcc9729acd995518c52eb1038c4d8416b5d)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 0aad8f1a49fe49b15858978a03b4adead669ff6d
      
https://github.com/qemu/qemu/commit/0aad8f1a49fe49b15858978a03b4adead669ff6d
  Author: Julio Guerra <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M target-ppc/translate.c

  Log Message:
  -----------
  PPC: Fix missing TRACE exception

This patch fixes bug 1031698 :
https://bugs.launchpad.net/qemu/+bug/1031698

If we look at the (truncated) translation of the conditional branch
instruction in the test submitted in the bug post, the call to the
exception helper is missing in the "bne-false" chunk of translated
code :

IN:
bne-    0x1800278

OUT:
0xb544236d:  jne    0xb5442396

0xb5442373:  mov    %ebp,(%esp)
0xb5442376:  mov    $0x44,%ebx
0xb544237b:  mov    %ebx,0x4(%esp)
0xb544237f:  mov    $0x1800278,%ebx
0xb5442384:  mov    %ebx,0x25c(%ebp)
0xb544238a:  call   0x827475a
               ^^^^^^^^^^^^^^^^^^

0xb5442396:  mov    %ebp,(%esp)
0xb5442399:  mov    $0x44,%ebx
0xb544239e:  mov    %ebx,0x4(%esp)
0xb54423a2:  mov    $0x1800270,%ebx
0xb54423a7:  mov    %ebx,0x25c(%ebp)

Indeed, gen_exception(ctx, excp) called by gen_goto_tb (called by
gen_bcond) changes ctx->exception's value to excp's :

gen_bcond()
{
  gen_goto_tb(ctx, 0, ctx->nip + li - 4);
  /* ctx->exception value is POWERPC_EXCP_BRANCH */

  gen_goto_tb(ctx, 1, ctx->nip);
  /* ctx->exception now value is POWERPC_EXCP_TRACE */
}

Making the following gen_goto_tb()'s test false during the second call :

if ((ctx->singlestep_enabled &
    (CPU_BRANCH_STEP | CPU_SINGLE_STEP)) &&
    ctx->exception == POWERPC_EXCP_BRANCH /* false...*/) {
   target_ulong tmp = ctx->nip;
   ctx->nip = dest;
   /* ... and this is the missing call */
   gen_exception(ctx, POWERPC_EXCP_TRACE);
   ctx->nip = tmp;
}

So the patch simply adds the missing matching case, fixing our problem.

Signed-off-by: Julio Guerra <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>
(cherry picked from commit f0cc4aa8450376ca2aee3ebb09db71f9f2ff333b)

Signed-off-by: Michael Roth <address@hidden>


  Commit: f05a3da4e00d24c4540811e6fff2c4f0484771bd
      
https://github.com/qemu/qemu/commit/f05a3da4e00d24c4540811e6fff2c4f0484771bd
  Author: Paolo Bonzini <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M qom/object.c

  Log Message:
  -----------
  qom: fix refcount of non-heap-allocated objects

The reference count for embedded objects is always one too low, because
object_initialize_with_type returns with zero references to the object.
This causes premature finalization of the object (or an assertion failure)
after calling object_ref to add an extra reference and object_unref to
remove it.

The fix is to move the initial object_ref call from object_new_with_type
to object_initialize_with_type.

Acked-by: Andreas Färber <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 764b63125a77dab54ed405d493452a4e05679c2e)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 54c6c5a35d8bd57b320bbba8b85604018004bd13
      
https://github.com/qemu/qemu/commit/54c6c5a35d8bd57b320bbba8b85604018004bd13
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M qapi/qapi-dealloc-visitor.c

  Log Message:
  -----------
  qapi: handle visitor->type_size() in QapiDeallocVisitor

visit_type_size() requires either visitor->type_size() or
visitor_uint64() to be implemented, otherwise a NULL function pointer is
invoked.

It is possible to trigger this crash as follows:

  $ qemu-system-x86_64 -netdev tap,sndbuf=0,id=netdev0 \
                 -device virtio-blk-pci,netdev=netdev0

The 'sndbuf' option has type "size".

