aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2019-11-19Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell16-59/+103
* microvm docs and fixes (Sergio, Liam) * New processor features for Intel errata (myself, Pawan) * Kconfig fixes (myself, Thomas) * Revert mc146818rtc change (myself) * Deprecate scsi-disk (myself) * RTC fix (myself, Marcelo) # gpg: Signature made Tue 19 Nov 2019 09:03:49 GMT # gpg: using RSA key BFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: mc146818rtc: fix timer interrupt reinjection again Revert "mc146818rtc: fix timer interrupt reinjection" scsi: deprecate scsi-disk hw/i386: Move save_tsc_khz from PCMachineClass to X86MachineClass docs/microvm.rst: add instructions for shutting down the guest docs/microvm.rst: fix alignment in "Limitations" vfio: vfio-pci requires EDID hw/i386: Fix compiler warning when CONFIG_IDE_ISA is disabled target/i386: Export TAA_NO bit to guests target/i386: add PSCHANGE_NO bit for the ARCH_CAPABILITIES MSR microvm: fix memory leak in microvm_fix_kernel_cmdline scripts: Detect git worktrees for get_maintainer.pl --git Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-19Merge remote-tracking branch 'remotes/philmd-gitlab/tags/mips-next-20191119' ↵Peter Maydell5-22/+22
into staging The DTrace via SystemTap backend can not support the dynamic '*' width format. We failed at noticing it for the 4.1 release, and LP#1844817 was opened to track it. Fix this regression for the next release. # gpg: Signature made Tue 19 Nov 2019 13:56:50 GMT # gpg: using RSA key 89C1E78F601EE86C867495CBA2A3FD6EDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (Phil) <philmd@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 89C1 E78F 601E E86C 8674 95CB A2A3 FD6E DEAD C0DE * remotes/philmd-gitlab/tags/mips-next-20191119: hw/mips/gt64xxx: Remove dynamic field width from trace events hw/block/pflash: Remove dynamic field width from trace events Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-19hw/mips/gt64xxx: Remove dynamic field width from trace eventsPhilippe Mathieu-Daudé2-10/+10
Since not all trace backends support dynamic field width in format (dtrace via stap does not), replace by a static field width instead. We previously passed to the trace API 'width << 1' as the number of hex characters to display (the dynamic field width). We don't need this anymore. Instead, display the size of bytes accessed. Fixes: ab6bff424f ("gt64xxx_pci: Convert debug printf to trace events") Reported-by: Eric Blake <eblake@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Buglink: https://bugs.launchpad.net/qemu/+bug/1844817 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-11-19hw/block/pflash: Remove dynamic field width from trace eventsPhilippe Mathieu-Daudé3-12/+12
Since not all trace backends support dynamic field width in format (dtrace via stap does not), replace by a static field width instead. We previously passed to the trace API 'width << 1' as the number of hex characters to display (the dynamic field width). We don't need this anymore. Instead, display the size of bytes accessed. Fixes: e8aa2d95ea ("pflash: Simplify trace_pflash_io_read/write") Fixes: c1474acd5d ("pflash: Simplify trace_pflash_data_read/write") Reported-by: Eric Blake <eblake@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Buglink: https://bugs.launchpad.net/qemu/+bug/1844817 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-11-19Merge remote-tracking branch ↵Peter Maydell8-81/+113
'remotes/pmaydell/tags/pull-target-arm-20191119' into staging target-arm queue: * Support EL0 v7m msr/mrs for CONFIG_USER_ONLY * Relax r13 restriction for ldrex/strex for v8.0 * Do not reject rt == rt2 for strexd * net/cadence_gem: Set PHY autonegotiation restart status * ssi: xilinx_spips: Skip spi bus update for a few register writes * pl031: Expose RTCICR as proper WC register # gpg: Signature made Tue 19 Nov 2019 13:30:35 GMT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20191119: target/arm: Support EL0 v7m msr/mrs for CONFIG_USER_ONLY target/arm: Relax r13 restriction for ldrex/strex for v8.0 target/arm: Do not reject rt == rt2 for strexd net/cadence_gem: Set PHY autonegotiation restart status ssi: xilinx_spips: Skip spi bus update for a few register writes target/arm: Merge arm_cpu_vq_map_next_smaller into sole caller pl031: Expose RTCICR as proper WC register Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-19target/arm: Support EL0 v7m msr/mrs for CONFIG_USER_ONLYRichard Henderson2-43/+73
