1. 12 Feb, 2019 1 commit
  2. 08 Feb, 2019 1 commit
  3. 07 Feb, 2019 4 commits
  4. 11 Dec, 2018 1 commit
  5. 06 Dec, 2018 2 commits
    • Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Peter Maydell authored
    • While performing block transfer write in smb_ioport_writeb(),
      'smb_index' is incremented and used to index smb_data[] array.
      Check 'smb_index' value to avoid OOB access.
      
      Note that this bug is exploitable by a guest to escape
      from the virtual machine. However the commit which
      introduced the bug was only made after the 3.0 release,
      and so it is not present in any released QEMU versions.
      
      Fixes: 38ad4fae i2c: pm_smbus: Add block transfer capability
      Reported-by: Michael Hanselmann <public@hansmi.ch>
      Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Reviewed-by: Li Qiang <liq3ea@gmail.com>
      Reviewed-by: Michael Hanselmann <public@hansmi.ch>
      Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
      Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
      Message-id: 20181206121830.6177-1-ppandit@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Prasad J Pandit authored
  6. 04 Dec, 2018 6 commits
    • Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Peter Maydell authored
    • This test tries to build a packet whose size is greater than INT_MAX
      which tries to trigger integer overflow in qemu_net_queue_append_iov()
      which may result OOB.
      
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-id: 20181204035347.6148-6-jasowang@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Jason Wang authored
    • Reviewed-by: Thomas Huth <thuth@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Message-id: 20181204035347.6148-5-jasowang@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Jason Wang authored
    • This allows flexibility to be reused for all kinds of command line
      used by other tests.
      
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Message-id: 20181204035347.6148-4-jasowang@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Jason Wang authored
    • If we want to qtest through hub, it would be much more simpler and
      safer to configure the hub without host network. So silent this
      warnings for qtest.
      
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-id: 20181204035347.6148-3-jasowang@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Jason Wang authored
    • We try to detect and drop too large packet (>INT_MAX) in 1592a994
      ("net: ignore packet size greater than INT_MAX") during packet
      delivering. Unfortunately, this is not sufficient as we may hit
      another integer overflow when trying to queue such large packet in
      qemu_net_queue_append_iov():
      
      - size of the allocation may overflow on 32bit
      - packet->size is integer which may overflow even on 64bit
      
      Fixing this by moving the check to qemu_sendv_packet_async() which is
      the entrance of all networking codes and reduce the limit to
      NET_BUFSIZE to be more conservative. This works since:
      
      - For the callers that call qemu_sendv_packet_async() directly, they
        only care about if zero is returned to determine whether to prevent
        the source from producing more packets. A callback will be triggered
        if peer can accept more then source could be enabled. This is
        usually used by high speed networking implementation like virtio-net
        or netmap.
      - For the callers that call qemu_sendv_packet() that calls
        qemu_sendv_packet_async() indirectly, they often ignore the return
        value. In this case qemu will just the drop packets if peer can't
        receive.
      
      Qemu will copy the packet if it was queued. So it was safe for both
      kinds of the callers to assume the packet was sent.
      
      Since we move the check from qemu_deliver_packet_iov() to
      qemu_sendv_packet_async(), it would be safer to make
      qemu_deliver_packet_iov() static to prevent any external user in the
      future.
      
      This is a revised patch of CVE-2018-17963.
      
      Cc: qemu-stable@nongnu.org
      Cc: Li Qiang <liq3ea@163.com>
      Fixes: 1592a994 ("net: ignore packet size greater than INT_MAX")
      Reported-by: Li Qiang <liq3ea@gmail.com>
      Reviewed-by: Li Qiang <liq3ea@gmail.com>
      Signed-off-by: Jason Wang <jasowang@redhat.com>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Message-id: 20181204035347.6148-2-jasowang@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Jason Wang authored
  7. 03 Dec, 2018 9 commits
    • usb: mtp fixes.
      
