summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* scsi: clarify sense codes for LUN0 emulationHannes Reinecke2017-08-081-1/+6
| | | | | | | | | | | | The LUN0 emulation is just that, an emulation for a non-existing LUN0. So we should be returning LUN_NOT_SUPPORTED for any request coming from any other LUN. And we should be aborting unhandled commands with INVALID OPCODE, not LUN NOT SUPPORTED. Signed-off-by: Hannes Reinecke <hare@suse.com> Message-Id: <1501835795-92331-4-git-send-email-hare@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* kvm: workaround build break on gcc-7.1.1 / fedora26Greg Kurz2017-08-081-10/+4Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Building QEMU on fedora26 with the latest gcc package fails: CC ppc64-softmmu/target/ppc/kvm.o In file included from include/sysemu/hw_accel.h:16:0, from target/ppc/kvm.c:31: target/ppc/kvm.c: In function ‘kvmppc_booke_watchdog_enable’: include/sysemu/kvm.h:449:35: error: ‘args_tmp[i]’ may be used uninitialized in this function [-Werror=maybe-uninitialized] cap.args[i] = args_tmp[i]; \ ^ target/ppc/kvm.c: In function ‘kvmppc_set_papr’: include/sysemu/kvm.h:449:35: error: ‘args_tmp[i]’ may be used uninitialized in this function [-Werror=maybe-uninitialized] cc1: all warnings being treated as errors $ rpm -q gcc gcc-7.1.1-3.fc26.ppc64le The compiler should obviously optimize this code away when no extra agument is passed to kvm_vm_enable_cap() and kvm_vcpu_enable_cap(), but it doesn't. This bug should be fixed one day in gcc, but we can also change our code pattern so that we don't hit the issue anymore. We workaround this, by using memcpy() instead of open-coding the copy. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <150210580404.1343.7325713896658799315.stgit@bahia.lan> Acked-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* Revert "rcu: do not create thread in pthread_atfork callback"Paolo Bonzini2017-08-084-7/+7
| | | | | | | | | | This reverts commit a59629fcc6f603e19b516dc08f75334e5c480bd0. This is not needed anymore because the IOThread mutex is not "magic" anymore (need not kick the CPU thread)and also because fork callbacks are only enabled at the very beginning of QEMU's execution. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* rcu: completely disable pthread_atfork callbacks as soon as possiblePaolo Bonzini2017-08-083-0/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | Because of -daemonize, system mode QEMU sometimes needs to fork() and keep RCU enabled in the child. However, there is a possible deadlock with synchronize_rcu: - the CPU thread is inside a RCU critical section and wants to take the BQL in order to do MMIO - the monitor thread, which is owning the BQL, calls rcu_init_lock which tries to take the rcu_sync_lock - the call_rcu thread has taken rcu_sync_lock in synchronize_rcu, but synchronize_rcu needs the CPU thread to end the critical section before returning. This cannot happen for user-mode emulation, because it does not have a BQL. To fix it, assume that system mode QEMU only forks in preparation for exec (except when daemonizing) and disable pthread_atfork as soon as the double fork has happened. Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* Merge remote-tracking branch 'remotes/yongbok/tags/mips-20170803' into stagingPeter Maydell2017-08-046-56/+89
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MIPS patches 2017-08-03 Changes: KVM T&E segment support for TCG malta: leave space for the bootmap after the initrd Apply CP0.PageMask before writing into TLB entry Fix fallout from indirect branch optimisation # gpg: Signature made Thu 03 Aug 2017 15:32:59 BST # gpg: using RSA key 0x2238EB86D5F797C2 # gpg: Good signature from "Yongbok Kim <yongbok.kim@imgtec.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 8600 4CF5 3415 A5D9 4CFA 2B5C 2238 EB86 D5F7 97C2 * remotes/yongbok/tags/mips-20170803: target/mips: Fix RDHWR CC with icount target/mips: Drop redundant gen_io_start/stop() target/mips: Use BS_EXCP where interrupts are expected target-mips: apply CP0.PageMask before writing into TLB entry mips: Add KVM T&E segment support for TCG mips: Improve segment defs for KVM T&E guests mips/malta: leave space for the bootmap after the initrd target-mips: Don't stop on [d]mtc0 DESAVE/KScratch Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/mips: Fix RDHWR CC with icountJames Hogan2017-08-021-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | RDHWR CC reads the CPU timer like MFC0 CP0_Count, so with icount enabled it must set can_do_io while it calls the helper to avoid the "Bad icount read" error. It should also break out of the translation loop to ensure that timer interrupts are immediately handled. Fixes: 2e70f6efa8b9 ("Add instruction counter.") Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Yongbok Kim <yongbok.kim@imgtec.com> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
