From a184e74f24f83935c8fc7cd76c06ad0717f89fdb Mon Sep 17 00:00:00 2001 From: Rabin Vincent Date: Tue, 10 Nov 2015 14:25:47 +0100 Subject: [PATCH 1/4] nand: fix address overflow The shifts of the address mask and value shift beyond 32 bits when there are 5 address cycles. Cc: qemu-stable@nongnu.org Signed-off-by: Rabin Vincent Reviewed-by: Paolo Bonzini Reviewed-by: Peter Crosthwaite Signed-off-by: Kevin Wolf --- hw/block/nand.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/block/nand.c b/hw/block/nand.c index 61d2cec032..a68266f887 100644 --- a/hw/block/nand.c +++ b/hw/block/nand.c @@ -522,8 +522,8 @@ void nand_setio(DeviceState *dev, uint32_t value) if (s->ale) { unsigned int shift = s->addrlen * 8; - unsigned int mask = ~(0xff << shift); - unsigned int v = value << shift; + uint64_t mask = ~(0xffull << shift); + uint64_t v = (uint64_t)value << shift; s->addr = (s->addr & mask) | v; s->addrlen ++; From 01809194a06d8e6c51c3e69600f14355225f4855 Mon Sep 17 00:00:00 2001 From: John Snow Date: Wed, 11 Nov 2015 15:27:36 -0500 Subject: [PATCH 2/4] iotests: fix race in 030 the stop_test case tests that we can resume a block-stream command after it has stopped/paused due to error. We cannot always reliably query it before it finishes after resume, though, so make this a conditional. The important thing is that we are still testing that it has stopped, and that it finishes successfully after we send a resume command. Signed-off-by: John Snow Reviewed-by: Fam Zheng Reviewed-by: Alberto Garcia Reviewed-by: Jeff Cody Signed-off-by: Kevin Wolf --- tests/qemu-iotests/030 | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/qemu-iotests/030 b/tests/qemu-iotests/030 index 952a524ec7..32469efd76 100755 --- a/tests/qemu-iotests/030 +++ b/tests/qemu-iotests/030 @@ -245,6 +245,7 @@ class TestEIO(TestErrors): while not completed: for event in self.vm.get_qmp_events(wait=True): if event['event'] == 'BLOCK_JOB_ERROR': + error = True self.assert_qmp(event, 'data/device', 'drive0') self.assert_qmp(event, 'data/operation', 'read') @@ -257,9 +258,11 @@ class TestEIO(TestErrors): self.assert_qmp(result, 'return', {}) result = self.vm.qmp('query-block-jobs') + if result == {'return': []}: + # Race; likely already finished. Check. + continue self.assert_qmp(result, 'return[0]/paused', False) self.assert_qmp(result, 'return[0]/io-status', 'ok') - error = True elif event['event'] == 'BLOCK_JOB_COMPLETED': self.assertTrue(error, 'job completed unexpectedly') self.assert_qmp(event, 'data/type', 'stream') From 0702d3d88c2059814212b83f01e14ff3bb7b0c66 Mon Sep 17 00:00:00 2001 From: Max Reitz Date: Mon, 9 Nov 2015 23:39:10 +0100 Subject: [PATCH 3/4] blockdev: Add missing bdrv_unref() in drive-backup All error paths after a successful bdrv_open() of target_bs should contain a bdrv_unref(target_bs). This one did not yet, so add it. Signed-off-by: Max Reitz Reviewed-by: Alberto Garcia Reviewed-by: Kevin Wolf Reviewed-by: Fam Zheng Signed-off-by: Kevin Wolf --- blockdev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/blockdev.c b/blockdev.c index 917ae0687f..07c1741214 100644 --- a/blockdev.c +++ b/blockdev.c @@ -3171,6 +3171,7 @@ static void do_drive_backup(const char *device, const char *target, bmap = bdrv_find_dirty_bitmap(bs, bitmap); if (!bmap) { error_setg(errp, "Bitmap '%s' could not be found", bitmap); + bdrv_unref(target_bs); goto out; } } From 4ad6f3db7db154d5274274bd0079d6318367ab16 Mon Sep 17 00:00:00 2001 From: Alberto Garcia Date: Fri, 13 Nov 2015 15:00:24 +0200 Subject: [PATCH 4/4] block: Call external_snapshot_clean after blockdev-snapshot Otherwise the AioContext will never be released. Signed-off-by: Alberto Garcia Message-id: 1447419624-21918-1-git-send-email-berto@igalia.com Reviewed-by: Fam Zheng Signed-off-by: Max Reitz --- blockdev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/blockdev.c b/blockdev.c index 07c1741214..313841b0b4 100644 --- a/blockdev.c +++ b/blockdev.c @@ -2098,6 +2098,7 @@ static const BlkActionOps actions[] = { .prepare = external_snapshot_prepare, .commit = external_snapshot_commit, .abort = external_snapshot_abort, + .clean = external_snapshot_clean, }, [TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_SYNC] = { .instance_size = sizeof(ExternalSnapshotState),