Alistair Francis [Wed, 18 Mar 2020 22:47:01 +0000 (15:47 -0700)]
linux-user: Support futex_time64
Add support for host and target futex_time64. If futex_time64 exists on
the host we try that first before falling back to the standard futex
syscall.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <d9390e368a9a1fd32d52aa771815e6e3d40cb1d4.1584571250.git.alistair.francis@wdc.com>
[lv: define sys_futex() if __NR_futex is defined (fix bug on 32bit host),
remove duplicate get_errno()] Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Peter Maydell [Thu, 26 Mar 2020 15:44:26 +0000 (15:44 +0000)]
Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2020-03-26' into staging
Block patches for 5.0-rc1:
- Fix qemu-img convert with a host device or iscsi target
- Use-after-free fix in mirror
- Some minor qcow2 fixes
- Minor sheepdog fix
- Minor qemu-img check report fix
# gpg: Signature made Thu 26 Mar 2020 14:28:26 GMT
# gpg: using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40
# gpg: issuer "mreitz@redhat.com"
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full]
# Primary key fingerprint: 91BE B60A 30DB 3E88 57D1 1829 F407 DB00 61D5 CF40
* remotes/maxreitz/tags/pull-block-2020-03-26:
iotests/138: Test leaks/corruptions fixed report
iotests: Add poke_file_[bl]e functions
qemu-img: Fix check's leak/corruption fix report
sheepdog: Consistently set bdrv_has_zero_init_truncate
qcow2: Avoid feature name extension on small cluster size
qcow2: List autoclear bit names in header
qcow2: Comment typo fixes
block: trickle down the fallback image creation function use to the block drivers
block: pass BlockDriver reference to the .bdrv_co_create
block/mirror: fix use after free of local_err
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Max Reitz [Tue, 24 Mar 2020 17:27:57 +0000 (18:27 +0100)]
iotests/138: Test leaks/corruptions fixed report
Test that qemu-img check reports the number of leaks and corruptions
fixed in its JSON report (after a successful run).
While touching the _unsupported_imgopts line, adjust the note on why
data_file does not work with this test: The current comment sounds a bit
like it is a mistake for qemu-img check not to check external data
files' refcounts. But there are no such refcounts, so it is no mistake.
Just say that qemu-img check does not do much for external data files,
and this is why this test does not work with them.
Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200324172757.1173824-4-mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
Max Reitz [Tue, 24 Mar 2020 17:27:56 +0000 (18:27 +0100)]
iotests: Add poke_file_[bl]e functions
Similarly to peek_file_[bl]e, we may want to write binary integers into
a file. Currently, this often means messing around with poke_file and
raw binary strings. I hope these functions make it a bit more
comfortable.
Signed-off-by: Max Reitz <mreitz@redhat.com> Code-suggested-by: Eric Blake <eblake@redhat.com>
Message-Id: <20200324172757.1173824-3-mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
Max Reitz [Tue, 24 Mar 2020 17:27:55 +0000 (18:27 +0100)]
qemu-img: Fix check's leak/corruption fix report
There are two problems with qemu-img check's report on how many leaks
and/or corruptions have been fixed:
(1) ImageCheck.has_leaks_fixed and ImageCheck.has_corruptions_fixed are
only true when ImageCheck.leaks or ImageCheck.corruptions (respectively)
are non-zero. qcow2's check implementation will set the latter to zero
after it has fixed leaks and corruptions, though, so leaks-fixed and
corruptions-fixed are actually never reported after successful repairs.
We should always report them when they are non-zero, just like all the
other fields of ImageCheck.
(2) After something has been fixed and we run the check a second time,
leaks_fixed and corruptions_fixed are taken from the first run; but
has_leaks_fixed and has_corruptions_fixed are not. The second run
actually cannot fix anything, so with (1) fixed, has_leaks_fixed and
has_corruptions_fixed will always be false here. (With (1) unfixed,
they will at least be false on successful runs, because then the number
of leaks and corruptions found in the second run should be 0.)
We should save has_leaks_fixed and has_corruptions_fixed just like we
save leaks_fixed and corruptions_fixed.
Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <20200324172757.1173824-2-mreitz@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
Eric Blake [Tue, 24 Mar 2020 17:42:33 +0000 (12:42 -0500)]
sheepdog: Consistently set bdrv_has_zero_init_truncate
block_int.h claims that .bdrv_has_zero_init must return 0 if
.bdrv_has_zero_init_truncate does likewise; but this is violated if
only the former callback is provided if .bdrv_co_truncate also exists.
When adding the latter callback, it was mistakenly added to only one
of the three possible sheepdog instantiations.
Fixes: 1dcaf527 Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20200324174233.1622067-5-eblake@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
Eric Blake [Tue, 24 Mar 2020 17:42:32 +0000 (12:42 -0500)]
qcow2: Avoid feature name extension on small cluster size
As the feature name table can be quite large (over 9k if all 64 bits
of all three feature fields have names; a mere 8 features leaves only
8 bytes for a backing file name in a 512-byte cluster), it is unwise
to emit this optional header in images with small cluster sizes.
Update iotest 036 to skip running on small cluster sizes; meanwhile,
note that iotest 061 never passed on alternative cluster sizes
(however, I limited this patch to tests with output affected by adding
feature names, rather than auditing for other tests that are not
robust to alternative cluster sizes).
Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-Id: <20200324174233.1622067-4-eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
Eric Blake [Tue, 24 Mar 2020 17:42:31 +0000 (12:42 -0500)]
qcow2: List autoclear bit names in header
The feature table is supposed to advertise the name of all feature
bits that we support; however, we forgot to update the table for
autoclear bits. While at it, move the table to read-only memory in
code, and tweak the qcow2 spec to name the second autoclear bit.
Update iotests that are affected by the longer header length.