      # gpg: Signature made Mon 03 Dec 2018 19:50:26 GMT
      # gpg:                using RSA key 4CB6D8EED3E87138
      # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
      # gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
      # gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
      # Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138
      
      * remotes/kraxel/tags/fixes-31-20181203-pull-request:
        usb-mtp: outlaw slashes in filenames
        usb-mtp: fix utf16_to_str
      
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Peter Maydell authored
    • Slash is unix directory separator, so they are not allowed in filenames.
      Note this also stops the classic escape via "../".
      
      Fixes: CVE-2018-16867
      Reported-by: Michael Hanselmann <public@hansmi.ch>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
      Message-id: 20181203101045.27976-3-kraxel@redhat.com
      Gerd Hoffmann authored
    • Make utf16_to_str return an allocated string.  Remove the assumtion that
      the number of string bytes equals the number of utf16 chars (which is
      only true for ascii chars).  Instead call wcstombs twice, once to figure
      the storage size and once for the actual conversion (as suggested by the
      wcstombs manpage).
      
      FIXME: surrogate pairs are not working correctly.  Pre-existing bug,
      fixing that is left for another day.
      
      Reported-by: Michael Hanselmann <public@hansmi.ch>
      Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
      Reviewed-by: Markus Armbruster <armbru@redhat.com>
      Message-id: 20181203101045.27976-2-kraxel@redhat.com
      Gerd Hoffmann authored
    • nbd patches for 2018-12-03
      
      Improve x-dirty-bitmap handling for experimenting with pull mode
      incremental backups.
      
      - Eric Blake: 0/3 NBD dirty bitmap cleanups
      
      # gpg: Signature made Mon 03 Dec 2018 15:56:23 GMT
      # gpg:                using RSA key A7A16B4A2527436A
      # gpg: Good signature from "Eric Blake <eblake@redhat.com>"
      # gpg:                 aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>"
      # gpg:                 aka "[jpeg image of size 6874]"
      # Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2  F3AA A7A1 6B4A 2527 436A
      
      * remotes/ericb/tags/pull-nbd-2018-12-03:
        nbd/client: Send NBD_CMD_DISC if open fails after connect
        nbd/client: Make x-dirty-bitmap more reliable
        nbd/server: Advertise all contexts in response to bare LIST
      
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Peter Maydell authored
    • Block layer patches:
      
      - mirror: Fix deadlock
      
      # gpg: Signature made Mon 03 Dec 2018 16:57:33 GMT
      # gpg:                using RSA key 7F09B272C88F2FD6
      # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
      # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6
      
      * remotes/kevin/tags/for-upstream:
        iotests: simple mirror test with kvm on 1G image
        mirror: fix dead-lock
      
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Peter Maydell authored
    • This test is broken without previous commit fixing dead-lock in mirror.
      
      Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
      Signed-off-by: Max Reitz <mreitz@redhat.com>
      Acked-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Vladimir Sementsov-Ogievskiy authored
    • Let start from the beginning:
      
      Commit b9e413dd (in 2.9)
      "block: explicitly acquire aiocontext in aio callbacks that need it"
      added pairs of aio_context_acquire/release to mirror_write_complete and
      mirror_read_complete, when they were aio callbacks for blk_aio_* calls.
      
      Then, commit 2e1990b2 (in 3.0) "block/mirror: Convert to coroutines"
      dropped these blk_aio_* calls, than mirror_write_complete and
      mirror_read_complete are not callbacks more, and don't need additional
      aiocontext acquiring. Furthermore, mirror_read_complete calls
      blk_co_pwritev inside these pair of aio_context_acquire/release, which
      leads to the following dead-lock with mirror:
      
       (gdb) info thr
         Id   Target Id         Frame
         3    Thread (LWP 145412) "qemu-system-x86" syscall ()
         2    Thread (LWP 145416) "qemu-system-x86" __lll_lock_wait ()
       * 1    Thread (LWP 145411) "qemu-system-x86" __lll_lock_wait ()
      
