qemu.git
2 hours agoMerge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-5.0-pull-request... master github/master
Peter Maydell [Mon, 30 Mar 2020 10:32:00 +0000 (11:32 +0100)] 
Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-5.0-pull-request' into staging

Add support for futex_time64

# gpg: Signature made Mon 30 Mar 2020 11:29:16 BST
# gpg:                using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C
# gpg:                issuer "laurent@vivier.eu"
# gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full]
# gpg:                 aka "Laurent Vivier <laurent@vivier.eu>" [full]
# gpg:                 aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full]
# Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F  5173 F30C 38BD 3F2F BE3C

* remotes/vivier2/tags/linux-user-for-5.0-pull-request:
  linux-user: Support futex_time64

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2 hours agolinux-user: Support futex_time64
Alistair Francis [Wed, 18 Mar 2020 22:47:01 +0000 (15:47 -0700)] 
linux-user: Support futex_time64

Add support for host and target futex_time64. If futex_time64 exists on
the host we try that first before falling back to the standard futex
syscall.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <d9390e368a9a1fd32d52aa771815e6e3d40cb1d4.1584571250.git.alistair.francis@wdc.com>
[lv: define sys_futex() if __NR_futex is defined (fix bug on 32bit host),
     remove duplicate get_errno()]
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2 days agoMerge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging
Peter Maydell [Sat, 28 Mar 2020 00:27:04 +0000 (00:27 +0000)] 
Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

Pull request

# gpg: Signature made Fri 27 Mar 2020 20:14:10 GMT
# gpg:                using RSA key F9B7ABDBBCACDF95BE76CBD07DEF8106AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" [full]
# Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
#      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

* remotes/jnsnow/tags/ide-pull-request:
  cmd646-ide: use qdev gpio rather than qemu_allocate_irqs()
  via-ide: use qdev gpio rather than qemu_allocate_irqs()
  via-ide: don't use PCI level for legacy IRQs
  hw/ide/sii3112: Use qdev gpio rather than qemu_allocate_irqs()
  fdc/i8257: implement verify transfer mode

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2 days agocmd646-ide: use qdev gpio rather than qemu_allocate_irqs()
Mark Cave-Ayland [Tue, 24 Mar 2020 21:05:19 +0000 (21:05 +0000)] 
cmd646-ide: use qdev gpio rather than qemu_allocate_irqs()

This prevents the memory from qemu_allocate_irqs() from being leaked which
can in some cases be spotted by Coverity (CID 1421984).

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-id: 20200324210519.2974-4-mark.cave-ayland@ilande.co.uk
Signed-off-by: John Snow <jsnow@redhat.com>
2 days agovia-ide: use qdev gpio rather than qemu_allocate_irqs()
Mark Cave-Ayland [Tue, 24 Mar 2020 21:05:18 +0000 (21:05 +0000)] 
via-ide: use qdev gpio rather than qemu_allocate_irqs()

This prevents the memory from qemu_allocate_irqs() from being leaked which
can in some cases be spotted by Coverity (CID 1421984).

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-id: 20200324210519.2974-3-mark.cave-ayland@ilande.co.uk
Signed-off-by: John Snow <jsnow@redhat.com>
2 days agovia-ide: don't use PCI level for legacy IRQs
Mark Cave-Ayland [Tue, 24 Mar 2020 21:05:17 +0000 (21:05 +0000)] 
via-ide: don't use PCI level for legacy IRQs

The PCI level calculation was accidentally left in when rebasing from a
previous patchset. Since both IRQs are driven separately, the value
being passed into the IRQ handler should be used directly.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-id: 20200324210519.2974-2-mark.cave-ayland@ilande.co.uk
Signed-off-by: John Snow <jsnow@redhat.com>
2 days agohw/ide/sii3112: Use qdev gpio rather than qemu_allocate_irqs()
Peter Maydell [Mon, 23 Mar 2020 15:17:15 +0000 (15:17 +0000)] 
hw/ide/sii3112: Use qdev gpio rather than qemu_allocate_irqs()

Coverity points out (CID 1421984) that we are leaking the
memory returned by qemu_allocate_irqs(). We can avoid this
leak by switching to using qdev_init_gpio_in(); the base
class finalize will free the irqs that this allocates under
the hood.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Tested-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-id: 20200323151715.29454-1-peter.maydell@linaro.org
[Maintainer edit: replace `DEVICE(dev)` by `ds` --js]
Signed-off-by: John Snow <jsnow@redhat.com>
2 days agofdc/i8257: implement verify transfer mode
Sven Schnelle [Fri, 1 Nov 2019 16:55:13 +0000 (17:55 +0100)] 
fdc/i8257: implement verify transfer mode

While working on the Tulip driver i tried to write some Teledisk images to
a floppy image which didn't work. Turned out that Teledisk checks the written
data by issuing a READ command to the FDC but running the DMA controller
in VERIFY mode. As we ignored the DMA request in that case, the DMA transfer
never finished, and Teledisk reported an error.

The i8257 spec says about verify transfers:

3) DMA verify, which does not actually involve the transfer of data. When an
8257 channel is in the DMA verify mode, it will respond the same as described
for transfer operations, except that no memory or I/O read/write control signals
will be generated.

Hervé proposed to remove all the dma_mode_ok stuff from fdc to have a more
clear boundary between DMA and FDC, so this patch also does that.

Suggested-by: Hervé Poussineau <hpoussin@reactos.org>
Signed-off-by: Sven Schnelle <svens@stackframe.org>
Reviewed-by: Hervé Poussineau <hpoussin@reactos.org>
2 days agoMerge remote-tracking branch 'remotes/stsquad/tags/pull-testing-270320-2' into staging
Peter Maydell [Fri, 27 Mar 2020 18:15:01 +0000 (18:15 +0000)] 
Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-270320-2' into staging

Testing updates:

  - docker updates (various dependencies)
  - travis updates (s390x KVM build)
  - tweak qemu/atomic.h headers in event of clash
  - test/vm updates (NetBSD -> 9.0, FreeBSD -> 12.1)
  - disable MTTCG for mips64/mips64el

# gpg: Signature made Fri 27 Mar 2020 13:45:18 GMT
# gpg:                using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [full]
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8  DF35 FBD0 DB09 5A9E 2A44

* remotes/stsquad/tags/pull-testing-270320-2:
  .travis.yml: Add a KVM-only s390x job
  tests/docker: Add libepoxy and libudev packages to the Fedora image
  tests/docker: Use Python3 PyYAML in the Fedora image
  tests/docker: Install gcrypt devel package in Debian image
  tests/docker: Keep package list sorted
  configure: disable MTTCG for MIPS guests
  tests/vm: fix basevm config
  tests/vm: update NetBSD to 9.0
  tests/vm: update FreeBSD to 12.1
  tests/vm: move vga setup
  tests/vm: write raw console log
  qemu/atomic.h: add #ifdef guards for stdatomic.h

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2 days agoMerge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Peter Maydell [Fri, 27 Mar 2020 16:04:22 +0000 (16:04 +0000)] 
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches:

- Fix another case of mirror block job deadlocks
- Minor fixes

# gpg: Signature made Fri 27 Mar 2020 15:18:37 GMT
# gpg:                using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full]
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream:
  qcow2: Remove unused fields from BDRVQcow2State
  mirror: Wait only for in-flight operations
  Revert "mirror: Don't let an operation wait for itself"
  nvme: Print 'cqid' for nvme_del_cq
  block: fix bdrv_root_attach_child forget to unref child_bs
  block/iscsi:use the flags in iscsi_open() prevent Clang warning

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2 days agoqcow2: Remove unused fields from BDRVQcow2State
Kevin Wolf [Thu, 26 Mar 2020 17:07:57 +0000 (18:07 +0100)] 
qcow2: Remove unused fields from BDRVQcow2State

These fields were already removed in commit c3c10f72, but then commit
b58deb34 revived them probably due to bad merge conflict resolution.
They are still unused, so remove them again.

Fixes: b58deb344ddff3b9d8b265bf73a65274767ee5f4
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20200326170757.12344-1-kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 days agomirror: Wait only for in-flight operations
Kevin Wolf [Thu, 26 Mar 2020 15:36:28 +0000 (16:36 +0100)] 
mirror: Wait only for in-flight operations

mirror_wait_for_free_in_flight_slot() just picks a random operation to
wait for. However, a MirrorOp is already in s->ops_in_flight when
mirror_co_read() waits for free slots, so if not enough slots are
immediately available, an operation can end up waiting for itself, or
two or more operations can wait for each other to complete, which
results in a hang.

Fix this by adding a flag to MirrorOp that tells us if the request is
already in flight (and therefore occupies slots that it will later
free), and picking only such operations for waiting.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1794692
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20200326153628.4869-3-kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 days agoRevert "mirror: Don't let an operation wait for itself"
Kevin Wolf [Thu, 26 Mar 2020 15:36:27 +0000 (16:36 +0100)] 
Revert "mirror: Don't let an operation wait for itself"

This reverts commit 7e6c4ff792734e196c8ca82564c56b5e7c6288ca.

The fix was incomplete as it only protected against requests waiting for
themselves, but not against requests waiting for each other. We need a
different solution.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20200326153628.4869-2-kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 days agonvme: Print 'cqid' for nvme_del_cq
Minwoo Im [Tue, 24 Mar 2020 14:06:46 +0000 (23:06 +0900)] 
nvme: Print 'cqid' for nvme_del_cq

The given argument for this trace should be cqid, not sqid.