| * target/mips: Drop redundant gen_io_start/stop()James Hogan2017-08-021-8/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | DMTC0 CP0_Cause does a redundant gen_io_start() and gen_io_end() pair, even though this is done for all DMTC0 operations outside of the switch statement. Remove these redundant calls. Fixes: 5dc5d9f055c5 ("mips: more fixes to the MIPS interrupt glue logic") Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: Yongbok Kim <yongbok.kim@imgtec.com> Cc: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
| * target/mips: Use BS_EXCP where interrupts are expectedJames Hogan2017-08-021-13/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit e350d8ca3ac7 ("target/mips: optimize indirect branches") made indirect branches able to directly find the next TB and jump straight to it without breaking out of translated code and going around the main execution loop. This breaks the assumption in target/mips/translate.c that BS_STOP is sufficient to cause pending interrupts to be handled, since interrupts are only checked in the main loop. Fix a few of these assumptions by using gen_save_pc to update the saved PC and using BS_EXCP instead of BS_STOP: - [D]MFC0 CP0_Count may trigger a timer interrupt which should be immediately handled. - [D]MTC0 CP0_Cause may trigger an interrupt (but in fact translation was only even being stopped in the DMTC0 case). - [D]MTC0 CP0_<any> when icount is used is assumed could potentially cause interrupts. - EI may trigger an interrupt which was pending. I specifically hit this case when running KVM nested in mipsel-softmmu. A timer interrupt while the 2nd guest was executing is caught by KVM which switches back to the normal Linux exception base and re-enables interrupts with EI. Since the above commit QEMU doesn't leave translated code until the nested KVM has already restored the KVM exception base and returned to the 2nd guest, at which point it is too late to check for pending interrupts and it gets stuck in an infinite loop of unhandled interrupts. Something similar was needed for ARM in commit b29fd33db578 ("target/arm: use DISAS_EXIT for eret handling"). Fixes: e350d8ca3ac7 ("target/mips: optimize indirect branches") Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Yongbok Kim <yongbok.kim@imgtec.com> Cc: Richard Henderson <rth@twiddle.net> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
| * target-mips: apply CP0.PageMask before writing into TLB entryLeon Alrae2017-08-021-2/+3
| | | | | | | | | | | | | | | | | | | | PFN0 and PFN1 have to be masked out with PageMask_Mask. Signed-off-by: Leon Alrae <leon.alrae@imgtec.com> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> [Yongbok Kim: Added commit message] Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
| * mips: Add KVM T&E segment support for TCGJames Hogan2017-08-025-16/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MIPS KVM trap & emulate guest kernels have a different segment layout compared with traditional MIPS kernels, to allow both the user and kernel code to run from the user address segment without repeatedly trapping to KVM. QEMU currently supports this layout only for KVM, but its sometimes useful to be able to run these kernels in QEMU on a PC, so enable it for TCG too. This also paves the way for MIPS KVM VZ support (which uses the normal virtual memory layout) by abstracting whether user mode kernel segments are in use. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: Yongbok Kim <yongbok.kim@imgtec.com> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: kvm@vger.kernel.org Reviewed-by: Richard Henderson <rth@twiddle.net> [Yongbok Kim: minor change] Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
