[Qemu-commits] [qemu/qemu] 3daa41: scsi: revert change to scsi_req_cancel_async and a...

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 3daa41078aedf227ec98b0d1c9d56b77b6d20153
      
https://github.com/qemu/qemu/commit/3daa41078aedf227ec98b0d1c9d56b77b6d20153
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M hw/scsi/scsi-bus.c

  Log Message:
  -----------
  scsi: revert change to scsi_req_cancel_async and add assertions

Fam Zheng noticed that the change in commit 36896bf ("scsi: always call
notifier on async cancellation", 2015-12-16) could cause a leak of
the request; scsi_req_cancel_async now calls scsi_req_ref
multiple times for multiple cancellations, but there is only
one call to scsi_req_cancel_complete.

So revert the patch and instead assert that the problematic case (a call
to scsi_req_cancel_async after the aiocb has been completed) cannot
happen.

Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 76c64d33601a4948d6f72022992574a75b6fab97
      
https://github.com/qemu/qemu/commit/76c64d33601a4948d6f72022992574a75b6fab97
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M target-i386/helper.c

  Log Message:
  -----------
  target-i386: do not duplicate page protection checks

x86_cpu_handle_mmu_fault is currently checking twice for writability
and executability of pages; the first time to decide whether to
trigger a page fault, the second time to compute the "prot" argument
to tlb_set_page_with_attrs.

Reorganize code so that first "prot" is computed, then it is used
to check whether to raise a page fault, then finally PROT_WRITE is
removed if the D bit will have to be set.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 4c1396cb576c9b14425558b73de1584c7a9735d7
      
https://github.com/qemu/qemu/commit/4c1396cb576c9b14425558b73de1584c7a9735d7
  Author: P J P <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M hw/i386/kvmvapic.c

  Log Message:
  -----------
  i386: avoid null pointer dereference

    Hello,

A null pointer dereference issue was reported by Mr Ling Liu, CC'd here. It
occurs while doing I/O port write operations via hmp interface. In that,
'current_cpu' remains null as it is not called from cpu_exec loop, which
results in the said issue.

Below is a proposed (tested)patch to fix this issue; Does it look okay?

===
>From ae88a4947fab9a148cd794f8ad2d812e7f5a1d0f Mon Sep 17 00:00:00 2001
From: Prasad J Pandit <address@hidden>
Date: Fri, 18 Dec 2015 11:16:07 +0530
Subject: [PATCH] i386: avoid null pointer dereference

When I/O port write operation is called from hmp interface,
'current_cpu' remains null, as it is not called from cpu_exec()
loop. This leads to a null pointer dereference in vapic_write
routine. Add check to avoid it.

Reported-by: Ling Liu <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: P J P <address@hidden>


  Commit: 36fef36b91f7ec0435215860f1458b5342ce2811
      
https://github.com/qemu/qemu/commit/36fef36b91f7ec0435215860f1458b5342ce2811
  Author: P J P <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M hw/scsi/megasas.c

  Log Message:
  -----------
  scsi: initialise info object with appropriate size

While processing controller 'CTRL_GET_INFO' command, the routine
'megasas_ctrl_get_info' overflows the '&info' object size. Use its
appropriate size to null initialise it.

Reported-by: Qinghao Tang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Message-Id: <address@hidden>
Cc: address@hidden
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: P J P <address@hidden>


  Commit: fca10318390dd3c2e9c9e90fbcdff0fe50188dbf
      
https://github.com/qemu/qemu/commit/fca10318390dd3c2e9c9e90fbcdff0fe50188dbf
  Author: Shmulik Ladkani <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M include/hw/compat.h

  Log Message:
  -----------
  vmw_pvscsi: x-disable-pcie, x-old-pci-configuration back-compat props are 2.5 
specific

pvscsi's x-disable-pcie and x-old-pci-configuration backward compat
properties were introduced in 952970b and d5da3ef:

  vmw_pvscsi: Introduce 'x-old-pci-configuration' backword compatability 
property
  vmw_pvscsi: Introduce 'x-disable-pcie' backword compatability property

and were placed into HW_COMPAT_2_4.