Signed-off-by: Minwoo Im <minwoo.im.dev@gmail.com>
Message-Id: <20200324140646.8274-1-minwoo.im.dev@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 days agoblock: fix bdrv_root_attach_child forget to unref child_bs
Vladimir Sementsov-Ogievskiy [Tue, 24 Mar 2020 15:59:21 +0000 (18:59 +0300)] 
block: fix bdrv_root_attach_child forget to unref child_bs

bdrv_root_attach_child promises to drop child_bs reference on failure.
It does it on first handled failure path, but not on the second. Fix
that.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200324155921.23822-1-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 days agoblock/iscsi:use the flags in iscsi_open() prevent Clang warning
Chen Qun [Wed, 11 Mar 2020 03:29:27 +0000 (11:29 +0800)] 
block/iscsi:use the flags in iscsi_open() prevent Clang warning

Clang static code analyzer show warning:
  block/iscsi.c:1920:9: warning: Value stored to 'flags' is never read
        flags &= ~BDRV_O_RDWR;
        ^        ~~~~~~~~~~~~

In iscsi_allocmap_init() only checks BDRV_O_NOCACHE, which
is the same in both of flags and bs->open_flags.
We can use the flags instead bs->open_flags to prevent Clang warning.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20200311032927.35092-1-kuhn.chenqun@huawei.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 days ago.travis.yml: Add a KVM-only s390x job
Philippe Mathieu-Daudé [Mon, 23 Mar 2020 16:15:14 +0000 (16:15 +0000)] 
.travis.yml: Add a KVM-only s390x job

Add a job to build QEMU on s390x with TCG disabled, so
this configuration won't bitrot over time.

This job is quick, running check-unit: Ran for 5 min 30 sec
https://travis-ci.org/github/philmd/qemu/jobs/665456423

Acked-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200322154015.25358-1-philmd@redhat.com>
Message-Id: <20200323161514.23952-12-alex.bennee@linaro.org>

2 days agotests/docker: Add libepoxy and libudev packages to the Fedora image
Philippe Mathieu-Daudé [Mon, 23 Mar 2020 16:15:13 +0000 (16:15 +0000)] 
tests/docker: Add libepoxy and libudev packages to the Fedora image

Install optional dependencies of QEMU to get better coverage.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200322120104.21267-5-philmd@redhat.com>
Message-Id: <20200323161514.23952-11-alex.bennee@linaro.org>

2 days agotests/docker: Use Python3 PyYAML in the Fedora image
Philippe Mathieu-Daudé [Mon, 23 Mar 2020 16:15:12 +0000 (16:15 +0000)] 
tests/docker: Use Python3 PyYAML in the Fedora image

The Python2 PyYAML is now pointless, switch to the Python3 version.

Fixes: bcbf27947 (docker: move tests from python2 to python3)
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200322120104.21267-4-philmd@redhat.com>
Message-Id: <20200323161514.23952-10-alex.bennee@linaro.org>

2 days agotests/docker: Install gcrypt devel package in Debian image
Philippe Mathieu-Daudé [Mon, 23 Mar 2020 16:15:11 +0000 (16:15 +0000)] 
tests/docker: Install gcrypt devel package in Debian image

In commit 6f8bbb374be we enabled building with the gcrypt library
on the the Debian 'x86 host', which was based on Debian Stretch.
Later in commit 698a71edbed we upgraded the Debian base image to
Buster.

Apparently Debian Stretch was listing gcrypt as a QEMU dependency,
but this is not the case anymore in Buster, so we need to install
it manually (it it not listed by 'apt-get -s build-dep qemu' in
the common debian10.docker anymore). This fixes:

 $ ../configure $QEMU_CONFIGURE_OPTS

  ERROR: User requested feature gcrypt
         configure was not able to find it.
         Install gcrypt devel >= 1.5.0

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200322120104.21267-3-philmd@redhat.com>
Message-Id: <20200323161514.23952-9-alex.bennee@linaro.org>

2 days agotests/docker: Keep package list sorted
Philippe Mathieu-Daudé [Mon, 23 Mar 2020 16:15:10 +0000 (16:15 +0000)] 
tests/docker: Keep package list sorted

Keep package list sorted, this eases rebase/cherry-pick.

Fixes: 3a6784813
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200322120104.21267-2-philmd@redhat.com>
Message-Id: <20200323161514.23952-8-alex.bennee@linaro.org>

2 days agoconfigure: disable MTTCG for MIPS guests
Alex Bennée [Mon, 23 Mar 2020 16:15:09 +0000 (16:15 +0000)] 
configure: disable MTTCG for MIPS guests

While debugging check-acceptance failures I found an instability in
the mips64el test case. Briefly the test case:

  retry.py -n 100 -c -- ./mips64el-softmmu/qemu-system-mips64el \
    -display none -vga none -serial mon:stdio \
    -machine malta -kernel ./vmlinux-4.7.0-rc1.I6400 \
    -cpu I6400 -smp 8 -vga std \
    -append "printk.time=0 clocksource=GIC console=tty0 console=ttyS0 panic=-1" \
    --no-reboot

Reports about a 9% failure rate:

  Results summary:
  0: 91 times (91.00%), avg time 5.547 (0.45 varience/0.67 deviation)
  -6: 9 times (9.00%), avg time 3.394 (0.02 varience/0.13 deviation)
  Ran command 100 times, 91 passes

When re-run with "--accel tcg,thread=single" the instability goes
away.

  Results summary:
  0: 100 times (100.00%), avg time 17.318 (249.76 varience/15.80 deviation)
  Ran command 100 times, 100 passes

Which seems to indicate there is some aspect of the MIPS MTTCG fixes
that has been missed. Ideally we would fix that but I'm afraid I don't
have time to investigate and am not super familiar with the
architecture anyway. In lieu of someone tracking down the failure lets
disable it for now.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com>
Cc: Aurelien Jarno <aurelien@aurel32.net>
Cc: Aleksandar Rikalo <aleksandar.rikalo@rt-rk.com>
Message-Id: <20200323161514.23952-7-alex.bennee@linaro.org>

2 days agotests/vm: fix basevm config
Alex Bennée [Mon, 23 Mar 2020 16:15:08 +0000 (16:15 +0000)] 
tests/vm: fix basevm config

When the patch was merged it was part of a longer series which had
already merged the config changes. Semu-revert the config related
changes for now so things will build.

Fixes: b081986c85fd2
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20200323161514.23952-6-alex.bennee@linaro.org>

2 days agotests/vm: update NetBSD to 9.0
Gerd Hoffmann [Mon, 23 Mar 2020 16:15:07 +0000 (16:15 +0000)] 
tests/vm: update NetBSD to 9.0

The installer supports GPT now, so the install workflow has changed a
bit.  Also: run without VGA device.  This works around a bug in the
seabios sercon code and makes the bootloader menu show up on the serial
line, so we can drop the quirk for that.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20200310083218.26355-5-kraxel@redhat.com>
Message-Id: <20200323161514.23952-5-alex.bennee@linaro.org>

2 days agotests/vm: update FreeBSD to 12.1
Gerd Hoffmann [Mon, 23 Mar 2020 16:15:06 +0000 (16:15 +0000)] 
tests/vm: update FreeBSD to 12.1

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20200310083218.26355-4-kraxel@redhat.com>
Message-Id: <20200323161514.23952-4-alex.bennee@linaro.org>

2 days agotests/vm: move vga setup
Gerd Hoffmann [Mon, 23 Mar 2020 16:15:05 +0000 (16:15 +0000)] 
tests/vm: move vga setup

Move '-device VGA' from basevm.py to the guests, so they have
the chance to opt out and run without display device.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20200310083218.26355-3-kraxel@redhat.com>
Message-Id: <20200323161514.23952-3-alex.bennee@linaro.org>

2 days agotests/vm: write raw console log
Gerd Hoffmann [Mon, 23 Mar 2020 16:15:04 +0000 (16:15 +0000)] 
tests/vm: write raw console log

Run "tail -f /var/tmp/*/qemu*console.raw" in another terminal
to watch the install console.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20200310083218.26355-2-kraxel@redhat.com>
Message-Id: <20200323161514.23952-2-alex.bennee@linaro.org>

2 days agoqemu/atomic.h: add #ifdef guards for stdatomic.h
Alex Bennée [Thu, 26 Mar 2020 16:46:16 +0000 (16:46 +0000)] 
qemu/atomic.h: add #ifdef guards for stdatomic.h

Deep inside the FreeBSD netmap headers we end up including stdatomic.h
which clashes with qemu's atomic functions which are modelled along
the C11 standard. To avoid a massive rename lets just ifdef around the
problem.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20200326170121.13045-1-alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
3 days agoMerge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-5.0-pull-request...
Peter Maydell [Thu, 26 Mar 2020 20:55:54 +0000 (20:55 +0000)] 
Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-5.0-pull-request' into staging

Emulate x86_64 vsyscalls
Fix syscall_nr.h cleanup

# gpg: Signature made Thu 26 Mar 2020 07:23:16 GMT
# gpg:                using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C
# gpg:                issuer "laurent@vivier.eu"
# gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full]
# gpg:                 aka "Laurent Vivier <laurent@vivier.eu>" [full]
# gpg:                 aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full]
# Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F  5173 F30C 38BD 3F2F BE3C

* remotes/vivier2/tags/linux-user-for-5.0-pull-request:
  linux-user: Flush out implementation of gettimeofday
  linux-user: Add x86_64 vsyscall page to /proc/self/maps
  linux-user/i386: Emulate x86_64 vsyscalls
  linux-user/i386: Split out gen_signal
  target/i386: Renumber EXCP_SYSCALL
  linux-user, configure: fix (again) syscall_nr.h dependencies cleanup

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 days agoMerge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2020-03-26' into staging
Peter Maydell [Thu, 26 Mar 2020 15:44:26 +0000 (15:44 +0000)] 
Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2020-03-26' into staging

Block patches for 5.0-rc1:
- Fix qemu-img convert with a host device or iscsi target
- Use-after-free fix in mirror
- Some minor qcow2 fixes
- Minor sheepdog fix
- Minor qemu-img check report fix

# gpg: Signature made Thu 26 Mar 2020 14:28:26 GMT
# gpg:                using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40
# gpg:                issuer "mreitz@redhat.com"
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full]
# Primary key fingerprint: 91BE B60A 30DB 3E88 57D1  1829 F407 DB00 61D5 CF40

* remotes/maxreitz/tags/pull-block-2020-03-26:
  iotests/138: Test leaks/corruptions fixed report
  iotests: Add poke_file_[bl]e functions
  qemu-img: Fix check's leak/corruption fix report
  sheepdog: Consistently set bdrv_has_zero_init_truncate
  qcow2: Avoid feature name extension on small cluster size
  qcow2: List autoclear bit names in header
  qcow2: Comment typo fixes
  block: trickle down the fallback image creation function use to the block drivers
  block: pass BlockDriver reference to the .bdrv_co_create
  block/mirror: fix use after free of local_err

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 days agoiotests/138: Test leaks/corruptions fixed report
Max Reitz [Tue, 24 Mar 2020 17:27:57 +0000 (18:27 +0100)] 
iotests/138: Test leaks/corruptions fixed report

Test that qemu-img check reports the number of leaks and corruptions
fixed in its JSON report (after a successful run).

