[Qemu-commits] [qemu/qemu] 0a7ad6: Fix semaphores fallback code

[GitHub]

  Branch: refs/heads/stable-1.3
  Home:   https://github.com/qemu/qemu
  Commit: 0a7ad69a0f012d5d70142f775f99405500d4d38e
      
https://github.com/qemu/qemu/commit/0a7ad69a0f012d5d70142f775f99405500d4d38e
  Author: Brad Smith <address@hidden>
  Date:   2013-01-14 (Mon, 14 Jan 2013)

  Changed paths:
    M qemu-thread-posix.c

  Log Message:
  -----------
  Fix semaphores fallback code

As reported in bug 1087114 the semaphores fallback code is broken which
results in QEMU crashing and making QEMU unusable.

This patch is from Paolo.

This needs to be back ported to the 1.3 stable tree as well.

Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Brad Smith <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit a795ef8dcb8cbadffc996c41ff38927a97645234)

Signed-off-by: Michael Roth <address@hidden>


  Commit: d67d95f24e14a7ff696814e0d291fe028e8ff12b
      
https://github.com/qemu/qemu/commit/d67d95f24e14a7ff696814e0d291fe028e8ff12b
  Author: Brad Smith <address@hidden>
  Date:   2013-01-14 (Mon, 14 Jan 2013)

  Changed paths:
    M qemu-thread-posix.c
    M qemu-thread-posix.h

  Log Message:
  -----------
  Disable semaphores fallback code for OpenBSD

Disable the semaphores fallback code for OpenBSD as modern OpenBSD
releases now have sem_timedwait().

Signed-off-by: Brad Smith <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit 927fa909d5d5cf8c07673cd16a6d3bdc81250bc0)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 3b4fc1f9d202d6faade11df9bb6c1dcd61e72b08
      
https://github.com/qemu/qemu/commit/3b4fc1f9d202d6faade11df9bb6c1dcd61e72b08
  Author: David Gibson <address@hidden>
  Date:   2013-01-14 (Mon, 14 Jan 2013)

  Changed paths:
    M arch_init.c

  Log Message:
  -----------
  Fix off-by-1 error in RAM migration code

The code for migrating (or savevm-ing) memory pages starts off by creating
a dirty bitmap and filling it with 1s.  Except, actually, because bit
addresses are 0-based it fills every bit except bit 0 with 1s and puts an
extra 1 beyond the end of the bitmap, potentially corrupting unrelated
memory.  Oops.  This patch fixes it.

Signed-off-by: David Gibson <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 7ec81e56edc2b2007ce0ae3982aa5c18af9546ab)

Signed-off-by: Michael Roth <address@hidden>


  Commit: f1a2195ec327fd2b837a3539623ee431d133f03c
      
https://github.com/qemu/qemu/commit/f1a2195ec327fd2b837a3539623ee431d133f03c
  Author: David Gibson <address@hidden>
  Date:   2013-01-14 (Mon, 14 Jan 2013)

  Changed paths:
    M arch_init.c

  Log Message:
  -----------
  migration: Fix madvise breakage if host and guest have different page sizes

madvise(DONTNEED) will throw away the contents of the whole page at the
given address, even if the given length is less than the page size.  One
can argue about whether that's the correct behaviour, but that's what it's
done for a long time in Linux at least.

That means that the madvise() in ram_load(), on a setup where
TARGET_PAGE_SIZE is smaller than the host page size, can throw away data
in guest pages adjacent to the one it's actually processing right now,
leading to guest memory corruption on an incoming migration.

This patch therefore, disables the madvise() if the host page size is
larger than TARGET_PAGE_SIZE.  This means we don't get the benefits of that
madvise() in this case, but a more complete fix is more difficult to
accomplish.  This at least fixes the guest memory corruption.