Fixes: 88ddffae Fixes: 93c24936 Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200324174233.1622067-3-eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
Eric Blake [Tue, 24 Mar 2020 17:42:30 +0000 (12:42 -0500)]
qcow2: Comment typo fixes
Various trivial typos noticed while working on this file.
Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-Id: <20200324174233.1622067-2-eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
Maxim Levitsky [Thu, 26 Mar 2020 01:12:18 +0000 (03:12 +0200)]
block: trickle down the fallback image creation function use to the block drivers
Instead of checking the .bdrv_co_create_opts to see if we need the
fallback, just implement the .bdrv_co_create_opts in the drivers that
need it.
This way we don't break various places that need to know if the
underlying protocol/format really supports image creation, and this way
we still allow some drivers to not support image creation.
Note that technically this driver reverts the image creation fallback
for the vxhs driver since I don't have a means to test it, and IMHO it
is better to leave it not supported as it was prior to generic image
creation patches.
Also drop iscsi_create_opts which was left accidentally.
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Message-Id: <20200326011218.29230-3-mlevitsk@redhat.com> Reviewed-by: Denis V. Lunev <den@openvz.org>
[mreitz: Fixed alignment, and moved bdrv_co_create_opts_simple() and
bdrv_create_opts_simple from block.h into block_int.h] Signed-off-by: Max Reitz <mreitz@redhat.com>
local_err is used again in mirror_exit_common() after
bdrv_set_backing_hd(), so we must zero it. Otherwise try to set
non-NULL local_err will crash.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200324153630.11882-3-vsementsov@virtuozzo.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
Peter Maydell [Thu, 26 Mar 2020 09:28:11 +0000 (09:28 +0000)]
Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20200325b' into staging
Combo Migration/HMP/virtiofs pull
Small fixes all around.
Ones that are noticeable:
a) Igor's migration compatibility fix affecting older machine types
has been seen in the wild
b) Philippe's autconverge fix should fix an intermittently
failing migration test.
c) Mao's makes a small change to the output of 'info
migrate_parameters' for tls-authz.
# gpg: Signature made Wed 25 Mar 2020 13:14:48 GMT
# gpg: using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7
# gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full]
# Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7
* remotes/dgilbert/tags/pull-migration-20200325b:
migration: use "" instead of (null) for tls-authz
migration/ram: fix use after free of local_err
migration/colo: fix use after free of local_err
vl.c: fix migration failure for 3.1 and older machine types
tools/virtiofsd/passthrough_ll: Fix double close()
hmp/vnc: Fix info vnc list leak
tests/migration: Reduce autoconverge initial bandwidth
xbzrle: update xbzrle doc
hmp-cmd: fix a missing_break warning
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
linux-user: Add x86_64 vsyscall page to /proc/self/maps
The page isn't (necessarily) present in the host /proc/self/maps,
and even if it might be it isn't present in page_flags, and even
if it was it might not have the same set of page permissions.
The easiest thing to do, particularly when it comes to the
"[vsyscall]" note at the end of line, is to special case it.
Notice the magic page during translate, much like we already
do for the arm32 commpage. At runtime, raise an exception to
return cpu_loop for emulation.
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200213032223.14643-4-richard.henderson@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
This is a bit tidier than open-coding the 5 lines necessary
to initialize the target_siginfo_t. In addition, this zeros
the remaining bytes of the target_siginfo_t, rather than
passing in garbage.
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200213032223.14643-3-richard.henderson@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
We are not short of numbers for EXCP_*. There is no need to confuse things
by having EXCP_VMEXIT and EXCP_SYSCALL overlap, even though the former is
only used for system mode and the latter is only used for user mode.
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200213032223.14643-2-richard.henderson@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
This patch fixes two problems:
- it cleanups linux-user variants (for instance ppc64-linux-user
and ppc64le-linux-user)
- it removes the .o file when it removes the .d file, otherwise the .o
file is never updated
Mao Zhongyi [Wed, 25 Mar 2020 01:49:30 +0000 (09:49 +0800)]
migration: use "" instead of (null) for tls-authz
run:
(qemu) info migrate_parameters
announce-initial: 50 ms
...
announce-max: 550 ms
multifd-compression: none
xbzrle-cache-size: 4194304
max-postcopy-bandwidth: 0
tls-authz: '(null)'
Migration parameter 'tls-authz' is used to provide the QOM ID
of a QAuthZ subclass instance that provides the access control
check, default is NULL. But the empty string is not a valid
object ID, so use "" instead of the default. Although it will
fail when lookup an object with ID "", it is harmless, just
consistent with tls_creds.
As a bonus, this patch also fixed the bad indentation on the
last line and removed 'has_tls_authz' redundant check in
'hmp_info_migrate_parameters'.
Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Message-Id: <119f539a9f4d198bc3bcced46b8280520d60bc51.1585100802.git.maozhongyi@cmss.chinamobile.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
local_err is used again in migration_bitmap_sync_precopy() after
precopy_notify(), so we must zero it. Otherwise try to set
non-NULL local_err will crash.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200324153630.11882-6-vsementsov@virtuozzo.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
local_err is used again in secondary_vm_do_failover() after
replication_stop_all(), so we must zero it. Otherwise try to set
non-NULL local_err will crash.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200324153630.11882-5-vsementsov@virtuozzo.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Igor Mammedov [Wed, 4 Mar 2020 17:27:48 +0000 (12:27 -0500)]
vl.c: fix migration failure for 3.1 and older machine types
Migration from QEMU(v4.0) fails when using 3.1 or older machine
type. For example if one attempts to migrate
QEMU-2.12 started as
qemu-system-ppc64 -nodefaults -M pseries-2.12 -m 4096 -mem-path /tmp/
to current master, it will fail with
qemu-system-ppc64: Unknown ramblock "ppc_spapr.ram", cannot accept migration
qemu-system-ppc64: error while loading state for instance 0x0 of device 'ram'
qemu-system-ppc64: load of migration failed: Invalid argument
Caused by 900c0ba373 commit which switches main RAM allocation to
memory backends and the fact in 3.1 and older QEMU, backends used
full[***] QOM path as memory region name instead of backend's name.