While touching the _unsupported_imgopts line, adjust the note on why
data_file does not work with this test: The current comment sounds a bit
like it is a mistake for qemu-img check not to check external data
files' refcounts.  But there are no such refcounts, so it is no mistake.
Just say that qemu-img check does not do much for external data files,
and this is why this test does not work with them.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200324172757.1173824-4-mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
3 days agoiotests: Add poke_file_[bl]e functions
Max Reitz [Tue, 24 Mar 2020 17:27:56 +0000 (18:27 +0100)] 
iotests: Add poke_file_[bl]e functions

Similarly to peek_file_[bl]e, we may want to write binary integers into
a file.  Currently, this often means messing around with poke_file and
raw binary strings.  I hope these functions make it a bit more
comfortable.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Code-suggested-by: Eric Blake <eblake@redhat.com>
Message-Id: <20200324172757.1173824-3-mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
3 days agoqemu-img: Fix check's leak/corruption fix report
Max Reitz [Tue, 24 Mar 2020 17:27:55 +0000 (18:27 +0100)] 
qemu-img: Fix check's leak/corruption fix report

There are two problems with qemu-img check's report on how many leaks
and/or corruptions have been fixed:

(1) ImageCheck.has_leaks_fixed and ImageCheck.has_corruptions_fixed are
only true when ImageCheck.leaks or ImageCheck.corruptions (respectively)
are non-zero.  qcow2's check implementation will set the latter to zero
after it has fixed leaks and corruptions, though, so leaks-fixed and
corruptions-fixed are actually never reported after successful repairs.
We should always report them when they are non-zero, just like all the
other fields of ImageCheck.

(2) After something has been fixed and we run the check a second time,
leaks_fixed and corruptions_fixed are taken from the first run; but
has_leaks_fixed and has_corruptions_fixed are not.  The second run
actually cannot fix anything, so with (1) fixed, has_leaks_fixed and
has_corruptions_fixed will always be false here.  (With (1) unfixed,
they will at least be false on successful runs, because then the number
of leaks and corruptions found in the second run should be 0.)
We should save has_leaks_fixed and has_corruptions_fixed just like we
save leaks_fixed and corruptions_fixed.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <20200324172757.1173824-2-mreitz@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
3 days agosheepdog: Consistently set bdrv_has_zero_init_truncate
Eric Blake [Tue, 24 Mar 2020 17:42:33 +0000 (12:42 -0500)] 
sheepdog: Consistently set bdrv_has_zero_init_truncate

block_int.h claims that .bdrv_has_zero_init must return 0 if
.bdrv_has_zero_init_truncate does likewise; but this is violated if
only the former callback is provided if .bdrv_co_truncate also exists.
When adding the latter callback, it was mistakenly added to only one
of the three possible sheepdog instantiations.

Fixes: 1dcaf527
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20200324174233.1622067-5-eblake@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
3 days agoqcow2: Avoid feature name extension on small cluster size
Eric Blake [Tue, 24 Mar 2020 17:42:32 +0000 (12:42 -0500)] 
qcow2: Avoid feature name extension on small cluster size

As the feature name table can be quite large (over 9k if all 64 bits
of all three feature fields have names; a mere 8 features leaves only
8 bytes for a backing file name in a 512-byte cluster), it is unwise
to emit this optional header in images with small cluster sizes.

Update iotest 036 to skip running on small cluster sizes; meanwhile,
note that iotest 061 never passed on alternative cluster sizes
(however, I limited this patch to tests with output affected by adding
feature names, rather than auditing for other tests that are not
robust to alternative cluster sizes).

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-Id: <20200324174233.1622067-4-eblake@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
3 days agoqcow2: List autoclear bit names in header
Eric Blake [Tue, 24 Mar 2020 17:42:31 +0000 (12:42 -0500)] 
qcow2: List autoclear bit names in header

The feature table is supposed to advertise the name of all feature
bits that we support; however, we forgot to update the table for
autoclear bits.  While at it, move the table to read-only memory in
code, and tweak the qcow2 spec to name the second autoclear bit.
Update iotests that are affected by the longer header length.

Fixes: 88ddffae
Fixes: 93c24936
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200324174233.1622067-3-eblake@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
3 days agoqcow2: Comment typo fixes
Eric Blake [Tue, 24 Mar 2020 17:42:30 +0000 (12:42 -0500)] 
qcow2: Comment typo fixes

Various trivial typos noticed while working on this file.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-Id: <20200324174233.1622067-2-eblake@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
3 days agoblock: trickle down the fallback image creation function use to the block drivers
Maxim Levitsky [Thu, 26 Mar 2020 01:12:18 +0000 (03:12 +0200)] 
block: trickle down the fallback image creation function use to the block drivers

Instead of checking the .bdrv_co_create_opts to see if we need the
fallback, just implement the .bdrv_co_create_opts in the drivers that
need it.

This way we don't break various places that need to know if the
underlying protocol/format really supports image creation, and this way
we still allow some drivers to not support image creation.

Fixes: fd17146cd93d1704cd96d7c2757b325fc7aac6fd
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1816007

Note that technically this driver reverts the image creation fallback
for the vxhs driver since I don't have a means to test it, and IMHO it
is better to leave it not supported as it was prior to generic image
creation patches.

Also drop iscsi_create_opts which was left accidentally.

Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Message-Id: <20200326011218.29230-3-mlevitsk@redhat.com>
Reviewed-by: Denis V. Lunev <den@openvz.org>
[mreitz: Fixed alignment, and moved bdrv_co_create_opts_simple() and
         bdrv_create_opts_simple from block.h into block_int.h]
Signed-off-by: Max Reitz <mreitz@redhat.com>
3 days agoblock: pass BlockDriver reference to the .bdrv_co_create
Maxim Levitsky [Thu, 26 Mar 2020 01:12:17 +0000 (03:12 +0200)] 
block: pass BlockDriver reference to the .bdrv_co_create

This will allow the reuse of a single generic .bdrv_co_create
implementation for several drivers.
No functional changes.

Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Message-Id: <20200326011218.29230-2-mlevitsk@redhat.com>
Reviewed-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Max Reitz <mreitz@redhat.com>
3 days agoblock/mirror: fix use after free of local_err
Vladimir Sementsov-Ogievskiy [Tue, 24 Mar 2020 15:36:26 +0000 (18:36 +0300)] 
block/mirror: fix use after free of local_err

local_err is used again in mirror_exit_common() after
bdrv_set_backing_hd(), so we must zero it. Otherwise try to set
non-NULL local_err will crash.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200324153630.11882-3-vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
4 days agoMerge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20200325b' into...
Peter Maydell [Thu, 26 Mar 2020 09:28:11 +0000 (09:28 +0000)] 
Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20200325b' into staging

Combo Migration/HMP/virtiofs pull

Small fixes all around.
Ones that are noticeable:
  a) Igor's migration compatibility fix affecting older machine types
     has been seen in the wild
  b) Philippe's autconverge fix should fix an intermittently
     failing migration test.
  c) Mao's makes a small change to the output of 'info
     migrate_parameters'  for tls-authz.

# gpg: Signature made Wed 25 Mar 2020 13:14:48 GMT
# gpg:                using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7
# gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full]
# Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A  9FA9 0516 331E BC5B FDE7

* remotes/dgilbert/tags/pull-migration-20200325b:
  migration: use "" instead of (null) for tls-authz
  migration/ram: fix use after free of local_err
  migration/colo: fix use after free of local_err
  vl.c: fix migration failure for 3.1 and older machine types
  tools/virtiofsd/passthrough_ll: Fix double close()
  hmp/vnc: Fix info vnc list leak
  tests/migration: Reduce autoconverge initial bandwidth
  xbzrle: update xbzrle doc
  hmp-cmd: fix a missing_break warning

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
4 days agolinux-user: Flush out implementation of gettimeofday
Richard Henderson [Thu, 13 Feb 2020 03:22:23 +0000 (19:22 -0800)] 
linux-user: Flush out implementation of gettimeofday

The first argument, timeval, is allowed to be NULL.

The second argument, timezone, was missing.  While its use is
deprecated, it is still present in the syscall.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200213032223.14643-6-richard.henderson@linaro.org>
[lv: add "#if defined(TARGET_NR_gettimeofday)"]
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
4 days agolinux-user: Add x86_64 vsyscall page to /proc/self/maps
Richard Henderson [Thu, 13 Feb 2020 03:22:22 +0000 (19:22 -0800)] 
linux-user: Add x86_64 vsyscall page to /proc/self/maps

The page isn't (necessarily) present in the host /proc/self/maps,
and even if it might be it isn't present in page_flags, and even
if it was it might not have the same set of page permissions.

The easiest thing to do, particularly when it comes to the
"[vsyscall]" note at the end of line, is to special case it.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200213032223.14643-5-richard.henderson@linaro.org>
[lv: remove trailing space]
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
4 days agolinux-user/i386: Emulate x86_64 vsyscalls
Richard Henderson [Thu, 13 Feb 2020 03:22:21 +0000 (19:22 -0800)] 
linux-user/i386: Emulate x86_64 vsyscalls

Notice the magic page during translate, much like we already
do for the arm32 commpage.  At runtime, raise an exception to
return cpu_loop for emulation.

