aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2018-08-15block: Remove deprecated -drive option serialKevin Wolf14-48/+8
This reinstates commit b0083267444a5e0f28391f6c2831a539f878d424, which was temporarily reverted for the 3.0 release so that libvirt gets some extra time to update their command lines. The -drive option serial was deprecated in QEMU 2.10. It's time to remove it. Tests need to be updated to set the serial number with -global instead of using the -drive option. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com>
2018-08-15block: Remove deprecated -drive option addrKevin Wolf5-30/+2
This reinstates commit eae3bd1eb7c6b105d30ec06008b3bc3dfc5f45bb, which was temporarily reverted for the 3.0 release so that libvirt gets some extra time to update their command lines. The -drive option addr was deprecated in QEMU 2.10. It's time to remove it. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com>
2018-08-15block: Remove deprecated -drive geometry optionsKevin Wolf7-131/+9
This reinstates commit a7aff6dd10b16b67e8b142d0c94c5d92c3fe88f6, which was temporarily reverted for the 3.0 release so that libvirt gets some extra time to update their command lines. The -drive options cyls, heads, secs and trans were deprecated in QEMU 2.10. It's time to remove them. hd-geo-test tested both the old version with geometry options in -drive and the new one with -device. Therefore the code using -drive doesn't have to be replaced there, we just need to remove the -drive test cases. This in turn allows some simplification of the code. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
2018-08-15luks: Allow share-rw=onFam Zheng1-1/+3
Format drivers such as qcow2 don't allow sharing the same image between two QEMU instances in order to prevent image corruptions, because of metadata cache. LUKS driver don't modify metadata except for when creating image, so it is safe to relax the permission. This makes share-rw=on property work on virtual devices. Suggested-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-08-15throttle-groups: Don't allow timers without throttled requestsAlberto Garcia1-10/+22
Commit 6fccbb475bc6effc313ee9481726a1748b6dae57 fixed a bug caused by QEMU attempting to remove a throttle group member with no pending requests but an active timer set. This was the result of a previous bdrv_drained_begin() call processing the throttled requests but leaving the timer untouched. Although the commit does solve the problem, the situation shouldn't happen in the first place. If we try to drain a throttle group member which has a timer set, we should cancel the timer instead of ignoring it. Signed-off-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-08-15qemu-iotests: Update 093 to improve the draining testAlberto Garcia1-8/+11
The previous patch fixes a problem in which draining a block device with more than one throttled request can make it wait first for the completion of requests in other members of the same group. This patch updates test_remove_group_member() in iotest 093 to reproduce that scenario. This updated test would hang QEMU without the fix from the previous patch. Signed-off-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-08-15throttle-groups: Skip the round-robin if a member is being drainedAlberto Garcia1-0/+9
In the throttling code after an I/O request has been completed the next one is selected from a different member using a round-robin algorithm. This ensures that all members get a chance to finish their pending I/O requests. However, if a group member has its I/O limits disabled (because it's being drained) then we should always give it priority in order to have all its pending requests finished as soon as possible. If we don't do this we could have a member in the process of being drained waiting for the throttled requests of other members, for which the I/O limits still apply. This can have additional consequences: if we're running in qtest mode (with QEMU_CLOCK_VIRTUAL) then timers can only fire if we advance the clock manually, so attempting to drain a block device can hang QEMU in the BDRV_POLL_WHILE() loop at the end of bdrv_do_drained_begin(). Signed-off-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-08-15qemu-iotests: Test removing a throttle group member with a pending timerAlberto Garcia2-2/+54