That was changed after 3.1 to use prefix-less names by default
(fa0cb34d22) for new machine types.
*** effectively makes main RAM memory region names defined by
MachineClass::default_ram_id being altered with '/objects/' prefix
and therefore migration fails as old QEMU sends prefix-less
name while new QEMU expects name with prefix when using 3.1 and
older machine types.
Fix it by forcing implicit[1] memory backend to always use
prefix-less names for its memory region by setting
'x-use-canonical-path-for-ramblock-id'
property to false.
1) i.e. memory backend created by compat glue which maps
-m/-mem-path/-mem-prealloc/default RAM size into
appropriate backend type/options to match old CLI format.
Fixes: 900c0ba373 Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reported-by: Lukáš Doktor <ldoktor@redhat.com>
Message-Id: <20200304172748.15338-1-imammedo@redhat.com> Tested-by: Lukáš Doktor <ldoktor@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
On success, the fdopendir() call closes fd. Later on the error
path we try to close an already-closed fd. This can lead to
use-after-free. Fix by only closing the fd if the fdopendir()
call failed.
Cc: qemu-stable@nongnu.org Fixes: b39bce121b (add dirp_map to hide lo_dirp pointers) Reported-by: Coverity (CID 1421933 USE_AFTER_FREE) Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20200321120654.7985-1-philmd@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
We're iterating the list, and then freeing the iteration pointer rather
than the list head.
Fixes: 0a9667ecdb6d ("hmp: Update info vnc") Reported-by: Coverity (CID 1421932) Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20200323120822.51266-1-dgilbert@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
When using max-bandwidth=~100Mb/s, this test fails on Travis-CI
s390x when configured with --disable-tcg:
$ make check-qtest
TEST check-qtest-s390x: tests/qtest/boot-serial-test
qemu-system-s390x: -accel tcg: invalid accelerator tcg
qemu-system-s390x: falling back to KVM
TEST check-qtest-s390x: tests/qtest/pxe-test
TEST check-qtest-s390x: tests/qtest/test-netfilter
TEST check-qtest-s390x: tests/qtest/test-filter-mirror
TEST check-qtest-s390x: tests/qtest/test-filter-redirector
TEST check-qtest-s390x: tests/qtest/drive_del-test
TEST check-qtest-s390x: tests/qtest/device-plug-test
TEST check-qtest-s390x: tests/qtest/virtio-ccw-test
TEST check-qtest-s390x: tests/qtest/cpu-plug-test
TEST check-qtest-s390x: tests/qtest/migration-test
**
ERROR:tests/qtest/migration-test.c:1229:test_migrate_auto_converge: 'got_stop' should be FALSE
ERROR - Bail out! ERROR:tests/qtest/migration-test.c:1229:test_migrate_auto_converge: 'got_stop' should be FALSE
make: *** [tests/Makefile.include:633: check-qtest-s390x] Error 1
Per David Gilbert, "it could just be the writing is slow on s390
and the migration thread fast; in which case the autocomplete
wouldn't be needed. Perhaps we just need to reduce the bandwidth
limit."
Tuning the threshold by reducing the initial bandwidth makes the
autoconverge test pass.
Suggested-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20200323184015.11565-1-philmd@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Tested-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Mao Zhongyi [Fri, 20 Mar 2020 14:32:16 +0000 (22:32 +0800)]
xbzrle: update xbzrle doc
Add new parameter description, also:
1. Remove unsociable space.
2. Nit picking: s/two/2 in report
Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Message-Id: <20200320143216.423374-1-maozhongyi@cmss.chinamobile.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Pan Nengyuan [Wed, 18 Mar 2020 07:16:20 +0000 (15:16 +0800)]
hmp-cmd: fix a missing_break warning
This fix coverity issues 94417686:
1260 break;
CID 94417686: (MISSING_BREAK)
1261. unterminated_case: The case for value "MIGRATION_PARAMETER_THROTTLE_TRIGGER_THRESHOLD" is not terminated by a 'break' statement.
1261 case MIGRATION_PARAMETER_THROTTLE_TRIGGER_THRESHOLD:
1262 p->has_throttle_trigger_threshold = true;
1263 visit_type_int(v, param, &p->throttle_trigger_threshold, &err);
1264 case MIGRATION_PARAMETER_CPU_THROTTLE_INITIAL:
Fixes: dc14a470763c96fd9d360e1028ce38e8c3613a77 Fixes: Coverity (CID 1421950) Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
Message-Id: <20200318071620.59748-1-pannengyuan@huawei.com> Reviewed-by: Keqian Zhu <zhukeqian1@huawei.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
ui/input-linux: Do not ignore ioctl() return value
Fix warnings reported by Clang static code analyzer:
CC ui/input-linux.o
ui/input-linux.c:343:9: warning: Value stored to 'rc' is never read
rc = ioctl(il->fd, EVIOCGBIT(EV_REL, sizeof(relmap)), &relmap);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ui/input-linux.c:351:9: warning: Value stored to 'rc' is never read
rc = ioctl(il->fd, EVIOCGBIT(EV_ABS, sizeof(absmap)), &absmap);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ui/input-linux.c:354:13: warning: Value stored to 'rc' is never read
rc = ioctl(il->fd, EVIOCGABS(ABS_X), &absinfo);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ui/input-linux.c:357:13: warning: Value stored to 'rc' is never read
rc = ioctl(il->fd, EVIOCGABS(ABS_Y), &absinfo);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ui/input-linux.c:365:9: warning: Value stored to 'rc' is never read
rc = ioctl(il->fd, EVIOCGBIT(EV_KEY, sizeof(keymap)), keymap);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ui/input-linux.c:366:9: warning: Value stored to 'rc' is never read
rc = ioctl(il->fd, EVIOCGKEY(sizeof(keystate)), keystate);
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-id: 20200322161219.17757-1-philmd@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Peter Maydell [Tue, 24 Mar 2020 16:56:05 +0000 (16:56 +0000)]
Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2020-03-24-tag0' into staging
qemu-ga patch queue for hard-freeze
* fix undefined C behavior with guest-file-* interfaces
* fix w32 installer issues
* fix crash for large file reads via guest-file-read on windows
* add missing man page documentation for virtio-vsock
* remotes/mdroth/tags/qga-pull-2020-03-24-tag0:
qemu-ga: document vsock-listen in the man page
qga: Fix undefined C behavior
qga-win: prevent crash when executing guest-file-read with large count
qga-win: Handle VSS_E_PROVIDER_ALREADY_REGISTERED error
qga: Installer: Wait for installation to finish
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Eric Blake [Fri, 20 Mar 2020 15:05:07 +0000 (10:05 -0500)]
qga: Fix undefined C behavior
The QAPI struct GuestFileWhence has a comment about how we are
exploiting equivalent values between two different integer types
shared in a union. But C says behavior is undefined on assignments to
overlapping storage when the two types are not the same width, and
indeed, 'int64_t value' and 'enum QGASeek name' are very likely to be
different in width. Utilize a temporary variable to fix things.
