aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-02-27virtio-iommu: Add skeletonEric Auger
This patchs adds the skeleton for the virtio-iommu device. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20200214132745.23392-2-eric.auger@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-02-27virtio: gracefully handle invalid region cachesStefan Hajnoczi
The virtqueue code sets up MemoryRegionCaches to access the virtqueue guest RAM data structures. The code currently assumes that VRingMemoryRegionCaches is initialized before device emulation code accesses the virtqueue. An assertion will fail in vring_get_region_caches() when this is not true. Device fuzzing found a case where this assumption is false (see below). Virtqueue guest RAM addresses can also be changed from a vCPU thread while an IOThread is accessing the virtqueue. This breaks the same assumption but this time the caches could become invalid partway through the virtqueue code. The code fetches the caches RCU pointer multiple times so we will need to validate the pointer every time it is fetched. Add checks each time we call vring_get_region_caches() and treat invalid caches as a nop: memory stores are ignored and memory reads return 0. The fuzz test failure is as follows: $ qemu -M pc -device virtio-blk-pci,id=drv0,drive=drive0,addr=4.0 \ -drive if=none,id=drive0,file=null-co://,format=raw,auto-read-only=off \ -drive if=none,id=drive1,file=null-co://,file.read-zeroes=on,format=raw \ -display none \ -qtest stdio endianness outl 0xcf8 0x80002020 outl 0xcfc 0xe0000000 outl 0xcf8 0x80002004 outw 0xcfc 0x7 write 0xe0000000 0x24 0x00ffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffab5cffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffab0000000001 inb 0x4 writew 0xe000001c 0x1 write 0xe0000014 0x1 0x0d The following error message is produced: qemu-system-x86_64: /home/stefanha/qemu/hw/virtio/virtio.c:286: vring_get_region_caches: Assertion `caches != NULL' failed. The backtrace looks like this: #0 0x00007ffff5520625 in raise () at /lib64/libc.so.6 #1 0x00007ffff55098d9 in abort () at /lib64/libc.so.6 #2 0x00007ffff55097a9 in _nl_load_domain.cold () at /lib64/libc.so.6 #3 0x00007ffff5518a66 in annobin_assert.c_end () at /lib64/libc.so.6 #4 0x00005555559073da in vring_get_region_caches (vq=<optimized out>) at qemu/hw/virtio/virtio.c:286 #5 vring_get_region_caches (vq=<optimized out>) at qemu/hw/virtio/virtio.c:283 #6 0x000055555590818d in vring_used_flags_set_bit (mask=1, vq=0x5555575ceea0) at qemu/hw/virtio/virtio.c:398 #7 virtio_queue_split_set_notification (enable=0, vq=0x5555575ceea0) at qemu/hw/virtio/virtio.c:398 #8 virtio_queue_set_notification (vq=vq@entry=0x5555575ceea0, enable=enable@entry=0) at qemu/hw/virtio/virtio.c:451 #9 0x0000555555908512 in virtio_queue_set_notification (vq=vq@entry=0x5555575ceea0, enable=enable@entry=0) at qemu/hw/virtio/virtio.c:444 #10 0x00005555558c697a in virtio_blk_handle_vq (s=0x5555575c57e0, vq=0x5555575ceea0) at qemu/hw/block/virtio-blk.c:775 #11 0x0000555555907836 in virtio_queue_notify_aio_vq (vq=0x5555575ceea0) at qemu/hw/virtio/virtio.c:2244 #12 0x0000555555cb5dd7 in aio_dispatch_handlers (ctx=ctx@entry=0x55555671a420) at util/aio-posix.c:429 #13 0x0000555555cb67a8 in aio_dispatch (ctx=0x55555671a420) at util/aio-posix.c:460 #14 0x0000555555cb307e in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at util/async.c:260 #15 0x00007ffff7bbc510 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0 #16 0x0000555555cb5848 in glib_pollfds_poll () at util/main-loop.c:219 #17 os_host_main_loop_wait (timeout=<optimized out>) at util/main-loop.c:242 #18 main_loop_wait (nonblocking=<optimized out>) at util/main-loop.c:518 #19 0x00005555559b20c9 in main_loop () at vl.c:1683 #20 0x0000555555838115 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4441 Reported-by: Alexander Bulekov <alxndr@bu.edu> Cc: Michael Tsirkin <mst@redhat.com> Cc: Cornelia Huck <cohuck@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20200207104619.164892-1-stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-02-26block/nbd: fix memory leak in nbd_open()Pan Nengyuan