A throttle group can have several members, and each one of them can have several pending requests in the queue. The requests are processed in a round-robin fashion, so the algorithm decides the drive that is going to run the next request and sets a timer in it. Once the timer fires and the throttled request is run then the next drive from the group is selected and a new timer is set. If the user tried to remove a drive from a group and that drive had a timer set then the code was not taking care of setting up a new timer in one of the remaining members of the group, freezing their I/O. This problem was fixed in 6fccbb475bc6effc313ee9481726a1748b6dae57, and this patch adds a new test case that reproduces this exact scenario. Signed-off-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-08-15block/qapi: Fix memory leak in qmp_query_blockstats()Kevin Wolf1-1/+2
For BlockBackends that are skipped in query-blockstats, we would leak info since commit 567dcb31. Allocate info only later to avoid the memory leak. Fixes: CID 1394727 Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com>
2018-08-14Update version for v3.0.0 releasev3.0.0Peter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-07Update version for v3.0.0-rc4 releasev3.0.0-rc4Peter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-07virtio-gpu: fix crashes upon warm reboot with vga modeMarc-André Lureau3-0/+17
With vga=775 on the Linux command line a first boot of the VM running Linux works fine. After a warm reboot it crashes during Linux boot. Before that, valgrind points out bad memory write to console surface. The VGA code is not aware that virtio-gpu got a message surface scanout when the display is disabled. Let's reset VGA graphic mode when it is the case, so that a new display surface is created when doing further VGA operations. https://bugs.launchpad.net/qemu/+bug/1784900/ Reported-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Message-id: 20180803153235.4134-1-marcandre.lureau@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-07slirp: Correct size check in m_inc()Peter Maydell1-1/+1
The data in an mbuf buffer is not necessarily at the start of the allocated buffer. (For instance m_adj() allows data to be trimmed from the start by just advancing the pointer and reducing the length.) This means that the allocated buffer size (m->m_size) and the amount of space from the m_data pointer to the end of the buffer (M_ROOM(m)) are not necessarily the same. Commit 864036e251f54c9 tried to change the m_inc() function from taking the new allocated-buffer-size to taking the new room-size, but forgot to change the initial "do we already have enough space" check. This meant that if we were trying to extend a buffer which had a leading gap between the buffer start and the data, we might incorrectly decide it didn't need to be extended, and then overrun the end of the buffer, causing memory corruption and an eventual crash. Change the "already big enough?" condition from checking the argument against m->m_size to checking against M_ROOM(). This only makes a difference for the callsite in m_cat(); the other three callsites all start with a freshly allocated mbuf from m_get(), which will have m->m_size == M_ROOM(m). Fixes: 864036e251f54c9 Fixes: https://bugs.launchpad.net/qemu/+bug/1785670 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Message-id: 20180807114501.12370-1-peter.maydell@linaro.org Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2018-08-06target/xtensa/cpu: Set owner of memory region in xtensa_cpu_initfnThomas Huth1-1/+1
The instance_init function of the xtensa CPUs creates a memory region, but does not set an owner, so the memory region is not destroyed correctly when the CPU object is removed. This can happen when introspecting the CPU devices, so introspecting the CPU device will leave a dangling memory region object in the QOM tree. Make sure to set the right owner here to fix this issue. Signed-off-by: Thomas Huth <thuth@redhat.com> Acked-by: Max Filippov <jcmvbkbc@gmail.com> Message-id: 1532005320-17794-1-git-send-email-thuth@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-06hw/intc/arm_gicv3_common: Move gicd shift bug handling to gicv3_post_loadPeter Maydell1-40/+37
The code currently in gicv3_gicd_no_migration_shift_bug_post_load() that handles migration from older QEMU versions with a particular bug is misplaced. We need to run this after migration in all cases, not just the cases where the "arm_gicv3/gicd_no_migration_shift_bug" subsection is present, so it must go in a post_load hook for the top level VMSD, not for the subsection. Move it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20180806123445.1459-6-peter.maydell@linaro.org
