aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2020-04-07Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell9-95/+193
Block layer patches: - Fix crashes and hangs related to iothreads, bdrv_drain and block jobs: - Fix some AIO context locking in jobs - Fix blk->in_flight during blk_wait_while_drained() - vpc: Don't round up already aligned BAT sizes # gpg: Signature made Tue 07 Apr 2020 15:25:24 BST # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: vpc: Don't round up already aligned BAT sizes block: Fix blk->in_flight during blk_wait_while_drained() block: Increase BB.in_flight for coroutine and sync interfaces block-backend: Reorder flush/pdiscard function definitions backup: don't acquire aio_context in backup_clean replication: assert we own context before job_cancel_sync job: take each job's lock individually in job_txn_apply Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-04-07Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2020-04-07' ↵Peter Maydell13-67/+224
into staging Block patches for 5.0-rc2: - Fix double QLIST_REMOVE() and potential request object leak in xen-block - Prevent a potential assertion failure in qcow2's code for compressed clusters by rejecting invalid (unaligned) requests with -EIO - Prevent discards on qcow2 v2 images from making backing data reappear - Make qemu-img convert report I/O error locations by byte offsets consistently - Fix for potential I/O test errors (accidental globbing due to missing quotes) # gpg: Signature made Tue 07 Apr 2020 13:30:01 BST # gpg: using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40 # gpg: issuer "mreitz@redhat.com" # gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full] # Primary key fingerprint: 91BE B60A 30DB 3E88 57D1 1829 F407 DB00 61D5 CF40 * remotes/maxreitz/tags/pull-block-2020-04-07: xen-block: Fix double qlist remove and request leak iotests/common.pattern: Quote echos qcow2: Check request size in qcow2_co_pwritev_compressed_part() qemu-img: Report convert errors by bytes, not sectors qcow2: Forbid discard in qcow2 v2 images with backing files Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-04-07Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2020-04-07' into ↵Peter Maydell1-1/+1
staging QAPI patches for 2020-04-07 # gpg: Signature made Tue 07 Apr 2020 12:43:38 BST # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qapi-2020-04-07: json: Fix check for unbalanced right curly brace Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-04-07Merge remote-tracking branch ↵Peter Maydell4-6/+13
'remotes/philmd-gitlab/tags/acceptance-fixes-20200407' into staging Acceptance tests patches - Fixed EXEC migration - Reduce PReP/40p artifacts download failures, - Disable Leon3 HelenOS - Speed up Travis-CI job by using a specific cache bucket CI jobs results: https://gitlab.com/philmd/qemu/pipelines/133379305 https://travis-ci.org/github/philmd/qemu/builds/671762970 # gpg: Signature made Tue 07 Apr 2020 11:37:57 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd-gitlab/tags/acceptance-fixes-20200407: .travis.yml: Cache acceptance-test assets tests/acceptance/machine_sparc_leon3: Disable HelenOS test tests/acceptance/ppc_prep_40p: Use mirror for ftp.software.ibm.com tests/acceptance/ppc_prep_40p: Use cdn.netbsd.org hostname Acceptance test: Fix to EXEC migration Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-04-07vpc: Don't round up already aligned BAT sizesKevin Wolf1-1/+1
As reported on Launchpad, Azure apparently doesn't accept images for upload that are not both aligned to 1 MB blocks and have a BAT size that matches the image size exactly. As far as I can tell, there is no real reason why we create a BAT that is one entry longer than necessary for aligned image sizes, so change that. (Even though the condition is only mentioned as "should" in the spec and previous products accepted larger BATs - but we'll try to maintain compatibility with as many of Microsoft's ever-changing interpretations of the VHD spec as possible.) Fixes: https://bugs.launchpad.net/bugs/1870098 Reported-by: Tobias Witek Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20200402093603.2369-1-kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2020-04-07block: Fix blk->in_flight during blk_wait_while_drained()Kevin Wolf1-12/+5
Waiting in blk_wait_while_drained() while blk->in_flight is increased for the current request is wrong because it will cause the drain operation to deadlock. This patch makes sure that blk_wait_while_drained() is called with blk->in_flight increased exactly once for the current request, and that it temporarily decreases the counter while it waits. Fixes: cf3129323f900ef5ddbccbe86e4fa801e88c566e Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-Id: <20200407121259.21350-4-kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2020-04-07block: Increase BB.in_flight for coroutine and sync interfacesKevin Wolf2-24/+80