Reported-by: Peter Maydell <peter.maydell@linaro.org> Fixes: 0b4b49387 Fixes: Coverity CID 1421990 Signed-off-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Basil Salman [Wed, 11 Mar 2020 17:04:17 +0000 (19:04 +0200)]
qga-win: prevent crash when executing guest-file-read with large count
guest-file-read command is currently implemented to read from a
file handle count number of bytes. when executed with a very large count number
qemu-ga crashes.
after some digging turns out that qemu-ga crashes after trying to allocate
a buffer large enough to save the data read in it, the buffer was allocated using
g_malloc0 which is not fail safe, and results a crash in case of failure.
g_malloc0 was replaced with g_try_malloc0() which returns NULL on failure,
A check was added for that case in order to prevent qemu-ga from crashing
and to send a response to the qemu-ga client accordingly.
Peter Maydell [Tue, 24 Mar 2020 12:24:41 +0000 (12:24 +0000)]
Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2020-03-24' into staging
Block patches for 5.0-rc0:
- Use-after-free fix
- Fix for a memleak in an error path
- Preventative measures against other potential use-after-frees, and
against NULL deferences at runtime
- iotest fixes
# gpg: Signature made Tue 24 Mar 2020 12:19:09 GMT
# gpg: using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40
# gpg: issuer "mreitz@redhat.com"
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full]
# Primary key fingerprint: 91BE B60A 30DB 3E88 57D1 1829 F407 DB00 61D5 CF40
* remotes/maxreitz/tags/pull-block-2020-03-24:
iotests/026: Move v3-exclusive test to new file
iotests: Fix cleanup path in some tests
block/qcow2: zero data_file child after free
block: bdrv_set_backing_bs: fix use-after-free
block: Assert BlockDriver::format_name is not NULL
block: Avoid memleak on qcow2 image info failure
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Max Reitz [Wed, 11 Mar 2020 14:07:07 +0000 (15:07 +0100)]
iotests/026: Move v3-exclusive test to new file
data_file does not work with v2, and we probably want 026 to keep
working for v2 images. Thus, open a new file for v3-exclusive error
path test cases.
Fixes: 81311255f217859413c94f2cd9cebf2684bbda94
(“iotests/026: Test EIO on allocation in a data-file”) Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200311140707.1243218-1-mreitz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Tested-by: John Snow <jsnow@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
Max Reitz [Mon, 24 Feb 2020 17:16:31 +0000 (18:16 +0100)]
iotests: Fix cleanup path in some tests
Some iotests leave behind some external data file when run for qcow2
with -o data_file. Fix that.
Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200224171631.384314-1-mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
data_file being NULL doesn't seem to be a correct state, but it's
better than dead pointer and simpler to debug.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200316060631.30052-3-vsementsov@virtuozzo.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
There is a use-after-free possible: bdrv_unref_child() leaves
bs->backing freed but not NULL. bdrv_attach_child may produce nested
polling loop due to drain, than access of freed pointer is possible.