2018-08-06hw/intc/arm_gicv3_common: Move post_load hooks to top-level VMSDPeter Maydell1-4/+4
Contrary to the the impression given in docs/devel/migration.rst, the migration code does not run the pre_load hook for a subsection unless the subsection appears on the wire, and so this is not a place where you can set the default value for state for the "subsection not present" case. Instead this needs to be done in a pre_load hook for whatever is the parent VMSD of the subsection. We got this wrong in two of the subsection definitions in the GICv3 migration structs; fix this. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20180806123445.1459-5-peter.maydell@linaro.org
2018-08-06target/arm: Add dummy needed functions to M profile vmstate subsectionsPeter Maydell1-0/+3
Currently the migration code incorrectly treats a subsection with no .needed function pointer as if it was the subsection list terminator -- it is ignored and so is everything after it. Work around this by giving various M profile vmstate structs a 'needed' function that always returns true. We reuse m_needed() for this, since it's always true here. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180806123445.1459-4-peter.maydell@linaro.org
2018-08-06hw/intc/arm_gicv3_common: Combine duplicate .subsections in vmstate_gicv3_cpuPeter Maydell1-3/+0
Commit 6692aac411199064 accidentally introduced a second initialization of the .subsections field of vmstate_gicv3_cpu, instead of adding the new subsection to the existing list. The effect of this was probably that migration of GICv3 with virtualization enabled was broken (or alternatively that migration of ICC_SRE_EL1 was broken, depending on which of the two initializers the compiler used). Combine the two into a single list. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180806123445.1459-3-peter.maydell@linaro.org
2018-08-06hw/intc/arm_gicv3_common: Give no-migration-shift-bug subsection a needed ↵Peter Maydell1-0/+6
function Currently the migration code incorrectly treats a subsection with no .needed function pointer as if it was the subsection list terminator -- it is ignored and so is everything after it. Work around this by giving vmstate_gicv3_gicd_no_migration_shift_bug a 'needed' function that always returns true. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180806123445.1459-2-peter.maydell@linaro.org
2018-08-06tcg/optimize: Do not skip default processing of dup_vecRichard Henderson1-2/+2
If we do not opimize away dup_vec, we must mark its output as changed. Fixes: 170ba88f45b Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com> Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com> Message-id: 20180805233258.31892-1-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-06Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-3.0-20180801' ↵Peter Maydell5-39/+22
into staging ppc patch queue for 2018-08-01 Here are a final couple of fixes for the 3.0 release. # gpg: Signature made Wed 01 Aug 2018 04:52:57 BST # gpg: using RSA key 6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-3.0-20180801: sam460ex: Fix PCI interrupts with multiple devices hw/misc/macio: Fix device introspection problems in macio devices Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-06Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell8-13/+19
pc, virtio: fixes A couple of last minute fixes. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Fri 03 Aug 2018 09:35:54 BST # gpg: using RSA key 281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: tests/acpi: update tables after memory hotplug changes pc: acpi: fix memory hotplug regression by reducing stub SRAT entry size tests/acpi-test: update ACPI tables test blobs hw/acpi-build: Add a check for memory-less NUMA nodes vhost: check region type before casting Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-03tests/acpi: update tables after memory hotplug changesMichael S. Tsirkin4-0/+0
Previous patch changes acpi tables, update expected files accordingly. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2018-08-03pc: acpi: fix memory hotplug regression by reducing stub SRAT entry sizeIgor Mammedov1-9/+10