External callers of blk_co_*() and of the synchronous blk_*() functions don't currently increase the BlockBackend.in_flight counter, but calls from blk_aio_*() do, so there is an inconsistency whether the counter has been increased or not. This patch moves the actual operations to static functions that can later know they will always be called with in_flight increased exactly once, even for external callers using the blk_co_*() coroutine interfaces. If the public blk_co_*() interface is unused, remove it. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20200407121259.21350-3-kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2020-04-07block-backend: Reorder flush/pdiscard function definitionsKevin Wolf1-46/+46
Move all variants of the flush/pdiscard functions to a single place and put the blk_co_*() version first because it is called by all other variants (and will become static in the next patch). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-Id: <20200407121259.21350-2-kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2020-04-07Merge remote-tracking branch ↵Peter Maydell3-20/+38
'remotes/kraxel/tags/fixes-20200407-pull-request' into staging fixes for 5.0: - audio: windows (dsound) fixes. - vga: ati blitter sanity check fixes. # gpg: Signature made Tue 07 Apr 2020 10:21:44 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-20200407-pull-request: ati-vga: Fix checks in ati_2d_blt() to avoid crash dsoundaudio: dsound_get_buffer_in should honor *size dsoundaudio: fix "Could not lock capture buffer" warning dsoundaudio: fix never-ending playback loop Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-04-07backup: don't acquire aio_context in backup_cleanStefan Reiter1-4/+0
All code-paths leading to backup_clean (via job_clean) have the job's context already acquired. The job's context is guaranteed to be the same as the one used by backup_top via backup_job_create. Since the previous logic effectively acquired the lock twice, this broke cleanup of backups for disks using IO threads, since the BDRV_POLL_WHILE in bdrv_backup_top_drop -> bdrv_do_drained_begin would only release the lock once, thus deadlocking with the IO thread. This is a partial revert of 0abf2581717a19. Signed-off-by: Stefan Reiter <s.reiter@proxmox.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-Id: <20200407115651.69472-4-s.reiter@proxmox.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2020-04-07replication: assert we own context before job_cancel_syncStefan Reiter1-1/+4
job_cancel_sync requires the job's lock to be held, all other callers already do this (replication_stop, drive_backup_abort, blockdev_backup_abort, job_cancel_sync_all, cancel_common). In this case we're in a BlockDriver handler, so we already have a lock, just assert that it is the same as the one used for the commit_job. Signed-off-by: Stefan Reiter <s.reiter@proxmox.com> Message-Id: <20200407115651.69472-3-s.reiter@proxmox.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2020-04-07job: take each job's lock individually in job_txn_applyStefan Reiter4-10/+60
All callers of job_txn_apply hold a single job's lock, but different jobs within a transaction can have different contexts, thus we need to lock each one individually before applying the callback function. Similar to job_completed_txn_abort this also requires releasing the caller's context before and reacquiring it after to avoid recursive locks which might break AIO_WAIT_WHILE in the callback. This is safe, since existing code would already have to take this into account, lest job_completed_txn_abort might have broken. This also brings to light a different issue: When a callback function in job_txn_apply moves it's job to a different AIO context, callers will try to release the wrong lock (now that we re-acquire the lock correctly, previously it would just continue with the old lock, leaving the job unlocked for the rest of the return path). Fix this by not caching the job's context. This is only necessary for qmp_block_job_finalize, qmp_job_finalize and job_exit, since everyone else calls through job_exit. One test needed adapting, since it calls job_finalize directly, so it manually needs to acquire the correct context. Signed-off-by: Stefan Reiter <s.reiter@proxmox.com> Message-Id: <20200407115651.69472-2-s.reiter@proxmox.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2020-04-07xen-block: Fix double qlist remove and request leakAnthony PERARD1-32/+16