| * mips: Improve segment defs for KVM T&E guestsJames Hogan2017-08-021-12/+11Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Improve the segment definitions used by get_physical_address() to yield target_ulong types, e.g. 0xffffffff80000000 instead of 0x80000000. This is in preparation for enabling emulation of MIPS KVM T&E segments in TCG MIPS targets, which unlike KVM could potentially have 64-bit target_ulong. In such a case the offset guest KSEG0 address ends up at e.g. 0x000000008xxxxxxx instead of 0xffffffff8xxxxxxx. This also allows the casts to int32_t that force sign extension to be removed, which removes any confusion due to relational comparison of unsigned (target_ulong) and signed (int32_t) types. Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: Yongbok Kim <yongbok.kim@imgtec.com> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: kvm@vger.kernel.org Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
| * mips/malta: leave space for the bootmap after the initrdAurelien Jarno2017-08-021-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since commit 9768e2abf7 the initrd is loaded at the end of the low memory to avoid clash for the kernel relocation when kaslr is used. However this in turn conflicts with the bootmap memory that the kernel tries to place after initrd, but in low memory. The bootmap spans the whole usable physical address space. The machine can have at most 2GiB of memory, 256MiB of low memory mapped at 0x00000000, and 1792MiB of high memory mapped at 0x90000000. The biggest bootmap therefore corresponds to the adresses 0x00000000 -> 0xffffffff, which at 1 bit per 4kiB page corresponds to 128kiB in memory. Therefore reserve 128kiB after the initrd. Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Tested-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
| * target-mips: Don't stop on [d]mtc0 DESAVE/KScratchJames Hogan2017-08-021-4/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Writing to the MIPS DESAVE register (and now the KScratch registers) will stop translation, supposedly due to risk of execution mode switches. However these registers are basically RW scratch registers with no side effects so there is no risk of them triggering execution mode changes. Drop the bstate = BS_STOP for these registers for both mtc0 and dmtc0. Fixes: 7a387fffce50 ("Add MIPS32R2 instructions, and generally straighten out the instruction decoding. This is also the first percent towards MIPS64 support.") Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Yongbok Kim <yongbok.kim@imgtec.com> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
* | Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell2017-08-045-9/+33
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | virtio: fix for rc2 Looks like the constant stream of additions of vhost-user devices is a problem for some people who are concerned about external connections from qemu. A per-device flag seems like an overkill, but a single configure flag seems like a sane way to support that, and it looks like we need to do it before the release. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Thu 03 Aug 2017 13:57:57 BST # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: build-sys: add --disable-vhost-user Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | build-sys: add --disable-vhost-userMarc-André Lureau2017-08-035-9/+33
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Learn to compile out vhost-user (net, scsi & upcoming users). Keep it enabled by default on non-win32, that is assumed to be POSIX. Fail if trying to enable it on win32. When trying to make a vhost-user netdev, it gives the following error: -netdev vhost-user,id=foo,chardev=chr-test: Parameter 'type' expects a netdev backend type And similar error with the HMP/QMP monitors. While at it, rename CONFIG_VHOST_NET_TEST CONFIG_VHOST_USER_NET_TEST since it's a vhost-user specific variable. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | Merge remote-tracking branch 'remotes/thibault/tags/samuel-thibault' into ↵Peter Maydell2017-08-042-40/+97