Signed-off-by: David Gibson <address@hidden>
Reported-by: Alexey Kardashevskiy <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 45e6cee42b98d10e2e14885ab656541a9ffd5187)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 16c5fe49de2be4aedf8cce30df924a5aadd0d9a1
      
https://github.com/qemu/qemu/commit/16c5fe49de2be4aedf8cce30df924a5aadd0d9a1
  Author: Petar Jovanovic <address@hidden>
  Date:   2013-01-14 (Mon, 14 Jan 2013)

  Changed paths:
    M target-mips/dsp_helper.c
    M tests/tcg/mips/mips32-dsp/insv.c

  Log Message:
  -----------
  target-mips: Fix incorrect code and test for INSV

Content of register rs should be shifted for pos before applying a mask.
This change contains both fix for the instruction and to the existing test.

Signed-off-by: Petar Jovanovic <address@hidden>
Reviewed-by: Eric Johnson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit 34f5606ee101f82a247d09d05644ad2a63c8e342)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 518799a3e796cc39dd2d22c56b67d7456506d74a
      
https://github.com/qemu/qemu/commit/518799a3e796cc39dd2d22c56b67d7456506d74a
  Author: Petar Jovanovic <address@hidden>
  Date:   2013-01-14 (Mon, 14 Jan 2013)

  Changed paths:
    M target-mips/dsp_helper.c
    M tests/tcg/mips/mips32-dsp/shilo.c
    M tests/tcg/mips/mips32-dsp/shilov.c

  Log Message:
  -----------
  target-mips: Fix incorrect shift for SHILO and SHILOV

helper_shilo has not been shifting an accumulator value correctly for negative
values in 'shift' field. Minor optimization for shift=0 case.
This change also adds tests that will trigger issue and check for regressions.

Signed-off-by: Petar Jovanovic <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Reviewed-by: Eric Johnson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit 19e6c50d2d843220efbdd3b2db21d83c122c364a)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 37e1428cc7968675a3fbb4048e869c8080023f5a
      
https://github.com/qemu/qemu/commit/37e1428cc7968675a3fbb4048e869c8080023f5a
  Author: Alex Williamson <address@hidden>
  Date:   2013-01-14 (Mon, 14 Jan 2013)

  Changed paths:
    M hw/vfio_pci.c

  Log Message:
  -----------
  vfio-pci: Don't use kvm_irqchip_in_kernel

kvm_irqchip_in_kernel() has an architecture specific meaning, so
we shouldn't be using it to determine whether to enabled KVM INTx
bypass.  kvm_irqfds_enabled() seems most appropriate.  Also use this
to protect our other call to kvm_check_extension() as that explodes
when KVM isn't enabled.

Signed-off-by: Alex Williamson <address@hidden>
Cc: address@hidden
(cherry picked from commit d281084d3e51f03999d12a506491a0c6f31b40e8)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 0bc5f4ad63e558aca20066ed1f8b46eaf973d095
      
https://github.com/qemu/qemu/commit/0bc5f4ad63e558aca20066ed1f8b46eaf973d095
  Author: Gerd Hoffmann <address@hidden>
  Date:   2013-01-15 (Tue, 15 Jan 2013)

  Changed paths:
    M pc-bios/acpi-dsdt.aml
    M pc-bios/bios.bin
    A pc-bios/q35-acpi-dsdt.aml
    M roms/seabios

  Log Message:
  -----------
  seabios: update to e8a76b0f225bba5ba9d63ab227e0a37b3beb1059

This patch updates seabios to latest git master.  Changes:

  (1) q35 patches merged.
  (2) some acpi cleanups.
  (3) fixes irq 8 conflict.

(3) makes this a candidate for the stable branch

Cc: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit ff1562908d1da12362aa9e3f3bfc7ba0da8114a4)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 36fd8179b635b7f67eb5c882675d9716d996a4a5
      
https://github.com/qemu/qemu/commit/36fd8179b635b7f67eb5c882675d9716d996a4a5
  Author: Gerd Hoffmann <address@hidden>
  Date:   2013-01-15 (Tue, 15 Jan 2013)

  Changed paths:
    M pc-bios/acpi-dsdt.aml
    M pc-bios/bios.bin
    M pc-bios/q35-acpi-dsdt.aml
    M roms/seabios

  Log Message:
  -----------
  Update seabios to a810e4e72a0d42c7bc04eda57382f8e019add901

git shortlog:

Kevin O'Connor (6):
      floppy: Minor - reduce handle_0e code size when CONFIG_FLOPPY is disabled.
      vga: Minor comment spelling fix.
      Don't recursively evaluate CFLAGS variables.
      Don't use gcc's -combine option.
      Add compile checking phase to build.
      acpi: Use prt_slot() macro to describe irq pins of first PCI device.