Commit 848a1cc1e (hw/acpi-build: build SRAT memory affinity structures for DIMM devices) broke the first dimm hotplug in following cases: 1: there is no coldplugged dimm in the last numa node but there is a coldplugged dimm in another node -m 4096,slots=4,maxmem=32G \ -object memory-backend-ram,id=m0,size=2G \ -device pc-dimm,memdev=m0,node=0 \ -numa node,nodeid=0 \ -numa node,nodeid=1 2: if order of dimms on CLI is: 1st plugged dimm in node1 2nd plugged dimm in node0 -m 4096,slots=4,maxmem=32G \ -object memory-backend-ram,size=2G,id=m0 \ -device pc-dimm,memdev=m0,node=1 \ -object memory-backend-ram,id=m1,size=2G \ -device pc-dimm,memdev=m1,node=0 \ -numa node,nodeid=0 \ -numa node,nodeid=1 (qemu) object_add memory-backend-ram,id=m2,size=1G (qemu) device_add pc-dimm,memdev=m2,node=0 the first DIMM hotplug to any node except the last one fails (Windows is unable to online it). Length reduction of stub hotplug memory SRAT entry, fixes issue for some reason. RHBZ: 1609234 Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2018-08-03tests/acpi-test: update ACPI tables test blobsDou Liyang2-0/+0
Now, QEmu adds a new check for memory-less NUMA nodes in build_srat(). It effects the ACPI test. So, Update ACPI tables test blobs. Signed-off-by: Dou Liyang <douly.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2018-08-03hw/acpi-build: Add a check for memory-less NUMA nodesDou Liyang1-3/+6
Currently, Qemu ACPI builder doesn't consider the memory-less NUMA nodes, eg: -m 4G,slots=4,maxmem=8G \ -numa node,nodeid=0 \ -numa node,nodeid=1,mem=2G \ -numa node,nodeid=2,mem=2G \ -numa node,nodeid=3\ Guest Linux will report [ 0.000000] ACPI: SRAT: Node 0 PXM 0 [mem 0x00000000-0xffffffffffffffff] [ 0.000000] ACPI: SRAT: Node 1 PXM 1 [mem 0x00000000-0x0009ffff] [ 0.000000] ACPI: SRAT: Node 1 PXM 1 [mem 0x00100000-0x7fffffff] [ 0.000000] ACPI: SRAT: Node 2 PXM 2 [mem 0x80000000-0xbfffffff] [ 0.000000] ACPI: SRAT: Node 2 PXM 2 [mem 0x100000000-0x13fffffff] [ 0.000000] ACPI: SRAT: Node 3 PXM 3 [mem 0x140000000-0x13fffffff] [ 0.000000] ACPI: SRAT: Node 3 PXM 3 [mem 0x140000000-0x33fffffff] hotplug [mem 0x00000000-0xffffffffffffffff] and [mem 0x140000000-0x13fffffff] are bogus. Add a check to avoid building srat memory for memory-less NUMA nodes, also update the test file. Now the info in guest linux will be [ 0.000000] ACPI: SRAT: Node 1 PXM 1 [mem 0x00000000-0x0009ffff] [ 0.000000] ACPI: SRAT: Node 1 PXM 1 [mem 0x00100000-0x7fffffff] [ 0.000000] ACPI: SRAT: Node 2 PXM 2 [mem 0x80000000-0xbfffffff] [ 0.000000] ACPI: SRAT: Node 2 PXM 2 [mem 0x100000000-0x13fffffff] [ 0.000000] ACPI: SRAT: Node 3 PXM 3 [mem 0x140000000-0x33fffffff] hotplug Signed-off-by: Dou Liyang <douly.fnst@cn.fujitsu.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2018-08-03vhost: check region type before castingTiwei Bie1-1/+3
Check region type first before casting the memory region to IOMMUMemoryRegion. Otherwise QEMU will abort with below error message when casting non-IOMMU memory region: vhost_iommu_region_add: Object 0x561f28bce4f0 is not an instance of type qemu:iommu-memory-region Fixes: cb1efcf462a2 ("iommu: Add IOMMU index argument to notifier APIs") Cc: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Tiwei Bie <tiwei.bie@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2018-08-01sam460ex: Fix PCI interrupts with multiple devicesBALATON Zoltan2-17/+10
The four interrupts of the PCI bus are connected to the same UIC pin on the real Sam460ex. Evidence for this can be found in the UBoot source for the Sam460ex in the Sam460ex.c file where PCI_INTERRUPT_LINE is written. Change the ppc440_pcix model to behave more like this. This fixes the problem that can be observed when adding further PCI cards that got their interrupt rotated to other interrupts than PCI INT A. In particular, the bug was observed with an additional OHCI PCI card or an ES1370 sound device. Signed-off-by: Sebastian Bauer <mail@sebastianbauer.info> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Tested-by: Sebastian Bauer <mail@sebastianbauer.info> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-08-01hw/misc/macio: Fix device introspection problems in macio devicesThomas Huth3-22/+12