In currently implementation there will be a memory leak when nbd_client_connect() returns error status. Here is an easy way to reproduce: 1. run qemu-iotests as follow and check the result with asan: ./check -raw 143 Following is the asan output backtrack: Direct leak of 40 byte(s) in 1 object(s) allocated from: #0 0x7f629688a560 in calloc (/usr/lib64/libasan.so.3+0xc7560) #1 0x7f6295e7e015 in g_malloc0 (/usr/lib64/libglib-2.0.so.0+0x50015) #2 0x56281dab4642 in qobject_input_start_struct /mnt/sdb/qemu-4.2.0-rc0/qapi/qobject-input-visitor.c:295 #3 0x56281dab1a04 in visit_start_struct /mnt/sdb/qemu-4.2.0-rc0/qapi/qapi-visit-core.c:49 #4 0x56281dad1827 in visit_type_SocketAddress qapi/qapi-visit-sockets.c:386 #5 0x56281da8062f in nbd_config /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1716 #6 0x56281da8062f in nbd_process_options /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1829 #7 0x56281da8062f in nbd_open /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1873 Direct leak of 15 byte(s) in 1 object(s) allocated from: #0 0x7f629688a3a0 in malloc (/usr/lib64/libasan.so.3+0xc73a0) #1 0x7f6295e7dfbd in g_malloc (/usr/lib64/libglib-2.0.so.0+0x4ffbd) #2 0x7f6295e96ace in g_strdup (/usr/lib64/libglib-2.0.so.0+0x68ace) #3 0x56281da804ac in nbd_process_options /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1834 #4 0x56281da804ac in nbd_open /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1873 Indirect leak of 24 byte(s) in 1 object(s) allocated from: #0 0x7f629688a3a0 in malloc (/usr/lib64/libasan.so.3+0xc73a0) #1 0x7f6295e7dfbd in g_malloc (/usr/lib64/libglib-2.0.so.0+0x4ffbd) #2 0x7f6295e96ace in g_strdup (/usr/lib64/libglib-2.0.so.0+0x68ace) #3 0x56281dab41a3 in qobject_input_type_str_keyval /mnt/sdb/qemu-4.2.0-rc0/qapi/qobject-input-visitor.c:536 #4 0x56281dab2ee9 in visit_type_str /mnt/sdb/qemu-4.2.0-rc0/qapi/qapi-visit-core.c:297 #5 0x56281dad0fa1 in visit_type_UnixSocketAddress_members qapi/qapi-visit-sockets.c:141 #6 0x56281dad17b6 in visit_type_SocketAddress_members qapi/qapi-visit-sockets.c:366 #7 0x56281dad186a in visit_type_SocketAddress qapi/qapi-visit-sockets.c:393 #8 0x56281da8062f in nbd_config /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1716 #9 0x56281da8062f in nbd_process_options /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1829 #10 0x56281da8062f in nbd_open /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1873 Fixes: 8f071c9db506e03ab Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Cc: qemu-stable <qemu-stable@nongnu.org> Cc: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <1575517528-44312-3-git-send-email-pannengyuan@huawei.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com>
2020-02-26block/nbd: extract the common cleanup codePan Nengyuan
The BDRVNBDState cleanup code is common in two places, add nbd_clear_bdrvstate() function to do these cleanups. Suggested-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <1575517528-44312-2-git-send-email-pannengyuan@huawei.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: fix compilation error and commit message] Signed-off-by: Eric Blake <eblake@redhat.com>
2020-02-26nbd-client: Support leading / in NBD URIEric Blake
The NBD URI specification [1] states that only one leading slash at the beginning of the URI path component is stripped, not all such slashes. This becomes important to a patch I just proposed to nbdkit [2], which would allow the exportname to select a file embedded within an ext2 image: ext2fs demands an absolute pathname beginning with '/', and because qemu was inadvertantly stripping it, my nbdkit patch had to work around the behavior. [1] https://github.com/NetworkBlockDevice/nbd/blob/master/doc/uri.md [2] https://www.redhat.com/archives/libguestfs/2020-February/msg00109.html Note that the qemu bug only affects handling of URIs such as nbd://host:port//abs/path (where '/abs/path' should be the export name); it is still possible to use --image-opts and pass the desired export name with a leading slash directly through JSON even without this patch. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20200212023101.1162686-1-eblake@redhat.com> Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-02-26nbd: Fix regression with multiple meta contextsEric Blake