However since these commits were pulled post v2.5, move them to
HW_COMPAT_2_5.

Signed-off-by: Shmulik Ladkani <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 46f296cd3a3ebc3d30e2dbc1da7c4882e3d35ce5
      
https://github.com/qemu/qemu/commit/46f296cd3a3ebc3d30e2dbc1da7c4882e3d35ce5
  Author: Daniel P. Berrange <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M hw/tpm/tpm_passthrough.c
    M include/qemu/sockets.h
    M qemu-char.c

  Log Message:
  -----------
  qemu-char: delete send_all/recv_all helper methods

The qemu-char.c contains two helper methods send_all
and recv_all. These are in fact declared in sockets.h
so ought to have been in util/qemu-sockets.c. For added
fun the impl of recv_all is completely missing on Win32.

Fortunately there is only a single caller of these
methods, the TPM passthrough code, which is only
ever compiled on Linux. With only a single caller
these helpers are not compelling enough to keep so
inline them in the TPM code, avoiding the need to
fix the missing recv_all on Win32.

Signed-off-by: Daniel P. Berrange <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 1cb6d137ffd380c458be2da24a58404708c0db55
      
https://github.com/qemu/qemu/commit/1cb6d137ffd380c458be2da24a58404708c0db55
  Author: Zhu Lingshan <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M block/iscsi.c

  Log Message:
  -----------
  iscsi: send readcapacity10 when readcapacity16 failed

When play with Dell MD3000 target, for sure it
is a TYPE_DISK, but readcapacity16 would fail.
Then we find that readcapacity10 succeeded. It
looks like the target just support readcapacity10
even through it is a TYPE_DISK or have some
TYPE_ROM characteristics.

This patch can give a chance to send
readcapacity16 when readcapacity10 failed.
This patch is not harmful to original pathes

Signed-off-by: Zhu Lingshan <address@hidden>
Message-Id: <address@hidden>
[Don't fall through on UNIT ATTENTION. - Paolo]
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: e1dc68155cafabfd6a065391f7826d5d0992b46e
      
https://github.com/qemu/qemu/commit/e1dc68155cafabfd6a065391f7826d5d0992b46e
  Author: Cao jin <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M hw/scsi/megasas.c
    M hw/scsi/scsi-bus.c
    M hw/scsi/virtio-scsi.c

  Log Message:
  -----------
  SCSI device: fix to incomplete QOMify

Signed-off-by: Cao jin <address@hidden>
Acked-by: Michael S. Tsirkin <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: ee7d7aabdaea4484e069cb99c9fc54e8cb24b56f
      
https://github.com/qemu/qemu/commit/ee7d7aabdaea4484e069cb99c9fc54e8cb24b56f
  Author: Fam Zheng <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M blockdev-nbd.c
    M include/block/nbd.h
    M nbd.c
    M qemu-nbd.c

  Log Message:
  -----------
  nbd: Always call "close_fn" in nbd_client_new

Rename the parameter "close" to "close_fn" to disambiguous with
close(2).

This unifies error handling paths of NBDClient allocation:
nbd_client_new will shutdown the socket and call the "close_fn" callback
if negotiation failed, so the caller don't need a different path than
the normal close.

The returned pointer is never used, make it void in preparation for the
next patch.