I've produced the following crash on 30 iotest with modified code. It
does not reproduce on master, but still seems possible:
#0 __strcmp_avx2 () at /lib64/libc.so.6
#1 bdrv_backing_overridden (bs=0x55c9d3cc2060) at block.c:6350
#2 bdrv_refresh_filename (bs=0x55c9d3cc2060) at block.c:6404
#3 bdrv_backing_attach (c=0x55c9d48e5520) at block.c:1063
#4 bdrv_replace_child_noperm
(child=child@entry=0x55c9d48e5520,
new_bs=new_bs@entry=0x55c9d3cc2060) at block.c:2290
#5 bdrv_replace_child
(child=child@entry=0x55c9d48e5520,
new_bs=new_bs@entry=0x55c9d3cc2060) at block.c:2320
#6 bdrv_root_attach_child
(child_bs=child_bs@entry=0x55c9d3cc2060,
child_name=child_name@entry=0x55c9d241d478 "backing",
child_role=child_role@entry=0x55c9d26ecee0 <child_backing>,
ctx=<optimized out>, perm=<optimized out>, shared_perm=21,
opaque=0x55c9d3c5a3d0, errp=0x7ffd117108e0) at block.c:2424
#7 bdrv_attach_child
(parent_bs=parent_bs@entry=0x55c9d3c5a3d0,
child_bs=child_bs@entry=0x55c9d3cc2060,
child_name=child_name@entry=0x55c9d241d478 "backing",
child_role=child_role@entry=0x55c9d26ecee0 <child_backing>,
errp=errp@entry=0x7ffd117108e0) at block.c:5876
#8 in bdrv_set_backing_hd
(bs=bs@entry=0x55c9d3c5a3d0,
backing_hd=backing_hd@entry=0x55c9d3cc2060,
errp=errp@entry=0x7ffd117108e0)
at block.c:2576
#9 stream_prepare (job=0x55c9d49d84a0) at block/stream.c:150
#10 job_prepare (job=0x55c9d49d84a0) at job.c:761
#11 job_txn_apply (txn=<optimized out>, fn=<optimized out>) at
job.c:145
#12 job_do_finalize (job=0x55c9d49d84a0) at job.c:778
#13 job_completed_txn_success (job=0x55c9d49d84a0) at job.c:832
#14 job_completed (job=0x55c9d49d84a0) at job.c:845
#15 job_completed (job=0x55c9d49d84a0) at job.c:836
#16 job_exit (opaque=0x55c9d49d84a0) at job.c:864
#17 aio_bh_call (bh=0x55c9d471a160) at util/async.c:117
#18 aio_bh_poll (ctx=ctx@entry=0x55c9d3c46720) at util/async.c:117
#19 aio_poll (ctx=ctx@entry=0x55c9d3c46720,
blocking=blocking@entry=true)
at util/aio-posix.c:728
#20 bdrv_parent_drained_begin_single (poll=true, c=0x55c9d3d558f0)
at block/io.c:121
#21 bdrv_parent_drained_begin_single (c=c@entry=0x55c9d3d558f0,
poll=poll@entry=true)
at block/io.c:114
#22 bdrv_replace_child_noperm
(child=child@entry=0x55c9d3d558f0,
new_bs=new_bs@entry=0x55c9d3d27300) at block.c:2258
#23 bdrv_replace_child
(child=child@entry=0x55c9d3d558f0,
new_bs=new_bs@entry=0x55c9d3d27300) at block.c:2320
#24 bdrv_root_attach_child
(child_bs=child_bs@entry=0x55c9d3d27300,
child_name=child_name@entry=0x55c9d241d478 "backing",
child_role=child_role@entry=0x55c9d26ecee0 <child_backing>,
ctx=<optimized out>, perm=<optimized out>, shared_perm=21,
opaque=0x55c9d3cc2060, errp=0x7ffd11710c60) at block.c:2424
#25 bdrv_attach_child
(parent_bs=parent_bs@entry=0x55c9d3cc2060,
child_bs=child_bs@entry=0x55c9d3d27300,
child_name=child_name@entry=0x55c9d241d478 "backing",
child_role=child_role@entry=0x55c9d26ecee0 <child_backing>,
errp=errp@entry=0x7ffd11710c60) at block.c:5876
#26 bdrv_set_backing_hd
(bs=bs@entry=0x55c9d3cc2060,
backing_hd=backing_hd@entry=0x55c9d3d27300,
errp=errp@entry=0x7ffd11710c60)
at block.c:2576
#27 stream_prepare (job=0x55c9d495ead0) at block/stream.c:150
...
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200316060631.30052-2-vsementsov@virtuozzo.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
block: Assert BlockDriver::format_name is not NULL
bdrv_do_find_format() calls strcmp() using BlockDriver::format_name
as argument, which must not be NULL. Assert this field is not null
when we register a block driver in bdrv_register().
Reported-by: Mansour Ahmadi <ManSoSec@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20200318222235.23856-1-philmd@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
* remotes/dgibson/tags/ppc-for-5.0-20200324:
ppc/ppc405_boards: Remove unnecessary NULL check
hw/ppc: Take QEMU lock when calling ppc_dcr_read/write()
spapr: Fix memory leak in h_client_architecture_support()
target/ppc: don't byte swap ELFv2 signal handler
target/ppc: Fix ISA v3.0 (POWER9) slbia implementation
target/ppc: Fix slbia TLB invalidation gap
ppc/spapr: Set the effective address provided flag in mc error log.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Sun, 22 Mar 2020 19:22:58 +0000 (19:22 +0000)]
hw/ppc: Take QEMU lock when calling ppc_dcr_read/write()
The ppc_dcr_read() and ppc_dcr_write() functions call into callbacks
in device code, so we need to hold the QEMU iothread lock while
calling them. This is the case already for the callsites in
kvmppc_handle_dcr_read/write(), but we must also take the lock when
calling the helpers from TCG.
This fixes a bug where attempting to initialise the PPC405EP
SDRAM will cause an assertion when sdram_map_bcr() attempts
to remap memory regions.
Reported-by: Amit Lazar <abasarlaz@hotmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20200322192258.14039-1-peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Greg Kurz [Sat, 21 Mar 2020 17:34:22 +0000 (18:34 +0100)]
spapr: Fix memory leak in h_client_architecture_support()
This is the only error path that needs to free the previously allocated
ov1.
Reported-by: Coverity (CID 1421924) Fixes: cbd0d7f36322 "spapr: Fail CAS if option vector table cannot be parsed" Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <158481206205.336182.16106097429336044843.stgit@bahia.lan> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Vincent Fazio [Thu, 19 Mar 2020 13:32:44 +0000 (08:32 -0500)]
target/ppc: don't byte swap ELFv2 signal handler
Previously, the signal handler would be byte swapped if the target and
host CPU used different endianness. This would cause a SIGSEGV when
attempting to translate the opcode pointed to by the swapped address.
Thread 1 "qemu-ppc64" received signal SIGSEGV, Segmentation fault.