Detected by a hang in the libnbd testsuite. If a client requests multiple meta contexts (both base:allocation and qemu:dirty-bitmap:x) at the same time, our attempt to silence a false-positive warning about a potential uninitialized variable introduced botched logic: we were short-circuiting the second context, and never sending the NBD_REPLY_FLAG_DONE. Combining two 'if' into one 'if/else' in bdf200a55 was wrong (I'm a bit embarrassed that such a change was my initial suggestion after the v1 patch, then I did not review the v2 patch that actually got committed). Revert that, and instead silence the false positive warning by replacing 'return ret' with 'return 0' (the value it always has at that point in the code, even though it eluded the deduction abilities of the robot that reported the false positive). Fixes: bdf200a5535 Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20200206173832.130004-1-eblake@redhat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu>
2020-02-26docs: rstfy vfio-ap documentationCornelia Huck
Move to system/, as this is mostly about configuring vfio-ap. Message-Id: <20200213162942.14177-3-cohuck@redhat.com> Reviewed-by: Pierre Morel <pmorel@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-02-26docs: rstfy s390 dasd ipl documentationCornelia Huck
While at it, also fix the numbering in 'What QEMU does'. Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20200213162942.14177-2-cohuck@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-02-26s390/sclp: improve special wait psw logicChristian Borntraeger
There is a special quiesce PSW that we check for "shutdown". Otherwise disabled wait is detected as "crashed". Architecturally we must only check PSW bits 116-127. Fix this. Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Message-Id: <1582204582-22995-1-git-send-email-borntraeger@de.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Acked-by: Janosch Frank <frankja@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-02-26s390x: Add missing vcpu reset functionsJanosch Frank
Up to now we only had an ioctl to reset vcpu data QEMU couldn't reach for the initial reset, which was also called for the clear reset. To be architecture compliant, we also need to clear local interrupts on a normal reset. Because of this and the upcoming protvirt support we need to add ioctls for the missing clear and normal resets. Signed-off-by: Janosch Frank <frankja@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Acked-by: David Hildenbrand <david@redhat.com> Message-Id: <20200214151636.8764-3-frankja@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-02-26linux-headers: updateCornelia Huck
Update to commit b1da3acc781c ("Merge tag 'ecryptfs-5.6-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs") Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-02-26target/s390x/translate: Fix RNSBG instructionThomas Huth
RNSBG is handled via the op_rosbg() helper function. But RNSBG has the opcode 0xEC54, i.e. 0x54 as second byte, while op_rosbg() currently checks for 0x55. This seems to be a typo, fix it to use 0x54 instead, so that op_rosbg() does not abort() anymore if a program uses RNSBG. I've checked with a simple test function that I now get the same results with KVM and with TCG: static void test_rnsbg(void) { uint64_t r1, r2; r2 = 0xffff000000000000UL; r1 = 0x123456789bdfaaaaUL; asm volatile (" rnsbg %0,%1,12,61,16 " : "+r"(r1) : "r"(r2)); printf("r1 afterwards: 0x%lx\n", r1); } Buglink: https://bugs.launchpad.net/qemu/+bug/1860920 Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20200130133417.10531-1-thuth@redhat.com> Fixes: d6c6372e186e ("target-s390: Implement R[NOX]SBG") Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-02-25tests/tcg: take into account expected clashes pauth-4Alex Bennée
Pointer authentication isn't perfect so measure the percentage of failed checks. As we want to vary the pointer we work through a bunch of different addresses. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Robert Foley <robert.foley@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200225124710.14152-20-alex.bennee@linaro.org>