       (gdb) bt
       #0  __lll_lock_wait ()
       #1  _L_lock_812 ()
       #2  __GI___pthread_mutex_lock
       #3  qemu_mutex_lock_impl (mutex=0x561032dce420 <qemu_global_mutex>,
           file=0x5610327d8654 "util/main-loop.c", line=236) at
           util/qemu-thread-posix.c:66
       #4  qemu_mutex_lock_iothread_impl
       #5  os_host_main_loop_wait (timeout=480116000) at util/main-loop.c:236
       #6  main_loop_wait (nonblocking=0) at util/main-loop.c:497
       #7  main_loop () at vl.c:1892
       #8  main
      
      Printing contents of qemu_global_mutex, I see that "__owner = 145416",
      so, thr1 is main loop, and now it wants BQL, which is owned by thr2.
      
       (gdb) thr 2
       (gdb) bt
       #0  __lll_lock_wait ()
       #1  _L_lock_870 ()
       #2  __GI___pthread_mutex_lock
       #3  qemu_mutex_lock_impl (mutex=0x561034d25dc0, ...
       #4  aio_context_acquire (ctx=0x561034d25d60)
       #5  dma_blk_cb
       #6  dma_blk_io
       #7  dma_blk_read
       #8  ide_dma_cb
       #9  bmdma_cmd_writeb
       #10 bmdma_write
       #11 memory_region_write_accessor
       #12 access_with_adjusted_size
       #15 flatview_write
       #16 address_space_write
       #17 address_space_rw
       #18 kvm_handle_io
       #19 kvm_cpu_exec
       #20 qemu_kvm_cpu_thread_fn
       #21 qemu_thread_start
       #22 start_thread
       #23 clone ()
      
      Printing mutex in fr 2, I see "__owner = 145411", so thr2 wants aio
      context mutex, which is owned by thr1. Classic dead-lock.
      
      Then, let's check that aio context is hold by mirror coroutine: just
      print coroutine stack of first tracked request in mirror job target:
      
       (gdb) [...]
       (gdb) qemu coroutine 0x561035dd0860
       #0  qemu_coroutine_switch
       #1  qemu_coroutine_yield
       #2  qemu_co_mutex_lock_slowpath
       #3  qemu_co_mutex_lock
       #4  qcow2_co_pwritev
       #5  bdrv_driver_pwritev
       #6  bdrv_aligned_pwritev
       #7  bdrv_co_pwritev
       #8  blk_co_pwritev
       #9  mirror_read_complete () at block/mirror.c:232
       #10 mirror_co_read () at block/mirror.c:370
       #11 coroutine_trampoline
       #12 __start_context
      
      Yes it is mirror_read_complete calling blk_co_pwritev after acquiring
      aio context.
      
      Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
      Reviewed-by: Max Reitz <mreitz@redhat.com>
      Signed-off-by: Kevin Wolf <kwolf@redhat.com>
      Vladimir Sementsov-Ogievskiy authored
    • Single opcode instructions in ff group were incorrectly processed
      because an overrun of _decode_tbl1[0xff] resulted in access of
      _decode_tbl2[0x0]. Thus, decode_sldtgroup was called instead of
      decode_ffgroup:
        7d71: decode_sldtgroup: 1
        Unimplemented handler (7d71) for 108 (ff 0)
      
      While at it correct maximum length for _decode_tbl2 and _decode_tbl3.
      
      Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com>
      Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Roman Bolshakov authored
    • Avoid an overflow.
      
      Signed-off-by: Corey Minyard <cminyard@mvista.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
      Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
      Cc: QEMU Stable <qemu-stable@nongnu.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Corey Minyard authored
  8. 30 Nov, 2018 3 commits
    • If nbd_client_init() fails after we are already connected,
      then the server will spam logs with:
      
      Disconnect client, due to: Unexpected end-of-file before all bytes were read
      
      unless we gracefully disconnect before closing the connection.
      