Laszlo Ersek (1):
      maininit(): print machine UUID under seabios version message

Paolo Bonzini (1):
      acpi: reintroduce LNKS

Paolo's patch fixes the FreeBSD boot failure.

Cc: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 15faf946f7a17a5fab0d05a2312d43249d81af3c)

Signed-off-by: Michael Roth <address@hidden>


  Commit: b68c48ff014f1366f19646550f3bf3aa6645537e
      
https://github.com/qemu/qemu/commit/b68c48ff014f1366f19646550f3bf3aa6645537e
  Author: Gerd Hoffmann <address@hidden>
  Date:   2013-01-15 (Tue, 15 Jan 2013)

  Changed paths:
    M hw/vga.c
    M qemu-pixman.c
    M qemu-pixman.h
    M ui/vnc-enc-tight.c
    M ui/vnc.c

  Log Message:
  -----------
  pixman: fix vnc tight png/jpeg support

This patch adds an x argument to qemu_pixman_linebuf_fill so it can
also be used to convert a partial scanline.  Then fix tight + png/jpeg
encoding by passing in the x+y offset, so the data is read from the
correct screen location instead of the upper left corner.

Cc: address@hidden
Cc: address@hidden
Reported-by: Tim Hardeneck <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit bc210eb163b162ff2e94e5c8f4307715731257f8)

Signed-off-by: Michael Roth <address@hidden>


  Commit: bfae9374f160f3fdf7dc550728111382703e56a7
      
https://github.com/qemu/qemu/commit/bfae9374f160f3fdf7dc550728111382703e56a7
  Author: Max Filippov <address@hidden>
  Date:   2013-01-15 (Tue, 15 Jan 2013)

  Changed paths:
    M target-xtensa/helper.c

  Log Message:
  -----------
  target-xtensa: fix ITLB/DTLB page protection flags

With MMU option xtensa architecture has two TLBs: ITLB and DTLB. ITLB is
only used for code access, DTLB is only for data. However TLB entries in
both TLBs have attribute field controlling write and exec access. These
bits need to be properly masked off depending on TLB type before being
used as tlb_set_page prot argument. Otherwise the following happens:

(1) ITLB entry for some PFN gets invalidated
(2) DTLB entry for the same PFN gets updated, attributes allow code
    execution
(3) code at the page with that PFN is executed (possible due to step 2),
    entry for the TB is written into the jump cache
(4) QEMU TLB entry for the PFN gets replaced with an entry for some
    other PFN
(5) code in the TB from step 3 is executed (possible due to jump cache)
    and it accesses data, for which there's no DTLB entry, causing DTLB
    miss exception
(6) re-translation of the TB from step 5 is attempted, but there's no
    QEMU TLB entry nor xtensa ITLB entry for that PFN, which causes ITLB
    miss exception at the TB start address
(7) ITLB miss exception is handled by the guest, but execution is
    resumed from the beginning of the faulting TB (the point where ITLB
    miss occured), not from the point where DTLB miss occured, which is
    wrong.

With that fix the above scenario causes ITLB miss exception (that used
to be step 7) at step 3, right at the beginning of the TB.