2020-02-25tests/tcg: fix typo in configure.sh test for v8.3Alex Bennée
Although most people use the docker images this can trip up on developer systems with actual valid cross-compilers! Fixes: bb516dfc5b3 Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200225124710.14152-19-alex.bennee@linaro.org>
2020-02-25tcg: save vaddr temp for plugin usageAlex Bennée
While do_gen_mem_cb does copy (via extu_tl_i64) vaddr into a new temp this won't help if the vaddr temp gets clobbered by the actual load/store op. To avoid this clobbering we explicitly copy vaddr before the op to ensure it is live my the time we do the instrumentation. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Emilio G. Cota <cota@braap.org> Cc: qemu-stable@nongnu.org Message-Id: <20200225124710.14152-18-alex.bennee@linaro.org>
2020-02-25tests/tcg: give debug builds a little bit longerAlex Bennée
When combined with heavy plugins we occasionally hit the timeouts. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200225124710.14152-17-alex.bennee@linaro.org>
2020-02-25tests/plugins: make howvec clean-up after itself.Alex Bennée
TCG plugins are responsible for their own memory usage and although the plugin_exit is tied to the end of execution in this case it is still poor practice. Ensure we delete the hash table and related data when we are done to be a good plugin citizen. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Robert Foley <robert.foley@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200225124710.14152-16-alex.bennee@linaro.org>
2020-02-25target/riscv: progressively load the instruction during decodeAlex Bennée
The plugin system would throw up a harmless warning when it detected that a disassembly of an instruction didn't use all it's bytes. Fix the riscv decoder to only load the instruction bytes it needs as it needs them. This drops opcode from the ctx in favour if passing the appropriately sized opcode down a few levels of the decode. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Robert Foley <robert.foley@linaro.org> Message-Id: <20200225124710.14152-15-alex.bennee@linaro.org>
2020-02-25qemu/bitops.h: Add extract8 and extract16Yoshinori Sato
Signed-off-by: Yoshinori Sato <ysato@users.sourceforge.jp> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20200212130311.127515-3-ysato@users.sourceforge.jp> Message-Id: <20200225124710.14152-14-alex.bennee@linaro.org>
2020-02-25tests/plugin: prevent uninitialized warningChen Qun
According to the glibc function requirements, we need initialise the variable. Otherwise there will be compilation warnings: glib-autocleanups.h:28:3: warning: ‘out’ may be used uninitialized in this function [-Wmaybe-uninitialized] g_free (*pp); ^~~~~~~~~~~~ Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20200206093238.203984-1-kuhn.chenqun@huawei.com> [AJB: uses Thomas's single line allocation] Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200225124710.14152-13-alex.bennee@linaro.org>
2020-02-25plugins/core: add missing break in cb_to_tcg_flagsEmilio G. Cota
Fixes: 54cb65d8588 Reported-by: Robert Henry <robhenry@microsoft.com> Signed-off-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200105072940.32204-1-cota@braap.org> Cc: qemu-stable@nongnu.org Message-Id: <20200225124710.14152-12-alex.bennee@linaro.org>
2020-02-25docs/devel: document query handle lifetimesAlex Bennée
I forgot to document the lifetime of handles in the developer documentation. Do so now. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Robert Foley <robert.foley@linaro.org> Reviewed-by: Robert Foley <robert.foley@linaro.org> Message-Id: <20200225124710.14152-11-alex.bennee@linaro.org>
2020-02-25tracing: only allow -trace to override -D if setAlex Bennée
Otherwise any -D settings the user may have made get ignored. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Robert Foley <robert.foley@linaro.org> Message-Id: <20200225124710.14152-10-alex.bennee@linaro.org>
2020-02-25tests/iotests: be a little more forgiving on the size testAlex Bennée
