Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* qcow2: Fix corruption after error in update_refcountKevin Wolf2010-07-201-0/+4
| | | | | | | | | | | After it is done with updating refcounts in the cache, update_refcount writes all changed entries to disk. If a refcount block allocation fails, however, there was no change yet and therefore first_index = last_index = -1. Don't treat -1 as a normal sector index (resulting in a 512 byte write!) but return without updating anything in this case. Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 86fa8da83771238de55dc44819a1a27bafef5353)
* qcow2: Fix corruption after refblock allocationKevin Wolf2010-07-201-2/+9
| | | | | | | | | | | Refblock allocation code needs to take into consideration that update_refcount will load a different refcount block into the cache, so it must initialize the cache for a new refcount block only afterwards. Not doing this means that not only the refcount in the wrong block is updated, but also that the caller will work on the wrong block. Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 25408c09502be036e5575754fe54019ed4ed5dfa)
* block: Fix multiwrite with overlapping requestsKevin Wolf2010-07-201-1/+1
| | | | | | | | With overlapping requests, the total number of sectors is smaller than the sum of the nb_sectors of both requests. Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit cbf1dff2f1033cadcb15c0ffc9c0a3d039d8ed42)
* qcow2: Fix error handling in l2_allocateKevin Wolf2010-07-201-9/+12
| | | | | | | | | | | | | | | | | l2_allocate has some intermediate states in which the image is inconsistent. Change the order to write to the L1 table only after the new L2 table has successfully been initialized. Also reset the L2 cache in failure case, it's very likely wrong. Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 175e11526e2613b3dc031c23fec3107aa4a80307) Conflicts: block/qcow2-cluster.c Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* qcow2: Clear L2 table cache after write errorKevin Wolf2010-07-201-2/+3
| | | | | | | | | | | | | | | If the L2 table was already updated in cache, but writing it to disk has failed, we must not continue using the changed version in the cache to stay consistent with what's on the disk. Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 1b7c801b40ce90795397bb566d019c9b76ef9c13) Conflicts: block/qcow2-cluster.c Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* ide: Fix ide_dma_cancelKevin Wolf2010-07-201-4/+4
| | | | | | | | | | When cancelling a request, bdrv_aio_cancel may decide that it waits for completion of a request rather than for cancellation. IDE therefore can't abandon its DMA status before calling bdrv_aio_cancel; otherwise the callback of a completed request would use invalid data. Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 38d8dfa193e9a45f0f08b06aab2ba2a94f40a041)
* usb-bus: fix no paramsLuiz Capitulino2010-07-201-1/+1
| | | | | | | | | | | After commit 702f3e0fb52c124c07f215426eeadb70a716643f, the params is nerver NULL. It should check *params instead of params to determine whether the params is empty. Signed-off-by: TeLeMan <geleman@gmail.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com> (cherry picked from commit 98f22dc172e1ebd5341da3de0d67666442566f72)
* Avoid crash on '-usbdevice <device>' without parametersJan Kiszka2010-07-201-1/+3
| | | | | | | | Many usbdevice_init implementors assume params is non-NULL. Signed-off-by: Jan Kiszka <jan.kiszka@web.de> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit 702f3e0fb52c124c07f215426eeadb70a716643f)
* Fix -usbdevice crashPaul Brook2010-07-204-0/+12
| | | | | | | | | If -usbdevice is used on a machine with no USB busses, usb_create will fail and return NULL. Patch below handles this failure gracefully rather than crashing when we try to init the device. Signed-off-by: Paul Brook <paul@codesourcery.com> (cherry picked from commit d44168fffa07fc57e61a37da65e9348661dec887)
* Fix multiboot compilationAlexander Graf2010-07-202-12/+28
| | | | | | | | | | | | | | | | | | | | | | | Commit dd4239d6574ca41c94fc0d0f77ddc728510ffc57 broke multiboot. It replaced the instruction "rep insb (%dx), %es:(%edi)" by the binary output of "addr32 rep insb (%dx), %es:(%di)". Linuxboot calls the respective helper function in a code16 section. So the original instruction was automatically translated to its "addr32" equivalent. For multiboot, we're running in code32 so gcc didn't add the "addr32" which breaks the instruction. This patch splits that helper function in one which uses addr32 and one which does not, so everyone's happy. The good news is that nobody probably cared so far. The bundled multiboot.bin binary was built before the change and is thus correct. Please also put this patch into -stable. Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 590bf491a49670843ee902c47f7ab1de5e9acd06)