      Ways to trigger this:
      
      $ opts=driver=nbd,export=foo,server.type=inet,server.host=localhost,server.port=10809
      $  qemu-img map --output=json --image-opts $opts,read-only=off
      $  qemu-img map --output=json --image-opts $opts,x-dirty-bitmap=nosuch:
      
      Signed-off-by: Eric Blake <eblake@redhat.com>
      Message-Id: <20181130023232.3079982-4-eblake@redhat.com>
      Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
      Eric Blake authored
    • The implementation of x-dirty-bitmap in qemu 3.0 (commit 216ee365)
      silently falls back to treating the server as not supporting
      NBD_CMD_BLOCK_STATUS if a requested meta_context name was not
      negotiated, which in turn means treating the _entire_ image as
      data. Since our hack relied on using 'qemu-img map' to view
      which portions of the image were dirty by seeing what the
      redirected bdrv_block_status() treats as holes, this means
      that our fallback treats the entire image as clean.  Better
      would have been to treat the entire image as dirty, or to fail
      to connect because the user's request for a specific context
      could not be honored. This patch goes with the latter.
      
      Signed-off-by: Eric Blake <eblake@redhat.com>
      Message-Id: <20181130023232.3079982-3-eblake@redhat.com>
      Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
      Eric Blake authored
    • The NBD spec, and even our code comment, says that if the client
      asks for NBD_OPT_LIST_META_CONTEXT with 0 queries, then we should
      reply with (a possibly-compressed representation of) ALL contexts
      that we are willing to let them try.  But commit 3d068aff forgot
      to advertise qemu:dirty-bitmap:FOO.
      
      Signed-off-by: Eric Blake <eblake@redhat.com>
      Message-Id: <20181130023232.3079982-2-eblake@redhat.com>
      Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
      Eric Blake authored
  9. 28 Nov, 2018 5 commits
    • Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Peter Maydell authored
    • Clang 3.4 does not know the "flatten" attribute yet. We've already
      introduced the QEMU_FLATTEN macro for this in commit 97ff87c0,
      so use this macro now here, too, to fix this issue.
      
      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Message-id: 1543399094-2260-1-git-send-email-thuth@redhat.com
      Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
      Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Thomas Huth authored
    • When using clang 3.4.2, compilation of QEMU fails like this:
      
        CC      aarch64-softmmu/hw/arm/aspeed.o
      hw/arm/aspeed.c:36:3: error: redefinition of typedef 'AspeedBoardState' is a C11
            feature [-Werror,-Wtypedef-redefinition]
      } AspeedBoardState;
        ^
      include/hw/arm/aspeed.h:14:33: note: previous definition is here
      typedef struct AspeedBoardState AspeedBoardState;
                                      ^
      1 error generated.
      make[1]: *** [hw/arm/aspeed.o] Error 1
      make: *** [subdir-aarch64-softmmu] Error 2
      
      Remove the duplicated typedef to fix this issue.
      
      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Reviewed-by: Cédric Le Goater <clg@kaod.org>
      Message-id: 1543397736-8198-1-git-send-email-thuth@redhat.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Thomas Huth authored
    • * lsi HBA reselection fix (George)
      * Small cleanups (Li Qiang)
      * bugfixes for vhost-user-bridge and hostmem (Marc-André)
      * single-thread TCG fix (me)
      * VMX migration blocker (me)
      * target/i386 fix for LOCK (Richard)
      * MAINTAINERS update (Philippe, Thomas)
      
      # gpg: Signature made Wed 28 Nov 2018 10:51:36 GMT
      # gpg:                using RSA key BFFBD25F78C7AE83
      # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
      # gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
      # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
      #      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83
      