0x00000000600a9257 in ldl_he_p (ptr=0x4c2c061000000000) at qemu/include/qemu/bswap.h:351
351 __builtin_memcpy(&r, ptr, sizeof(r));
#0 0x00000000600a9257 in ldl_he_p (ptr=0x4c2c061000000000) at qemu/include/qemu/bswap.h:351
#1 0x00000000600a92fe in ldl_be_p (ptr=0x4c2c061000000000) at qemu/include/qemu/bswap.h:449
#2 0x00000000600c0790 in translator_ldl_swap at qemu/include/exec/translator.h:201
#3 0x000000006011c1ab in ppc_tr_translate_insn at qemu/target/ppc/translate.c:7856
#4 0x000000006005ae70 in translator_loop at qemu/accel/tcg/translator.c:102
The signal handler will be byte swapped as a result of the __get_user()
call in sigaction() if it is necessary, no additional swap is required.
Signed-off-by: Vincent Fazio <vfazio@gmail.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200319133244.8818-1-vfazio@xes-inc.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Nicholas Piggin [Thu, 19 Mar 2020 06:44:39 +0000 (16:44 +1000)]
target/ppc: Fix ISA v3.0 (POWER9) slbia implementation
The new ISA v3.0 slbia variants have not been implemented for TCG,
which can lead to crashing when a POWER9 machine boots Linux using
the hash MMU, for example ("disable_radix" kernel command line).
Add them.
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-Id: <20200319064439.1020571-1-npiggin@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org>
[dwg: Fixed compile error for USER_ONLY builds] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Nicholas Piggin [Wed, 18 Mar 2020 04:41:34 +0000 (14:41 +1000)]
target/ppc: Fix slbia TLB invalidation gap
slbia must invalidate TLBs even if it does not remove a valid SLB
entry, because slbmte can overwrite valid entries without removing
their TLBs.
As the architecture says, slbia invalidates all lookaside information,
not conditionally based on if it removed valid entries.
It does not seem possible for POWER8 or earlier Linux kernels to hit
this bug because it never changes its kernel SLB translations, and it
should always have valid entries if any accesses are made to userspace
regions. However other operating systems which may modify SLB entry 0
or do more fancy things with segments might be affected.
When POWER9 slbia support is added in the next patch, this becomes a
real problem because some new slbia variants don't invalidate all
non-zero entries.
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-Id: <20200318044135.851716-1-npiggin@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
ppc/spapr: Set the effective address provided flag in mc error log.
Per PAPR, it is expected to set effective address provided flag in
sub_err_type member of mc extended error log (i.e
rtas_event_log_v6_mc.sub_err_type). This somehow got missed in original
fwnmi-mce patch series. The current code just updates the effective address
but does not set the flag to indicate that it is available. Hence guest
fails to extract effective address from mce rtas log. This patch fixes
that.
Without this patch guest MCE logs fails print DAR value:
Peter Maydell [Mon, 23 Mar 2020 17:41:21 +0000 (17:41 +0000)]
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20200323' into staging
target-arm queue:
* target/arm: avoid undefined behaviour shift in watchpoint code
* target/arm: avoid undefined behaviour shift in handle_simd_dupe()
* target/arm: add assert that immh != 0 in disas_simd_shift_imm()
* aspeed/smc: Fix DMA support for AST2600
* hw/arm/bcm283x: Correct the license text ('and' vs 'or')
* remotes/pmaydell/tags/pull-target-arm-20200323:
target/arm: Move computation of index in handle_simd_dupe
target/arm: Assert immh != 0 in disas_simd_shift_imm
target/arm: Rearrange disabled check for watchpoints
aspeed/smc: Fix DMA support for AST2600
hw/arm/bcm283x: Correct the license text
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Move computation of index in handle_simd_dupe
Coverity reports a BAD_SHIFT with ctz32(imm5), with imm5 == 0.
This is an invalid encoding, but we diagnose that just below
by rejecting size > 3. Avoid the warning by sinking the
computation of index below the check.
Reported-by: Coverity (CID 1421965) Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200320160622.8040-4-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Assert immh != 0 in disas_simd_shift_imm
Coverity raised a shed-load of errors cascading from inferring
that clz32(immh) might yield 32, from immh might be 0.
While immh cannot be 0 from encoding, it is not obvious even to
a human how we've checked that: via the filtering provided by
data_proc_simd[].
Reported-by: Coverity (CID 1421923, and more) Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200320160622.8040-3-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Cédric Le Goater [Mon, 23 Mar 2020 17:22:30 +0000 (17:22 +0000)]
aspeed/smc: Fix DMA support for AST2600
Recent firmwares uses SPI DMA transfers in U-Boot to load the
different images (kernel, initrd, dtb) in the SoC DRAM. The AST2600
FMC model is missing the masks to be applied on the DMA registers
which resulted in incorrect values. Fix that and wire the SPI
controllers which have DMA support on the AST2600.
Fixes: bcaa8ddd081c ("aspeed/smc: Add AST2600 support") Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20200320053923.20565-1-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
The license is the 'GNU General Public License v2.0 or later',
not 'and':
This program is free software; you can redistribute it and/ori
modify it under the terms of the GNU General Public License as
published by the Free Software Foundation; either version 2 of
the License, or (at your option) any later version.
Fix the license comment.
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200312213455.15854-1-philmd@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Stefan Hajnoczi [Thu, 19 Mar 2020 16:35:59 +0000 (16:35 +0000)]
aio-posix: fix io_uring with external events
When external event sources are disabled fdmon-io_uring falls back to
fdmon-poll. The ->need_wait() callback needs to watch for this so it
can return true when external event sources are disabled.
It is also necessary to call ->wait() when AioHandlers have changed
because io_uring is asynchronous and we must submit new sqes.
Both of these changes to ->need_wait() together fix tests/test-aio -p
/aio/external-client, which failed with:
Akihiro Suda (8):
remove confusing comment that exists from ancient slirp
add slirp_new(SlirpConfig *, SlirpCb *, void *)
allow custom MTU
add disable_host_loopback (prohibit connections to 127.0.0.1)
add SlirpConfig version
emu: remove dead code
emu: disable by default
fix a typo in a comment
Anders Waldenborg (1):
state: fix loading of guestfwd state
Giuseppe Scrivano (1):
socket: avoid getpeername after shutdown(SHUT_WR)
Jindrich Novy (1):
Don't leak memory when reallocation fails.