* qemu-sockets: avoid strlen of NULL pointerJens Osterkamp2010-07-201-1/+2
| | | | | | | | | | | If the user wants to create a chardev of type socket but forgets to give a host= option, qemu_opt_get returns NULL. This NULL pointer is then fed into strlen a few lines below without a check which results in a segfault. This fixes it. Signed-off-by: Jens Osterkamp <jens@linux.vnet.ibm.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit e23a22e620e84f42bdbd473b82672654e7c8de73)
* block: fix aio_flush segfaults for read-only protocols (e.g. curl)Avi Kivity2010-07-201-1/+3
| | | | | | | | | | | Not all block format drivers expose an io_flush method (reasonable for read-only protocols), so calling io_flush there will immediately segfault. Fix by checking for the method's existence before calling it. Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit c53a7285b4377e91f30b7742c7e12c16d6bf86f0)
* virtio-blk: fix barrier supportChristoph Hellwig2010-07-201-2/+13
| | | | | | | | | Before issuing the barrier to the block driver we need to flush our oustanding queue of write requests, as the flush is supposed to be issued after them. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 618fbb84299780af96e3d4c4b6f2148656fe3708)
* block: fix sector comparism in multiwrite_req_compareChristoph Hellwig2010-07-201-1/+13
| | | | | | | | | | | | | | | | The difference between the start sectors of two requests can be larger than the size of the "int" type, which can lead to a not correctly sorted multiwrite array and thus spurious I/O errors and filesystem corruption due to incorrect request merges. So instead of doing the cute sector arithmetics trick spell out the exact comparisms. Spotted by Kevin Wolf based on a testcase from Michael Tokarev. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 77be4366baface6613cfc312ba281f8e5860997c)
* pci: irq_state vmstate breakageMichael S. Tsirkin2010-07-201-2/+2
| | | | | | | | | | | | | | | | Code for saving irq_state got vm_state macros wrong, passing in the wrong parameter. As a result, we both saved a wrong value and restored it to a wrong offset. This leads to device and bus irq counts getting out of sync, which in turn leads to interrupts getting lost or never cleared, such as https://bugzilla.redhat.com/show_bug.cgi?id=588133 Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit c3f8f61157625d0bb5bfc135047573de48fdc675)
* Merge commit 'v0.12.4' into stable-0.12qemu-kvm-0.12.4Avi Kivity2010-05-0936-402/+605
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * commit 'v0.12.4': (49 commits) Update for 0.12.4 release Workaround for broken OSS_GETVERSION on FreeBSD, part two oss: fix fragment setting oss: issue OSS_GETVERSION ioctl only when needed oss: refactor code around policy setting oss: workaround for cases when OSS_GETVERSION is not defined block: Free iovec arrays allocated by multiwrite_merge() lsi: fix segfault in lsi_command_complete lsi: pass lsi_request to lsi_reselect lsi: move dma_len+dma_buf into lsi_request lsi: move current_dev into lsi_request lsi: have lsi_request for the whole life time of the request. lsi: use QTAILQ for lsi_queue tcp/mips: Change TCG_AREG0 (fp -> s0) sh_pci: fix memory and I/O access Fix incoming migration with iothread Fix SIGFPE for vnc display of width/height = 1 net: remove broken net_set_boot_mask() boot device validation qcow2: Remove request from in-flight list after error qcow2: Don't ignore immediate read/write failures ... Signed-off-by: Avi Kivity <avi@redhat.com>
| * Update for 0.12.4 releaseAnthony Liguori2010-05-042-1/+51
| | | | | | | | Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
| * Workaround for broken OSS_GETVERSION on FreeBSD, part twoJuergen Lock2010-04-251-4/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Turns out on those versions of FreeBSD (>= 7.x) that know OSS_GETVERSION the ioctl doesn't actually work yet (except in the Linuxolator), so if building on FreeBSD assume the sound drivers are new enough if the ioctl returns the errno it does currently on FreeBSD. (Rev 2 after private discussion with malc.) Signed-off-by: Juergen Lock <nox@jelal.kn-bremen.de> Signed-off-by: malc <av1474@comtv.ru> (cherry picked from commit 72ff25e4e98d6dba9286d032b9ff5432553bbad5)