At least on ZFS this was failing as 512 was less than or equal to 512. I suspect the reason is additional compression done by ZFS and however qemu-img gets the actual size. Loosen the criteria to make sure after is not bigger than before and also dump the values in the report. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Robert Foley <robert.foley@linaro.org> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200225124710.14152-9-alex.bennee@linaro.org>
2020-02-25travis.yml: single-thread build-tcg stagesAlex Bennée
This still seems to be a problem for Travis. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200225124710.14152-8-alex.bennee@linaro.org>
2020-02-25travis.yml: Fix Travis YAML configuration warningsWainer dos Santos Moschetta
This fixes the following warnings Travis has detected on the YAML configuration: - 'on root: missing os, using the default "linux"' - 'on root: the key matrix is an alias for jobs, using jobs' - 'on jobs.include.python: unexpected sequence, using the first value (3.5)' - 'on jobs.include.python: unexpected sequence, using the first value (3.6)' Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20200207210124.141119-2-wainersm@redhat.com> Message-Id: <20200225124710.14152-7-alex.bennee@linaro.org>
2020-02-25travis.yml: Test the s390-ccw build, tooThomas Huth
Since we can now use a s390x host on Travis, we can also build and test the s390-ccw bios images there. For this we have to make sure that roms/SLOF is checked out, too, and then move the generated *.img files to the right location before running the tests. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200206202543.7085-1-thuth@redhat.com> Message-Id: <20200225124710.14152-6-alex.bennee@linaro.org>
2020-02-25tests/rcutorture: mild documenting refactor of update threadAlex Bennée
This is mainly to help with reasoning what the test is trying to do. We can move rcu_stress_idx to a local variable as there is only ever one updater thread. I've also added an assert to catch the case where we end up updating the current structure to itself which is the only way I can see the mberror cases we are seeing on Travis. We shall see if the rcutorture test failures go away now. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200225124710.14152-5-alex.bennee@linaro.org>
2020-02-25tests/rcutorture: better document locking of statsAlex Bennée
This is pure code motion with no functional effect. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200225124710.14152-4-alex.bennee@linaro.org>
2020-02-25tests/rcutorture: update usage hintAlex Bennée
Although documented in the comments we don't display all the various invocations we can in the usage. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200225124710.14152-3-alex.bennee@linaro.org>
2020-02-25tests/tcg: include a skip runner for pauth3 with pluginsAlex Bennée
If we have plugins enabled we still need to have built the test to be able to run it. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Robert Foley <robert.foley@linaro.org> Message-Id: <20200225124710.14152-2-alex.bennee@linaro.org>
2020-02-25vhost-user-blk: convert to new virtio_delete_queuePan Nengyuan
use the new virtio_delete_queue function to cleanup. Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> Message-Id: <20200224041336.30790-3-pannengyuan@huawei.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-02-25vhost-user-blk: delete virtioqueues in unrealize to fix memleaksPan Nengyuan
virtio queues forgot to delete in unrealize, and aslo error path in realize, this patch fix these memleaks, the leak stack is as follow: Direct leak of 114688 byte(s) in 16 object(s) allocated from: #0 0x7f24024fdbf0 in calloc (/lib64/libasan.so.3+0xcabf0) #1 0x7f2401642015 in g_malloc0 (/lib64/libglib-2.0.so.0+0x50015) #2 0x55ad175a6447 in virtio_add_queue /mnt/sdb/qemu/hw/virtio/virtio.c:2327 #3 0x55ad17570cf9 in vhost_user_blk_device_realize /mnt/sdb/qemu/hw/block/vhost-user-blk.c:419 #4 0x55ad175a3707 in virtio_device_realize /mnt/sdb/qemu/hw/virtio/virtio.c:3509 #5 0x55ad176ad0d1 in device_set_realized /mnt/sdb/qemu/hw/core/qdev.c:876 #6 0x55ad1781ff9d in property_set_bool /mnt/sdb/qemu/qom/object.c:2080 #7 0x55ad178245ae in object_property_set_qobject /mnt/sdb/qemu/qom/qom-qobject.c:26 #8 0x55ad17821eb4 in object_property_set_bool /mnt/sdb/qemu/qom/object.c:1338 #9 0x55ad177aeed7 in virtio_pci_realize /mnt/sdb/qemu/hw/virtio/virtio-pci.c:1801 Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20200224041336.30790-2-pannengyuan@huawei.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-02-25virtio-crypto: do delete ctrl_vq in virtio_crypto_device_unrealizePan Nengyuan