      * remotes/bonzini/tags/for-upstream:
        hostmem: no need to check for host_memory_backend_mr_inited() in alloc()
        hostmem-memfd: honour share=on/off property
        MAINTAINERS: Add an entry for the Firmware Configuration (fw_cfg) device
        MAINTAINERS: Add some missing entries related to accelerators
        target/i386: Generate #UD when applying LOCK to a register destination
        checkpatch: g_test_message does not need a trailing newline
        vl.c: remove outdated comment
        vhost-user-bridge: fix recvmsg iovlen
        vl: Improve error message when we can't load fw_cfg from file
        vmstate: constify VMStateField
        migration: savevm: consult migration blockers
        lsi: Reselection needed to remove pending commands from queue
        cpus: run work items for all vCPUs if single-threaded
        target/i386: kvm: add VMX migration blocker
      
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Peter Maydell authored
    • memfd_backend_memory_alloc/file_backend_memory_alloc both needlessly
      are are calling host_memory_backend_mr_inited() which creates an
      illusion that alloc could be called multiple times but it isn't, it's
      called once from UserCreatable complete().
      
      Suggested-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
      Reviewed-by: Igor Mammedov <imammedo@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Marc-André Lureau authored
  10. 27 Nov, 2018 8 commits
    • Some versions of Clang prior to 6.0 (and some builds of clang after,
      such as 6.0.1-2.fc28) fail to recognize { 0 } as a valid initializer
      for a struct with subobjects when -Wmissing-braces is enabled.
      
      https://bugs.llvm.org/show_bug.cgi?id=21689 and
      https://reviews.llvm.org/rL314499 suggests this should be fixed in 6.0,
      but it might not be the case for older versions or downstream versions.
      
      For now, follow the precedent of ebf2a499 and replace the standard { 0 }
      with the accepted { } to silence this warning and allow the build to
      work under clang 6.0.1-2.fc28, and builds prior to 6.0.
      
      Signed-off-by: John Snow <jsnow@redhat.com>
      Reviewed-by: Eric Blake <eblake@redhat.com>
      Message-id: 20181127184929.20065-1-jsnow@redhat.com
      Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      John Snow authored
    • qemu_vfio_open_common() initializes s->lock only after passing s to
      qemu_vfio_dma_map() via qemu_vfio_init_ramblock().
      qemu_vfio_dma_map() tries to lock the uninitialized lock and crashes.
      
      Fix by initializing s->lock first.
      
      RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1645840
      Fixes: 418026ca
      Cc: qemu-stable@nongnu.org
      Signed-off-by: Markus Armbruster <armbru@redhat.com>
      Reviewed-by: Cornelia Huck <cohuck@redhat.com>
      Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
      Message-id: 20181127084143.1113-1-armbru@redhat.com
      Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
      Markus Armbruster authored
    • The share=on/off property is used to modified mmap() MAP_SHARED
      setting. Make it on by default for convenience and compatibility
      reasons.
      
      Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Marc-André Lureau authored
    • Step in to maintain it, with Laszlo (EDK2) and Gerd (SeaBIOS)
      as designated reviewers.
      
      Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
      Message-Id: <20181122021139.1486-1-philmd@redhat.com>
      Acked-by: Eduardo Habkost <ehabkost@redhat.com>
      Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Philippe Mathieu-Daudé authored
    • Add some files from accel/stubs/, include/hw/kvm/ and scripts/kvm/
      to the MAINTAINERS file.
      
      Signed-off-by: Thomas Huth <thuth@redhat.com>
      Message-Id: <1542891438-13329-1-git-send-email-thuth@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Thomas Huth authored
    • Fixes a TCG crash due to attempting the atomic operation without
      having set up the address first.  This does not attempt to fix
      all of the other missing checks for LOCK.
      
      Fixes: a7cee522
      Fixes: https://bugs.launchpad.net/qemu/+bug/1803160
      Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
      Message-Id: <20181113193510.24862-1-richard.henderson@linaro.org>
      Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Richard Henderson authored
    • Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
      Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
      Reviewed-by: Thomas Huth <thuth@redhat.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Paolo Bonzini authored
    • Cc: qemu-trivial@nongnu.org
      
      Signed-off-by: Li Qiang <liq3ea@gmail.com>
      Message-Id: <1542276385-7638-1-git-send-email-liq3ea@gmail.com>
      Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
      Li Qiang authored