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200213032223.14643-4-richard.henderson@linaro.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
4 days agolinux-user/i386: Split out gen_signal
Richard Henderson [Thu, 13 Feb 2020 03:22:20 +0000 (19:22 -0800)] 
linux-user/i386: Split out gen_signal

This is a bit tidier than open-coding the 5 lines necessary
to initialize the target_siginfo_t.  In addition, this zeros
the remaining bytes of the target_siginfo_t, rather than
passing in garbage.

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200213032223.14643-3-richard.henderson@linaro.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
4 days agotarget/i386: Renumber EXCP_SYSCALL
Richard Henderson [Thu, 13 Feb 2020 03:22:19 +0000 (19:22 -0800)] 
target/i386: Renumber EXCP_SYSCALL

We are not short of numbers for EXCP_*.  There is no need to confuse things
by having EXCP_VMEXIT and EXCP_SYSCALL overlap, even though the former is
only used for system mode and the latter is only used for user mode.

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200213032223.14643-2-richard.henderson@linaro.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
4 days agolinux-user, configure: fix (again) syscall_nr.h dependencies cleanup
Laurent Vivier [Wed, 25 Mar 2020 07:57:57 +0000 (08:57 +0100)] 
linux-user, configure: fix (again) syscall_nr.h dependencies cleanup

This patch fixes two problems:
- it cleanups linux-user variants (for instance ppc64-linux-user
  and ppc64le-linux-user)
- it removes the .o file when it removes the .d file, otherwise the .o
  file is never updated

Fixes: 5f29856b852d ("linux-user, configure: improve syscall_nr.h dependencies checking")
Fixes: 4d6a835dea47 ("linux-user: introduce parameters to generate syscall_nr.h")
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200325075757.1959961-1-laurent@vivier.eu>

4 days agoMerge remote-tracking branch 'remotes/kraxel/tags/fixes-20200325-pull-request' into...
Peter Maydell [Wed, 25 Mar 2020 21:23:33 +0000 (21:23 +0000)] 
Merge remote-tracking branch 'remotes/kraxel/tags/fixes-20200325-pull-request' into staging

fixes: input error handling & audio segfault

# gpg: Signature made Wed 25 Mar 2020 10:58:26 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/fixes-20200325-pull-request:
  hw/audio/fmopl: fix segmentation fault
  ui/input-linux: Do not ignore ioctl() return value

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 days agomigration: use "" instead of (null) for tls-authz
Mao Zhongyi [Wed, 25 Mar 2020 01:49:30 +0000 (09:49 +0800)] 
migration: use "" instead of (null) for tls-authz

run:
(qemu) info migrate_parameters
announce-initial: 50 ms
...
announce-max: 550 ms
multifd-compression: none
xbzrle-cache-size: 4194304
max-postcopy-bandwidth: 0
 tls-authz: '(null)'

Migration parameter 'tls-authz' is used to provide the QOM ID
of a QAuthZ subclass instance that provides the access control
check, default is NULL. But the empty string is not a valid
object ID, so use "" instead of the default. Although it will
fail when lookup an object with ID "", it is harmless, just
consistent with tls_creds.

As a bonus, this patch also fixed the bad indentation on the
last line and removed 'has_tls_authz' redundant check in
'hmp_info_migrate_parameters'.

Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Message-Id: <119f539a9f4d198bc3bcced46b8280520d60bc51.1585100802.git.maozhongyi@cmss.chinamobile.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 days agomigration/ram: fix use after free of local_err
Vladimir Sementsov-Ogievskiy [Tue, 24 Mar 2020 15:36:29 +0000 (18:36 +0300)] 
migration/ram: fix use after free of local_err

local_err is used again in migration_bitmap_sync_precopy() after
precopy_notify(), so we must zero it. Otherwise try to set
non-NULL local_err will crash.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200324153630.11882-6-vsementsov@virtuozzo.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 days agomigration/colo: fix use after free of local_err
Vladimir Sementsov-Ogievskiy [Tue, 24 Mar 2020 15:36:28 +0000 (18:36 +0300)] 
migration/colo: fix use after free of local_err

local_err is used again in secondary_vm_do_failover() after
replication_stop_all(), so we must zero it. Otherwise try to set
non-NULL local_err will crash.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200324153630.11882-5-vsementsov@virtuozzo.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 days agovl.c: fix migration failure for 3.1 and older machine types
Igor Mammedov [Wed, 4 Mar 2020 17:27:48 +0000 (12:27 -0500)] 
vl.c: fix migration failure for 3.1 and older machine types

Migration from QEMU(v4.0) fails when using 3.1 or older machine
type. For example if one attempts to migrate
QEMU-2.12 started as
  qemu-system-ppc64 -nodefaults -M pseries-2.12 -m 4096 -mem-path /tmp/
to current master, it will fail with
  qemu-system-ppc64: Unknown ramblock "ppc_spapr.ram", cannot accept migration
  qemu-system-ppc64: error while loading state for instance 0x0 of device 'ram'
  qemu-system-ppc64: load of migration failed: Invalid argument

Caused by 900c0ba373 commit which switches main RAM allocation to
memory backends and the fact in 3.1 and older QEMU, backends used
full[***] QOM path as memory region name instead of backend's name.
That was changed after 3.1 to use prefix-less names by default
(fa0cb34d22) for new machine types.
*** effectively makes main RAM memory region names defined by
MachineClass::default_ram_id being altered with '/objects/' prefix
and therefore migration fails as old QEMU sends prefix-less
name while new QEMU expects name with prefix when using 3.1 and
older machine types.

Fix it by forcing implicit[1] memory backend to always use
prefix-less names for its memory region by setting
  'x-use-canonical-path-for-ramblock-id'
property to false.

1) i.e. memory backend created by compat glue which maps
-m/-mem-path/-mem-prealloc/default RAM size into
appropriate backend type/options to match old CLI format.

Fixes: 900c0ba373
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reported-by: Lukáš Doktor <ldoktor@redhat.com>
Message-Id: <20200304172748.15338-1-imammedo@redhat.com>
Tested-by: Lukáš Doktor <ldoktor@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 days agotools/virtiofsd/passthrough_ll: Fix double close()
Philippe Mathieu-Daudé [Sat, 21 Mar 2020 12:06:54 +0000 (13:06 +0100)] 
tools/virtiofsd/passthrough_ll: Fix double close()

On success, the fdopendir() call closes fd. Later on the error
path we try to close an already-closed fd. This can lead to
use-after-free. Fix by only closing the fd if the fdopendir()
call failed.

Cc: qemu-stable@nongnu.org
Fixes: b39bce121b (add dirp_map to hide lo_dirp pointers)
Reported-by: Coverity (CID 1421933 USE_AFTER_FREE)
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20200321120654.7985-1-philmd@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 days agohmp/vnc: Fix info vnc list leak
Dr. David Alan Gilbert [Mon, 23 Mar 2020 12:08:22 +0000 (12:08 +0000)] 
hmp/vnc: Fix info vnc list leak

We're iterating the list, and then freeing the iteration pointer rather
than the list head.

Fixes: 0a9667ecdb6d ("hmp: Update info vnc")
Reported-by: Coverity (CID 1421932)
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20200323120822.51266-1-dgilbert@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 days agotests/migration: Reduce autoconverge initial bandwidth
Philippe Mathieu-Daudé [Mon, 23 Mar 2020 18:40:15 +0000 (19:40 +0100)] 
tests/migration: Reduce autoconverge initial bandwidth

When using max-bandwidth=~100Mb/s, this test fails on Travis-CI
s390x when configured with --disable-tcg:

  $ make check-qtest
    TEST    check-qtest-s390x: tests/qtest/boot-serial-test
  qemu-system-s390x: -accel tcg: invalid accelerator tcg
  qemu-system-s390x: falling back to KVM
    TEST    check-qtest-s390x: tests/qtest/pxe-test
    TEST    check-qtest-s390x: tests/qtest/test-netfilter
    TEST    check-qtest-s390x: tests/qtest/test-filter-mirror
    TEST    check-qtest-s390x: tests/qtest/test-filter-redirector
    TEST    check-qtest-s390x: tests/qtest/drive_del-test
    TEST    check-qtest-s390x: tests/qtest/device-plug-test
    TEST    check-qtest-s390x: tests/qtest/virtio-ccw-test
    TEST    check-qtest-s390x: tests/qtest/cpu-plug-test
    TEST    check-qtest-s390x: tests/qtest/migration-test
  **
  ERROR:tests/qtest/migration-test.c:1229:test_migrate_auto_converge: 'got_stop' should be FALSE
  ERROR - Bail out! ERROR:tests/qtest/migration-test.c:1229:test_migrate_auto_converge: 'got_stop' should be FALSE
  make: *** [tests/Makefile.include:633: check-qtest-s390x] Error 1

Per David Gilbert, "it could just be the writing is slow on s390
and the migration thread fast; in which case the autocomplete
wouldn't be needed. Perhaps we just need to reduce the bandwidth
limit."

Tuning the threshold by reducing the initial bandwidth makes the
autoconverge test pass.