Commit a31ca6801c02 ("qemu/queue.h: clear linked list pointers on remove") revealed that a request was removed twice from a list, once in xen_block_finish_request() and a second time in xen_block_release_request() when both function are called from xen_block_complete_aio(). But also, the `requests_inflight' counter is decreased twice, and thus became negative. This is a bug that was introduced in bfd0d6366043 ("xen-block: improve response latency"), where a `finished' list was removed. That commit also introduced a leak of request in xen_block_do_aio(). That function calls xen_block_finish_request() but the request is never released after that. To fix both issue, we do two changes: - we squash finish_request() and release_request() together as we want to remove a request from 'inflight' list to add it to 'freelist'. - before releasing a request, we need to let the other end know the result, thus we should call xen_block_send_response() before releasing a request. The first change fixes the double QLIST_REMOVE() as we remove the extra call. The second change makes the leak go away because if we want to call finish_request(), we need to call a function that does all of finish, send response, and release. Fixes: bfd0d6366043 ("xen-block: improve response latency") Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Message-Id: <20200406140217.1441858-1-anthony.perard@citrix.com> Reviewed-by: Paul Durrant <paul@xen.org> [mreitz: Amended commit message as per Paul's suggestions] Signed-off-by: Max Reitz <mreitz@redhat.com>
2020-04-07iotests/common.pattern: Quote echosMax Reitz1-11/+11
From time to time, my shell decides to repace the bracketed numbers here by the numbers inside (i.e., "=== Clusters to be compressed [1]" is printed as "=== Clusters to be compressed 1"). That makes tests that use common.pattern fail. Prevent that from happening by quoting the arguments to all echos in common.pattern. Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20200403101134.805871-1-mreitz@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2020-04-07qcow2: Check request size in qcow2_co_pwritev_compressed_part()Alberto Garcia1-0/+5
When issuing a compressed write request the number of bytes must be a multiple of the cluster size or reach the end of the last cluster. With the current code such requests are allowed and we hit an assertion: $ qemu-img create -f qcow2 img.qcow2 1M $ qemu-io -c 'write -c 0 32k' img.qcow2 qemu-io: block/qcow2.c:4257: qcow2_co_pwritev_compressed_task: Assertion `bytes == s->cluster_size || (bytes < s->cluster_size && (offset + bytes == bs->total_sectors << BDRV_SECTOR_BITS))' failed. Aborted This patch fixes a regression introduced in 0d483dce38 Signed-off-by: Alberto Garcia <berto@igalia.com> Message-Id: <20200406143401.26854-1-berto@igalia.com> Reviewed-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2020-04-07qemu-img: Report convert errors by bytes, not sectorsEric Blake2-5/+5
Various qemu-img commands are inconsistent on whether they report status/errors in terms of bytes or sector offsets. The latter is confusing (especially as more places move to 4k block sizes), so let's switch everything to just use bytes everywhere. One iotest is impacted. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20200402135717.476398-1-eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2020-04-07qcow2: Forbid discard in qcow2 v2 images with backing filesAlberto Garcia9-19/+187
A discard request deallocates the selected clusters so they read back as zeroes. This is done by clearing the cluster offset field and setting QCOW_OFLAG_ZERO in the L2 entry. This flag is however only supported when qcow_version >= 3. In older images the cluster is simply deallocated, exposing any possible stale data from the backing file. Since discard is an advisory operation it's safer to simply forbid it in this scenario. Note that we are adding this check to qcow2_co_pdiscard() and not to qcow2_cluster_discard() or discard_in_l2_slice() because the last two are also used by qcow2_snapshot_create() to discard the clusters used by the VM state. In this case there's no risk of exposing stale data to the guest and we really want that the clusters are always discarded. Signed-off-by: Alberto Garcia <berto@igalia.com> Message-Id: <20200331114345.29993-1-berto@igalia.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2020-04-07json: Fix check for unbalanced right curly braceSimran Singhal1-1/+1