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging slirp updates # gpg: Signature made Wed 02 Aug 2017 23:27:41 BST # gpg: using RSA key 0x9E511E01C737F075 # gpg: Good signature from "Samuel Thibault <samuel.thibault@aquilenet.fr>" # gpg: aka "Samuel Thibault <sthibault@debian.org>" # gpg: aka "Samuel Thibault <samuel.thibault@gnu.org>" # gpg: aka "Samuel Thibault <samuel.thibault@inria.fr>" # gpg: aka "Samuel Thibault <samuel.thibault@labri.fr>" # gpg: aka "Samuel Thibault <samuel.thibault@ens-lyon.org>" # gpg: aka "Samuel Thibault <samuel.thibault@u-bordeaux.fr>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 900C B024 B679 31D4 0F82 304B D017 8C76 7D06 9EE6 # Subkey fingerprint: 9A37 3D36 64A8 DC62 DA0A 34FD 9E51 1E01 C737 F075 * remotes/thibault/tags/samuel-thibault: slirp: check len against dhcp options array end slirp: fill error when failing to initialize user network Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * slirp: check len against dhcp options array endPrasad J Pandit2017-08-031-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | While parsing dhcp options string in 'dhcp_decode', if an options' length 'len' appeared towards the end of 'bp_vend' array, ensuing read could lead to an OOB memory access issue. Add check to avoid it. This is CVE-2017-11434. Reported-by: Reno Robert <renorobert@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
| * slirp: fill error when failing to initialize user networkHervé Poussineau2017-08-031-40/+94
|/ | | | | | | | | | | | With "-netdev user,id=net0,dns=1.2.3.4" error was: qemu-system-i386: -netdev user,id=net0,dns=1.2.3.4: Device 'user' could not be initialized Error is now: qemu-system-i386: -netdev user,id=net0,dns=1.2.3.4: DNS doesn't belong to network Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* Update version for v2.10.0-rc1 releasePeter Maydell2017-08-021-1/+1
| | | | Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* tests/hmp: Fix typo in the 'chardev-send-break' testThomas Huth2017-08-022-1/+2
| | | | | | | | | | | | | testchardev2 is not a valid chardev id here. Use testchardev1 instead which has been created with chardev-add right before the 'chardev-send-break' line. And while we're at it, add the test-hmp.c file to the MAINTAINERS file, too. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1501149097-19071-1-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge remote-tracking branch ↵Peter Maydell2017-08-023-3/+14
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/dgilbert/tags/pull-migration-20170802a' into staging Migration pull 2017-08-02 Just minor fixes for 2.10 # gpg: Signature made Wed 02 Aug 2017 14:55:21 BST # gpg: using RSA key 0x0516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert/tags/pull-migration-20170802a: io: fix qio_channel_socket_accept err handling migration: fix comment disorder in RAMState migration: fix small leaks Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * io: fix qio_channel_socket_accept err handlingPeter Xu2017-08-021-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When accept failed, we should setup errp with the reason. More importantly, the caller may assume errp be non-NULL when error happens, and not setting the errp may crash QEMU. At the same time, move the trace_qio_channel_socket_accept_fail() after the if check on EINTR. Two reasons: 1. when EINTR happened, it's not really a fault (we should just try again), so we should not log with an "accept failure". 2. trace_*() functions may overwrite errno, then the old errno will be missing. We need to either check errno before trace_*() calls, or reserve the errno. Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1501666880-10159-3-git-send-email-peterx@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
| * migration: fix comment disorder in RAMStatePeter Xu2017-08-021-2/+2
| | | | | | | | | | | | | | | | | | | | | | Comments for "migration_dirty_pages" and "bitmap_mutex" are switched. Fix it. Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1501666880-10159-2-git-send-email-peterx@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
| * migration: fix small leaksMarc-André Lureau2017-08-021-0/+10
|/ | | | | | | | | | | | | | | | | | | | | | | | Spotted thanks to valgrind and tests/device-introspect-test: ==11711== 1 bytes in 1 blocks are definitely lost in loss record 6 of 14,537 ==11711== at 0x4C2EB6B: malloc (vg_replace_malloc.c:299) ==11711== by 0x1E0CDBD8: g_malloc (gmem.c:94) ==11711== by 0x1E0E696E: g_strdup (gstrfuncs.c:363) ==11711== by 0x695693: migration_instance_init (migration.c:2226) ==11711== by 0x717C4B: object_init_with_type (object.c:344) ==11711== by 0x717E80: object_initialize_with_type (object.c:375) ==11711== by 0x7182EB: object_new_with_type (object.c:483) ==11711== by 0x718328: object_new (object.c:493) ==11711== by 0x4B8A29: qmp_device_list_properties (qmp.c:542) ==11711== by 0x4A9561: qmp_marshal_device_list_properties (qmp-marshal.c:1425) ==11711== by 0x819D4A: do_qmp_dispatch (qmp-dispatch.c:104) ==11711== by 0x819E82: qmp_dispatch (qmp-dispatch.c:131) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170801160419.14180-1-marcandre.lureau@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell2017-08-0212-22/+77