Simply moving the non-stub helper_v7m_mrs/msr outside of !CONFIG_USER_ONLY is not an option, because of all of the other system-mode helpers that are called. But we can split out a few subroutines to handle the few EL0 accessible registers without duplicating code. Reported-by: Christophe Lyon <christophe.lyon@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20191118194916.3670-1-richard.henderson@linaro.org [PMM: deleted now-redundant comment; added a default case to switch in v7m_msr helper] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-19target/arm: Relax r13 restriction for ldrex/strex for v8.0Richard Henderson1-4/+8
Armv8-A removes UNPREDICTABLE for R13 for these cases. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20191117090621.32425-3-richard.henderson@linaro.org [PMM: changed ENABLE_ARCH_8 checks to check a new bool 'v8a', since these cases are still UNPREDICTABLE for v8M] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-19target/arm: Do not reject rt == rt2 for strexdRichard Henderson1-1/+1
There was too much cut and paste between ldrexd and strexd, as ldrexd does prohibit two output registers the same. Fixes: af288228995 Reported-by: Michael Goffioul <michael.goffioul@gmail.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20191117090621.32425-2-richard.henderson@linaro.org Reviewed-by: Robert Foley <robert.foley@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-19net/cadence_gem: Set PHY autonegotiation restart statusLinus Ziegert1-4/+5
The Linux kernel PHY driver sets AN_RESTART in the BMCR of the PHY when autonegotiation is started. Recently the kernel started to read back the PHY's AN_RESTART bit and now checks whether the autonegotiation is complete and the bit was cleared [1]. Otherwise the link status is down. The emulated PHY needs to clear AN_RESTART immediately to inform the kernel driver about the completion of autonegotiation phase. [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c36757eb9dee Signed-off-by: Linus Ziegert <linus.ziegert+qemu@holoplot.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20191104181604.21943-1-linus.ziegert+qemu@holoplot.com Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-19ssi: xilinx_spips: Skip spi bus update for a few register writesSai Pavan Boddu1-4/+18
A few configuration register writes need not update the spi bus state, so just return after the register write. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1573830705-14579-1-git-send-email-sai.pavan.boddu@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-19target/arm: Merge arm_cpu_vq_map_next_smaller into sole callerRichard Henderson3-20/+7
Coverity reports, in sve_zcr_get_valid_len, "Subtract operation overflows on operands arm_cpu_vq_map_next_smaller(cpu, start_vq + 1U) and 1U" First, the aarch32 stub version of arm_cpu_vq_map_next_smaller, returning 0, does exactly what Coverity reports. Remove it. Second, the aarch64 version of arm_cpu_vq_map_next_smaller has a set of asserts, but they don't cover the case in question. Further, there is a fair amount of extra arithmetic needed to convert from the 0-based zcr register, to the 1-base vq form, to the 0-based bitmap, and back again. This can be simplified by leaving the value in the 0-based form. Finally, use test_bit to simplify the common case, where the length in the zcr registers is in fact a supported length. Reported-by: Coverity (CID 1407217) Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Message-id: 20191118091414.19440-1-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-19pl031: Expose RTCICR as proper WC registerAlexander Graf1-5/+1