We immediately diagnose unbalanced right curly brace: $ qemu-kvm --nodefaults --nographic --qmp stdio {"QMP": {"version": {"qemu": {"micro": 91, "minor": 2, "major": 4}, "package": "v5.0.0-rc1-1-gf6ce4a439a08"}, "capabilities": ["oob"]}} } {"error": {"class": "GenericError", "desc": "JSON parse error, expecting value"}} except within square bracket: [} The check for unbalanced braces has a typo. Fix it. Fixes: 8d3265b3d00db1071d1d3bf8433b4818088fdeb5 Signed-off-by: Simran Singhal <singhalsimran0@gmail.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <20200402182848.GA3023@simran-Inspiron-5558> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Commit message rewritten to explain what's broken] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2020-04-07Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-5.0-20200407' ↵Peter Maydell15-26/+148
into staging ppc patch queue 2020-04-07 An assortment of fixes for qemu-5.0, including a number for the FWNMI feature which is new this release. # gpg: Signature made Tue 07 Apr 2020 05:35:10 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-5.0-20200407: ppc/pnv: Create BMC devices only when defaults are enabled pseries: Update SLOF firmware image hw/ppc/ppc440_uc.c: Remove incorrect iothread locking from dcr_write_pcie() spapr: Fix failure path for attempting to hot unplug PCI bridges ppc/spapr: Don't kill the guest if a recovered FWNMI machine check delivery fails ppc/spapr: Add FWNMI machine check delivery warnings ppc/spapr: Improve FWNMI machine check delivery corner case comments ppc/spapr: KVM FWNMI should not be enabled until guest requests it vfio/spapr: Fix page size calculation hw/ppc/e500.c: Handle qemu_find_file() failure Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-04-07ati-vga: Fix checks in ati_2d_blt() to avoid crashBALATON Zoltan1-11/+26
In some corner cases (that never happen during normal operation but a malicious guest could program wrong values) pixman functions were called with parameters that result in a crash. Fix this and add more checks to disallow such cases. Reported-by: Ziming Zhang <ezrakiez@gmail.com> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 20200406204029.19559747D5D@zero.eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-04-07ppc/pnv: Create BMC devices only when defaults are enabledCédric Le Goater3-5/+74
Commit e2392d4395dd ("ppc/pnv: Create BMC devices at machine init") introduced default BMC devices which can be a problem when the same devices are defined on the command line with : -device ipmi-bmc-sim,id=bmc0 -device isa-ipmi-bt,bmc=bmc0,irq=10 QEMU fails with : qemu-system-ppc64: error creating device tree: node: FDT_ERR_EXISTS Use defaults_enabled() when creating the default BMC devices to let the user provide its own BMC devices using '-nodefaults'. If no BMC device are provided, output a warning but let QEMU run as this is a supported configuration. However, when multiple BMC devices are defined, stop QEMU with a clear error as the results are unexpected. Fixes: e2392d4395dd ("ppc/pnv: Create BMC devices at machine init") Reported-by: Nathan Chancellor <natechancellor@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20200404153655.166834-1-clg@kaod.org> Tested-by: Nathan Chancellor <natechancellor@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-04-07pseries: Update SLOF firmware imageAlexey Kardashevskiy3-1/+1
This is a single regression fix for for 5.0: Greg Kurz (1): slof: Only close stdout for virtio-serial devices Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-04-07hw/ppc/ppc440_uc.c: Remove incorrect iothread locking from dcr_write_pcie()Peter Maydell1-3/+0
In dcr_write_pcie() we take the iothread lock around a call to pcie_host_mmcfg_udpate(). This is an incorrect attempt to deal with the bug fixed in commit 235352ee6e73d7716, where we were not taking the iothread lock before calling device dcr read/write functions. (It's not sufficient locking, because although the other cases in the switch statement won't assert, there is no locking which prevents multiple guest CPUs from trying to access the PPC460EXPCIEState struct at the same time and corrupting data.) Unfortunately with commit 235352ee6e73d7716 we are now trying to recursively take the iothread lock, which will assert: $ qemu-system-ppc -M sam460ex --display none ** ERROR:/home/petmay01/linaro/qemu-from-laptop/qemu/cpus.c:1830:qemu_mutex_lock_iothread_impl: assertion failed: (!qemu_mutex_iothread_locked()) Aborted (core dumped) Remove the locking within dcr_write_pcie(). Fixes: 235352ee6e73d7716 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20200330125228.24994-1-peter.maydell@linaro.org> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-04-07spapr: Fix failure path for attempting to hot unplug PCI bridgesDavid Gibson1-0/+1
For various technical reasons we can't currently allow unplug a PCI to PCI bridge on the pseries machine. spapr_pci_unplug_request() correctly generates an error message if that's attempted. But.. if the given errp is not error_abort or error_fatal, it doesn't actually stop trying to unplug the bridge anyway. Fixes: 14e714900f6b "spapr: Allow hot plug/unplug of PCI bridges and devices under PCI bridges" Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Greg Kurz <groug@kaod.org>