Similar to other virtio-deivces, ctrl_vq forgot to delete in virtio_crypto_device_unrealize, this patch fix it. This device has aleardy maintained vq pointers. Thus, we use the new virtio_delete_queue function directly to do the cleanup. The leak stack: Direct leak of 10752 byte(s) in 3 object(s) allocated from: #0 0x7f4c024b1970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970) #1 0x7f4c018be49d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d) #2 0x55a2f8017279 in virtio_add_queue /mnt/sdb/qemu-new/qemu_test/qemu/hw/virtio/virtio.c:2333 #3 0x55a2f8057035 in virtio_crypto_device_realize /mnt/sdb/qemu-new/qemu_test/qemu/hw/virtio/virtio-crypto.c:814 #4 0x55a2f8005d80 in virtio_device_realize /mnt/sdb/qemu-new/qemu_test/qemu/hw/virtio/virtio.c:3531 #5 0x55a2f8497d1b in device_set_realized /mnt/sdb/qemu-new/qemu_test/qemu/hw/core/qdev.c:891 #6 0x55a2f8b48595 in property_set_bool /mnt/sdb/qemu-new/qemu_test/qemu/qom/object.c:2238 #7 0x55a2f8b54fad in object_property_set_qobject /mnt/sdb/qemu-new/qemu_test/qemu/qom/qom-qobject.c:26 #8 0x55a2f8b4de2c in object_property_set_bool /mnt/sdb/qemu-new/qemu_test/qemu/qom/object.c:1390 #9 0x55a2f80609c9 in virtio_crypto_pci_realize /mnt/sdb/qemu-new/qemu_test/qemu/hw/virtio/virtio-crypto-pci.c:58 Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> Cc: "Gonglei (Arei)" <arei.gonglei@huawei.com> Message-Id: <20200225075554.10835-5-pannengyuan@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-02-25virtio-pmem: do delete rq_vq in virtio_pmem_unrealizePan Nengyuan
Similar to other virtio-devices, rq_vq forgot to delete in virtio_pmem_unrealize, this patch fix it. This device has already maintained a vq pointer, thus we use the new virtio_delete_queue function directly to do the cleanup. Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> Message-Id: <20200225075554.10835-4-pannengyuan@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-02-25vhost-user-fs: convert to the new virtio_delete_queue functionPan Nengyuan
use the new virtio_delete_queue function to cleanup. Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20200225075554.10835-3-pannengyuan@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-02-25vhost-user-fs: do delete virtio_queues in unrealizePan Nengyuan
Similar to other virtio device(https://patchwork.kernel.org/patch/11399237/), virtio queues forgot to delete in unrealize, and aslo error path in realize, this patch fix these memleaks, the leak stack is as follow: Direct leak of 57344 byte(s) in 1 object(s) allocated from: #0 0x7f15784fb970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970) #1 0x7f157790849d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d) #2 0x55587a1bf859 in virtio_add_queue /mnt/sdb/qemu-new/qemu_test/qemu/hw/virtio/virtio.c:2333 #3 0x55587a2071d5 in vuf_device_realize /mnt/sdb/qemu-new/qemu_test/qemu/hw/virtio/vhost-user-fs.c:212 #4 0x55587a1ae360 in virtio_device_realize /mnt/sdb/qemu-new/qemu_test/qemu/hw/virtio/virtio.c:3531 #5 0x55587a63fb7b in device_set_realized /mnt/sdb/qemu-new/qemu_test/qemu/hw/core/qdev.c:891 #6 0x55587acf03f5 in property_set_bool /mnt/sdb/qemu-new/qemu_test/qemu/qom/object.c:2238 #7 0x55587acfce0d in object_property_set_qobject /mnt/sdb/qemu-new/qemu_test/qemu/qom/qom-qobject.c:26 #8 0x55587acf5c8c in object_property_set_bool /mnt/sdb/qemu-new/qemu_test/qemu/qom/object.c:1390 #9 0x55587a8e22a2 in pci_qdev_realize /mnt/sdb/qemu-new/qemu_test/qemu/hw/pci/pci.c:2095 #10 0x55587a63fb7b in device_set_realized /mnt/sdb/qemu-new/qemu_test/qemu/hw/core/qdev.c:891 #11 0x55587acf03f5 in