Reviewed-by: Andreas Färber <address@hidden>
Reviewed-by: Michael Roth <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 0c26f2eca40d6c65ea9edc62a10e510dc7f65cc8)

Signed-off-by: Michael Roth <address@hidden>


  Commit: ffffff01466a0180de7632842cf583c8a9cbf959
      
https://github.com/qemu/qemu/commit/ffffff01466a0180de7632842cf583c8a9cbf959
  Author: Bruce Rogers <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M qapi/qapi-dealloc-visitor.c

  Log Message:
  -----------
  qapi: fix qapi_dealloc_type_size parameter type

The second parameter to qapi_dealloc_type_size should be a uint64_t *,
not a size_t *. This was causing our 32 bit x86 build to fail, since
warnings are treated as errors.

Signed-off-by: Bruce Rogers <address@hidden>
Reviewed-by: Michael Roth <address@hidden>
Reviewed-by: Stefan Weil <address@hidden>
Signed-off-by: Luiz Capitulino <address@hidden>
(cherry picked from commit 1d16252652688a775b244fffa1b9ac9b719ceffc)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 972a2bf07287e4a9a4a7bd03d4e9af5d4259baef
      
https://github.com/qemu/qemu/commit/972a2bf07287e4a9a4a7bd03d4e9af5d4259baef
  Author: Peter Lieven <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M block/iscsi.c

  Log Message:
  -----------
  iscsi: fix segfault in url parsing

If an invalid URL is specified iscsi_get_error(iscsi) is called
with iscsi == NULL.

Signed-off-by: Peter Lieven <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit 8da1e18b0cf46b6c95c88bbad1cc50d6dd1bef4b)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 707f2b69ff97820f345e509f68155e265c7e45a4
      
https://github.com/qemu/qemu/commit/707f2b69ff97820f345e509f68155e265c7e45a4
  Author: Peter Lieven <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M block/iscsi.c

  Log Message:
  -----------
  iscsi: fix deadlock during login

If the connection is interrupted before the first login is successfully
completed qemu-kvm is waiting forever in qemu_aio_wait().

This is fixed by performing an sync login to the target. If the
connection breaks after the first successful login errors are
handled internally by libiscsi.

Signed-off-by: Peter Lieven <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit e829b0bb054ed3389e5b22dad61875e51674e629)

Signed-off-by: Michael Roth <address@hidden>


  Commit: cef2566953b967f8ff79ef6305c92728a795fdac
      
https://github.com/qemu/qemu/commit/cef2566953b967f8ff79ef6305c92728a795fdac
  Author: Peter Lieven <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M block/iscsi.c

  Log Message:
  -----------
  iscsi: do not assume device is zero initialized

Without any complex checks we can't assume that an
iscsi target is initialized to zero.

Signed-off-by: Peter Lieven <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit f807ecd5741325fe0d281199ff22cdda0acb6a7a)

Signed-off-by: Michael Roth <address@hidden>


  Commit: ea08f3a4e25fe76d42a186152949516c2a63a46b
      
https://github.com/qemu/qemu/commit/ea08f3a4e25fe76d42a186152949516c2a63a46b
  Author: David Gibson <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M hw/virtio-scsi.c

  Log Message:
  -----------
  virtio-scsi: Fix some endian bugs with virtio-scsi

The virtio-scsi specification does not specify the correct endianness for
fields in the request structure.  It's therefore best to assume that it is
"guest native" endian since that's the (stupid and poorly defined) norm in
virtio.

However, the qemu device for virtio-scsi has no byteswaps at all, and so
will break if the guest has different endianness from the host.  This patch
fixes it by adding tswap() calls for the sense_len and resid fields in
the request structure.  In theory status_qualifier needs swaps as well,
but that field is never actually touched.  The tag field is a uint64_t, but
since its value is completely arbitrary, it might as well be uint8_t[8]
and so it does not need swapping.

Cc: Paolo Bonzini <address@hidden>
Cc: Paul 'Rusty' Russell <address@hidden>
Signed-off-by: David Gibson <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit 474ee55a18765e7de8f0b2cc00db5d26286bb24d)

Signed-off-by: Michael Roth <address@hidden>


  Commit: bf47da47dbcbf2c90119ba0bd45560d5b2f1dd13
      
https://github.com/qemu/qemu/commit/bf47da47dbcbf2c90119ba0bd45560d5b2f1dd13
  Author: David Gibson <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M hw/virtio-scsi.c

  Log Message:
  -----------
  virtio-scsi: Fix subtle (guest) endian bug

The virtio-scsi config space is, by specification, in guest endian (which
is ill-defined, but there you go).  In virtio_scsi_get_config() we set up
all the fields in there, using stl_raw().  Which is a problem for the
max_channel and max_target fields, which are 16-bit, not 32-bit.  For
little-endian targets we get away with it by accident, since the first
two bytes will still be correct, and the extra two bytes written (with
zeroes) will be overwritten correctly by the next store.