2020-04-07ppc/spapr: Don't kill the guest if a recovered FWNMI machine check delivery ↵Nicholas Piggin1-5/+25
fails Try to be tolerant of FWNMI delivery errors if the machine check had been recovered by the host. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20200325142906.221248-5-npiggin@gmail.com> Reviewed-by: Greg Kurz <groug@kaod.org> [dwg: Updated comment at Greg's suggestion] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-04-07ppc/spapr: Add FWNMI machine check delivery warningsNicholas Piggin2-0/+7
Add some messages which explain problems and guest misbehaviour that may be difficult to diagnose in rare cases of machine checks. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20200325142906.221248-4-npiggin@gmail.com> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-04-07ppc/spapr: Improve FWNMI machine check delivery corner case commentsNicholas Piggin1-8/+11
Some of the conditions are not as clearly documented as they could be. Also the non-FWNMI case does not need a large comment. Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20200325142906.221248-3-npiggin@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-04-07ppc/spapr: KVM FWNMI should not be enabled until guest requests itNicholas Piggin4-3/+24
The KVM FWNMI capability should be enabled with the "ibm,nmi-register" rtas call. Although MCEs from KVM will be delivered as architected interrupts to the guest before "ibm,nmi-register" is called, KVM has different behaviour depending on whether the guest has enabled FWNMI (it attempts to do more recovery on behalf of a non-FWNMI guest). Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20200325142906.221248-2-npiggin@gmail.com> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-04-07vfio/spapr: Fix page size calculationAlexey Kardashevskiy1-3/+3
Coverity detected an issue (CID 1421903) with potential call of clz64(0) which returns 64 which make it do "<<" with a negative number. This checks the mask and avoids undefined behaviour. In practice pgsizes and memory_region_iommu_get_min_page_size() always have some common page sizes and even if they did not, the resulting page size would be 0x8000.0000.0000.0000 (gcc 9.2) and ioctl(VFIO_IOMMU_SPAPR_TCE_CREATE) would fail anyway. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Message-Id: <20200324063912.25063-1-aik@ozlabs.ru> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-04-07hw/ppc/e500.c: Handle qemu_find_file() failurePeter Maydell1-0/+4
If qemu_find_file() doesn't find the BIOS it returns NULL; we were passing that unchecked through to load_elf(), which assumes a non-NULL pointer and may misbehave. In practice it fails with a weird message: $ qemu-system-ppc -M ppce500 -display none -kernel nonesuch Bad address qemu-system-ppc: could not load firmware '(null)' Handle the failure case better: $ qemu-system-ppc -M ppce500 -display none -kernel nonesuch qemu-system-ppc: could not find firmware/kernel file 'nonesuch' Spotted by Coverity (CID 1238954). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20200324121216.23899-1-peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-04-06.travis.yml: Cache acceptance-test assetsPhilippe Mathieu-Daudé1-0/+2
Keep all acceptance-test assets in the same cache bucket. As of v5.0.0-rc1, the cache is 2610.11MB: https://travis-ci.org/github/philmd/qemu/jobs/670558103 Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Acked-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20200403172919.24621-6-philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-04-06tests/acceptance/machine_sparc_leon3: Disable HelenOS testPhilippe Mathieu-Daudé1-0/+4
This test was written/tested around beginning of 2019, but was extracted from a bigger series and posted end of June 2019 [*]. Unfortunately I did not notice commit 162abf1a8 was merged by then, which implements the AHB and APB plug and play devices. HelenOS 0.6 is expecting the PnP registers to be not implemented by QEMU, then forces the discovered AMBA devices (see [2]). Before 162abf1a8, the console was displaying: HelenOS bootloader, release 0.6.0 (Elastic Horse) Built on 2014-12-21 20:17:42 for sparc32 Copyright (c) 2001-2014 HelenOS project 0x4000bf20|0x4000bf20: kernel image (496640/128466 bytes) 0x4002b4f2|0x4002b4f2: ns image (154195/66444 bytes) 0x4003b87e|0x4003b87e: loader image (153182/66437 bytes) 0x4004bc03|0x4004bc03: init image (155339/66834 bytes) 0x4005c115|0x4005c115: locsrv image (162063/70267 bytes) 0x4006d390|0x4006d390: rd image (152678/65889 bytes) 0x4007d4f1|0x4007d4f1: vfs image (168480/73394 bytes) 0x4008f3a3|0x4008f3a3: logger image (158034/68368 bytes) 