The current PL031 RTCICR register implementation always clears the IRQ pending status on a register write, regardless of the value the guest writes. To justify that behavior, it references the ARM926EJ-S Development Chip Reference Manual (DDI0287B) and indicates that said document states that any write clears the internal IRQ state. It is indeed true that in section 11.1 this document says: "The interrupt is cleared by writing any data value to the interrupt clear register RTCICR". However, later in section 11.2.2 it contradicts itself by saying: "Writing 1 to bit 0 of RTCICR clears the RTCINTR flag." The latter statement matches the PL031 TRM (DDI0224C), which says: "Writing 1 to bit position 0 clears the corresponding interrupt. Writing 0 has no effect." Let's assume that the self-contradictory DDI0287B is in error, and follow the reference manual for the device itself, by making the register write-one-to-clear. Reported-by: Hendrik Borghorst <hborghor@amazon.de> Signed-off-by: Alexander Graf <graf@amazon.com> Message-id: 20191104115228.30745-1-graf@amazon.com [PMM: updated commit message to note that DDI0287B says two conflicting things] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-19Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2019-11-19' ↵Peter Maydell1-5/+31
into staging Monitor patches for 2019-11-19 # gpg: Signature made Tue 19 Nov 2019 08:50:57 GMT # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-monitor-2019-11-19: monitor/qmp: resume monitor when clearing its queue Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-19Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2019-11-19' into ↵Peter Maydell44-40/+606
staging nbd patches for 2019-11-19 - iotests: more tests of NBD reconnect, various test output improvements - nbd: fix spec compliance issue with long strings - slience a Coverity warning on coroutines # gpg: Signature made Tue 19 Nov 2019 03:06:41 GMT # gpg: using RSA key 71C2CC22B1C4602927D2F3AAA7A16B4A2527436A # gpg: Good signature from "Eric Blake <eblake@redhat.com>" [full] # gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" [full] # gpg: aka "[jpeg image of size 6874]" [full] # Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A * remotes/ericb/tags/pull-nbd-2019-11-19: tests: More iotest 223 improvements iotests: Include QMP input in .out files iotests: Switch nbd tests to use Unix rather than TCP iotests: Fix 173 MAINTAINERS: add more bitmap-related to Dirty Bitmaps section nbd: Don't send oversize strings bitmap: Enforce maximum bitmap name length nbd/server: Prefer heap over stack for parsing client names qemu-coroutine-sleep: Silence Coverity warning iotests: Test NBD client reconnection Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-19mc146818rtc: fix timer interrupt reinjection againPaolo Bonzini1-7/+9
Commit 369b41359af46bded5799c9ef8be2b641d92e043 broke timer interrupt reinjection when there is no period change by the guest. In that case, old_period is 0, which ends up zeroing irq_coalesced (counter of reinjected interrupts). The consequence is Windows 7 is unable to synchronize time via NTP. Easily reproducible by playing a fullscreen video with cirrus and VNC. Fix by passing s->period when periodic_timer_update is called due to expiration of the timer. With this change, old_period == 0 only means that the periodic timer was off. Reported-by: Marcelo Tosatti <mtosatti@redhat.com> Co-developed-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-11-19Revert "mc146818rtc: fix timer interrupt reinjection"Paolo Bonzini1-34/+33
This reverts commit b429de730174b388ea5760e3debb0d542ea3c261, except that the reversal of the outer "if (period)" is left in. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-11-19scsi: deprecate scsi-diskPaolo Bonzini4-3/+23
It's an old compatibility shim that just delegates to scsi-cd or scsi-hd. Just like ide-drive, we don't need this. Acked-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-11-19hw/i386: Move save_tsc_khz from PCMachineClass to X86MachineClassLiam Merwick7-9/+9
Attempting to migrate a VM using the microvm machine class results in the source QEMU aborting with the following message/backtrace: target/i386/machine.c:955:tsc_khz_needed: Object 0x555556608fa0 is not an instance of type generic-pc-machine abort() object_class_dynamic_cast_assert() vmstate_save_state_v() vmstate_save_state() vmstate_save() qemu_savevm_state_complete_precopy() migration_thread() migration_thread() migration_thread() qemu_thread_start() start_thread() clone() The access to the machine class returned by MACHINE_GET_CLASS() in tsc_khz_needed() is crashing as it is trying to dereference a different type of machine class object (TYPE_PC_MACHINE) to that of this microVM. This can be resolved by extending the changes in the following commit f0bb276bf8d5 ("hw/i386: split PCMachineState deriving X86MachineState from it") and moving the save_tsc_khz field in PCMachineClass to X86MachineClass. Fixes: f0bb276bf8d5 ("hw/i386: split PCMachineState deriving X86MachineState from it") Signed-off-by: Liam Merwick <liam.merwick@oracle.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <1574075605-25215-1-git-send-email-liam.merwick@oracle.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-11-19docs/microvm.rst: add instructions for shutting down the guestSergio Lopez1-0/+21