Suggested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20200323184015.11565-1-philmd@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 days agoxbzrle: update xbzrle doc
Mao Zhongyi [Fri, 20 Mar 2020 14:32:16 +0000 (22:32 +0800)] 
xbzrle: update xbzrle doc

Add new parameter description, also:
1. Remove unsociable space.
2. Nit picking: s/two/2 in report

Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Message-Id: <20200320143216.423374-1-maozhongyi@cmss.chinamobile.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 days agohmp-cmd: fix a missing_break warning
Pan Nengyuan [Wed, 18 Mar 2020 07:16:20 +0000 (15:16 +0800)] 
hmp-cmd: fix a missing_break warning

This fix coverity issues 94417686:
    1260        break;
    CID 94417686: (MISSING_BREAK)
    1261. unterminated_case: The case for value "MIGRATION_PARAMETER_THROTTLE_TRIGGER_THRESHOLD" is not terminated by a 'break' statement.
    1261    case MIGRATION_PARAMETER_THROTTLE_TRIGGER_THRESHOLD:
    1262        p->has_throttle_trigger_threshold = true;
    1263        visit_type_int(v, param, &p->throttle_trigger_threshold, &err);
    1264    case MIGRATION_PARAMETER_CPU_THROTTLE_INITIAL:

Fixes: dc14a470763c96fd9d360e1028ce38e8c3613a77
Fixes: Coverity (CID 1421950)
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
Message-Id: <20200318071620.59748-1-pannengyuan@huawei.com>
Reviewed-by: Keqian Zhu <zhukeqian1@huawei.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 days agohw/audio/fmopl: fix segmentation fault
Volker Rümelin [Tue, 24 Mar 2020 06:18:55 +0000 (07:18 +0100)] 
hw/audio/fmopl: fix segmentation fault

Current code allocates the memory for ENV_CURVE too late. Move
allocation to OPLOpenTable() and deallocation to OPLCloseTable().

To reproduce the bug start qemu with -soundhw adlib.

Fixes 2eea51bd01 "hw/audio/fmopl: Move ENV_CURVE to .heap to save
32KiB of .bss"

Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200324061855.5951-1-vr_qemu@t-online.de
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 days agoui/input-linux: Do not ignore ioctl() return value
Philippe Mathieu-Daudé [Sun, 22 Mar 2020 16:12:19 +0000 (17:12 +0100)] 
ui/input-linux: Do not ignore ioctl() return value

Fix warnings reported by Clang static code analyzer:

    CC      ui/input-linux.o
      ui/input-linux.c:343:9: warning: Value stored to 'rc' is never read
          rc = ioctl(il->fd, EVIOCGBIT(EV_REL, sizeof(relmap)), &relmap);
          ^    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      ui/input-linux.c:351:9: warning: Value stored to 'rc' is never read
          rc = ioctl(il->fd, EVIOCGBIT(EV_ABS, sizeof(absmap)), &absmap);
          ^    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      ui/input-linux.c:354:13: warning: Value stored to 'rc' is never read
              rc = ioctl(il->fd, EVIOCGABS(ABS_X), &absinfo);
              ^    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      ui/input-linux.c:357:13: warning: Value stored to 'rc' is never read
              rc = ioctl(il->fd, EVIOCGABS(ABS_Y), &absinfo);
              ^    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      ui/input-linux.c:365:9: warning: Value stored to 'rc' is never read
          rc = ioctl(il->fd, EVIOCGBIT(EV_KEY, sizeof(keymap)), keymap);
          ^    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      ui/input-linux.c:366:9: warning: Value stored to 'rc' is never read
          rc = ioctl(il->fd, EVIOCGKEY(sizeof(keystate)), keystate);
          ^    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Reported-by: Clang Static Analyzer
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-id: 20200322161219.17757-1-philmd@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 days agoUpdate version for v5.0.0-rc0 release v5.0.0-rc0
Peter Maydell [Tue, 24 Mar 2020 17:50:00 +0000 (17:50 +0000)] 
Update version for v5.0.0-rc0 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 days agoMerge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2020-03-24-tag0' into...
Peter Maydell [Tue, 24 Mar 2020 16:56:05 +0000 (16:56 +0000)] 
Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2020-03-24-tag0' into staging

qemu-ga patch queue for hard-freeze

* fix undefined C behavior with guest-file-* interfaces
* fix w32 installer issues
* fix crash for large file reads via guest-file-read on windows
* add missing man page documentation for virtio-vsock

# gpg: Signature made Tue 24 Mar 2020 16:45:24 GMT
# gpg:                using RSA key CEACC9E15534EBABB82D3FA03353C9CEF108B584
# gpg:                issuer "mdroth@linux.vnet.ibm.com"
# gpg: Good signature from "Michael Roth <flukshun@gmail.com>" [full]
# gpg:                 aka "Michael Roth <mdroth@utexas.edu>" [full]
# gpg:                 aka "Michael Roth <mdroth@linux.vnet.ibm.com>" [full]
# Primary key fingerprint: CEAC C9E1 5534 EBAB B82D  3FA0 3353 C9CE F108 B584

* remotes/mdroth/tags/qga-pull-2020-03-24-tag0:
  qemu-ga: document vsock-listen in the man page
  qga: Fix undefined C behavior
  qga-win: prevent crash when executing guest-file-read with large count
  qga-win: Handle VSS_E_PROVIDER_ALREADY_REGISTERED error
  qga: Installer: Wait for installation to finish

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 days agoqemu-ga: document vsock-listen in the man page
Stefan Hajnoczi [Mon, 23 Mar 2020 11:04:08 +0000 (11:04 +0000)] 
qemu-ga: document vsock-listen in the man page

Although qemu-ga has supported vsock since 2016 it was not documented on
the man page.

Also add the socket address representation to the qga --help output.

Fixes: 586ef5dee77180fc32e33bc08051600030630239
       ("qga: add vsock-listen method")
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
5 days agoqga: Fix undefined C behavior
Eric Blake [Fri, 20 Mar 2020 15:05:07 +0000 (10:05 -0500)] 
qga: Fix undefined C behavior

The QAPI struct GuestFileWhence has a comment about how we are
exploiting equivalent values between two different integer types
shared in a union. But C says behavior is undefined on assignments to
overlapping storage when the two types are not the same width, and
indeed, 'int64_t value' and 'enum QGASeek name' are very likely to be
different in width.  Utilize a temporary variable to fix things.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Fixes: 0b4b49387
Fixes: Coverity CID 1421990
Signed-off-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
5 days agoqga-win: prevent crash when executing guest-file-read with large count
Basil Salman [Wed, 11 Mar 2020 17:04:17 +0000 (19:04 +0200)] 
qga-win: prevent crash when executing guest-file-read with large count

guest-file-read command is currently implemented to read from a
file handle count number of bytes. when executed with a very large count number
qemu-ga crashes.
after some digging turns out that qemu-ga crashes after trying to allocate
a buffer large enough to save the data read in it, the buffer was allocated using
g_malloc0 which is not fail safe, and results a crash in case of failure.
g_malloc0 was replaced with g_try_malloc0() which returns NULL on failure,
A check was added for that case in order to prevent qemu-ga from crashing
and to send a response to the qemu-ga client accordingly.

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1594054
Signed-off-by: Basil Salman <basil@daynix.com>
Reported-by: Fakhri Zulkifli <mohdfakhrizulkifli@gmail.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
5 days agoqga-win: Handle VSS_E_PROVIDER_ALREADY_REGISTERED error
Sameeh Jubran [Wed, 11 Mar 2020 17:04:16 +0000 (19:04 +0200)] 
qga-win: Handle VSS_E_PROVIDER_ALREADY_REGISTERED error

This patch handles the case where VSS Provider is already registered,
where in such case qga uninstalls the provider and registers it again.

Signed-off-by: Sameeh Jubran <sjubran@redhat.com>
Signed-off-by: Basil Salman <basil@daynix.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
5 days agoqga: Installer: Wait for installation to finish
Basil Salman [Wed, 11 Mar 2020 17:04:15 +0000 (19:04 +0200)] 
qga: Installer: Wait for installation to finish

Installation might fail if we don't wait for the provider
unregisteration process to finish.

Signed-off-by: Sameeh Jubran <sjubran@redhat.com>
Signed-off-by: Basil Salman <basil@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
6 days agoMerge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2020-03-24' into staging
Peter Maydell [Tue, 24 Mar 2020 12:24:41 +0000 (12:24 +0000)] 
Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2020-03-24' into staging

Block patches for 5.0-rc0:
- Use-after-free fix
- Fix for a memleak in an error path
- Preventative measures against other potential use-after-frees, and
  against NULL deferences at runtime
- iotest fixes

# gpg: Signature made Tue 24 Mar 2020 12:19:09 GMT
# gpg:                using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40
# gpg:                issuer "mreitz@redhat.com"
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full]
# Primary key fingerprint: 91BE B60A 30DB 3E88 57D1  1829 F407 DB00 61D5 CF40

* remotes/maxreitz/tags/pull-block-2020-03-24:
  iotests/026: Move v3-exclusive test to new file
  iotests: Fix cleanup path in some tests
  block/qcow2: zero data_file child after free
  block: bdrv_set_backing_bs: fix use-after-free
  block: Assert BlockDriver::format_name is not NULL
  block: Avoid memleak on qcow2 image info failure

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 days agoiotests/026: Move v3-exclusive test to new file
Max Reitz [Wed, 11 Mar 2020 14:07:07 +0000 (15:07 +0100)] 
iotests/026: Move v3-exclusive test to new file

data_file does not work with v2, and we probably want 026 to keep
working for v2 images.  Thus, open a new file for v3-exclusive error
path test cases.

Fixes: 81311255f217859413c94f2cd9cebf2684bbda94
       (“iotests/026: Test EIO on allocation in a data-file”)
Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200311140707.1243218-1-mreitz@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Tested-by: John Snow <jsnow@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
6 days agoiotests: Fix cleanup path in some tests
Max Reitz [Mon, 24 Feb 2020 17:16:31 +0000 (18:16 +0100)] 
iotests: Fix cleanup path in some tests

Some iotests leave behind some external data file when run for qcow2
with -o data_file.  Fix that.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200224171631.384314-1-mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
6 days agoblock/qcow2: zero data_file child after free
Vladimir Sementsov-Ogievskiy [Mon, 16 Mar 2020 06:06:31 +0000 (09:06 +0300)] 
block/qcow2: zero data_file child after free

data_file being NULL doesn't seem to be a correct state, but it's
better than dead pointer and simpler to debug.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200316060631.30052-3-vsementsov@virtuozzo.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
6 days agoblock: bdrv_set_backing_bs: fix use-after-free
Vladimir Sementsov-Ogievskiy [Mon, 16 Mar 2020 06:06:30 +0000 (09:06 +0300)] 
block: bdrv_set_backing_bs: fix use-after-free

There is a use-after-free possible: bdrv_unref_child() leaves
bs->backing freed but not NULL. bdrv_attach_child may produce nested
polling loop due to drain, than access of freed pointer is possible.