| * oss: fix fragment settingmalc2010-04-251-13/+16
| | | | | | | | | | | | | | | | | | Previous patch introduced subtle regression, in cases when OSS_GETVERSION fails the code wasn't falling back to SNDCTL_DSP_SETFRAGMENT. Signed-off-by: malc <av1474@comtv.ru> (cherry picked from commit 3d709fe73a77c40e263b3af6e650fd4b519c3562)
| * oss: issue OSS_GETVERSION ioctl only when neededmalc2010-04-251-17/+17
| | | | | | | | | | Signed-off-by: malc <av1474@comtv.ru> (cherry picked from commit 6d246526ce3c145b2831285def6983f5de6190d3)
| * oss: refactor code around policy settingmalc2010-04-251-12/+8
| | | | | | | | | | | | | | | | This fixes a problem with a previous patch spotted by Juergen Lock, thanks to him again. Signed-off-by: malc <av1474@comtv.ru> (cherry picked from commit 78d9356d3caad95a74bc9cd65eea5fc7e050c35d)
| * oss: workaround for cases when OSS_GETVERSION is not definedmalc2010-04-251-1/+12
| | | | | | | | | | | | | | Thanks to Juergen Lock. Signed-off-by: malc <av1474@comtv.ru> (cherry picked from commit e726fe7d60d46636c74c1c4a8fac7e4a05efb163)
| * block: Free iovec arrays allocated by multiwrite_merge()Stefan Hajnoczi2010-04-241-0/+3
| | | | | | | | | | | | | | | | | | | | | | A new iovec array is allocated when creating a merged write request. This patch ensures that the iovec array is deleted in addition to its qiov owner. Reported-by: Leszek Urbanski <tygrys@moo.pl> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 1e1ea48d42e011b9bdd0d689d184e7cac4617b66)
| * lsi: fix segfault in lsi_command_completeGerd Hoffmann2010-04-181-1/+1
| | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 6ac08101f9de84be1fb7b45f87caed8ba8f3eb5a)
| * lsi: pass lsi_request to lsi_reselectGerd Hoffmann2010-04-181-16/+7
| | | | | | | | | | | | | | | | | | | | All callers of lsi_reselect have a lsi_request struct at hand anyway. So just pass it directly instead of having lsi_reselect search for it using the tag. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit aa4d32c4742e62e09786bd1067a5b98239867e93)
| * lsi: move dma_len+dma_buf into lsi_requestGerd Hoffmann2010-04-181-22/+23
| | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit b96a0da06bd782ef290445479a6d4d0de00c2c23)
| * lsi: move current_dev into lsi_requestGerd Hoffmann2010-04-181-11/+12
| | | | | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit daa70311e0f7b37cd0ea3c4de0d163ccf1a36abe)
| * lsi: have lsi_request for the whole life time of the request.Gerd Hoffmann2010-04-181-21/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | Right now lsi_request is allocated when a request is queued and released when a request is unqueued. With this patch applied the lsi_request is kept for the whole lifetime of the scsi request. Rationale: We can use it for per-request data then. The patch does that already for the request tag. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit af12ac9880eacdd79d49a11d5672df7170afb38f)
| * lsi: use QTAILQ for lsi_queueGerd Hoffmann2010-04-181-40/+28
| | | | | | | | | | | | | | | | | | Replace the funky array logic for queued commands with standard qemu list functions. Also rename lsi_queue to lsi_request. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit 042ec49dc52e54153942a089a46ae584152998fb)
| * tcp/mips: Change TCG_AREG0 (fp -> s0)Stefan Weil2010-04-143-8/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Register fp (frame pointer) is a bad choice for compilations without optimisation, because the compiler makes heavy use of this register (so the resulting code crashes). Register s0 had been used for TCG_AREG1 in earlier releases, but was no longer used and is now free for TCG_AREG0. The resulting code works for compilations without optimisation (tested with qemu mips in qemu mips on x86 host). Signed-off-by: Stefan Weil <weil@mail.berlios.de> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
| * sh_pci: fix memory and I/O accessAurelien Jarno2010-04-143-96/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since commit 8da3ff180974732fc4272cb4433fef85c1822961 ("MMIO callback interface changes"), the addresses passed to the I/O functions are an offset to the start of the area. As a consequence, there is no need to correct the address using the value of IOBR. This make possible the use of the default MMIO functions. Moreover the addresses are now remaped when the value if IOBR change. The memory area corresponds to the devices behing the PCI bus, it should not be mapped by the PCI controller. Remove the corresponding code. Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry-picked from commit 5ba9e9522cf572715ca1966b292f64fb78342e22)