Signed-off-by: Max Filippov <address@hidden>
Cc: address@hidden
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit 659f807c0a700317a7a0fae7a6e6ebfe68bfbbc4)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 7ca2496588914a51e2f3f7983bb25f5dc8ba5630
      
https://github.com/qemu/qemu/commit/7ca2496588914a51e2f3f7983bb25f5dc8ba5630
  Author: Gerd Hoffmann <address@hidden>
  Date:   2013-01-15 (Tue, 15 Jan 2013)

  Changed paths:
    M hw/qxl-render.c

  Log Message:
  -----------
  qxl: save qemu_create_displaysurface_from result

Spotted by Coverity.

https://bugzilla.redhat.com/show_bug.cgi?id=885644

Cc: address@hidden
Reported-by: Markus Armbruster <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 2f464b5a32b414adb545acc6d94b5c35c7d258ba)

Signed-off-by: Michael Roth <address@hidden>


  Commit: c4cd5b0f6de4173db97553a95ec9d82a8492ca7c
      
https://github.com/qemu/qemu/commit/c4cd5b0f6de4173db97553a95ec9d82a8492ca7c
  Author: Uri Lublin <address@hidden>
  Date:   2013-01-15 (Tue, 15 Jan 2013)

  Changed paths:
    M ui/spice-core.c

  Log Message:
  -----------
  qxl+vnc: register a vm state change handler for dummy spice_server

When qxl + vnc are used, a dummy spice_server is initialized.
The spice_server has to be told when the VM runstate changes,
which is what this patch does.

Without it, from qxl_send_events(), the following error message is shown:
  qxl_send_events: spice-server bug: guest stopped, ignoring

Cc: address@hidden
Signed-off-by: Uri Lublin <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 938b8a36b65e44c44ca29245437f8d7ac0f826e8)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 5afd0ecaa6d5f4807a7d87fd39c51a5ecec2caee
      
https://github.com/qemu/qemu/commit/5afd0ecaa6d5f4807a7d87fd39c51a5ecec2caee
  Author: Michael Contreras <address@hidden>
  Date:   2013-01-15 (Tue, 15 Jan 2013)

  Changed paths:
    M hw/e1000.c

  Log Message:
  -----------
  e1000: Discard oversized packets based on SBP|LPE

Discard packets longer than 16384 when !SBP to match the hardware behavior.

Signed-off-by: Michael Contreras <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 2c0331f4f7d241995452b99afaf0aab00493334a)

Signed-off-by: Michael Roth <address@hidden>


  Commit: d745511fc91c71d62cc96f99f5b1b69aed501bb5
      
https://github.com/qemu/qemu/commit/d745511fc91c71d62cc96f99f5b1b69aed501bb5
  Author: Paolo Bonzini <address@hidden>
  Date:   2013-01-15 (Tue, 15 Jan 2013)

  Changed paths:
    M arch_init.c

  Log Message:
  -----------
  migration: fix migration_bitmap leak

Cc: address@hidden
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Juan Quintela <address@hidden>
(cherry picked from commit 244eaa7514a944b36273eb8428f32da8e9124fcf)

Signed-off-by: Michael Roth <address@hidden>


  Commit: ff0c079c1425b004019ab33f4ba1339d9ea365d2
      
https://github.com/qemu/qemu/commit/ff0c079c1425b004019ab33f4ba1339d9ea365d2
  Author: Paolo Bonzini <address@hidden>
  Date:   2013-01-15 (Tue, 15 Jan 2013)

  Changed paths:
    M buffered_file.c

  Log Message:
  -----------
  buffered_file: do not send more than s->bytes_xfer bytes per tick

Sending more was possible if the buffer was large.

Cc: address@hidden
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Juan Quintela <address@hidden>
(cherry picked from commit bde54c08b4854aceee3dee25121a2b835cb81166)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 1205b8080fb596ce50b2dc0466587c012d9f979d
      
https://github.com/qemu/qemu/commit/1205b8080fb596ce50b2dc0466587c012d9f979d
  Author: Max Filippov <address@hidden>
  Date:   2013-01-15 (Tue, 15 Jan 2013)

  Changed paths:
    M target-xtensa/translate.c

  Log Message:
  -----------
  target-xtensa: fix search_pc for the last TB opcode

Zero out tcg_ctx.gen_opc_instr_start for instructions representing the
last guest opcode in the TB.