I've produced the following crash on 30 iotest with modified code. It
does not reproduce on master, but still seems possible:

    #0  __strcmp_avx2 () at /lib64/libc.so.6
    #1  bdrv_backing_overridden (bs=0x55c9d3cc2060) at block.c:6350
    #2  bdrv_refresh_filename (bs=0x55c9d3cc2060) at block.c:6404
    #3  bdrv_backing_attach (c=0x55c9d48e5520) at block.c:1063
    #4  bdrv_replace_child_noperm
        (child=child@entry=0x55c9d48e5520,
        new_bs=new_bs@entry=0x55c9d3cc2060) at block.c:2290
    #5  bdrv_replace_child
        (child=child@entry=0x55c9d48e5520,
        new_bs=new_bs@entry=0x55c9d3cc2060) at block.c:2320
    #6  bdrv_root_attach_child
        (child_bs=child_bs@entry=0x55c9d3cc2060,
        child_name=child_name@entry=0x55c9d241d478 "backing",
        child_role=child_role@entry=0x55c9d26ecee0 <child_backing>,
        ctx=<optimized out>, perm=<optimized out>, shared_perm=21,
        opaque=0x55c9d3c5a3d0, errp=0x7ffd117108e0) at block.c:2424
    #7  bdrv_attach_child
        (parent_bs=parent_bs@entry=0x55c9d3c5a3d0,
        child_bs=child_bs@entry=0x55c9d3cc2060,
        child_name=child_name@entry=0x55c9d241d478 "backing",
        child_role=child_role@entry=0x55c9d26ecee0 <child_backing>,
        errp=errp@entry=0x7ffd117108e0) at block.c:5876
    #8  in bdrv_set_backing_hd
        (bs=bs@entry=0x55c9d3c5a3d0,
        backing_hd=backing_hd@entry=0x55c9d3cc2060,
        errp=errp@entry=0x7ffd117108e0)
        at block.c:2576
    #9  stream_prepare (job=0x55c9d49d84a0) at block/stream.c:150
    #10 job_prepare (job=0x55c9d49d84a0) at job.c:761
    #11 job_txn_apply (txn=<optimized out>, fn=<optimized out>) at
        job.c:145
    #12 job_do_finalize (job=0x55c9d49d84a0) at job.c:778
    #13 job_completed_txn_success (job=0x55c9d49d84a0) at job.c:832
    #14 job_completed (job=0x55c9d49d84a0) at job.c:845
    #15 job_completed (job=0x55c9d49d84a0) at job.c:836
    #16 job_exit (opaque=0x55c9d49d84a0) at job.c:864
    #17 aio_bh_call (bh=0x55c9d471a160) at util/async.c:117
    #18 aio_bh_poll (ctx=ctx@entry=0x55c9d3c46720) at util/async.c:117
    #19 aio_poll (ctx=ctx@entry=0x55c9d3c46720,
        blocking=blocking@entry=true)
        at util/aio-posix.c:728
    #20 bdrv_parent_drained_begin_single (poll=true, c=0x55c9d3d558f0)
        at block/io.c:121
    #21 bdrv_parent_drained_begin_single (c=c@entry=0x55c9d3d558f0,
        poll=poll@entry=true)
        at block/io.c:114
    #22 bdrv_replace_child_noperm
        (child=child@entry=0x55c9d3d558f0,
        new_bs=new_bs@entry=0x55c9d3d27300) at block.c:2258
    #23 bdrv_replace_child
        (child=child@entry=0x55c9d3d558f0,
        new_bs=new_bs@entry=0x55c9d3d27300) at block.c:2320
    #24 bdrv_root_attach_child
        (child_bs=child_bs@entry=0x55c9d3d27300,
        child_name=child_name@entry=0x55c9d241d478 "backing",
        child_role=child_role@entry=0x55c9d26ecee0 <child_backing>,
        ctx=<optimized out>, perm=<optimized out>, shared_perm=21,
        opaque=0x55c9d3cc2060, errp=0x7ffd11710c60) at block.c:2424
    #25 bdrv_attach_child
        (parent_bs=parent_bs@entry=0x55c9d3cc2060,
        child_bs=child_bs@entry=0x55c9d3d27300,
        child_name=child_name@entry=0x55c9d241d478 "backing",
        child_role=child_role@entry=0x55c9d26ecee0 <child_backing>,
        errp=errp@entry=0x7ffd11710c60) at block.c:5876
    #26 bdrv_set_backing_hd
        (bs=bs@entry=0x55c9d3cc2060,
        backing_hd=backing_hd@entry=0x55c9d3d27300,
        errp=errp@entry=0x7ffd11710c60)
        at block.c:2576
    #27 stream_prepare (job=0x55c9d495ead0) at block/stream.c:150
    ...

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200316060631.30052-2-vsementsov@virtuozzo.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
6 days agoblock: Assert BlockDriver::format_name is not NULL
Philippe Mathieu-Daudé [Wed, 18 Mar 2020 22:22:35 +0000 (23:22 +0100)] 
block: Assert BlockDriver::format_name is not NULL

bdrv_do_find_format() calls strcmp() using BlockDriver::format_name
as argument, which must not be NULL. Assert this field is not null
when we register a block driver in bdrv_register().

Reported-by: Mansour Ahmadi <ManSoSec@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20200318222235.23856-1-philmd@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
6 days agoblock: Avoid memleak on qcow2 image info failure
Eric Blake [Fri, 20 Mar 2020 18:36:20 +0000 (13:36 -0500)] 
block: Avoid memleak on qcow2 image info failure

If we fail to get bitmap info, we must not leak the encryption info.

Fixes: b8968c875f403
Fixes: Coverity CID 1421894
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20200320183620.1112123-1-eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>
Tested-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
6 days agoMerge remote-tracking branch 'remotes/dgibson/tags/ppc-for-5.0-20200324' into staging
Peter Maydell [Tue, 24 Mar 2020 09:50:46 +0000 (09:50 +0000)] 
Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-5.0-20200324' into staging

ppc patch queue for 2020-03-24

Here's a final pull request before the qemu-5.0 hard freeze.

We have an implementation of the POWER9 forms of the slbia
instruction, a small cleanup and a handful of assorted fixes.

# gpg: Signature made Tue 24 Mar 2020 05:12:30 GMT
# gpg:                using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392
# gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full]
# gpg:                 aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full]
# gpg:                 aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full]
# gpg:                 aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown]
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dgibson/tags/ppc-for-5.0-20200324:
  ppc/ppc405_boards: Remove unnecessary NULL check
  hw/ppc: Take QEMU lock when calling ppc_dcr_read/write()
  spapr: Fix memory leak in h_client_architecture_support()
  target/ppc: don't byte swap ELFv2 signal handler
  target/ppc: Fix ISA v3.0 (POWER9) slbia implementation
  target/ppc: Fix slbia TLB invalidation gap
  ppc/spapr: Set the effective address provided flag in mc error log.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 days agoppc/ppc405_boards: Remove unnecessary NULL check
Philippe Mathieu-Daudé [Fri, 20 Mar 2020 15:57:40 +0000 (16:57 +0100)] 
ppc/ppc405_boards: Remove unnecessary NULL check

This code is inside the "if (dinfo)" condition, so testing
again here whether it is NULL is unnecessary.

Fixes: dd59bcae7 (Don't size flash memory to match backing image)
Reported-by: Coverity (CID 1421917)
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20200320155740.5342-1-philmd@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 days agohw/ppc: Take QEMU lock when calling ppc_dcr_read/write()
Peter Maydell [Sun, 22 Mar 2020 19:22:58 +0000 (19:22 +0000)] 
hw/ppc: Take QEMU lock when calling ppc_dcr_read/write()

The ppc_dcr_read() and ppc_dcr_write() functions call into callbacks
in device code, so we need to hold the QEMU iothread lock while
calling them.  This is the case already for the callsites in
kvmppc_handle_dcr_read/write(), but we must also take the lock when
calling the helpers from TCG.

This fixes a bug where attempting to initialise the PPC405EP
SDRAM will cause an assertion when sdram_map_bcr() attempts
to remap memory regions.

Reported-by: Amit Lazar <abasarlaz@hotmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20200322192258.14039-1-peter.maydell@linaro.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 days agospapr: Fix memory leak in h_client_architecture_support()
Greg Kurz [Sat, 21 Mar 2020 17:34:22 +0000 (18:34 +0100)] 
spapr: Fix memory leak in h_client_architecture_support()

This is the only error path that needs to free the previously allocated
ov1.

Reported-by: Coverity (CID 1421924)
Fixes: cbd0d7f36322 "spapr: Fail CAS if option vector table cannot be parsed"
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <158481206205.336182.16106097429336044843.stgit@bahia.lan>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
6 days agotarget/ppc: don't byte swap ELFv2 signal handler
Vincent Fazio [Thu, 19 Mar 2020 13:32:44 +0000 (08:32 -0500)] 
target/ppc: don't byte swap ELFv2 signal handler

Previously, the signal handler would be byte swapped if the target and
host CPU used different endianness. This would cause a SIGSEGV when
attempting to translate the opcode pointed to by the swapped address.

 Thread 1 "qemu-ppc64" received signal SIGSEGV, Segmentation fault.
 0x00000000600a9257 in ldl_he_p (ptr=0x4c2c061000000000) at qemu/include/qemu/bswap.h:351
 351        __builtin_memcpy(&r, ptr, sizeof(r));

 #0  0x00000000600a9257 in ldl_he_p (ptr=0x4c2c061000000000) at qemu/include/qemu/bswap.h:351
 #1  0x00000000600a92fe in ldl_be_p (ptr=0x4c2c061000000000) at qemu/include/qemu/bswap.h:449
 #2  0x00000000600c0790 in translator_ldl_swap at qemu/include/exec/translator.h:201
 #3  0x000000006011c1ab in ppc_tr_translate_insn at qemu/target/ppc/translate.c:7856
 #4  0x000000006005ae70 in translator_loop at qemu/accel/tcg/translator.c:102

The signal handler will be byte swapped as a result of the __get_user()
call in sigaction() if it is necessary, no additional swap is required.