Add a new section explaining the particularities of the microvm machine type for triggering a guest-initiated shut down. Signed-off-by: Sergio Lopez <slp@redhat.com> Message-Id: <20191115161338.42864-3-slp@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-11-19docs/microvm.rst: fix alignment in "Limitations"Sergio Lopez1-3/+3
Fix the alignment of the items in the "Limitations" section. Signed-off-by: Sergio Lopez <slp@redhat.com> Message-Id: <20191115161338.42864-2-slp@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-11-19vfio: vfio-pci requires EDIDPaolo Bonzini1-0/+1
hw/vfio/display.c needs the EDID subsystem, select it. Cc: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-11-19hw/i386: Fix compiler warning when CONFIG_IDE_ISA is disabledThomas Huth1-2/+2
When CONFIG_IDE_ISA is disabled, compilation currently fails: hw/i386/pc_piix.c: In function ‘pc_init1’: hw/i386/pc_piix.c:81:9: error: unused variable ‘i’ [-Werror=unused-variable] Move the variable declaration to the right code block to avoid this problem. Fixes: 4501d317b50e ("hw/i386/pc: Extract pc_i8259_create()") Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20191115145049.26868-1-thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-11-19target/i386: Export TAA_NO bit to guestsPawan Gupta1-1/+1
TSX Async Abort (TAA) is a side channel attack on internal buffers in some Intel processors similar to Microachitectural Data Sampling (MDS). Some future Intel processors will use the ARCH_CAP_TAA_NO bit in the IA32_ARCH_CAPABILITIES MSR to report that they are not vulnerable to TAA. Make this bit available to guests. Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-11-19target/i386: add PSCHANGE_NO bit for the ARCH_CAPABILITIES MSRPaolo Bonzini1-1/+1
This is required to disable ITLB multihit mitigations in nested hypervisors. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-11-19microvm: fix memory leak in microvm_fix_kernel_cmdlineSergio Lopez1-0/+2
In microvm_fix_kernel_cmdline(), fw_cfg_modify_string() is duplicating cmdline instead of taking ownership of it. Free it afterwards to avoid leaking it. Reported-by: Coverity (CID 1407218) Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Sergio Lopez <slp@redhat.com> Message-Id: <20191112163423.91884-1-slp@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-11-19scripts: Detect git worktrees for get_maintainer.pl --gitAlexey Kardashevskiy1-1/+1
Recent git versions support worktrees where .git is not a directory but a file with a path to the .git repository; however the get_maintainer.pl script only recognises the .git directory, let's fix it. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Tested-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20191112034532.69079-1-aik@ozlabs.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-11-19monitor/qmp: resume monitor when clearing its queueWolfgang Bumiller1-5/+31
When a monitor's queue is filled up in handle_qmp_command() it gets suspended. It's the dispatcher bh's job currently to resume the monitor, which it does after processing an event from the queue. However, it is possible for a CHR_EVENT_CLOSED event to be processed before before the bh is scheduled, which will clear the queue without resuming the monitor, thereby preventing the dispatcher from reaching the resume() call. Any new connections to the qmp socket will be accept()ed and show the greeting, but will not respond to any messages sent afterwards (as they will not be read from the still-suspended socket). Fix this by resuming the monitor when clearing a queue which was filled up. Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Message-Id: <20191115085914.21287-1-w.bumiller@proxmox.com>
2019-11-18tests: More iotest 223 improvementsEric Blake2-4/+97
Run the core of the test twice, once without iothreads, and again with, for more coverage of both setups. Suggested-by: Nir Soffer <nsoffer@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-Id: <20191114213415.23499-5-eblake@redhat.com>