property_set_bool /mnt/sdb/qemu-new/qemu_test/qemu/qom/object.c:2238 #12 0x55587acfce0d in object_property_set_qobject /mnt/sdb/qemu-new/qemu_test/qemu/qom/qom-qobject.c:26 #13 0x55587acf5c8c in object_property_set_bool /mnt/sdb/qemu-new/qemu_test/qemu/qom/object.c:1390 #14 0x55587a496d65 in qdev_device_add /mnt/sdb/qemu-new/qemu_test/qemu/qdev-monitor.c:679 Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20200225075554.10835-2-pannengyuan@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-02-25Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* device_del fix (Julia) * FXAM fix (myself) * memdev refactoring (Igor) * memory region API cleanups (Peter, Philippe) * ioeventfd optimization (Stefan) * new WHPX maintainer (Sunil) * Large guest startup optimizations (Chen) # gpg: Signature made Tue 25 Feb 2020 12:42:24 GMT # gpg: using RSA key BFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (104 commits) WHPX: Assigning maintainer for Windows Hypervisor Platform accel/kvm: Check ioctl(KVM_SET_USER_MEMORY_REGION) return value target/i386: check for empty register in FXAM qdev-monitor: Forbid repeated device_del mem-prealloc: optimize large guest startup memory: batch allocate ioeventfds[] in address_space_update_ioeventfds() Avoid cpu_physical_memory_rw() with a constant is_write argument Let cpu_[physical]_memory() calls pass a boolean 'is_write' argument exec: Let cpu_[physical]_memory API use a boolean 'is_write' argument Avoid address_space_rw() with a constant is_write argument Let address_space_rw() calls pass a boolean 'is_write' argument exec: Let address_space_unmap() use a boolean 'is_write' argument hw/virtio: Let vhost_memory_map() use a boolean 'is_write' argument hw/virtio: Let virtqueue_map_iovec() use a boolean 'is_write' argument hw/ide: Let the DMAIntFunc prototype use a boolean 'is_write' argument hw/ide/internal: Remove unused DMARestartFunc typedef Remove unnecessary cast when using the cpu_[physical]_memory API exec: Let the cpu_[physical]_memory API use void pointer arguments Remove unnecessary cast when using the address_space API hw/net: Avoid casting non-const pointer, use address_space_write() ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-02-25rebuild-expected-aml.sh: remind about the processMichael S. Tsirkin
Remind users of rebuild-expected-aml.sh about the process to follow. Suppress the warning if allowed file list exists - that's a big hint user is already aware of the process. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-02-25bios-tables-test: default diff commandMichael S. Tsirkin
Most people probably just want diff -u. So let's use that as the default. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-02-25bios-tables-test: fix up DIFF generationMichael S. Tsirkin
Turns out it goes to stdout which is suppressed even with V=1. Force DIFF output to stderr to make it visible. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-02-25bios-tables-test: tell people how to updateMichael S. Tsirkin
For now just a pointer to the source file. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
2020-02-25Merge branch 'exec_rw_const_v4' of https://github.com/philmd/qemu into HEADPaolo Bonzini
2020-02-25Merge remote-tracking branch 'remotes/pmaydell/tags/pull-docs-20200225' into ↵Peter Maydell
staging * create a new 'tools' manual, and move the documentation for qemu-img, qemu-nbd, virtfs-proxy-helper, qemu-trace-stap and virtiofsd to it # gpg: Signature made Tue 25 Feb 2020 11:00:16 GMT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-docs-20200225: docs: Move tools documentation to tools manual docs: Move qemu-option-trace.rst.inc to docs/ docs: Create new 'tools' manual Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-02-25docs: Move tools documentation to tools manualPeter Maydell
Move the following tools documentation files to the new tools manual: docs/interop/qemu-img.rst docs/interop/qemu-nbd.rst docs/interop/virtfs-proxy-helper.rst docs/interop/qemu-trace-stap.rst docs/interop/virtiofsd.rst Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20200217155415.30949-4-peter.maydell@linaro.org