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pc, acpi, virtio: fixes, test speedup for rc1 Some fixes all over the place. Notably vhost-user gained a new message to set endian-ness. Borderline for 2.10 but seems to be the only way to fix legacy guests. Also pc tests are run on kvm now. Not a fix at all but doesn't touch qemu itself, so I merged it since I had to run these a lot and I just got tired of waiting for these to finish. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Tue 01 Aug 2017 22:36:47 BST # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: pc: acpi: force FADT rev1 for 440fx based machine types pc: make 'pc.rom' readonly when machine has PCI enabled vhost-user: fix watcher need be removed when vhost-user hotplug tests/bios-tables-test: Compiler warning fix accel: cleanup error output intel_iommu: use access_flags for iotlb intel_iommu: fix iova for pt vhost-user: fix legacy cross-endian configurations vhost: fix a memory leak tests: switch pxe and vm gen id tests to use kvm Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * pc: acpi: force FADT rev1 for 440fx based machine typesIgor Mammedov2017-08-011-4/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | w2k used to boot on QEMU until revision of FADT has been bumped to rev3 (commit 77af8a2b hw/i386: Use Rev3 FADT (ACPI 2.0) instead of Rev1 to improve guest OS support.) Keep PC machine at rev1 to remain compatible and Q35 at rev3 where w2k isn't supported anyway so OSX could run as well. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Tested-by: John Arbuckle <programmingkidx@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pc: make 'pc.rom' readonly when machine has PCI enabledIgor Mammedov2017-08-011-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | looking at bios ROM mapping in QEMU it seems that only isapc (i.e. not PCI enabled machine) requires ROM being mapped as RW in other cases BIOS is mapped as RO. Do the same for option ROM 'pc.rom' when machine has PCI enabled. As useful side-effect pc.rom MemoryRegion stops being put in vhost memory map (filtered out by vhost_section()), which reduces number of entries by 1. Coincidentally it fixes migration failure reported in "[PATCH V2] vhost: fix a migration failed because of vhost region merge" where following destination CLI with /sys/module/vhost/parameters/max_mem_regions = 8 export DIMMSCOUNT=6 QEMU -enable-kvm \ -netdev type=tap,id=guest0,vhost=on,script=no,vhostforce \ -device virtio-net-pci,netdev=guest0 \ -m 256,slots=256,maxmem=2G \ `i=0; while [ $i -lt $DIMMSCOUNT ]; do echo \ "-object memory-backend-ram,id=m$i,size=128M \ -device pc-dimm,id=d$i,memdev=m$i"; i=$(($i + 1)); \ done` will fail to startup with error: "-device pc-dimm,id=d5,memdev=m5: a used vhost backend has no free memory slots left" while it's possible to add the 6th DIMM during hotplug on source. Issue is caused by the fact that number of entries in vhost map is bigger on 1 entry, when -device is processed, than after guest boots up, and that offending entry belongs to 'pc.rom', it's not like vhost intends to do IO in ROM range so making it RO hides region from vhost and makes number of entries in vhost memory map at -device/machine_done time match number of entries after guest boots. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reported-by: Peng Hao <peng.hao2@zte.com.cn> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * vhost-user: fix watcher need be removed when vhost-user hotplugYunjian Wang2017-08-011-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "nc" is freed after hotplug vhost-user, but the watcher is not removed. The QEMU crash when the watcher access the "nc" when socket disconnects. Program received signal SIGSEGV, Segmentation fault. #0 object_get_class (obj=obj@entry=0x2) at qom/object.c:750 #1 0x00007f9bb4180da1 in qemu_chr_fe_disconnect (be=<optimized out>) at chardev/char-fe.c:372 #2 0x00007f9bb40d1100 in net_vhost_user_watch (chan=<optimized out>, cond=<optimized out>, opaque=<optimized out>) at net/vhost-user.c:188 #3 0x00007f9baf97f99a in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0 #4 0x00007f9bb41d7ebc in glib_pollfds_poll () at util/main-loop.c:213 #5 os_host_main_loop_wait (timeout=<optimized out>) at util/main-loop.c:261 #6 main_loop_wait (nonblocking=nonblocking@entry=0) at util/main-loop.c:515 #7 0x00007f9bb3e266a7 in main_loop () at vl.c:1917 #8 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4786 Signed-off-by: Yunjian Wang <wangyunjian@huawei.