0x4009feb3|0x4009feb3: ext4fs image (234510/100301 bytes) 0x400b8680|0x400b8680: initrd image (8388608/1668901 bytes) ABMA devices: <1:00c> at 0x80000100 irq 3 <1:00d> at 0x80000200 <1:011> at 0x80000300 irq 8 Memory size: 64 MB As of this commit, it is now confused: ABMA devices: <1:3000> at 0x00000000 irq 0 <1:3000> at 0x00000000 irq 0 <1:3000> at 0x00000000 irq 0 <1:3000> at 0x00000000 irq 0 <1:3000> at 0x00000000 irq 0 <1:3000> at 0x00000000 irq 0 <1:3000> at 0x00000000 irq 0 ... As this test is not working as expected, simply disable it (by skipping it) for now. [1] https://www.mail-archive.com/qemu-devel@nongnu.org/msg627094.html [2] https://github.com/HelenOS/helenos/blob/0.6.0/boot/arch/sparc32/src/ambapp.c#L75 Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200331105048.27989-2-f4bug@amsat.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-04-06tests/acceptance/ppc_prep_40p: Use mirror for ftp.software.ibm.comPhilippe Mathieu-Daudé1-1/+2
To avoid regular failures on Travis-CI with ftp.software.ibm.com, use a mirror. Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Tested-by: Willian Rampazzo <willianr@gmail.com> Reviewed-by: Willian Rampazzo <willianr@gmail.com> Message-Id: <20200403172919.24621-4-philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-04-06tests/acceptance/ppc_prep_40p: Use cdn.netbsd.org hostnamePhilippe Mathieu-Daudé1-2/+2
Use NetBSD content delivery network to get faster downloads. Suggested-by: Kamil Rytarowski <kamil@netbsd.org> Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Message-Id: <20200211134504.9156-1-philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-04-06Acceptance test: Fix to EXEC migrationOksana Vohchana1-3/+3
The exec migration test isn't run a whole test scenario. This patch fixes it Fixes: 2e768cb682bf Signed-off-by: Oksana Vohchana <ovoshcha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Message-Id: <20200325113138.20337-1-ovoshcha@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-04-06Merge remote-tracking branch ↵Peter Maydell6-44/+69
'remotes/pmaydell/tags/pull-target-arm-20200406' into staging target-arm queue: * don't expose "ieee_half" via gdbstub (prevents gdb crashes or errors with older GDB versions) * hw/arm/collie: Put StrongARMState* into a CollieMachineState struct * PSTATE.PAN should not clear exec bits * hw/gpio/aspeed_gpio.c: Don't directly include assert.h (fixes compilation on some Windows build scenarios) * dump: Fix writing of ELF section * dma/xlnx-zdma: various bug fixes * target/arm/helperc. delete obsolete TODO comment # gpg: Signature made Mon 06 Apr 2020 11:04:01 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20200406: dma/xlnx-zdma: Reorg to fix CUR_DSCR dma/xlnx-zdma: Advance the descriptor address when stopping dma/xlnx-zdma: Clear DMA_DONE when halting dma/xlnx-zdma: Populate DBG0.CMN_BUF_FREE dma/xlnx-zdma: Remove comment dump: Fix writing of ELF section hw/gpio/aspeed_gpio.c: Don't directly include assert.h target/arm: Remove obsolete TODO note from get_phys_addr_lpae() target/arm: PSTATE.PAN should not clear exec bits hw/arm/collie: Put StrongARMState* into a CollieMachineState struct target/arm: don't expose "ieee_half" via gdbstub Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-04-06dsoundaudio: dsound_get_buffer_in should honor *sizeVolker Rümelin2-8/+6
This patch prevents an underflow of variable samples in function audio_pcm_hw_run_in(). See commit 599eac4e5a "audio: audio_generic_get_buffer_in should honor *size". This time the while loop in audio_pcm_hw_run_in() will terminate nevertheless, because it seems the recording stream in Windows is always rate limited. Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-id: 20200405075017.9901-3-vr_qemu@t-online.de Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-04-06dsoundaudio: fix "Could not lock capture buffer" warningVolker Rümelin1-0/+5
IDirectSoundCaptureBuffer_Lock() fails on Windows when called with len = 0. Return early from dsound_get_buffer_in() in this case. To reproduce the warning start a linux guest. In the guest start Audacity and you will see a lot of "Could not lock capture buffer" warnings. Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-id: 20200405075017.9901-2-vr_qemu@t-online.de Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-04-06dsoundaudio: fix never-ending playback loopVolker Rümelin1-1/+1