Cc: address@hidden
Signed-off-by: Max Filippov <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit 36f25d2537c40c6c47f4abee5d31a24863d1adf7)

*modified to use older global version of gen_opc_instr_start

Signed-off-by: Michael Roth <address@hidden>


  Commit: f042cca009607d4571cbe87323967535fe63daf7
      
https://github.com/qemu/qemu/commit/f042cca009607d4571cbe87323967535fe63daf7
  Author: Alex Williamson <address@hidden>
  Date:   2013-01-15 (Tue, 15 Jan 2013)

  Changed paths:
    M hw/vfio_pci.c

  Log Message:
  -----------
  vfio-pci: Make host MSI-X enable track guest

Guests typically enable MSI-X with all of the vectors in the MSI-X
vector table masked.  Only when the vector is enabled does the vector
get unmasked, resulting in a vector_use callback.  These two points,
enable and unmask, correspond to pci_enable_msix() and request_irq()
for Linux guests.  Some drivers rely on VF/PF or PF/fw communication
channels that expect the physical state of the device to match the
guest visible state of the device.  They don't appreciate lazily
enabling MSI-X on the physical device.

To solve this, enable MSI-X with a single vector when the MSI-X
capability is enabled and immediate disable the vector.  This leaves
the physical device in exactly the same state between host and guest.
Furthermore, the brief gap where we enable vector 0, it fires into
userspace, not KVM, so the guest doesn't get spurious interrupts.
Ideally we could call VFIO_DEVICE_SET_IRQS with the right parameters
to enable MSI-X with zero vectors, but this will currently return an
error as the Linux MSI-X interfaces do not allow it.

Signed-off-by: Alex Williamson <address@hidden>
Cc: address@hidden
(cherry picked from commit b0223e29afdc88cc262a764026296414396cd129)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 006c747440b1b22aa5bbef89442ef037741adabc
      
https://github.com/qemu/qemu/commit/006c747440b1b22aa5bbef89442ef037741adabc
  Author: Alex Williamson <address@hidden>
  Date:   2013-01-15 (Tue, 15 Jan 2013)

  Changed paths:
    M hw/kvm/pci-assign.c

  Log Message:
  -----------
  pci-assign: Enable MSIX on device to match guest

When a guest enables MSIX on a device we evaluate the MSIX vector
table, typically find no unmasked vectors and don't switch the device
to MSIX mode.  This generally works fine and the device will be
switched once the guest enables and therefore unmasks a vector.
Unfortunately some drivers enable MSIX, then use interfaces to send
commands between VF & PF or PF & firmware that act based on the host
state of the device.  These therefore may break when MSIX is managed
lazily.  This change re-enables the previous test used to enable MSIX
(see qemu-kvm a6b402c9), which basically guesses whether a vector
will be used based on the data field of the vector table.

Cc: address@hidden
Signed-off-by: Alex Williamson <address@hidden>
Acked-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
(cherry picked from commit feb9a2ab4b0260d8d680a7ffd25063dafc7ec628)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 86bab459489a192486ec0f49e0ef5114ff6554d2
      
https://github.com/qemu/qemu/commit/86bab459489a192486ec0f49e0ef5114ff6554d2
  Author: Alex Williamson <address@hidden>
  Date:   2013-01-15 (Tue, 15 Jan 2013)

  Changed paths:
    M hw/vfio_pci.c

  Log Message:
  -----------
  vfio-pci: Loosen sanity checks to allow future features

VFIO_PCI_NUM_REGIONS and VFIO_PCI_NUM_IRQS should never have been
used in this manner as it locks a specific kernel implementation.
Future features may introduce new regions or interrupt entries
(VGA may add legacy ranges, AER might add an IRQ for error
signalling).  Fix this before it gets us into trouble.

Signed-off-by: Alex Williamson <address@hidden>
Cc: address@hidden
(cherry picked from commit 8fc94e5a8046e349e07976f9bcaffbcd5833f3a2)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 204dd38c2da72687848d1a6fd2a81a8eaac6bf78
      
https://github.com/qemu/qemu/commit/204dd38c2da72687848d1a6fd2a81a8eaac6bf78
  Author: Paolo Bonzini <address@hidden>
  Date:   2013-01-15 (Tue, 15 Jan 2013)

  Changed paths:
    M block/raw-posix.c

  Log Message:
  -----------
  raw-posix: fix bdrv_aio_ioctl

When the raw-posix aio=thread code was moved from posix-aio-compat.c
to block/raw-posix.c, there was an unintended change to the ioctl code.
The code used to return the ioctl command, which posix_aio_read()
would later morph into a zero.  This hack is not necessary anymore,
and in fact breaks scsi-generic (which expects a zero return code).
Remove it.