2019-11-18iotests: Include QMP input in .out filesEric Blake23-0/+285
We generally include relevant HMP input in .out files, by virtue of the fact that HMP echoes its input. But QMP does not, so we have to explicitly inject it in the output stream (appropriately filtered to keep the tests passing), in order to make it easier to read .out files to see what behavior is being tested (especially true where the output file is a sequence of {'return': {}}). Suggested-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20191114213415.23499-4-eblake@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2019-11-18iotests: Switch nbd tests to use Unix rather than TCPEric Blake2-7/+12
Up to now, all it took to cause a lot of iotest failures was to have a background process such as 'nbdkit -p 10810 null' running, because we hard-coded the TCP port. Switching to a Unix socket eliminates this contention. We still have TCP coverage in test 233, and that test is more careful to not pick a hard-coded port. Add a comment explaining where the format layer applies when using NBD as protocol (until NBD gains support for a resize extension, we only pipe raw bytes over the wire). Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20191114213415.23499-3-eblake@redhat.com> [eblake: Tweak socket name per Max Reitz' review]
2019-11-18iotests: Fix 173Eric Blake2-3/+7
This test has been broken since 3.0. It used TEST_IMG to influence the name of a file created during _make_test_img, but commit 655ae6bb changed things so that the wrong file name is being created, which then caused _launch_qemu to fail. In the meantime, the set of events issued for the actions of the test has increased. Why haven't we noticed the failure? Because the test rarely gets run: './check -qcow2 173' is insufficient (that defaults to using file protocol) './check -nfs 173' is insufficient (that defaults to using raw format) so the test is only run with: ./check -qcow2 -nfs 173 Note that we already have a number of other problems with -nfs: ./check -nfs (fails 18/30) ./check -qcow2 -nfs (fails 45/76 after this patch, if exports does not permit 'insecure') and it's not on my priority list to fix those. Rather, I found this because of my next patch's work on tests using _send_qemu_cmd. Fixes: 655ae6b Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-Id: <20191114213415.23499-2-eblake@redhat.com>
2019-11-18MAINTAINERS: add more bitmap-related to Dirty Bitmaps sectionVladimir Sementsov-Ogievskiy1-0/+2
Let's add bitmaps persistence qcow2 feature and postcopy bitmaps migration to Dirty Bitmaps section. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20191026165655.14112-1-vsementsov@virtuozzo.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com>
2019-11-18nbd: Don't send oversize stringsEric Blake6-12/+58
Qemu as server currently won't accept export names larger than 256 bytes, nor create dirty bitmap names longer than 1023 bytes, so most uses of qemu as client or server have no reason to get anywhere near the NBD spec maximum of a 4k limit per string. However, we weren't actually enforcing things, ignoring when the remote side violates the protocol on input, and also having several code paths where we send oversize strings on output (for example, qemu-nbd --description could easily send more than 4k). Tighten things up as follows: client: - Perform bounds check on export name and dirty bitmap request prior to handing it to server - Validate that copied server replies are not too long (ignoring NBD_INFO_* replies that are not copied is not too bad) server: - Perform bounds check on export name and description prior to advertising it to client - Reject client name or metadata query that is too long - Adjust things to allow full 4k name limit rather than previous 256 byte limit Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20191114024635.11363-4-eblake@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2019-11-18bitmap: Enforce maximum bitmap name lengthEric Blake4-4/+14