But for big-endian guests, this means the max_target field ends up as zero,
which means the guest will only recognize a single disk on the virtio-scsi
bus.  This patch fixes the problem.

Cc: Paolo Bonzini <address@hidden>
Cc: Paul 'Rusty' Russell <address@hidden>
Signed-off-by: David Gibson <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit 863d1050c96cff91dd478767c0da9cc288575919)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 8c9283c82a8428018b2e43c5f5381a99d1648d4b
      
https://github.com/qemu/qemu/commit/8c9283c82a8428018b2e43c5f5381a99d1648d4b
  Author: Yonit Halperin <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M hw/qxl.c

  Log Message:
  -----------
  qxl: reload memslots after migration, when qxl is in UNDEFINED mode

The devram memslot stays active when qxl enters UNDEFINED mode (i.e, no
primary surface). If migration has occurred while the device is in
UNDEFINED stae, the memslots have to be reloaded at the destination.

Fixes rhbz#874574

Signed-off-by: Yonit Halperin <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit fa98efe932d93a15ffa867f3b05149c8d1fc7c28)

Signed-off-by: Michael Roth <address@hidden>


  Commit: cd00334f1ae587aee146517af295adbfd7ab702a
      
https://github.com/qemu/qemu/commit/cd00334f1ae587aee146517af295adbfd7ab702a
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M hw/usb/bus.c

  Log Message:
  -----------
  usb: fail usbdevice_create() when there is no USB bus

Report an error instead of segfaulting when attaching a USB device to a
machine with no USB busses:

  $ qemu-system-arm -machine vexpress-a9 \
      -sd Fedora-17-armhfp-vexpress-mmcblk0.img \
      -kernel vmlinuz-3.4.2-3.fc17.armv7hl \
      -initrd initramfs-3.4.2-3.fc17.armv7hl.img \
      -usbdevice disk:format=raw:test.img

Note that the vexpress-a9 machine does not have a USB host controller.

Reported-by: David Abdurachmanov <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit c128d6a6d785eb9235a4f6dbd52f405ab8c60bee)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 178ef3a43ad24d074c683e2fe0658e589747c823
      
https://github.com/qemu/qemu/commit/178ef3a43ad24d074c683e2fe0658e589747c823
  Author: Dietmar Maurer <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M include/qemu/ratelimit.h

  Log Message:
  -----------
  stream: fix ratelimit_set_speed

The formula to compute slice_quota was wrong since commit 6ef228fc.

Signed-off-by: Dietmar Maurer <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit e3980e28bb888bf643054770452998d1b4319609)

Signed-off-by: Michael Roth <address@hidden>


  Commit: e1a0ffb95728304f962ce36b27dcd3a16f04a05d
      
https://github.com/qemu/qemu/commit/e1a0ffb95728304f962ce36b27dcd3a16f04a05d
  Author: Michael Contreras <address@hidden>
  Date:   2012-12-03 (Mon, 03 Dec 2012)

  Changed paths:
    M hw/e1000.c

  Log Message:
  -----------
  e1000: Discard packets that are too long if !SBP and !LPE

The e1000_receive function for the e1000 needs to discard packets longer than
1522 bytes if the SBP and LPE flags are disabled. The linux driver assumes
this behavior and allocates memory based on this assumption.

Signed-off-by: Michael Contreras <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit b0d9ffcd0251161c7c92f94804dcf599dfa3edeb)

Signed-off-by: Michael Roth <address@hidden>


  Commit: ff0245dea25937a93878069b15eee245344eb6b9
      
https://github.com/qemu/qemu/commit/ff0245dea25937a93878069b15eee245344eb6b9
  Author: Michael Roth <address@hidden>
  Date:   2012-12-11 (Tue, 11 Dec 2012)

  Changed paths:
    M VERSION

  Log Message:
  -----------
  update VERSION for v1.2.2

Signed-off-by: Michael Roth <address@hidden>


Compare: https://github.com/qemu/qemu/compare/f4c53d94d253...ff0245dea259