Signed-off-by: Vincent Fazio <vfazio@gmail.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200319133244.8818-1-vfazio@xes-inc.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 days agotarget/ppc: Fix ISA v3.0 (POWER9) slbia implementation
Nicholas Piggin [Thu, 19 Mar 2020 06:44:39 +0000 (16:44 +1000)] 
target/ppc: Fix ISA v3.0 (POWER9) slbia implementation

The new ISA v3.0 slbia variants have not been implemented for TCG,
which can lead to crashing when a POWER9 machine boots Linux using
the hash MMU, for example ("disable_radix" kernel command line).

Add them.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-Id: <20200319064439.1020571-1-npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
[dwg: Fixed compile error for USER_ONLY builds]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 days agotarget/ppc: Fix slbia TLB invalidation gap
Nicholas Piggin [Wed, 18 Mar 2020 04:41:34 +0000 (14:41 +1000)] 
target/ppc: Fix slbia TLB invalidation gap

slbia must invalidate TLBs even if it does not remove a valid SLB
entry, because slbmte can overwrite valid entries without removing
their TLBs.

As the architecture says, slbia invalidates all lookaside information,
not conditionally based on if it removed valid entries.

It does not seem possible for POWER8 or earlier Linux kernels to hit
this bug because it never changes its kernel SLB translations, and it
should always have valid entries if any accesses are made to userspace
regions. However other operating systems which may modify SLB entry 0
or do more fancy things with segments might be affected.

When POWER9 slbia support is added in the next patch, this becomes a
real problem because some new slbia variants don't invalidate all
non-zero entries.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-Id: <20200318044135.851716-1-npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 days agoppc/spapr: Set the effective address provided flag in mc error log.
Mahesh Salgaonkar [Wed, 18 Mar 2020 07:34:20 +0000 (13:04 +0530)] 
ppc/spapr: Set the effective address provided flag in mc error log.

Per PAPR, it is expected to set effective address provided flag in
sub_err_type member of mc extended error log (i.e
rtas_event_log_v6_mc.sub_err_type). This somehow got missed in original
fwnmi-mce patch series. The current code just updates the effective address
but does not set the flag to indicate that it is available. Hence guest
fails to extract effective address from mce rtas log. This patch fixes
that.

Without this patch guest MCE logs fails print DAR value:

[   11.933608] Disabling lock debugging due to kernel taint
[   11.933773] MCE: CPU0: machine check (Severe) Host TLB Multihit [Recovered]
[   11.933979] MCE: CPU0: NIP: [c000000000090b34] radix__flush_tlb_range_psize+0x194/0xf00
[   11.934223] MCE: CPU0: Initiator CPU
[   11.934341] MCE: CPU0: Unknown

After the change:

[   22.454149] Disabling lock debugging due to kernel taint
[   22.454316] MCE: CPU0: machine check (Severe) Host TLB Multihit DAR: deadbeefdeadbeef [Recovered]
[   22.454605] MCE: CPU0: NIP: [c0000000003e5804] kmem_cache_alloc+0x84/0x330
[   22.454820] MCE: CPU0: Initiator CPU
[   22.454944] MCE: CPU0: Unknown

Signed-off-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
Message-Id: <158451653844.22972.17999316676230071087.stgit@jupiter>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 days agoMerge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
Peter Maydell [Mon, 23 Mar 2020 20:54:24 +0000 (20:54 +0000)] 
Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

Pull request

# gpg: Signature made Mon 23 Mar 2020 19:24:02 GMT
# gpg:                using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full]
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>" [full]
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/block-pull-request:
  aio-posix: fix io_uring with external events

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 days agoMerge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20200323' into...
Peter Maydell [Mon, 23 Mar 2020 17:41:21 +0000 (17:41 +0000)] 
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20200323' into staging

target-arm queue:
 * target/arm: avoid undefined behaviour shift in watchpoint code
 * target/arm: avoid undefined behaviour shift in handle_simd_dupe()
 * target/arm: add assert that immh != 0 in disas_simd_shift_imm()
 * aspeed/smc: Fix DMA support for AST2600
 * hw/arm/bcm283x: Correct the license text ('and' vs 'or')

# gpg: Signature made Mon 23 Mar 2020 17:38:59 GMT
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20200323:
  target/arm: Move computation of index in handle_simd_dupe
  target/arm: Assert immh != 0 in disas_simd_shift_imm
  target/arm: Rearrange disabled check for watchpoints
  aspeed/smc: Fix DMA support for AST2600
  hw/arm/bcm283x: Correct the license text

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 days agotarget/arm: Move computation of index in handle_simd_dupe
Richard Henderson [Mon, 23 Mar 2020 17:22:30 +0000 (17:22 +0000)] 
target/arm: Move computation of index in handle_simd_dupe

Coverity reports a BAD_SHIFT with ctz32(imm5), with imm5 == 0.
This is an invalid encoding, but we diagnose that just below
by rejecting size > 3.  Avoid the warning by sinking the
computation of index below the check.

Reported-by: Coverity (CID 1421965)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200320160622.8040-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 days agotarget/arm: Assert immh != 0 in disas_simd_shift_imm
Richard Henderson [Mon, 23 Mar 2020 17:22:30 +0000 (17:22 +0000)] 
target/arm: Assert immh != 0 in disas_simd_shift_imm

Coverity raised a shed-load of errors cascading from inferring
that clz32(immh) might yield 32, from immh might be 0.

While immh cannot be 0 from encoding, it is not obvious even to
a human how we've checked that: via the filtering provided by
data_proc_simd[].

Reported-by: Coverity (CID 1421923, and more)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200320160622.8040-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 days agotarget/arm: Rearrange disabled check for watchpoints
Richard Henderson [Mon, 23 Mar 2020 17:22:30 +0000 (17:22 +0000)] 
target/arm: Rearrange disabled check for watchpoints

Coverity rightly notes that ctz32(bas) on 0 will return 32,
which makes the len calculation a BAD_SHIFT.

A value of 0 in DBGWCR<n>_EL1.BAS is reserved.  Simply move
the existing check we have for this case.

Reported-by: Coverity (CID 1421964)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200320160622.8040-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 days agoaspeed/smc: Fix DMA support for AST2600
Cédric Le Goater [Mon, 23 Mar 2020 17:22:30 +0000 (17:22 +0000)] 
aspeed/smc: Fix DMA support for AST2600

Recent firmwares uses SPI DMA transfers in U-Boot to load the
different images (kernel, initrd, dtb) in the SoC DRAM. The AST2600
FMC model is missing the masks to be applied on the DMA registers
which resulted in incorrect values. Fix that and wire the SPI
controllers which have DMA support on the AST2600.

Fixes: bcaa8ddd081c ("aspeed/smc: Add AST2600 support")
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20200320053923.20565-1-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 days agohw/arm/bcm283x: Correct the license text
Philippe Mathieu-Daudé [Mon, 23 Mar 2020 17:22:30 +0000 (17:22 +0000)] 
hw/arm/bcm283x: Correct the license text

The license is the 'GNU General Public License v2.0 or later',
not 'and':

  This program is free software; you can redistribute it and/ori
  modify it under the terms of the GNU General Public License as
  published by the Free Software Foundation; either version 2 of
  the License, or (at your option) any later version.

Fix the license comment.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200312213455.15854-1-philmd@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 days agoMerge remote-tracking branch 'remotes/cohuck/tags/s390x-20200323' into staging
Peter Maydell [Mon, 23 Mar 2020 15:38:30 +0000 (15:38 +0000)] 
Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20200323' into staging

- fix an off-by-one in the ipl code
- s390x documentation reordering

# gpg: Signature made Mon 23 Mar 2020 12:42:47 GMT
# gpg:                using RSA key C3D0D66DC3624FF6A8C018CEDECF6B93C6F02FAF
# gpg:                issuer "cohuck@redhat.com"
# gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [marginal]
# gpg:                 aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full]
# gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full]
# gpg:                 aka "Cornelia Huck <cohuck@kernel.org>" [marginal]
# gpg:                 aka "Cornelia Huck <cohuck@redhat.com>" [marginal]
# Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0  18CE DECF 6B93 C6F0 2FAF

* remotes/cohuck/tags/s390x-20200323:
  s390/ipl: fix off-by-one in update_machine_ipl_properties()
  Documentation: create/move s390x documentation

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 days agolinux-user, configure: improve syscall_nr.h dependencies checking
Laurent Vivier [Mon, 23 Mar 2020 11:41:16 +0000 (12:41 +0100)] 
linux-user, configure: improve syscall_nr.h dependencies checking

This is mostly a fix for in-tree build.

It removes errors on .d directories:

  grep: ./.gitlab-ci.d: Is a directory
  grep: ./scripts/qemu-guest-agent/fsfreeze-hook.d: Is a directory

and improves performance by only checking <ARCH>-linux-user directories.

Reported-by: BALATON Zoltan <balaton@eik.bme.hu>
Tested-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200323114116.163609-1-laurent@vivier.eu
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agos390/ipl: fix off-by-one in update_machine_ipl_properties()
Halil Pasic [Fri, 20 Mar 2020 14:31:01 +0000 (15:31 +0100)] 
s390/ipl: fix off-by-one in update_machine_ipl_properties()

In update_machine_ipl_properties() the array ascii_loadparm needs to
hold the 8 char loadparm and a string terminating zero char.

Let's increase the size of ascii_loadparm accordingly.

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Fixes: 0a01e082a428 ("s390/ipl: sync back loadparm")
Fixes: Coverity CID 1421966
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20200320143101.41764-1-pasic@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
7 days agoDocumentation: create/move s390x documentation
Cornelia Huck [Wed, 18 Mar 2020 10:39:40 +0000 (11:39 +0100)] 
Documentation: create/move s390x documentation

Create a subdirectory for s390x under docs/system/ and move the
existing vfio-ap documentation there.

