[Qemu-commits] [qemu/qemu] 071785: Revert "spapr_pci: map the MSI window in each PHB"

[GitHub]

  Branch: refs/heads/stable-2.1
  Home:   https://github.com/qemu/qemu
  Commit: 07178559a95e49a3da2e3b226efffc28f1bd134d
      
https://github.com/qemu/qemu/commit/07178559a95e49a3da2e3b226efffc28f1bd134d
  Author: Greg Kurz <address@hidden>
  Date:   2014-09-23 (Tue, 23 Sep 2014)

  Changed paths:
    M hw/ppc/spapr.c
    M hw/ppc/spapr_pci.c
    M include/hw/pci-host/spapr.h
    M include/hw/ppc/spapr.h

  Log Message:
  -----------
  Revert "spapr_pci: map the MSI window in each PHB"

This patch is predicated on cc943c, which was dropped from
stable tree for other reasons.

This reverts commit 0824ca6bd126b97fac18d12d514823463f415bec.

Signed-off-by: Michael Roth <address@hidden>


  Commit: a56b9cfd86c89aeb5f436a0596c2b5377eae1cde
      
https://github.com/qemu/qemu/commit/a56b9cfd86c89aeb5f436a0596c2b5377eae1cde
  Author: Eduardo Habkost <address@hidden>
  Date:   2014-09-23 (Tue, 23 Sep 2014)

  Changed paths:
    M hw/core/machine.c

  Log Message:
  -----------
  hw/machine: Free old values of string properties

Reviewed-by: Markus Armbruster <address@hidden>
Reviewed-by: Marcel Apfelbaum <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>
Acked-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
Reviewed-by: Amos Kong <address@hidden>
Cc: address@hidden
(cherry picked from commit 556068eed04b7f11187aabd89b981552d8d0c30e)
Signed-off-by: Michael Roth <address@hidden>


  Commit: 9e8d9941119fc2db7905d851a127a78bf672f009
      
https://github.com/qemu/qemu/commit/9e8d9941119fc2db7905d851a127a78bf672f009
  Author: Eduardo Habkost <address@hidden>
  Date:   2014-09-23 (Tue, 23 Sep 2014)

  Changed paths:
    M backends/rng-egd.c

  Log Message:
  -----------
  Revert "rng-egd: remove redundant free"

This reverts commit 5e490b6a504912225dff0e520e1c6af68295d238.

Cc: address@hidden
Reviewed-by: Markus Armbruster <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
(cherry picked from commit abb4d5f2e2830b7a6dc4ddcc612dfab15e3a320d)
Signed-off-by: Michael Roth <address@hidden>


  Commit: 074e3471386ec97ffa145642ba614b2b87be2f10
      
https://github.com/qemu/qemu/commit/074e3471386ec97ffa145642ba614b2b87be2f10
  Author: Michael S. Tsirkin <address@hidden>
  Date:   2014-09-23 (Tue, 23 Sep 2014)

  Changed paths:
    M hw/net/virtio-net.c

  Log Message:
  -----------
  virtio-net: drop assert on vm stop

On vm stop, vm_running state set to stopped
before device is notified, so callbacks can get envoked with
vm_running = false; and this is not an error.

Cc: address@hidden
Acked-by: Jason Wang <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
(cherry picked from commit 131c5221fe25a9547c4a388a3d26ff7fd14843e5)
Signed-off-by: Michael Roth <address@hidden>


  Commit: 80f4d021f0323934df90f8c7f0954703d088c200
      
https://github.com/qemu/qemu/commit/80f4d021f0323934df90f8c7f0954703d088c200
  Author: Michael S. Tsirkin <address@hidden>
  Date:   2014-09-23 (Tue, 23 Sep 2014)

  Changed paths:
    M hw/virtio/virtio.c

  Log Message:
  -----------
  Revert "virtio: don't call device on !vm_running"

This reverts commit a1bc7b827e422e1ff065640d8ec5347c4aadfcd8.
    virtio: don't call device on !vm_running
It turns out that virtio net assumes that vm_running
is updated before device status callback in many places,
so this change leads to asserts.
Previous commit fixes the root issue that motivated
a1bc7b827e422e1ff065640d8ec5347c4aadfcd8 differently,
so there's no longer a need for this change.