Signed-off-by: Fam Zheng <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 798bfe00063ceaa90aa2bf6e4e5c569c80fb4e92
      
https://github.com/qemu/qemu/commit/798bfe00063ceaa90aa2bf6e4e5c569c80fb4e92
  Author: Fam Zheng <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M MAINTAINERS
    M Makefile.objs
    R nbd.c
    A nbd/Makefile.objs
    A nbd/client.c
    A nbd/common.c
    A nbd/nbd-internal.h
    A nbd/server.c
    M tests/qemu-iotests/083

  Log Message:
  -----------
  nbd: Split nbd.c

We have NBD server code and client code, all mixed in a file. Now split
them into separate files under nbd/, and update MAINTAINERS.

filter_nbd for iotest 083 is updated to keep the log filtered out.

Signed-off-by: Fam Zheng <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 1a6245a5b0b4e8d822c739b403fc67c8a7bc8d12
      
https://github.com/qemu/qemu/commit/1a6245a5b0b4e8d822c739b403fc67c8a7bc8d12
  Author: Fam Zheng <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M nbd/server.c

  Log Message:
  -----------
  nbd-server: Coroutine based negotiation

Create a coroutine in nbd_client_new, so that nbd_send_negotiate doesn't
need qemu_set_block().

Handlers need to be set temporarily for csock fd in case the coroutine
yields during I/O.

With this, if the other end disappears in the middle of the negotiation,
we don't block the whole event loop.

To make the code clearer, unify all function names that belong to
negotiate, so they are less likely to be misused. This is important
because we rely on negotiation staying in main loop, as commented in
nbd_negotiate_read/write().

Signed-off-by: Fam Zheng <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: eb38c3b67018ff8069e4f674a28661931a8a3e4f
      
https://github.com/qemu/qemu/commit/eb38c3b67018ff8069e4f674a28661931a8a3e4f
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M nbd/server.c

  Log Message:
  -----------
  nbd-server: do not check request length except for reads and writes

Only reads and writes need to allocate memory correspondent to the
request length.  Other requests can be sent to the storage without
allocating any memory, and thus any request length is acceptable.

Reported-by: Sitsofe Wheeler <address@hidden>
Cc: address@hidden
Reviewed-by: Max Reitz <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: f1c17521e79df863a5771d96974fab0d07f02be0
      
https://github.com/qemu/qemu/commit/f1c17521e79df863a5771d96974fab0d07f02be0
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M block/block-backend.c
    M include/sysemu/block-backend.h
    M nbd/server.c

  Log Message:
  -----------
  nbd-server: do not exit on failed memory allocation

The amount of memory allocated in nbd_co_receive_request is driven by the
NBD client (possibly a virtual machine).  Parallel I/O can cause the
server to allocate a large amount of memory; check for failures and
return ENOMEM in that case.

Cc: address@hidden
Reviewed-by: Max Reitz <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: d0d7708ba29cbcc343364a46bff981e0ff88366f
      
https://github.com/qemu/qemu/commit/d0d7708ba29cbcc343364a46bff981e0ff88366f
  Author: Daniel P. Berrange <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M backends/baum.c
    M backends/msmouse.c
    M gdbstub.c
    M include/sysemu/char.h
    M qapi-schema.json
    M qemu-char.c
    M qemu-options.hx
    M spice-qemu-char.c
    M ui/console.c

  Log Message:
  -----------
  qemu-char: add logfile facility to all chardev backends

Typically a UNIX guest OS will log boot messages to a serial
port in addition to any graphical console. An admin user
may also wish to use the serial port for an interactive
console. A virtualization management system may wish to
collect system boot messages by logging the serial port,
but also wish to allow admins interactive access.

Currently providing such a feature forces the mgmt app
to either provide 2 separate serial ports, one for
logging boot messages and one for interactive console
login, or to proxy all output via a separate service
that can multiplex the two needs onto one serial port.
While both are valid approaches, they each have their
own downsides. The former causes confusion and extra
setup work for VM admins creating disk images. The latter
places an extra burden to re-implement much of the QEMU
chardev backends logic in libvirt or even higher level
mgmt apps and adds extra hops in the data transfer path.

A simpler approach that is satisfactory for many use
cases is to allow the QEMU chardev backends to have a
"logfile" property associated with them.