Valgrind reports an error when introspecting the macio devices, e.g.: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'macio-newworld'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q ppc64-softmmu/qemu-system-ppc64 -M none,accel=qtest -qmp stdio [...] ==30768== Invalid read of size 8 ==30768== at 0x5BC1EA: qdev_print (qdev-monitor.c:686) ==30768== by 0x5BC1EA: qbus_print (qdev-monitor.c:719) ==30768== by 0x43E458: handle_hmp_command (monitor.c:3446) [...] Use the new function sysbus_init_child_obj() to initialize the objects here, to get the reference counting of the objects right, so that they are cleaned up correctly when the parent gets removed. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-07-31Update version for v3.0.0-rc3 releasev3.0.0-rc3Peter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-31Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2018-07-31' ↵Peter Maydell1-1/+43
into staging Monitor patches for 2018-07-31 (3.0.0-rc3) # gpg: Signature made Tue 31 Jul 2018 16:46:16 BST # gpg: using RSA key 3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-monitor-2018-07-31: monitor: temporary fix for dead-lock on event recursion Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-31monitor: temporary fix for dead-lock on event recursionMarc-André Lureau1-1/+43
With a Spice port chardev, it is possible to reenter monitor_qapi_event_queue() (when the client disconnects for example). This will dead-lock on monitor_lock. Instead, use some TLS variables to check for recursion and queue the events. Fixes: (gdb) bt #0 0x00007fa69e7217fd in __lll_lock_wait () at /lib64/libpthread.so.0 #1 0x00007fa69e71acf4 in pthread_mutex_lock () at /lib64/libpthread.so.0 #2 0x0000563303567619 in qemu_mutex_lock_impl (mutex=0x563303d3e220 <monitor_lock>, file=0x5633036589a8 "/home/elmarco/src/qq/monitor.c", line=645) at /home/elmarco/src/qq/util/qemu-thread-posix.c:66 #3 0x0000563302fa6c25 in monitor_qapi_event_queue (event=QAPI_EVENT_SPICE_DISCONNECTED, qdict=0x56330602bde0, errp=0x7ffc6ab5e728) at /home/elmarco/src/qq/monitor.c:645 #4 0x0000563303549aca in qapi_event_send_spice_disconnected (server=0x563305afd630, client=0x563305745360, errp=0x563303d8d0f0 <error_abort>) at qapi/qapi-events-ui.c:149 #5 0x00005633033e600f in channel_event (event=3, info=0x5633061b0050) at /home/elmarco/src/qq/ui/spice-core.c:235 #6 0x00007fa69f6c86bb in reds_handle_channel_event (reds=<optimized out>, event=3, info=0x5633061b0050) at reds.c:316 #7 0x00007fa69f6b193b in main_dispatcher_self_handle_channel_event (info=0x5633061b0050, event=3, self=0x563304e088c0) at main-dispatcher.c:197 #8 0x00007fa69f6b193b in main_dispatcher_channel_event (self=0x563304e088c0, event=event@entry=3, info=0x5633061b0050) at main-dispatcher.c:197 #9 0x00007fa69f6d0833 in red_stream_push_channel_event (s=s@entry=0x563305ad8f50, event=event@entry=3) at red-stream.c:414 #10 0x00007fa69f6d086b in red_stream_free (s=0x563305ad8f50) at red-stream.c:388 #11 0x00007fa69f6b7ddc in red_channel_client_finalize (object=0x563304df2360) at red-channel-client.c:347 #12 0x00007fa6a56b7fb9 in g_object_unref () at /lib64/libgobject-2.0.so.0 #13 0x00007fa69f6ba212 in red_channel_client_push (rcc=0x563304df2360) at red-channel-client.c:1341 #14 0x00007fa69f68b259 in red_char_device_send_msg_to_client (client=<optimized out>, msg=0x5633059b6310, dev=0x563304e08bc0) at char-device.c:305 #15 0x00007fa69f68b259 in red_char_device_send_msg_to_clients (msg=0x5633059b6310, dev=0x563304e08bc0) at char-device.c:305 #16 0x00007fa69f68b259 in red_char_device_read_from_device (dev=0x563304e08bc0) at char-device.c:353 #17 0x000056330317d01d in spice_chr_write (chr=0x563304cafe20, buf=0x563304cc50b0 "{\"timestamp\": {\"seconds\": 1532944763, \"microseconds\": 326636}, \"event\": \"SHUTDOWN\", \"data\": {\"guest\": false}}\r\n", len=111) at /home/elmarco/src/qq/chardev/spice.c:199 #18 0x00005633034deee7 in qemu_chr_write_buffer (s=0x563304cafe20, buf=0x563304cc50b0 "{\"timestamp\": {\"seconds\": 1532944763, \"microseconds\": 326636}, \"event\": \"SHUTDOWN\", \"data\": {\"guest\": false}}\r\n", len=111, offset=0x7ffc6ab5ea70, write_all=false) at /home/elmarco/src/qq/chardev/char.c:112 #19 0x00005633034df054 in qemu_chr_write (s=0x563304cafe20, buf=0x563304cc50b0 "{\"timestamp\": {\"seconds\": 1532944763, \"microseconds\": 326636}, \"event\": \"SHUTDOWN\", \"data\": {\"guest\": false}}\r\n", len=111, write_all=false) at /home/elmarco/src/qq/chardev/char.c:147 #20 0x00005633034e1e13 in qemu_chr_fe_write (be=0x563304dbb800, buf=0x563304cc50b0 "{\"timestamp\": {\"seconds\": 1532944763, \"microseconds\": 326636}, \"event\": \"SHUTDOWN\", \"data\": {\"guest\": false}}\r\n", len=111) at /home/elmarco/src/qq/chardev/char-fe.c:42 #21 0x0000563302fa6334 