Marc-André Lureau (60):
Merge branch 'AkihiroSuda/libslirp-slirp4netns'
Merge branch 'fix-typo' into 'master'
meson: make it subproject friendly
Merge branch 'meson' into 'master'
misc: fix compilation warnings
Merge branch 'fix-shutdown-wr' into 'master'
sbuf: remove unused and undefined sbcopy() path
sbuf: check more strictly sbcopy() bounds with offset
sbuf: replace a comment with a runtime warning
Replace remaining malloc/free user with glib
tcp_attach() can no longer fail
state: can't ENOMEM
sbuf: use unsigned types
sbuf: simplify sbreserve()
dnssearch: use g_strv_length()
vmstate: silence scan-build warning
gitlab-ci: run scan-build
Merge branch 'mem-cleanups' into 'master'
libslirp.map: bind slirp_new to SLIRP_4.1 version
meson: fix libtool versioning
Release v4.1.0
Merge branch '4.1.0' into 'master'
CHANGELOG: start unreleased section
Merge branch 'add-unix' into 'master'
util: add G_SIZEOF_MEMBER() macro
Check bootp_filename is not going to be truncated
bootp: remove extra cast
bootp: replace simple snprintf() with strcpy()
tftp: clarify what is actually OACK m_len
tcp_emu: add more fixme/warnings comments
util: add slirp_fmt() helpers
dhcpv6: use slirp_fmt()
misc: use slirp_fmt0()
tftp: use slirp_fmt0()
tcp_ctl: use slirp_fmt()
tcp_emu: fix unsafe snprintf() usages
misc: improve error report
Use g_snprintf()
util: add gnuc format function attribute to slirp_fmt*
Merge branch 'aw-guestfwd-state' into 'master'
Merge branch 'slirp-fmt' into 'master'
socket: remove extra label and variable
socket: factor out sotranslate ipv4/ipv6 handling
socket: remove need for extra scope_id variable
socket: do not fallback on host loopback if get_dns_addr() failed
socket: do not fallback on loopback addr for addresses in our mask/prefix
Prepare for v4.2.0 release
Merge branch 'translate-fix' into 'master'
Merge branch 'release-v4.2.0' into 'master'
changelog: post-release
changelog: fix link
.gitlab-ci: add --werror, treat CI build warnings as errors
Revert "socket: remove need for extra scope_id variable"
Teach slirp_version_string() to return vcs version
Merge branch 'mingw-fix' into 'master'
Merge branch 'vcs-version' into 'master'
meson: bump required version to 0.49
build-sys: fix NetBSD build regression
Merge branch 'netbsd-fix' into 'master'
build-sys: make libslirp-version.h depend on Makefile
PanNengyuan (1):
libslirp: fix NULL pointer dereference in tcp_sockclosed
Philippe Mathieu-Daudé (1):
Add a git-publish configuration file
Prasad J Pandit (4):
slirp: ncsi: compute checksum for valid data length
slirp: use correct size while emulating IRC commands
slirp: use correct size while emulating commands
slirp: tftp: restrict relative path access
Samuel Thibault (14):
ip_reass: explain why we should not always update the q pointer
Merge branch 'comment' into 'master'
Merge branch 'no-emu' into 'master'
Fix bogus indent, no source change
ip_reass: Fix use after free
Merge branch 'reass2' into 'master'
Make host receive broadcast packets
arp: Allow 0.0.0.0 destination address
Merge branch 'warnings' into 'master'
Merge branch 'arp_0' into 'master'
Merge branch 'broadcast' into 'master'
tcp_emu: Fix oob access
Merge branch 'oob' into 'master'
Merge branch 'master' into 'master'
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Peter Maydell [Mon, 16 Mar 2020 11:20:06 +0000 (11:20 +0000)]
Update copyright date for user-facing copyright strings
Update the copyright date to 2020 for the copyright strings which are
user-facing and represent overall copyright info for all of QEMU.
Reported-by: John Arbuckle <programmingkidx@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200316112006.19107-1-peter.maydell@linaro.org
Kevin Wolf [Fri, 13 Mar 2020 08:36:17 +0000 (09:36 +0100)]
iotests: Increase pause_wait() timeout
Waiting for only 1 second proved to be too short on a loaded system,
resulting in false positives when testing pull requests. Increase the
timeout a bit to make this less likely.
Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200313083617.8326-4-kwolf@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Kevin Wolf [Fri, 13 Mar 2020 08:36:16 +0000 (09:36 +0100)]
python/qemu: Kill QEMU process if 'quit' doesn't work
With a QEMU bug, it can happen that the QEMU process doesn't react to a
'quit' QMP command. If we got an exception during previous QMP
communication (e.g. iotests Timeout expiring), we could also be in an
inconsistent state where after sending 'quit' we immediately read an old
response and close the socket even though the 'quit' command wasn't
processed yet. Both cases would lead to a hanging test.
Fix this by waiting for the QEMU process to exit after sending 'quit'
with a timeout, and if it doesn't happen within three seconds, send
SIGKILL.
Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200313083617.8326-3-kwolf@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Kevin Wolf [Fri, 13 Mar 2020 08:36:15 +0000 (09:36 +0100)]
iotests.py: Enable faulthandler
With this, you can send SIGABRT to a hanging test case and you'll get a
Python stack trace so you know where it was hanging.
Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200313083617.8326-2-kwolf@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
# gpg: Signature made Sat 21 Mar 2020 17:29:59 GMT
# gpg: using RSA key 36D4C0F0CF2FE46D
# gpg: Good signature from "Marcel Apfelbaum <marcel.apfelbaum@zoho.com>" [marginal]
# gpg: aka "Marcel Apfelbaum <marcel@redhat.com>" [marginal]
# gpg: aka "Marcel Apfelbaum <marcel.apfelbaum@gmail.com>" [marginal]
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg: It is not certain that the signature belongs to the owner.