 $QEMU -chardev socket,host=localhost,port=9000,\
          server=on,nowait,id-charserial0,\
                logfile=/var/log/libvirt/qemu/test-serial0.log
       -device isa-serial,chardev=charserial0,id=serial0

This patch introduces a 'ChardevCommon' struct which
is setup as a base for all the ChardevBackend types.
Ideally this would be registered directly as a base
against ChardevBackend, rather than each type, but
the QAPI generator doesn't allow that since the
ChardevBackend is a non-discriminated union. The
ChardevCommon struct provides the optional 'logfile'
parameter, as well as 'logappend' which controls
whether QEMU truncates or appends (default truncate).

Signed-off-by: Daniel P. Berrange <address@hidden>
Message-Id: <address@hidden>
[Call qemu_chr_parse_common if cd->parse is NULL. - Paolo]
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: fefd749ce29837d399a38d6052ca9968fa7352e7
      
https://github.com/qemu/qemu/commit/fefd749ce29837d399a38d6052ca9968fa7352e7
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M qemu-char.c

  Log Message:
  -----------
  qemu-char: do not leak QemuMutex when freeing a character device

The leak is only apparent on Win32.  On POSIX platforms destroying a
mutex is not necessary.

Reported-by: Eric Blake <address@hidden>
Reviewed-by: Daniel P. Berrange <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 19b6d84316892c8086e0115d6f09cb01abb86cfc
      
https://github.com/qemu/qemu/commit/19b6d84316892c8086e0115d6f09cb01abb86cfc
  Author: Peter Maydell <address@hidden>
  Date:   2016-01-15 (Fri, 15 Jan 2016)

  Changed paths:
    M MAINTAINERS
    M Makefile.objs
    M backends/baum.c
    M backends/msmouse.c
    M block/block-backend.c
    M block/iscsi.c
    M blockdev-nbd.c
    M gdbstub.c
    M hw/i386/kvmvapic.c
    M hw/scsi/megasas.c
    M hw/scsi/scsi-bus.c
    M hw/scsi/virtio-scsi.c
    M hw/tpm/tpm_passthrough.c
    M include/block/nbd.h
    M include/hw/compat.h
    M include/qemu/sockets.h
    M include/sysemu/block-backend.h
    M include/sysemu/char.h
    R nbd.c
    A nbd/Makefile.objs
    A nbd/client.c
    A nbd/common.c
    A nbd/nbd-internal.h
    A nbd/server.c
    M qapi-schema.json
    M qemu-char.c
    M qemu-nbd.c
    M qemu-options.hx
    M spice-qemu-char.c
    M target-i386/helper.c
    M tests/qemu-iotests/083
    M ui/console.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

* qemu-char logfile facility
* NBD coroutine based negotiation
* bugfixes

# gpg: Signature made Fri 15 Jan 2016 17:58:28 GMT using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <address@hidden>"
# gpg:                 aka "Paolo Bonzini <address@hidden>"

* remotes/bonzini/tags/for-upstream:
  qemu-char: do not leak QemuMutex when freeing a character device
  qemu-char: add logfile facility to all chardev backends
  nbd-server: do not exit on failed memory allocation
  nbd-server: do not check request length except for reads and writes
  nbd-server: Coroutine based negotiation
  nbd: Split nbd.c
  nbd: Always call "close_fn" in nbd_client_new
  SCSI device: fix to incomplete QOMify
  iscsi: send readcapacity10 when readcapacity16 failed
  qemu-char: delete send_all/recv_all helper methods
  vmw_pvscsi: x-disable-pcie, x-old-pci-configuration back-compat props are 2.5 
specific
  scsi: initialise info object with appropriate size
  i386: avoid null pointer dereference
  target-i386: do not duplicate page protection checks
  scsi: revert change to scsi_req_cancel_async and add assertions

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/5a57acb66f19...19b6d8431689