in monitor_flush_locked (mon=0x563304dbb800) at /home/elmarco/src/qq/monitor.c:425 #22 0x0000563302fa6520 in monitor_puts (mon=0x563304dbb800, str=0x563305de7e9e "") at /home/elmarco/src/qq/monitor.c:468 #23 0x0000563302fa680c in qmp_send_response (mon=0x563304dbb800, rsp=0x563304df5730) at /home/elmarco/src/qq/monitor.c:517 #24 0x0000563302fa6905 in qmp_queue_response (mon=0x563304dbb800, rsp=0x563304df5730) at /home/elmarco/src/qq/monitor.c:538 #25 0x0000563302fa6b5b in monitor_qapi_event_emit (event=QAPI_EVENT_SHUTDOWN, qdict=0x563304df5730) at /home/elmarco/src/qq/monitor.c:624 #26 0x0000563302fa6c4b in monitor_qapi_event_queue (event=QAPI_EVENT_SHUTDOWN, qdict=0x563304df5730, errp=0x7ffc6ab5ed00) at /home/elmarco/src/qq/monitor.c:649 #27 0x0000563303548cce in qapi_event_send_shutdown (guest=false, errp=0x563303d8d0f0 <error_abort>) at qapi/qapi-events-run-state.c:58 #28 0x000056330313bcd7 in main_loop_should_exit () at /home/elmarco/src/qq/vl.c:1822 #29 0x000056330313bde3 in main_loop () at /home/elmarco/src/qq/vl.c:1862 #30 0x0000563303143781 in main (argc=3, argv=0x7ffc6ab5f068, envp=0x7ffc6ab5f088) at /home/elmarco/src/qq/vl.c:4644 Note that error report is now moved to the first caller, which may receive an error for a recursed event. This is probably fine (95% of callers use &error_abort, the rest have NULL error and ignore it) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20180731150144.14022-1-marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [*_no_recurse renamed to *_no_reenter, local variables reordered] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2018-07-31Merge remote-tracking branch ↵Peter Maydell3-6/+39
'remotes/vivier2/tags/linux-user-for-3.0-pull-request' into staging Fix safe_syscall() on ppc64 host Fix mmap() 0 length error case # gpg: Signature made Tue 31 Jul 2018 09:41:07 BST # gpg: using RSA key F30C38BD3F2FBE3C # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" # gpg: aka "Laurent Vivier <laurent@vivier.eu>" # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/linux-user-for-3.0-pull-request: linux-user: ppc64: don't use volatile register during safe_syscall tests: add check_invalid_maps to test-mmap linux-user/mmap.c: handle invalid len maps correctly Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-31Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell8-15/+14
Bug fixes. # gpg: Signature made Mon 30 Jul 2018 13:00:39 BST # gpg: using RSA key BFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: backends/cryptodev: remove dead code timer: remove replay clock probe in deadline calculation i386: implement MSR_SMI_COUNT for TCG i386: do not migrate MSR_SMI_COUNT on machine types <2.12 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-31Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20180731' into stagingPeter Maydell1-0/+1
fix large guests on s390x # gpg: Signature made Tue 31 Jul 2018 07:47:38 BST # gpg: using RSA key DECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # gpg: aka "Cornelia Huck <cohuck@kernel.org>" # gpg: aka "Cornelia Huck <cohuck@redhat.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20180731: s390x/sclp: fix maxram calculation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-31linux-user: ppc64: don't use volatile register during safe_syscallShivaprasad G Bhat1-2/+6
r11 is a volatile register on PPC as per calling conventions. The safe_syscall code uses it to check if the signal_pending is set during the safe_syscall. When a syscall is interrupted on return from signal handling, the r11 might be corrupted before we retry the syscall leading to a crash. The registers r0-r13 are not to be used here as they have volatile/designated/reserved usages. Change the code to use r14 which is non-volatile. Use SP+16 which is a slot for LR, for save/restore of previous value of r14. SP+16 can be used, as LR is preserved across the syscall. Steps to reproduce: On PPC host, issue `qemu-x86_64 /usr/bin/cc -E -` Attempt Ctrl-C, the issue is reproduced. Reference: https://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi-1.9.html#REG https://openpowerfoundation.org/wp-content/uploads/2016/03/ABI64BitOpenPOWERv1.1_16July2015_pub4.pdf Signed-off-by: Shivaprasad G Bhat <sbhat@linux.vnet.ibm.com> Tested-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <153301568965.30312.10498134581068746871.stgit@dhcp-9-109-246-16> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-07-31tests: add check_invalid_maps to test-mmapAlex Bennée1-1/+21