We document that for qcow2 persistent bitmaps, the name cannot exceed 1023 bytes. It is inconsistent if transient bitmaps do not have to abide by the same limit, and it is unlikely that any existing client even cares about using bitmap names this long. It's time to codify that ALL bitmaps managed by qemu (whether persistent in qcow2 or not) have a documented maximum length. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20191114024635.11363-3-eblake@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2019-11-18nbd/server: Prefer heap over stack for parsing client namesEric Blake2-15/+20
As long as we limit NBD names to 256 bytes (the bare minimum permitted by the standard), stack-allocation works for parsing a name received from the client. But as mentioned in a comment, we eventually want to permit up to the 4k maximum of the NBD standard, which is too large for stack allocation; so switch everything in the server to use heap allocation. For now, there is no change in actually supported name length. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20191114024635.11363-2-eblake@redhat.com> [eblake: fix uninit variable compile failure] Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2019-11-18qemu-coroutine-sleep: Silence Coverity warningEric Blake1-0/+7
Coverity warns that we store the address of a stack variable through a pointer passed in by the caller, which would let the caller trivially trigger use-after-free if that stored value is still present when we finish execution. However, the way coroutines work is that after our call to qemu_coroutine_yield(), control is temporarily continued in the caller prior to our function concluding, and in order to resume our coroutine, the caller must poll until the variable has been set to NULL. Thus, we can add an assert that we do not leak stack storage to the caller on function exit. Fixes: Coverity CID 1406474 CC: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20191111203524.21912-1-eblake@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2019-11-18iotests: Test NBD client reconnectionAndrey Shinkevich5-1/+110
The test for an NBD client. The NBD server is disconnected after the client write request. The NBD client should reconnect and complete the write operation. Suggested-by: Denis V. Lunev <den@openvz.org> Suggested-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: Eric Blake <eblake@redhat.com> Message-Id: <1573529976-815699-1-git-send-email-andrey.shinkevich@virtuozzo.com>
2019-11-18Merge remote-tracking branch 'remotes/awilliam/tags/vfio-fixes-20191118.0' ↵Peter Maydell2-1/+4
into staging VFIO fixes 2019-11-18 - Fix migration blocker double free (Michal Privoznik) - Use migration_add_blocker() return value (Jens Freimann) - Depend on EDID for display support (Paolo Bonzini) # gpg: Signature made Mon 18 Nov 2019 17:44:52 GMT # gpg: using RSA key 239B9B6E3BB08B22 # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" [full] # gpg: aka "Alex Williamson <alex@shazbot.org>" [full] # gpg: aka "Alex Williamson <alwillia@redhat.com>" [full] # gpg: aka "Alex Williamson <alex.l.williamson@gmail.com>" [full] # Primary key fingerprint: 42F6 C04E 540B D1A9 9E7B 8A90 239B 9B6E 3BB0 8B22 * remotes/awilliam/tags/vfio-fixes-20191118.0: vfio: vfio-pci requires EDID vfio: don't ignore return value of migrate_add_blocker hw/vfio/pci: Fix double free of migration_blocker Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-18vfio: vfio-pci requires EDIDPaolo Bonzini1-0/+1
hw/vfio/display.c needs the EDID subsystem, select it. Cc: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2019-11-18vfio: don't ignore return value of migrate_add_blockerJens Freimann1-1/+1
When an error occurs in migrate_add_blocker() it sets a negative return value and uses error pointer we pass in. Instead of just looking at the error pointer check for a negative return value and avoid a coverity error because the return value is set but never used. This fixes CID 1407219. Reported-by: Coverity (CID 1407219) Fixes: f045a0104c8c ("vfio: unplug failover primary device before migration") Signed-off-by: Jens Freimann <jfreimann@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2019-11-18hw/vfio/pci: Fix double free of migration_blockerMichal Privoznik1-0/+2