# Primary key fingerprint: B1C6 3A57 F92E 08F2 640F 31F5 36D4 C0F0 CF2F E46D
* remotes/marcel/tags/rdma-pull-request:
hw/rdma: avoid suspicious strncpy() use
hw/rdma: Skip data-path mr_id translation
hw/rdma: Cosmetic change - no need for two sge arrays
hw/rdma/vmw/pvrdma_dev_ring: Replace strncpy with pstrcpy
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Stefan Hajnoczi [Mon, 16 Mar 2020 16:07:02 +0000 (16:07 +0000)]
hw/rdma: avoid suspicious strncpy() use
gcc (GCC) 9.2.1 20190827 (Red Hat 9.2.1-1) with sanitizers enabled
reports the following error:
CC x86_64-softmmu/hw/rdma/vmw/pvrdma_dev_ring.o
In file included from /usr/include/string.h:495,
from include/qemu/osdep.h:101,
from hw/rdma/vmw/pvrdma_dev_ring.c:16:
In function ‘strncpy’,
inlined from ‘pvrdma_ring_init’ at hw/rdma/vmw/pvrdma_dev_ring.c:33:5:
/usr/include/bits/string_fortified.h:106:10: error: ‘__builtin_strncpy’ specified bound 32 equals destination size [-Werror=stringop-truncation]
106 | return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Use pstrcpy() instead of strncpy(). It is guaranteed to NUL-terminate
strings.
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml.gmail.com>
Message-Id: <20200316160702.478964-3-stefanha@redhat.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Yuval Shaia [Fri, 20 Mar 2020 14:34:29 +0000 (16:34 +0200)]
hw/rdma: Skip data-path mr_id translation
With the change made in commit 68b89aee71 ("Utilize ibv_reg_mr_iova for
memory registration") the MR emulation is no longer needed in order to
translate the guest addresses into host addresses.
With that, the next obvious step is to skip entirely the processing in
data-path.
To accomplish this, return the backend's lkey to driver so we will not
need to do the emulated mr_id to backend mr_id translation in data-path.
The function build_host_sge_array is still called in data-path but only
for backward computability with statistics collection.
While there, as a cosmetic change to make the code cleaner - make one
copy of the function rdma_backend_create_mr and leave the redundant
guest_start argument in the legacy code.
Yuval Shaia [Fri, 20 Mar 2020 14:34:28 +0000 (16:34 +0200)]
hw/rdma: Cosmetic change - no need for two sge arrays
The function build_host_sge_array uses two sge arrays, one for input and
one for output.
Since the size of the two arrays is the same, the function can write
directly to the given source array (i.e. input/output argument).
Julia Suvorova [Wed, 18 Mar 2020 13:48:49 +0000 (14:48 +0100)]
hw/rdma/vmw/pvrdma_dev_ring: Replace strncpy with pstrcpy
ring->name is defined as 'char name[MAX_RING_NAME_SZ]'. Replace untruncated
strncpy with QEMU function.
This case prevented QEMU from compiling with --enable-sanitizers.
Signed-off-by: Julia Suvorova <jusual@redhat.com>
Message-Id: <20200318134849.237011-1-jusual@redhat.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml.gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Leonardo Bras [Thu, 19 Mar 2020 04:03:26 +0000 (01:03 -0300)]
device_tree: Add info message when dumping dtb to file
When dumping dtb to a file, qemu exits silently before starting the VM.
Add info message so user can easily track why the proccess exits.
Add error message if dtb dump failed.
Signed-off-by: Leonardo Bras <leonardo@linux.ibm.com>
Message-Id: <20200319040326.391090-1-leonardo@linux.ibm.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Peter Maydell [Fri, 20 Mar 2020 16:00:21 +0000 (16:00 +0000)]
Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-5.0-pull-request' into staging
update syscall numbers to linux 5.5 (with scripts)
add clock_gettime64/clock_settime64
add AT_EXECFN
v4: restore syscall.tbl series but remove vsyscall series
v3: remove syscall.tbl series
v2: guard copy_to_user_timezone() with TARGET_NR_gettimeofday
remove "Support futex_time64" patch
guard sys_futex with TARGET_NR_exit
Laurent Vivier [Mon, 16 Mar 2020 08:56:20 +0000 (09:56 +0100)]
linux-user, openrisc: sync syscall numbers with kernel v5.5
Use helper script scripts/gensyscalls.sh to generate the file.
Add TARGET_NR_or1k_atomic
Remove useless comments and blank lines.
Define diretly the __NR_XXX64 syscalls rather than using the
intermediate __NR3264 definition.
Laurent Vivier [Tue, 10 Mar 2020 10:33:58 +0000 (11:33 +0100)]
linux-user, mips: add syscall table generation support
Copy syscall.tbl and syscallhdr.sh from linux/arch/mips/kernel/syscalls/syscall_o32.tbl v5.5
Update syscallhdr.sh to generate QEMU syscall_nr.h
Move the offset (4000) from the file to the Makefile.objs to be passed
to syscallhdr.sh
Rename on the fly fadvise64 to fadvise64_64.
Laurent Vivier [Tue, 10 Mar 2020 10:33:51 +0000 (11:33 +0100)]
linux-user, ppc: add syscall table generation support
Copy syscall.tbl and syscallhdr.sh from linux/arch/ppc/kernel/syscalls v5.5
Update syscallhdr.sh to generate QEMU syscall_nr.h
and to not generate the entry if entry point is sys_ni_syscall.
Fix ppc/signal.c to define do_sigreturn() for TARGET_ABI32.
projects / qemu-xen.git / log