[Qemu-commits] [qemu/qemu] ade9c1: clear pending status before calling memory commit

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: ade9c1aac5292ff698fa550adebe794c37d86cc9
      
https://github.com/qemu/qemu/commit/ade9c1aac5292ff698fa550adebe794c37d86cc9
  Author: Xu, Anthony <address@hidden>
  Date:   2017-03-24 (Fri, 24 Mar 2017)

  Changed paths:
    M memory.c

  Log Message:
  -----------
  clear pending status before calling memory commit

clear pending status before calling memory commit.
Otherwise when memory_region_finalize is called,
memory_region_transaction_depth is 0 and
memory_region_update_pending is true.
That's wrong.

Signed-off -by: Anthony Xu <address@hidden>

Message-Id: <address@hidden>

Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 3d69f821616a578aeed569b3b56e157922819602
      
https://github.com/qemu/qemu/commit/3d69f821616a578aeed569b3b56e157922819602
  Author: Fam Zheng <address@hidden>
  Date:   2017-03-24 (Fri, 24 Mar 2017)

  Changed paths:
    M hw/scsi/virtio-scsi.c
    M include/hw/virtio/virtio-scsi.h

  Log Message:
  -----------
  virtio-scsi: Make virtio_scsi_acquire/release public

They will be used in virtio-scsi-dataplane.c as well, so move them to
header.

Signed-off-by: Fam Zheng <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 71407786054cad26de7ef66718b2a57a4bcb49b5
      
https://github.com/qemu/qemu/commit/71407786054cad26de7ef66718b2a57a4bcb49b5
  Author: Fam Zheng <address@hidden>
  Date:   2017-03-24 (Fri, 24 Mar 2017)

  Changed paths:
    M hw/scsi/virtio-scsi-dataplane.c
    M hw/scsi/virtio-scsi.c

  Log Message:
  -----------
  virtio-scsi: Fix acquire/release in dataplane handlers

After the AioContext lock push down, there is a race between
virtio_scsi_dataplane_start and those "assert(s->ctx &&
s->dataplane_started)", because the latter doesn't isn't wrapped in
aio_context_acquire.

Reproducer is simply booting a Fedora guest with an empty
virtio-scsi-dataplane controller:

    qemu-system-x86_64 \
      -drive 
if=none,id=root,format=raw,file=Fedora-Cloud-Base-25-1.3.x86_64.raw \
      -device virtio-scsi \
      -device scsi-disk,drive=root,bootindex=1 \
      -object iothread,id=io \
      -device virtio-scsi-pci,iothread=io \
      -net user,hostfwd=tcp::10022-:22 -net nic,model=virtio -m 2048 \
      --enable-kvm

Fix this by moving acquire/release pairs from virtio_scsi_handle_*_vq to
their callers - and wrap the broken assertions in.

Signed-off-by: Fam Zheng <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 30663fd26c0307e414622c7a8607fbc04f92ec14
      
https://github.com/qemu/qemu/commit/30663fd26c0307e414622c7a8607fbc04f92ec14
  Author: Pranith Kumar <address@hidden>
  Date:   2017-03-24 (Fri, 24 Mar 2017)

  Changed paths:
    M target/i386/translate.c

  Log Message:
  -----------
  tcg/i386: Check the size of instruction being translated

This fixes the bug: 'user-to-root privesc inside VM via bad translation
caching' reported by Jann Horn here:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1122

Reviewed-by: Richard Henderson <address@hidden>
CC: Peter Maydell <address@hidden>
CC: Paolo Bonzini <address@hidden>
Reported-by: Jann Horn <address@hidden>
Signed-off-by: Pranith Kumar <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: dfd0dcc71724b11e125f67c8710c50c41da6ee4a
      
https://github.com/qemu/qemu/commit/dfd0dcc71724b11e125f67c8710c50c41da6ee4a
  Author: Jitendra Kolhe <address@hidden>
  Date:   2017-03-24 (Fri, 24 Mar 2017)

  Changed paths:
    M util/oslib-posix.c

  Log Message:
  -----------
  mem-prealloc: fix sysconf(_SC_NPROCESSORS_ONLN) failure case.

This was spotted by Coverity, in case where sysconf(_SC_NPROCESSORS_ONLN)
fails and returns -1. This results in memset_num_threads getting set to -1.
Which we then pass to g_new0().
The patch replaces MAX_MEM_PREALLOC_THREAD_COUNT macro with a function call
get_memset_num_threads() to handle sysconf() failure gracefully. In case
sysconf() fails, we fall back to single threaded.

(Spotted by Coverity, CID 1372465.)