When user tries to hotplug a VFIO device, but the operation fails somewhere in the middle (in my testing it failed because of RLIMIT_MEMLOCK forbidding more memory allocation), then a double free occurs. In vfio_realize() the vdev->migration_blocker is allocated, then something goes wrong which causes control to jump onto 'error' label where the error is freed. But the pointer is left pointing to invalid memory. Later, when vfio_instance_finalize() is called, the memory is freed again. In my testing the second hunk was sufficient to fix the bug, but I figured the first hunk doesn't hurt either. ==169952== Invalid read of size 8 ==169952== at 0xA47DCD: error_free (error.c:266) ==169952== by 0x4E0A18: vfio_instance_finalize (pci.c:3040) ==169952== by 0x8DF74C: object_deinit (object.c:606) ==169952== by 0x8DF7BE: object_finalize (object.c:620) ==169952== by 0x8E0757: object_unref (object.c:1074) ==169952== by 0x45079C: memory_region_unref (memory.c:1779) ==169952== by 0x45376B: do_address_space_destroy (memory.c:2793) ==169952== by 0xA5C600: call_rcu_thread (rcu.c:283) ==169952== by 0xA427CB: qemu_thread_start (qemu-thread-posix.c:519) ==169952== by 0x80A8457: start_thread (in /lib64/libpthread-2.29.so) ==169952== by 0x81C96EE: clone (in /lib64/libc-2.29.so) ==169952== Address 0x143137e0 is 0 bytes inside a block of size 48 free'd ==169952== at 0x4A342BB: free (vg_replace_malloc.c:530) ==169952== by 0xA47E05: error_free (error.c:270) ==169952== by 0x4E0945: vfio_realize (pci.c:3025) ==169952== by 0x76A4FF: pci_qdev_realize (pci.c:2099) ==169952== by 0x689B9A: device_set_realized (qdev.c:876) ==169952== by 0x8E2C80: property_set_bool (object.c:2080) ==169952== by 0x8E0EF6: object_property_set (object.c:1272) ==169952== by 0x8E3FC8: object_property_set_qobject (qom-qobject.c:26) ==169952== by 0x8E11DB: object_property_set_bool (object.c:1338) ==169952== by 0x5E7BDD: qdev_device_add (qdev-monitor.c:673) ==169952== by 0x5E81E5: qmp_device_add (qdev-monitor.c:798) ==169952== by 0x9E18A8: do_qmp_dispatch (qmp-dispatch.c:132) ==169952== Block was alloc'd at ==169952== at 0x4A35476: calloc (vg_replace_malloc.c:752) ==169952== by 0x51B1158: g_malloc0 (in /usr/lib64/libglib-2.0.so.0.6000.6) ==169952== by 0xA47357: error_setv (error.c:61) ==169952== by 0xA475D9: error_setg_internal (error.c:97) ==169952== by 0x4DF8C2: vfio_realize (pci.c:2737) ==169952== by 0x76A4FF: pci_qdev_realize (pci.c:2099) ==169952== by 0x689B9A: device_set_realized (qdev.c:876) ==169952== by 0x8E2C80: property_set_bool (object.c:2080) ==169952== by 0x8E0EF6: object_property_set (object.c:1272) ==169952== by 0x8E3FC8: object_property_set_qobject (qom-qobject.c:26) ==169952== by 0x8E11DB: object_property_set_bool (object.c:1338) ==169952== by 0x5E7BDD: qdev_device_add (qdev-monitor.c:673) Fixes: f045a0104c8c ("vfio: unplug failover primary device before migration") Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2019-11-18Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell6-3/+419
Block layer patches: - Fix HMP savevm with -blockdev - Minor iotests improvements # gpg: Signature made Mon 18 Nov 2019 16:51:56 GMT # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: iotests: Test multiple blockdev-snapshot calls block: Remove 'backing': null from bs->{explicit_,}options iotests: Fix "no qualified output" error path qemu-iotests/iotests.py: improve assert_qmp message Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-18iotests: Test multiple blockdev-snapshot callsKevin Wolf3-0/+414
Test that doing a second blockdev-snapshot doesn't make the first overlay's backing file go away. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2019-11-18block: Remove 'backing': null from bs->{explicit_,}optionsKevin Wolf1-0/+2
bs->options and bs->explicit_options shouldn't contain any options for child nodes. bdrv_open_inherited() takes care to remove any options that match a child name after opening the image and the same is done when reopening. However, we miss the case of 'backing': null, which is a child option, but results in no child being created. This means that a 'backing': null remains in bs->options and bs->explicit_options. A typical use for 'backing': null is in live snapshots: blockdev-add for the qcow2 overlay makes sure not to open the backing file (because it is already opened and blockdev-snapshot will attach it). After doing a blockdev-snapshot, bs->options and bs->explicit_options become inconsistent with the actual state (bs has a backing file now, but the options still say null). On the next occasion that the image is reopened, e.g. switching it from read-write to read-only when another snapshot is taken, the option will take effect again and the node incorrectly loses its backing file. Fix bdrv_open_inherited() to remove the 'backing' option from bs->options and bs->explicit_options even for the case where it specifies that no backing file is wanted. Reported-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Tested-by: Peter Krempa <pkrempa@redhat.com>