| * Fix incoming migration with iothreadMarcelo Tosatti2010-04-141-0/+2
| | | | | | | | | | | | | | | | | | Do not allow the vcpus to execute if the vm is stopped. Fixes -incoming with CONFIG_IOTHREAD enabled. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> (cherry picked from commit c5f32c99c6855d466737daf1cd262e7e92062f87)
| * Fix SIGFPE for vnc display of width/height = 1Chris Webb2010-04-111-2/+4
| | | | | | | | | | | | | | | | | | | | | | During boot, the screen gets resized to height 1 and a mouse click at this point will cause a division by zero when calculating the absolute pointer position from the pixel (x, y). Return a click in the middle of the screen instead in this case. Signed-off-by: Chris Webb <chris@arachsys.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit cc39a92cbfc80c70d2b83708a4c9b309c3126ac3)
| * net: remove broken net_set_boot_mask() boot device validationEduardo Habkost2010-04-113-25/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are many problems with net_set_boot_mask(): 1) It is broken when using the device model instead of "-net nic". Example: $ qemu-system-x86_64 -device rtl8139,vlan=0,id=net0,mac=52:54:00:82:41:fd,bus=pci.0,addr=0x4 -net user,vlan=0,name=hostnet0 -vnc 0.0.0.0:0 -boot n Cannot boot from non-existent NIC $ 2) The mask was previously used to set which boot ROMs were supposed to be loaded, but this was changed long time ago. Now all ROM images are loaded, and SeaBIOS takes care of jumping to the right boot entry point depending on the boot settings. 3) Interpretation and validation of the boot parameter letters is done on the machine type code. Examples: PC accepts only a,b,c,d,n as valid boot device letters. mac99 accepts only a,b,c,d,e,f. As a side-effect of this change, qemu-kvm won't abort anymore if using "-boot n" on a machine with no network devices. Checking if the requested boot device is valid is now a task for the BIOS or the machine-type code. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Acked-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry-picked from da1fcfda59a6bcbdf58d49243fbced455f2bf78a)
| * qcow2: Remove request from in-flight list after errorKevin Wolf2010-04-102-1/+6
| | | | | | | | | | | | | | | | | | | | | | If we complete a request with a failure we need to remove it from the list of requests that are in flight. If we don't do it, the next time the same AIOCB is used for a cluster allocation it will create a loop in the list and qemu will hang in an endless loop. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit c644db3d53c90ef569ff5a90e9f821b88e7123bb)
| * qcow2: Don't ignore immediate read/write failuresKevin Wolf2010-04-101-2/+6
| | | | | | | | | | | | | | | | Returning -EIO is far from optimal, but at least it's an error code. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 171e3d6b9997c98a97d0c525867f7cd9b640cadd)
| * block: Fix multiwrite memory leak in error caseKevin Wolf2010-04-101-1/+2
| | | | | | | | | | | | | | | | | | | | | | Previously multiwrite_user_cb was never called if a request in the multiwrite batch failed right away because it did set mcb->error immediately. Make it look more like a normal callback to fix this. Reported-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 7eb58a6c556c3880e6712cbf6d24d681261c5095)
| * block: Fix error code in multiwrite for immediate failuresKevin Wolf2010-04-101-2/+2
| | | | | | | | | | | | Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 0f0b604b00851f2c7160b4195136c1fd27418088)
| * block: Fix multiwrite error handlingKevin Wolf2010-04-101-1/+1
| | | | | | | | | | | | | | | | | | | | When two requests of the same multiwrite batch fail, the callback of all requests in that batch were called twice. This could have any kind of nasty effects, in my case it lead to use after free and eventually a segfault. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit cb6d3ca07b8f62b47ef30c6a92caa3e8bd71248b)
| * scsi-disk: fix buffer overflowGerd Hoffmann2010-04-091-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | In case s->version is shorter than 4 bytes we overflow the memcpy src buffer. Fix it by clearing the target buffer, then copy only the amount of bytes we actually have. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from 314b1811c15f4e982e4667d9b845aee4b5a63d91) Signed-off-by: Kevin Wolf <kwolf@redhat.com>