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * tests/bios-tables-test: Compiler warning fixDr. David Alan Gilbert2017-08-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | gcc 7.1.1 in fedora 26 moans about the: tables = g_new0(uint32_t, tables_nr) because it can't convince itself that tables_nr is positive. This is fallout from g_assert_cmpint no longer necessarily being no-return; replace it with a plain g_assert. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
| * accel: cleanup error outputLaurent Vivier2017-08-011-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Only emit "XXX accelerator not found", if there are not further accelerators listed. eg accel=kvm:tcg doesn't print a "KVM accelerator not found" warning when it falls back to tcg, but a accel=kvm prints a warning, since no fallback is given. Suggested-by: Daniel P. Berrange <berrange@redhat.com> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: Thomas Huth <thuth@redhat.com>
| * intel_iommu: use access_flags for iotlbPeter Xu2017-08-012-10/+8Star
| | | | | | | | | | | | | | | | It was cached by read/write separately. Let's merge them. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * intel_iommu: fix iova for ptPeter Xu2017-08-012-3/+2Star
| | | | | | | | | | | | | | | | | | | | | | | | | | IOMMUTLBEntry.iova is returned incorrectly on one PT path (though mostly we cannot really trigger this path, even if we do, we are mostly disgarding this value, so it didn't break anything). Fix it by converting the VTD_PAGE_MASK into the correct definition VTD_PAGE_MASK_4K, then remove VTD_PAGE_MASK. Fixes: b93130 ("intel_iommu: cleanup vtd_{do_}iommu_translate()") Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * vhost-user: fix legacy cross-endian configurationsFelipe Franciosi2017-08-012-2/+37
| | | | | | | | | | | | | | | | | | | | | | | | Currently, vhost-user does not implement any means for notifying the backend about guest endianess. This commit introduces a new message called VHOST_USER_SET_VRING_ENDIAN which is analogous to the ioctl() called VHOST_SET_VRING_ENDIAN used for kernel vhost backends. Such message is necessary for backends supporting legacy (pre-1.0) virtio devices running in big-endian guests. Signed-off-by: Felipe Franciosi <felipe@nutanix.com> Signed-off-by: Mike Cui <cui@nutanix.com>
| * vhost: fix a memory leakPeng Hao2017-08-011-0/+2
| | | | | | | | | | | | | | | | | | vhost exists a call for g_file_get_contents, but not call g_free. Signed-off-by: Peng Hao<peng.hao2@zte.com.cn> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
| * tests: switch pxe and vm gen id tests to use kvmMichael S. Tsirkin2017-08-012-2/+2
| | | | | | | | | | | | | | | | | | | | Speed up tests on host systems with kvm support. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Thomas Huth <thuth@redhat.com> Cc: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
* | Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2017-08-0116-106/+437
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Xen fix (Anthony) * chardev fixes (Anton, Marc-André) * small dead code removal (Zhongyi) * documentation (Dan) * bugfixes (David) * decrease migration downtime (Jay) * improved error output (Laurent) * RTC tests and bugfix (me) * Bluetooth clang analyzer fix (me) * KVM CPU hotplug race (Peng Hao) * Two other patches from Philippe's clang analyzer series # gpg: Signature made Tue 01 Aug 2017 16:56:21 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: mc146818rtc: implement UIP latching as intended mc146818rtc: simplify check_update_timer rtc-test: introduce more update tests rtc-test: cleanup register_b_set_flag test hw/scsi/vmw_pvscsi: Convert to realize hw/scsi/vmw_pvscsi: Remove the dead error handling migration: optimize the downtime qemu-options: document existance of versioned machine types bt: stop the sdp memory allocation craziness exec: Add lock parameter to qemu_ram_ptr_length target-i386: kvm_get/put_vcpu_events don't handle sipi_vector docs: document deprecation policy & deprecated features in appendix char: don't exit on hmp 'chardev-add help' char-fd: remove useless