Signed-off-by: Jitendra Kolhe <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 12f8def0e02232d7c6416ad9b66640f973c531d1
      
https://github.com/qemu/qemu/commit/12f8def0e02232d7c6416ad9b66640f973c531d1
  Author: Andrey Shedel <address@hidden>
  Date:   2017-03-27 (Mon, 27 Mar 2017)

  Changed paths:
    M include/qemu/thread-win32.h
    M util/qemu-thread-win32.c

  Log Message:
  -----------
  win32: replace custom mutex and condition variable with native primitives

The multithreaded TCG implementation exposed deadlocks in the win32
condition variables: as implemented, qemu_cond_broadcast waited on
receivers, whereas the pthreads API it was intended to emulate does
not. This was causing a deadlock because broadcast was called while
holding the IO lock, as well as all possible waiters blocked on the
same lock.

This patch replaces all the custom synchronisation code for mutexes
and condition variables with native Windows primitives (SRWlocks and
condition variables) with the same semantics as their POSIX
equivalents. To enable that, it requires a Windows Vista or newer host
OS.

Signed-off-by: Andrey Shedel <address@hidden>
[AB: edited commit message]
Signed-off-by: Andrew Baumann <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: e4548bb640497bf4d6df3850c0838d1b581fddc9
      
https://github.com/qemu/qemu/commit/e4548bb640497bf4d6df3850c0838d1b581fddc9
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2017-03-27 (Mon, 27 Mar 2017)

  Changed paths:
    M block/nbd-client.h
    M block/nbd.c

  Log Message:
  -----------
  nbd: drop unused NBDClientSession.is_unix field

Signed-off-by: Stefan Hajnoczi <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 5354edd286ea6e956b81da66c9dcc5e47028198e
      
https://github.com/qemu/qemu/commit/5354edd286ea6e956b81da66c9dcc5e47028198e
  Author: Paolo Bonzini <address@hidden>
  Date:   2017-03-27 (Mon, 27 Mar 2017)

  Changed paths:
    M hw/intc/apic_common.c
    M include/hw/i386/apic_internal.h

  Log Message:
  -----------
  Revert "apic: save apic_delivered flag"

This reverts commit 07bfa354772f2de67008dc66c201b627acff0106.
The global variable is only read as part of a
       apic_reset_irq_delivered();
      qemu_irq_raise(s->irq);
      if (!apic_get_irq_delivered()) {

sequence, so the value never matters at migration time.

Reported-by: Dr. David Alan Gilbert <address@hidden>
Cc: Pavel Dovgalyuk <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: bed58b4443b001227b953dca80ce76fa76ea0fc1
      
https://github.com/qemu/qemu/commit/bed58b4443b001227b953dca80ce76fa76ea0fc1
  Author: Fam Zheng <address@hidden>
  Date:   2017-03-27 (Mon, 27 Mar 2017)

  Changed paths:
    M hw/scsi/scsi-generic.c

  Log Message:
  -----------
  scsi-generic: Fill in opt_xfer_len in INQUIRY reply if it is zero

When opt_xfer_len is zero, Linux ignores max_xfer_len erroneously.

While that obviously should be fixed, we do older guests a favor to
always filling in a value.

Signed-off-by: Fam Zheng <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: eb06c9e2d3c8f026a206e8402b0ffa201060ec8e
      
https://github.com/qemu/qemu/commit/eb06c9e2d3c8f026a206e8402b0ffa201060ec8e
  Author: Peter Maydell <address@hidden>
  Date:   2017-03-27 (Mon, 27 Mar 2017)

  Changed paths:
    M block/nbd-client.h
    M block/nbd.c
    M hw/intc/apic_common.c
    M hw/scsi/scsi-generic.c
    M hw/scsi/virtio-scsi-dataplane.c
    M hw/scsi/virtio-scsi.c
    M include/hw/i386/apic_internal.h
    M include/hw/virtio/virtio-scsi.h
    M include/qemu/thread-win32.h
    M memory.c
    M target/i386/translate.c
    M util/oslib-posix.c
    M util/qemu-thread-win32.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

* MTTCG fix for win32
* virtio-scsi assertion failure
* mem-prealloc coverity fix
* x86 migration revert which requires more thought
* x86 instruction limit (avoids >2 page translation blocks)
* nbd dead code cleanup
* small memory.c logic fix

# gpg: Signature made Mon 27 Mar 2017 17:03:04 BST
# gpg:                using RSA key 0xBFFBD25F78C7AE83
# gpg: Good signature from "Paolo Bonzini <address@hidden>"
# gpg:                 aka "Paolo Bonzini <address@hidden>"
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream:
  scsi-generic: Fill in opt_xfer_len in INQUIRY reply if it is zero
  Revert "apic: save apic_delivered flag"
  nbd: drop unused NBDClientSession.is_unix field
  win32: replace custom mutex and condition variable with native primitives
  mem-prealloc: fix sysconf(_SC_NPROCESSORS_ONLN) failure case.
  tcg/i386: Check the size of instruction being translated
  virtio-scsi: Fix acquire/release in dataplane handlers
  virtio-scsi: Make virtio_scsi_acquire/release public
  clear pending status before calling memory commit

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/9366f53d509a...eb06c9e2d3c8