Cc: address@hidden
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit b608c8dc02c78ee95455a0989bdf1b41c768b2ef)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 9d173df5538a73cb8be53684ab19ea201c783663
      
https://github.com/qemu/qemu/commit/9d173df5538a73cb8be53684ab19ea201c783663
  Author: Kevin Wolf <address@hidden>
  Date:   2013-01-21 (Mon, 21 Jan 2013)

  Changed paths:
    M aio-posix.c
    M aio-win32.c
    M qemu-aio.h
    M tests/test-aio.c

  Log Message:
  -----------
  aio: Fix return value of aio_poll()

aio_poll() must return true if any work is still pending, even if it
didn't make progress, so that bdrv_drain_all() doesn't stop waiting too
early. The possibility of stopping early occasionally lead to a failed
assertion in bdrv_drain_all(), when some in-flight request was missed
and the function didn't really drain all requests.

In order to make that change, the return value as specified in the
function comment must change for blocking = false; fortunately, the
return value of blocking = false callers is only used in test cases, so
this change shouldn't cause any trouble.

Cc: address@hidden
Signed-off-by: Kevin Wolf <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 2ea9b58f0bc62445b7ace2381b4c4db7d5597e19)

Signed-off-by: Michael Roth <address@hidden>


  Commit: cdb483457cdbd6012e336e40c12b4ace4f6f2a2f
      
https://github.com/qemu/qemu/commit/cdb483457cdbd6012e336e40c12b4ace4f6f2a2f
  Author: Kevin Wolf <address@hidden>
  Date:   2013-01-21 (Mon, 21 Jan 2013)

  Changed paths:
    M block/win32-aio.c

  Log Message:
  -----------
  win32-aio: Fix vectored reads

Copying data in the right direction really helps a lot!

Cc: address@hidden
Signed-off-by: Kevin Wolf <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit bcbbd234d42f1111e42b91376db61922d42e7e9e)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 563068a8b2e980713e056512bcd941237f6090fb
      
https://github.com/qemu/qemu/commit/563068a8b2e980713e056512bcd941237f6090fb
  Author: Kevin Wolf <address@hidden>
  Date:   2013-01-21 (Mon, 21 Jan 2013)

  Changed paths:
    M block/win32-aio.c

  Log Message:
  -----------
  win32-aio: Fix memory leak

The buffer is allocated for both reads and writes, and obviously it
should be freed even if an error occurs.

Cc: address@hidden
Signed-off-by: Kevin Wolf <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit e8bccad5ac6095b5af7946cd72d9aacb57f7c0a3)

Conflicts:

        block/win32-aio.c

*addressed conflict due to buggy g_free() still in use instead of
qemu_vfree() as it is upstream (via commit 7479acdb)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 4ee28799d417de0c929622021d6dbaa58a53dfc5
      
https://github.com/qemu/qemu/commit/4ee28799d417de0c929622021d6dbaa58a53dfc5
  Author: Peter Maydell <address@hidden>
  Date:   2013-01-21 (Mon, 21 Jan 2013)

  Changed paths:
    M tcg/arm/tcg-target.c

  Log Message:
  -----------
  tcg/target-arm: Add missing parens to assertions

Silence a (legitimate) complaint about missing parentheses:

tcg/arm/tcg-target.c: In function ‘tcg_out_qemu_ld’:
tcg/arm/tcg-target.c:1148:5: error: suggest parentheses around
comparison in operand of ‘&’ [-Werror=parentheses]
tcg/arm/tcg-target.c: In function ‘tcg_out_qemu_st’:
tcg/arm/tcg-target.c:1357:5: error: suggest parentheses around
comparison in operand of ‘&’ [-Werror=parentheses]

which meant that we would mistakenly always assert if running
a QEMU built with debug enabled on ARM.