chr pointer accel: cleanup error output cpu_physical_memory_sync_dirty_bitmap: Fix alignment check vl.c/exit: pause cpus before closing block devices Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | mc146818rtc: implement UIP latching as intendedPaolo Bonzini2017-08-011-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In some cases, the guest can observe the wrong ordering of UIP and interrupts. This can happen if the VCPU exit is timed like this: iothread VCPU ... wait for interrupt ... t-100ns read register A t wake up, take BQL t+100ns update_in_progress return false return UIP=0 trigger interrupt The interrupt is late; the VCPU expected the falling edge of UIP to happen after the interrupt. update_in_progress is already trying to cover this case by latching UIP if the timer is going to fire soon, and the fix is documented in the commit message for commit 56038ef623 ("RTC: Update the RTC clock only when reading it", 2012-09-10). It cannot be tested with qtest, because its timing of interrupts vs. reads is exact. However, the implementation was incorrect because UIP cmos_ioport_read cleared register A instead of leaving that to rtc_update_timer. Fixing the implementation of cmos_ioport_read to match the commit message, however, breaks the "uip-stuck" test case from the previous patch. To fix it, skip update timer optimizations if UIP has been latched. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | mc146818rtc: simplify check_update_timerPaolo Bonzini2017-08-011-13/+11Star
| | | | | | | | | | | | | | | | | | | | | Move all the optimized cases together, since they all have UF=1 in common. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | rtc-test: introduce more update testsPaolo Bonzini2017-08-011-1/+81
| | | | | | | | | | | | | | | | | | Test divider reset and UIP behavior. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | rtc-test: cleanup register_b_set_flag testPaolo Bonzini2017-08-011-30/+46
| | | | | | | | | | | | | | | | | | | | | Introduce set_datetime_bcd/assert_datetime_bcd, and handle UIP correctly. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | hw/scsi/vmw_pvscsi: Convert to realizeMao Zhongyi2017-08-011-5/+3Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Convert a device model where initialization obviously can't fail, make it implement realize() rather than init(). Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com> Message-Id: <20170726084153.10121-2-maozy.fnst@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | hw/scsi/vmw_pvscsi: Remove the dead error handlingMao Zhongyi2017-08-011-4/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | qemu_bh_new() is a wrapper around aio_bh_new(), which returns null only when g_new() does. It doesn't. So remove the dead error handling. Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com> Message-Id: <20170726084153.10121-1-maozy.fnst@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | migration: optimize the downtimeJay Zhou2017-08-011-1/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Qemu_savevm_state_cleanup takes about 300ms in my ram migration tests with a 8U24G vm(20G is really occupied), the main cost comes from KVM_SET_USER_MEMORY_REGION ioctl when mem.memory_size = 0 in kvm_set_user_memory_region. In kmod, the main cost is kvm_zap_obsolete_pages, which traverses the active_mmu_pages list to zap the unsync sptes. It can be optimized by delaying memory_global_dirty_log_stop to the next vm_start. Changes v2->v3: - NULL VMChangeStateHandler if it is deleted and protect the scenario of nested invocations of memory_global_dirty_log_start/stop [Paolo] Changes v1->v2: - create a VMChangeStateHandler in memory.c to reduce the coupling [Paolo] Signed-off-by: Jay Zhou <jianjay.zhou@huawei.com> Message-Id: <1501237733-2736-1-git-send-email-jianjay.zhou@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | qemu-options: document existance of versioned machine typesDaniel P. Berrange2017-08-011-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The -machine docs did not explain what the versioned machine types are for, nor that they'll be maintained across releases. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <20170725141041.1195-1-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | bt: stop the sdp memory allocation crazinessPaolo Bonzini2017-08-011-4/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Clang static analyzer reports a memory leak. Actually, the allocated memory escapes here: record->attribute_list[record->attributes].pair = data; but clang is correct that the memory might leak if len is zero. We know it isn't; assert that it is the case. The craziness doesn't end there. The memory is freed by bt_l2cap_sdp_close_ch: g_free(sdp->service_list[i].attribute_list->pair); which actually should have been written like this: g_free(sdp->service_list[i].attribute_list[0].pair); The attribute_list is sorted with qsort; but indeed the first entry of attribute_list should point to "data" even after the qsort, because the first record has id SDP_ATTR_RECORD_HANDLE, whose numeric value is zero. But hang on. The qsort function is static int sdp_attributeid_compare( const struct sdp_service_attribute_s *a, const struct sdp_service_attribute_s *b) { return (int) b->attribute_id - a->attribute_id; } but no one ever writes attribute_id. So it only works if qsort is stable, and who knows what else is broken, but we can fix it by setting attribute_id in the while loop. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | exec: Add lock parameter to qemu_ram_ptr_lengthAnthony PERARD2017-08-011-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 04bf2526ce87f21b32c9acba1c5518708c243ad0 (exec: use qemu_ram_ptr_length to access guest ram) start using qemu_ram_ptr_length instead of qemu_map_ram_ptr, but when used with Xen, the behavior of both function is different. They both call xen_map_cache, but one with "lock", meaning the mapping of guest memory is never released implicitly, and the second one without, which means, mapping can be release later, when needed. In the context of address_space_{read,write}_continue, the ptr to those mapping should not be locked because it is used immediatly and never used again. The lock parameter make it explicit in which context qemu_ram_ptr_length is called. Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Message-Id: <20170726165326.10327-1-anthony.perard@citrix.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | target-i386: kvm_get/put_vcpu_events don't handle sipi_vectorPeng Hao2017-08-011-15/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | qemu call kvm_get_vcpu_events, and kernel return sipi_vector always 0, never valid when reporting to user space. But when qemu calls kvm_put_vcpu_events will make sipi_vector in kernel be 0. This will accidently modify sipi_vector when sipi_vector in kernel is not 0. Signed-off-by: Peng Hao <peng.hao2@zte.com.cn> Reviewed-by: Liu Yi <liu.yi24@zte.com.cn> Message-Id: <1500047256-8911-1-git-send-email-peng.hao2@zte.com.cn> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | docs: document deprecation policy & deprecated features in appendixDaniel P. Berrange2017-08-011-0/+175
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The deprecation of features in QEMU is totally adhoc currently, with no way for the user to get a list of what is deprecated in each release. This adds an appendix to the doc that records when each deprecation was made and provides text explaining what to use instead, if anything. Since there has been no formal policy around removal of deprecated features in the past, any deprecations prior to 2.10.0 are to be treated as if they had been made at the 2.10.0 release. Thus the earliest that existing deprecations will be deleted is the start of the 2.12.0 cycle. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <20170725113638.7019-1-berrange@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | char: don't exit on hmp 'chardev-add help'Anton Nefedov2017-08-013-6/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | qemu_chr_new_from_opts() is used from both vl.c and hmp, and it is quite confusing to see qemu suddenly exit after receiving a help option in hmp. Do exit(0) from vl.c instead. Signed-off-by: Anton Nefedov <anton.nefedov@virtuozzo.com> Message-Id: <1500977081-120929-1-git-send-email-anton.nefedov@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | char-fd: remove useless chr pointerMarc-André Lureau2017-08-012-2/+1Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Apparently unused since it was introduced in commit a29753f8aa79a34a324afebe340182a51a5aef11. Now, it can be trivially accessed by CHARDEV() of self. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170720100046.4424-1-marcandre.lureau@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-01-08 17:15:47 +0100