2019-11-18iotests: Fix "no qualified output" error pathKevin Wolf1-1/+1
The variable for error messages to be displayed is $results, not $reason. Fix 'check' to print the "no qualified output" error message again instead of having a failure without any message telling the user why it failed. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2019-11-18qemu-iotests/iotests.py: improve assert_qmp messageVladimir Sementsov-Ogievskiy1-2/+2
From the two values compared, make it obvious which is found at path, and which is expected. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2019-11-18Merge remote-tracking branch ↵Peter Maydell12-0/+0
'remotes/kraxel/tags/seabios-20191118-pull-request' into staging seabios: update to pre-1.13 snapshot again (lchs fixed) # gpg: Signature made Mon 18 Nov 2019 14:23:50 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/seabios-20191118-pull-request: seabios: update to pre-1.13 snapshot again Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-18seabios: update to pre-1.13 snapshot againGerd Hoffmann12-0/+0
Due to lchs support merge in upstream seabios gone wrong (applied v3 instead of v4) here is another seabios snapshot update with the mis-merge fixed up, so lchs support should actually work in -rc2. Also picked up two tpm bugfixes. git shortlog from previous snapshot =================================== Gerd Hoffmann (4): Revert "geometry: Apply LCHS values for boot devices" Revert "config: Add toggle for bootdevice information" Revert "geometry: Add boot_lchs_find_*() utility functions" Revert "geometry: Read LCHS from fw_cfg" Sam Eiderman (4): geometry: Read LCHS from fw_cfg boot: Build ata and scsi paths in function geometry: Add boot_lchs_find_*() utility functions geometry: Apply LCHS values for boot devices Stefan Berger (2): tpm: Require a response to have minimum size of a valid response header tcgbios: Check for enough bytes returned from TPM2_GetCapability Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-11-18Merge remote-tracking branch 'remotes/vivier2/tags/ppc-for-4.2-pull-request' ↵Peter Maydell15-44/+185
into staging ppc patch queue 2019-11-15 Several fixes for 4.2.0-rc2: fix mos6522 performance issue, xive/xics issues, fix /chosen device-tree on reset and KVM default cpu-model for all machine classes # gpg: Signature made Mon 18 Nov 2019 10:52:19 GMT # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "lvivier@redhat.com" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/ppc-for-4.2-pull-request: mos6522: fix T1 and T2 timers spapr/kvm: Set default cpu model for all machine classes spapr: Add /chosen to FDT only at reset time to preserve kernel and initramdisk ppc: Skip partially initialized vCPUs in 'info pic' xive, xics: Fix reference counting on CPU objects ppc: Add intc_destroy() handlers to SpaprInterruptController/PnvChip Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-18mos6522: fix T1 and T2 timersLaurent Vivier1-15/+52
With the Quadra 800 emulation, mos6522 timers processing can consume until 70% of the host CPU time with an idle guest (I guess the problem should also happen with PowerMac emulation). On a recent system, it can be painless (except if you look at top), but on an old host like a PowerMac G5 the guest kernel can be terribly slow during the boot sequence (for instance, unpacking initramfs can take 15 seconds rather than only 3 seconds). We can avoid this CPU overload by enabling QEMU internal timers only if the mos6522 counter interrupts are enabled. Sometime the guest kernel wants to read the counters values, but we don't need the timers to update the counters. With this patch applied, an idle Q800 consumes only 3% of host CPU time (and the guest can boot in a decent time). Signed-off-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20191102154919.17775-1-laurent@vivier.eu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Laurent Vivier <lvivier@redhat.com>
generated by cgit v1.1 at 2025-01-07 17:35:40 +0000