Signed-off-by: Peter Maydell <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit 5256a7208a7c2af19baf8f99bd4f06632f9f9ba9)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 90c96d33c41e243d5f2c6cc197779f5ab744879e
      
https://github.com/qemu/qemu/commit/90c96d33c41e243d5f2c6cc197779f5ab744879e
  Author: Roger Pau Monne <address@hidden>
  Date:   2013-01-21 (Mon, 21 Jan 2013)

  Changed paths:
    M hw/xen_disk.c

  Log Message:
  -----------
  xen_disk: fix memory leak

On ioreq_release the full ioreq was memset to 0, loosing all the data
and memory allocations inside the QEMUIOVector, which leads to a
memory leak. Create a new function to specifically reset ioreq.

Reported-by: Maik Wessler <address@hidden>
Signed-off-by: Roger Pau Monné <address@hidden>
Signed-off-by: Stefano Stabellini <address@hidden>
(cherry picked from commit 282c6a2f292705f823554447ca0b7731b6f81a97)

Signed-off-by: Michael Roth <address@hidden>


  Commit: df50a7e0cb221eb78a115e417189bb85838a19e0
      
https://github.com/qemu/qemu/commit/df50a7e0cb221eb78a115e417189bb85838a19e0
  Author: Stefano Stabellini <address@hidden>
  Date:   2013-01-21 (Mon, 21 Jan 2013)

  Changed paths:
    M hw/xen_pt_msi.c

  Log Message:
  -----------
  xen: fix trivial PCI passthrough MSI-X bug

We are currently passing entry->data as address parameter. Pass
entry->addr instead.

Signed-off-by: Stefano Stabellini <address@hidden>
Tested-by: Sander Eikelenboom <address@hidden>
Xen-devel: http://marc.info/?l=xen-devel&m=135515462613715
(cherry picked from commit 044b99c6555f562254ae70dc39f32190eecbc1f2)

Signed-off-by: Michael Roth <address@hidden>


  Commit: e76672424d3d4a3a22ef86a03729491883187583
      
https://github.com/qemu/qemu/commit/e76672424d3d4a3a22ef86a03729491883187583
  Author: Sander Eikelenboom <address@hidden>
  Date:   2013-01-21 (Mon, 21 Jan 2013)

  Changed paths:
    M hw/xen_pt.c
    M xen-all.c

  Log Message:
  -----------
  Fix compile errors when enabling Xen debug logging.

Signed-off-by: Sander Eikelenboom <address@hidden>
Acked-by: Stefano Stabellini <address@hidden>
(cherry picked from commit f1b8caf1d927f30f66054733a783651a24db4999)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 1bd4397e8d818124dca46874dd6cb03d22828079
      
https://github.com/qemu/qemu/commit/1bd4397e8d818124dca46874dd6cb03d22828079
  Author: Markus Armbruster <address@hidden>
  Date:   2013-01-21 (Mon, 21 Jan 2013)

  Changed paths:
    M hw/qxl.c

  Log Message:
  -----------
  qxl: Fix SPICE_RING_PROD_ITEM(), SPICE_RING_CONS_ITEM() sanity check

The pointer arithmetic there is safe, but ugly.  Coverity grouses
about it.  However, the actual comparison is off by one: <= end
instead of < end.  Fix by rewriting the check in a cleaner way.

Signed-off-by: Markus Armbruster <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit bc5f92e5db6f303e73387278e32f8669f0abf0e5)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 04024dea2674861fcf13582a77b58130c67fccd8
      
https://github.com/qemu/qemu/commit/04024dea2674861fcf13582a77b58130c67fccd8
  Author: Michael Roth <address@hidden>
  Date:   2013-01-28 (Mon, 28 Jan 2013)

  Changed paths:
    M VERSION

  Log Message:
  -----------
  update VERSION for v1.3.1

Signed-off-by: Michael Roth <address@hidden>


Compare: https://github.com/qemu/qemu/compare/0a7ad69a0f01^...04024dea2674