Create an initial document describing s390x system emulation.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Message-Id: <20200318103940.1169-1-cohuck@redhat.com>

7 days agoaio-posix: fix io_uring with external events
Stefan Hajnoczi [Thu, 19 Mar 2020 16:35:59 +0000 (16:35 +0000)] 
aio-posix: fix io_uring with external events

When external event sources are disabled fdmon-io_uring falls back to
fdmon-poll.  The ->need_wait() callback needs to watch for this so it
can return true when external event sources are disabled.

It is also necessary to call ->wait() when AioHandlers have changed
because io_uring is asynchronous and we must submit new sqes.

Both of these changes to ->need_wait() together fix tests/test-aio -p
/aio/external-client, which failed with:

  test-aio: tests/test-aio.c:404: test_aio_external_client: Assertion `aio_poll(ctx, false)' failed.

Reported-by: Julia Suvorova <jusual@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20200319163559.117903-1-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 days agoMerge remote-tracking branch 'remotes/elmarco/tags/slirp-pull-request' into staging
Peter Maydell [Sun, 22 Mar 2020 21:00:38 +0000 (21:00 +0000)] 
Merge remote-tracking branch 'remotes/elmarco/tags/slirp-pull-request' into staging

# gpg: Signature made Sun 22 Mar 2020 17:07:31 GMT
# gpg:                using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg:                issuer "marcandre.lureau@redhat.com"
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full]
# gpg:                 aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full]
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276  F62D DAE8 E109 7596 9CE5

* remotes/elmarco/tags/slirp-pull-request:
  slirp: update submodule to v4.2.0+

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agoslirp: update submodule to v4.2.0+
Marc-André Lureau [Tue, 17 Mar 2020 18:10:47 +0000 (19:10 +0100)] 
slirp: update submodule to v4.2.0+

git shortlog
126c04acbabd7ad32c2b018fe10dfac2a3bc1210..55ab21c9a36852915b81f1b41ebaf3b6509dd8ba

5eraph (1):
      Use specific outbound IP address

Akihiro Suda (8):
      remove confusing comment that exists from ancient slirp
      add slirp_new(SlirpConfig *, SlirpCb *, void *)
      allow custom MTU
      add disable_host_loopback (prohibit connections to 127.0.0.1)
      add SlirpConfig version
      emu: remove dead code
      emu: disable by default
      fix a typo in a comment

Anders Waldenborg (1):
      state: fix loading of guestfwd state

Giuseppe Scrivano (1):
      socket: avoid getpeername after shutdown(SHUT_WR)

Jindrich Novy (1):
      Don't leak memory when reallocation fails.

Jordi Pujol Palomer (1):
      fork_exec: correctly parse command lines that contain spaces

Marc-André Lureau (60):
      Merge branch 'AkihiroSuda/libslirp-slirp4netns'
      Merge branch 'fix-typo' into 'master'
      meson: make it subproject friendly
      Merge branch 'meson' into 'master'
      misc: fix compilation warnings
      Merge branch 'fix-shutdown-wr' into 'master'
      sbuf: remove unused and undefined sbcopy() path
      sbuf: check more strictly sbcopy() bounds with offset
      sbuf: replace a comment with a runtime warning
      Replace remaining malloc/free user with glib
      tcp_attach() can no longer fail
      state: can't ENOMEM
      sbuf: use unsigned types
      sbuf: simplify sbreserve()
      dnssearch: use g_strv_length()
      vmstate: silence scan-build warning
      gitlab-ci: run scan-build
      Merge branch 'mem-cleanups' into 'master'
      libslirp.map: bind slirp_new to SLIRP_4.1 version
      meson: fix libtool versioning
      Release v4.1.0
      Merge branch '4.1.0' into 'master'
      CHANGELOG: start unreleased section
      Merge branch 'add-unix' into 'master'
      util: add G_SIZEOF_MEMBER() macro
      Check bootp_filename is not going to be truncated
      bootp: remove extra cast
      bootp: replace simple snprintf() with strcpy()
      tftp: clarify what is actually OACK m_len
      tcp_emu: add more fixme/warnings comments
      util: add slirp_fmt() helpers
      dhcpv6: use slirp_fmt()
      misc: use slirp_fmt0()
      tftp: use slirp_fmt0()
      tcp_ctl: use slirp_fmt()
      tcp_emu: fix unsafe snprintf() usages
      misc: improve error report
      Use g_snprintf()
      util: add gnuc format function attribute to slirp_fmt*
      Merge branch 'aw-guestfwd-state' into 'master'
      Merge branch 'slirp-fmt' into 'master'
      socket: remove extra label and variable
      socket: factor out sotranslate ipv4/ipv6 handling
      socket: remove need for extra scope_id variable
      socket: do not fallback on host loopback if get_dns_addr() failed
      socket: do not fallback on loopback addr for addresses in our mask/prefix
      Prepare for v4.2.0 release
      Merge branch 'translate-fix' into 'master'
      Merge branch 'release-v4.2.0' into 'master'
      changelog: post-release
      changelog: fix link
      .gitlab-ci: add --werror, treat CI build warnings as errors
      Revert "socket: remove need for extra scope_id variable"
      Teach slirp_version_string() to return vcs version
      Merge branch 'mingw-fix' into 'master'
      Merge branch 'vcs-version' into 'master'
      meson: bump required version to 0.49
      build-sys: fix NetBSD build regression
      Merge branch 'netbsd-fix' into 'master'
      build-sys: make libslirp-version.h depend on Makefile

PanNengyuan (1):
      libslirp: fix NULL pointer dereference in tcp_sockclosed

Philippe Mathieu-Daudé (1):
      Add a git-publish configuration file

Prasad J Pandit (4):
      slirp: ncsi: compute checksum for valid data length
      slirp: use correct size while emulating IRC commands
      slirp: use correct size while emulating commands
      slirp: tftp: restrict relative path access

Renzo Davoli (2):
      Add slirp_remove_guestfwd()
      Add slirp_add_unix()

Samuel Thibault (14):
      ip_reass: explain why we should not always update the q pointer
      Merge branch 'comment' into 'master'
      Merge branch 'no-emu' into 'master'
      Fix bogus indent, no source change
      ip_reass: Fix use after free
      Merge branch 'reass2' into 'master'
      Make host receive broadcast packets
      arp: Allow 0.0.0.0 destination address
      Merge branch 'warnings' into 'master'
      Merge branch 'arp_0' into 'master'
      Merge branch 'broadcast' into 'master'
      tcp_emu: Fix oob access
      Merge branch 'oob' into 'master'
      Merge branch 'master' into 'master'

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
8 days agoUpdate copyright date for user-facing copyright strings
Peter Maydell [Mon, 16 Mar 2020 11:20:06 +0000 (11:20 +0000)] 
Update copyright date for user-facing copyright strings

Update the copyright date to 2020 for the copyright strings which are
user-facing and represent overall copyright info for all of QEMU.

Reported-by: John Arbuckle <programmingkidx@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200316112006.19107-1-peter.maydell@linaro.org

8 days agoiotests: Increase pause_wait() timeout
Kevin Wolf [Fri, 13 Mar 2020 08:36:17 +0000 (09:36 +0100)] 
iotests: Increase pause_wait() timeout

Waiting for only 1 second proved to be too short on a loaded system,
resulting in false positives when testing pull requests. Increase the
timeout a bit to make this less likely.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200313083617.8326-4-kwolf@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 days agopython/qemu: Kill QEMU process if 'quit' doesn't work
Kevin Wolf [Fri, 13 Mar 2020 08:36:16 +0000 (09:36 +0100)] 
python/qemu: Kill QEMU process if 'quit' doesn't work

With a QEMU bug, it can happen that the QEMU process doesn't react to a
'quit' QMP command. If we got an exception during previous QMP
communication (e.g. iotests Timeout expiring), we could also be in an
inconsistent state where after sending 'quit' we immediately read an old
response and close the socket even though the 'quit' command wasn't
processed yet. Both cases would lead to a hanging test.

Fix this by waiting for the QEMU process to exit after sending 'quit'
with a timeout, and if it doesn't happen within three seconds, send
SIGKILL.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200313083617.8326-3-kwolf@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 days agoiotests.py: Enable faulthandler
Kevin Wolf [Fri, 13 Mar 2020 08:36:15 +0000 (09:36 +0100)] 
iotests.py: Enable faulthandler

With this, you can send SIGABRT to a hanging test case and you'll get a
Python stack trace so you know where it was hanging.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200313083617.8326-2-kwolf@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 days agoMerge remote-tracking branch 'remotes/marcel/tags/rdma-pull-request' into staging
Peter Maydell [Sat, 21 Mar 2020 20:51:12 +0000 (20:51 +0000)] 
Merge remote-tracking branch 'remotes/marcel/tags/rdma-pull-request' into staging

RDMA queue

* hw/rdma: fix gcc 9.2 warnings
* hw/rdma: eliminate data-path processing
* hw/rdma: Replace strncpy with pstrcpy

# gpg: Signature made Sat 21 Mar 2020 17:29:59 GMT
# gpg:                using RSA key 36D4C0F0CF2FE46D
# gpg: Good signature from "Marcel Apfelbaum <marcel.apfelbaum@zoho.com>" [marginal]
# gpg:                 aka "Marcel Apfelbaum <marcel@redhat.com>" [marginal]
# gpg:                 aka "Marcel Apfelbaum <marcel.apfelbaum@gmail.com>" [marginal]
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: B1C6 3A57 F92E 08F2 640F  31F5 36D4 C0F0 CF2F E46D

* remotes/marcel/tags/rdma-pull-request:
  hw/rdma: avoid suspicious strncpy() use
  hw/rdma: Skip data-path mr_id translation
  hw/rdma: Cosmetic change - no need for two sge arrays
  hw/rdma/vmw/pvrdma_dev_ring: Replace strncpy with pstrcpy

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>