This adds a test to make sure we fail properly for a 0 length mmap. There are most likely other failure conditions we should also check. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Cc: umarcor <1783362@bugs.launchpad.net> Message-Id: <20180730134321.19898-3-alex.bennee@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-07-31linux-user/mmap.c: handle invalid len maps correctlyAlex Bennée1-3/+12
I've slightly re-organised the check to more closely match the sequence that the kernel uses in do_mmap(). We check for both the zero case (EINVAL) and the overflow length case (ENOMEM). Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Cc: umarcor <1783362@bugs.launchpad.net> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20180730134321.19898-2-alex.bennee@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-07-30Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell18-41/+449
Block layer patches: - qemu-img convert -C is now required to enable copy offloading - file-posix: Fix write_zeroes with unmap on block devices (would fall back to explicit writes on recent kernels) - Fix query-blockstats interface for use with -blockdev - Minor fixes and documentation updates # gpg: Signature made Mon 30 Jul 2018 16:08:14 BST # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: qemu-iotests: Test query-blockstats with -drive and -blockdev block/qapi: Include anonymous BBs in query-blockstats block/qapi: Add 'qdev' field to query-blockstats result file-posix: Fix write_zeroes with unmap on block devices block: Fix documentation for BDRV_REQ_MAY_UNMAP iotests: Add test for 'qemu-img convert -C' compatibility qemu-img: Add -C option for convert with copy offloading Revert "qemu-img: Document copy offloading implications with -S and -c" iotests: Don't lock /dev/null in 226 docs: Describe using images in writing iotests file-posix: Handle EINTR in preallocation=full write qcow2: A grammar fix in conflicting cache sizing error message qcow: fix a reference leak Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-30Merge remote-tracking branch ↵Peter Maydell6-9/+5
'remotes/pmaydell/tags/pull-target-arm-20180730' into staging target-arm queue: * arm/smmuv3: Fix broken VM state migration * armv7m_nvic: Fix broken VM state migration * hw/arm/sysbus-fdt: Fix assertion in copy_properties_from_host() * hw/arm/iotkit: Fix IRQ number for timer1 * hw/misc/tz-mpc: Zero the LUT on initialization, not just reset * target/arm: Remove duplicate 'host' entry in '-cpu ?' output # gpg: Signature made Mon 30 Jul 2018 15:16:01 BST # gpg: using RSA key 3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20180730: target/arm: Remove duplicate 'host' entry in '-cpu ?' output hw/misc/tz-mpc: Zero the LUT on initialization, not just reset hw/arm/iotkit: Fix IRQ number for timer1 armv7m_nvic: Fix m-security subsection name hw/arm/sysbus-fdt: Fix assertion in copy_properties_from_host() arm/smmuv3: Fix missing VMSD terminator Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-30s390x/sclp: fix maxram calculationChristian Borntraeger1-0/+1
We clamp down ram_size to match the sclp increment size. We do not do the same for maxram_size, which means for large guests with some sizes (e.g. -m 50000) maxram_size differs from ram_size. This can break other code (e.g. CMMA migration) which uses maxram_size to calculate the number of pages and then throws some errors. Fixes: 82fab5c5b90e468f3e9d54c ("s390x/sclp: remove memory hotplug support") Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> CC: qemu-stable@nongnu.org CC: David Hildenbrand <david@redhat.com> Message-Id: <1532959766-53343-1-git-send-email-borntraeger@de.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-07-30target/arm: Remove duplicate 'host' entry in '-cpu ?' outputPhilippe Mathieu-Daudé1-6/+0
Since 86f0a186d6f the TYPE_ARM_HOST_CPU is only compiled when CONFIG_KVM is enabled. Remove the now redundant special-case introduced in a96c0514ab7, to avoid: $ qemu-system-aarch64 -machine virt -cpu \? | fgrep host host host (only available in KVM mode) Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180727132311.2777-1-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-30hw/misc/tz-mpc: Zero the LUT on initialization, not just resetPeter Maydell1-1/+1