Currently the DirectSound backend fails to stop audio playback in dsound_enable_out(). To detect a lost buffer condition dsound_get_status_out() incorrectly uses the error code DSERR_BUFFERLOST instead of flag DSBSTATUS_BUFFERLOST as a mask and returns with an error. As a result dsound_enable_out() returns early and doesn't stop playback. To reproduce the bug start qemu on a Windows host with -soundhw pcspk -audiodev dsound,id=audio0. On the guest FreeDOS 1.2 command line enter beep. The image Day 1 - F-Bird from the QEMU Advent Calendar 2018 shows the bug as well. Buglink: https://bugs.launchpad.net/qemu/+bug/1699628 Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-id: 20200405075017.9901-1-vr_qemu@t-online.de Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-04-06dma/xlnx-zdma: Reorg to fix CUR_DSCREdgar E. Iglesias1-25/+22
Reorganize the descriptor handling so that CUR_DSCR always points to the next descriptor to be processed. Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-id: 20200402134721.27863-6-edgar.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-04-06dma/xlnx-zdma: Advance the descriptor address when stoppingEdgar E. Iglesias1-1/+0
Advance the descriptor address when stopping the channel. Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200402134721.27863-5-edgar.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-04-06dma/xlnx-zdma: Clear DMA_DONE when haltingEdgar E. Iglesias1-0/+1
Clear DMA_DONE when halting the DMA channel. Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200402134721.27863-4-edgar.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-04-06dma/xlnx-zdma: Populate DBG0.CMN_BUF_FREEEdgar E. Iglesias1-0/+6
Populate DBG0.CMN_BUF_FREE so that SW can see some free space. Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-id: 20200402134721.27863-3-edgar.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-04-06dma/xlnx-zdma: Remove commentEdgar E. Iglesias1-1/+0
Remove comment. Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-id: 20200402134721.27863-2-edgar.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-04-05Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2020-04-04' ↵Peter Maydell4-3/+61
into staging Error reporting patches for 2020-04-04 # gpg: Signature made Sat 04 Apr 2020 13:19:40 BST # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-error-2020-04-04: qga/commands-posix: fix use after free of local_err dump/win_dump: fix use after free of err scripts/coccinelle: add error-use-after-free.cocci Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-04-04qga/commands-posix: fix use after free of local_errVladimir Sementsov-Ogievskiy1-0/+3
local_err is used several times in guest_suspend(). Setting non-NULL local_err will crash, so let's zero it after freeing. Also fix possible leak of local_err in final if(). Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20200324153630.11882-7-vsementsov@virtuozzo.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2020-04-04dump/win_dump: fix use after free of errVladimir Sementsov-Ogievskiy1-3/+1
It's possible that we'll try to set err twice (or more). It's bad, it will crash. Instead, use warn_report(). Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20200324153630.11882-4-vsementsov@virtuozzo.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2020-04-04scripts/coccinelle: add error-use-after-free.cocciVladimir Sementsov-Ogievskiy2-0/+57
Add script to find and fix trivial use-after-free of Error objects. How to use: spatch --sp-file scripts/coccinelle/error-use-after-free.cocci \ --macro-file scripts/cocci-macro-file.h --in-place \ --no-show-diff ( FILES... | --use-gitgrep . ) Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20200324153630.11882-2-vsementsov@virtuozzo.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Pastos in commit message and comment fixed, globbing in MAINTAINERS expanded] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2020-04-03dump: Fix writing of ELF sectionPeter Maydell1-1/+1
In write_elf_section() we set the 'shdr' pointer to point to local structures shdr32 or shdr64, which we fill in to be written out to the ELF dump. Unfortunately the address we pass to fd_write_vmcore() has a spurious '&' operator, so instead of writing out the section header we write out the literal pointer value followed by whatever is on the stack after the 'shdr' local variable. Pass the correct address into fd_write_vmcore(). Spotted by Coverity: CID 1421970. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200324173630.12221-1-peter.maydell@linaro.org
2020-04-03hw/gpio/aspeed_gpio.c: Don't directly include assert.hPeter Maydell1-2/+0
Remove a direct include of assert.h -- this is already provided by qemu/osdep.h, and it breaks our rule that the first include must always be osdep.h. In particular we must get the assert() macro via osdep.h to avoid compile failures on mingw (see the comment in osdep.h where we redefine assert() for that platform). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-id: 20200403124712.24826-1-peter.maydell@linaro.org
generated by cgit v1.1 at 2025-02-13 06:44:59 +0000