| * qcow2: Rewrite alloc_refcount_block/grow_refcount_tableKevin Wolf2010-04-091-88/+222
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current implementation of alloc_refcount_block and grow_refcount_table has fundamental problems regarding error handling. There are some places where an I/O error means that the image is going to be corrupted. I have found that the only way to fix this is to completely rewrite the thing. In detail, the problem is that the refcount blocks itself are allocated using alloc_refcount_noref (to avoid endless recursion when updating the refcount of the new refcount block, which migh access just the same refcount block but its allocation is not yet completed...). Only at the end of the refcount allocation the refcount of the refcount block is increased. If an error happens in between, the refcount block is in use, but has a refcount of zero and will likely be overwritten later. The new approach is explained in comments in the code. The trick is basically to let new refcount blocks describe their own refcount, so their refcount will be automatically changed when they are hooked up in the refcount table. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit 92dcb59fd4e1491afa0756ee9c2594869b487d23)
| * qcow2: Factor next_refcount_table_size outKevin Wolf2010-04-091-11/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | When the refcount table grows, it doesn't only grow by one entry but reserves some space for future refcount blocks. The algorithm to calculate the number of entries stays the same with the fixes, so factor it out before replacing the rest. As Juan suggested take the opportunity to simplify the code a bit. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit 05121aedc41f87e44e41e9cef55f2e49ce7ba94e)
| * block: avoid creating too large iovecs in multiwrite_mergeChristoph Hellwig2010-04-092-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If we go over the maximum number of iovecs support by syscall we get back EINVAL from the kernel which translate to I/O errors for the guest. Add a MAX_IOV defintion for platforms that don't have it. For now we use the same 1024 define that's used on Linux and various other platforms, but until the windows block backend implements some kind of vectored I/O it doesn't matter. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit e2a305fb13ff0f5cf6ff805555aaa90a5ed5954c) Signed-off-by: Kevin Wolf <kwolf@redhat.com>
| * json-parser: Fix segfault on malformed inputKevin Wolf2010-04-091-1/+1
| | | | | | | | | | | | | | | | | | | | If the parser fails to parse the key in parse_pair, it will access a NULL pointer. A simple way to trigger this is sending {foo} via QMP. This patch turns the segfault into a syntax error reply. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit d758d90fe1f74a46042fca665036a23b4d5fe87d)
| * linux-user: switch default ppc64 CPU to 970fx from 970Aurelien Jarno2010-04-091-1/+1
| | | | | | | | | | Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit f7177937a2c0db4c3bb42e3adfde937e9c0734a1)
| * target-sh4: MMU: fix store queue addressesAurelien Jarno2010-04-091-1/+1
| | | | | | | | | | | | | | The store queues are located from 0xe0000000 to 0xe3ffffff. Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit b1563142123593581895049568c5526b1e91da7b)
| * target-sh4: MMU: fix ITLB priviledge checkAurelien Jarno2010-04-091-1/+1
| | | | | | | | | | | | | | | | There is an ITLB access violation if SR_MD=0 (user mode) while the high bit of the protection key is 0 (priviledge mode). Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit bc13ad29e6b7484ccd5e7ee0f5d0f966585eb4c9)
| * target-sh4: MMU: fix mem_idx computationAurelien Jarno2010-04-091-1/+1
| | | | | | | | | | | | | | | | | | The mem_idx is wrongly computed. As written in target-sh4/cpu.h, mode 0 corresponds to kernel mode (SR_MD = 1), while mode 1 corresponds to user mode (SR_MD = 0). Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 33b8f5546cc16eaa3d89fe133a9843c794b65d6c)
| * sh7750: handle MMUCR TI bitAurelien Jarno2010-04-093-2/+25
| | | | | | | | | | | | | | | | When the MMUCR TI bit is set, all the UTLB and ITLB entries should be flushed. Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit e781d1285fc3b81d689ba25360c6c272116387fa)
| * UHCI spurious interrut fixPaul Brook2010-04-061-3/+4
| | | | | | | | | | | | Only raise an interrupt if the TD has actually completed. Signed-off-by: Paul Brook <paul@codesourcery.com>