In the tz-mpc device we allocate a data block for the LUT, which we then clear to zero in the device's reset method. This is conceptually fine, but unfortunately results in a valgrind complaint about use of uninitialized data on startup: ==30906== Conditional jump or move depends on uninitialised value(s) ==30906== at 0x503609: tz_mpc_translate (tz-mpc.c:439) ==30906== by 0x3F3D90: address_space_translate_iommu (exec.c:511) ==30906== by 0x3F3FF8: flatview_do_translate (exec.c:584) ==30906== by 0x3F4292: flatview_translate (exec.c:644) ==30906== by 0x3F2120: address_space_translate (memory.h:1962) ==30906== by 0x3FB753: address_space_ldl_internal (memory_ldst.inc.c:36) ==30906== by 0x3FB8A6: address_space_ldl (memory_ldst.inc.c:80) ==30906== by 0x619037: ldl_phys (memory_ldst_phys.inc.h:25) ==30906== by 0x61985D: arm_cpu_reset (cpu.c:255) ==30906== by 0x98791B: cpu_reset (cpu.c:249) ==30906== by 0x57FFDB: armv7m_reset (armv7m.c:265) ==30906== by 0x7B1775: qemu_devices_reset (reset.c:69) This is because of a reset ordering problem -- the TZ MPC resets after the CPU, but an M-profile CPU's reset function includes memory loads to get the initial PC and SP, which then go through an MPC that hasn't yet been reset. The simplest fix for this is to zero the LUT when we initialize the data, which will result in the MPC's translate function giving the right answers for these early memory accesses. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Thomas Huth <thuth@redhat.com> Message-id: 20180724153616.32352-1-peter.maydell@linaro.org
2018-07-30hw/arm/iotkit: Fix IRQ number for timer1Peter Maydell1-1/+1
A cut-and-paste error meant we were incorrectly wiring up the timer1 IRQ to IRQ3. IRQ3 is the interrupt for timer0 -- move timer0 to IRQ4 where it belongs. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180727113854.20283-3-peter.maydell@linaro.org
2018-07-30armv7m_nvic: Fix m-security subsection namePeter Maydell1-1/+1
The vmstate save/load code insists that subsections of a VMState must have names which include their parent VMState's name as a leading substring. Unfortunately it neither documents this nor checks it on device init or state save, but instead fails state load with a confusing error message ("Missing section footer for armv7m_nvic"). Fix the name of the m-security subsection of the NVIC, so that state save/load works correctly for the security-enabled NVIC. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180727113854.20283-2-peter.maydell@linaro.org
2018-07-30hw/arm/sysbus-fdt: Fix assertion in copy_properties_from_host()Geert Uytterhoeven1-0/+1
When copy_properties_from_host() ignores the error for an optional property, it frees the error, but fails to reset it. Hence if two or more optional properties are missing, an assertion is triggered: util/error.c:57: error_setv: Assertion `*errp == NULL' failed. Fis this by resetting err to NULL after ignoring the error. Fixes: 9481cf2e5f2f2bb6 ("hw/arm/sysbus-fdt: helpers for clock node generation") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Message-id: 20180725113000.11014-1-geert+renesas@glider.be Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-30arm/smmuv3: Fix missing VMSD terminatorDr. David Alan Gilbert1-0/+1
The 'vmstate_smmuv3_queue' is missing the end-of-list marker. Fixes: 10a83cb9887 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20180727135406.15132-1-dgilbert@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: dropped stray blank line] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-30qemu-iotests: Test query-blockstats with -drive and -blockdevKevin Wolf3-0/+307
Make sure that query-blockstats returns information for every BlockBackend that is named or attached to a device model (or both). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-07-30block/qapi: Include anonymous BBs in query-blockstatsKevin Wolf1-1/+5
Consistent with query-block, query-blockstats should not only include named BlockBackends, but also those that are anonymous, but belong to a device model. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2018-07-30block/qapi: Add 'qdev' field to query-blockstats resultKevin Wolf2-4/+20
Like for query-block, the client needs to identify which BlockBackend the returned data is for. Anonymous BlockBackends are identified by the device model they are attached to. Add a 'qdev' field that contains the qdev ID or QOM path of the attached device model. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
generated by cgit v1.1 at 2024-12-28 02:29:38 +0000