In the future, we might be able to drop checking vm_running
completely, and check vm state directly.

Reported-by: Dietmar Maurer <address@hidden>
Cc: address@hidden
Acked-by: Jason Wang <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
(cherry picked from commit 9e8e8c48653471fa5fed447e388fdef57d4f6998)
Signed-off-by: Michael Roth <address@hidden>


  Commit: 00dd2b22f691422ab3208af9af87df52875dc26a
      
https://github.com/qemu/qemu/commit/00dd2b22f691422ab3208af9af87df52875dc26a
  Author: Michael S. Tsirkin <address@hidden>
  Date:   2014-09-23 (Tue, 23 Sep 2014)

  Changed paths:
    M hw/i386/pc.c

  Log Message:
  -----------
  pc: leave more space for BIOS allocations

Since QEMU 2.1, we are allocating more space for ACPI tables, so no
space is left after initrd for the BIOS to allocate memory.

Besides ACPI tables, there are a few other uses of high memory in
SeaBIOS: SMBIOS tables and USB drivers use it in particular.  These uses
allocate a very small amount of memory.  Malloc metadata also lives
there.  So we need _some_ extra padding there to avoid initrd breakage,
but not much.

John Snow found a case where RHEL5 was broken by the recent change to
ACPI_TABLE_SIZE; in his case 4KB of extra padding are fine, but just to
be safe I am adding 32KB, which is roughly the same amount of padding
that was left by QEMU 2.0 and earlier.

Move initrd to leave some space for the BIOS.

Cc: address@hidden
Signed-off-by: Paolo Bonzini <address@hidden>
Reported-by: John Snow <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
(cherry picked from commit 438f92ee9f6a4f78f8adcc399809e252b6da72a2)
Signed-off-by: Michael Roth <address@hidden>


  Commit: 9a72433843d912a45046959b1953861211d1838d
      
https://github.com/qemu/qemu/commit/9a72433843d912a45046959b1953861211d1838d
  Author: Petr Matousek <address@hidden>
  Date:   2014-09-24 (Wed, 24 Sep 2014)

  Changed paths:
    M slirp/udp.c

  Log Message:
  -----------
  slirp: udp: fix NULL pointer dereference because of uninitialized socket

When guest sends udp packet with source port and source addr 0,
uninitialized socket is picked up when looking for matching and already
created udp sockets, and later passed to sosendto() where NULL pointer
dereference is hit during so->slirp->vnetwork_mask.s_addr access.

Fix this by checking that the socket is not just a socket stub.

This is CVE-2014-3640.

Signed-off-by: Petr Matousek <address@hidden>
Reported-by: Xavier Mehrenberger <address@hidden>
Reported-by: Stephane Duverger <address@hidden>
Reviewed-by: Jan Kiszka <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Reviewed-by: Michael Tokarev <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>
(cherry picked from commit 01f7cecf0037997cb0e58ec0d56bf9b5a6f7cb2a)
Signed-off-by: Michael Roth <address@hidden>


  Commit: 562d6b4f7f7ee39a4ce81ed3605e2fb4546af262
      
https://github.com/qemu/qemu/commit/562d6b4f7f7ee39a4ce81ed3605e2fb4546af262
  Author: Michael Roth <address@hidden>
  Date:   2014-09-25 (Thu, 25 Sep 2014)

  Changed paths:
    M VERSION

  Log Message:
  -----------
  Update version for v2.1.2 release

Signed-off-by: Michael Roth <address@hidden>


Compare: https://github.com/qemu/qemu/compare/3cb451edb23d...562d6b4f7f7e