2020-02-25docs: Move qemu-option-trace.rst.inc to docs/Peter Maydell
The qemu-option-trace.rst.inc file contains a rST documentation fragment which describes trace options common to qemu-nbd and qemu-img. We put this file into interop/, but we'd like to move the qemu-nbd and qemu-img files into the tools/ manual. We could move the .rst.inc file along with them, but we're eventually going to want to use it for the main QEMU binary options documentation too, and that will be in system/. So move qemu-option-trace.rst.inc to the top-level docs/ directory, where all these files can include it via .. include:: ../qemu-option-trace.rst.inc This does have the slight downside that we now need to explicitly tell Make which manuals use this file rather than relying on a wildcard for all .rst.inc in the manual. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20200217155415.30949-3-peter.maydell@linaro.org
2020-02-25docs: Create new 'tools' manualPeter Maydell
Some of the documentation for QEMU "tools" which are standalone binaries like qemu-img is an awkward fit in our current 5-manual split. We've put it into "interop", but they're not really about interoperability. Create a new top level manual "tools" which will be a better home for this documentation. This commit creates an empty initial manual; we will move the relevant documentation files in a subsequent commit. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20200217155415.30949-2-peter.maydell@linaro.org
2020-02-25Merge tag 'patchew/20200219160953.13771-1-imammedo@redhat.com' of ↵Paolo Bonzini
https://github.com/patchew-project/qemu into HEAD This series removes ad hoc RAM allocation API (memory_region_allocate_system_memory) and consolidates it around hostmem backend. It allows to * resolve conflicts between global -mem-prealloc and hostmem's "policy" option, fixing premature allocation before binding policy is applied * simplify complicated memory allocation routines which had to deal with 2 ways to allocate RAM. * reuse hostmem backends of a choice for main RAM without adding extra CLI options to duplicate hostmem features. A recent case was -mem-shared, to enable vhost-user on targets that don't support hostmem backends [1] (ex: s390) * move RAM allocation from individual boards into generic machine code and provide them with prepared MemoryRegion. * clean up deprecated NUMA features which were tied to the old API (see patches) - "numa: remove deprecated -mem-path fallback to anonymous RAM" - (POSTPONED, waiting on libvirt side) "forbid '-numa node,mem' for 5.0 and newer machine types" - (POSTPONED) "numa: remove deprecated implicit RAM distribution between nodes" Introduce a new machine.memory-backend property and wrapper code that aliases global -mem-path and -mem-alloc into automatically created hostmem backend properties (provided memory-backend was not set explicitly given by user). A bulk of trivial patches then follow to incrementally convert individual boards to using machine.memory-backend provided MemoryRegion. Board conversion typically involves: * providing MachineClass::default_ram_size and MachineClass::default_ram_id so generic code could create default backend if user didn't explicitly provide memory-backend or -m options * dropping memory_region_allocate_system_memory() call * using convenience MachineState::ram MemoryRegion, which points to MemoryRegion allocated by ram-memdev On top of that for some boards: * missing ram_size checks are added (typically it were boards with fixed ram size) * ram_size fixups are replaced by checks and hard errors, forcing user to provide correct "-m" values instead of ignoring it and continuing running. After all boards are converted, the old API is removed and memory allocation routines are cleaned up.
2020-02-25WHPX: Assigning maintainer for Windows Hypervisor PlatformSunil Muthuswamy
Signed-off-by: Sunil Muthuswamy <sunilmut@microsoft.com> Message-Id: <SN4PR2101MB0880E245954826FD91C9D67DC0110@SN4PR2101MB0880.namprd21.prod.outlook.com> Reviewed-by: Justin Terry (VM) <juterry@microsoft.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-02-25accel/kvm: Check ioctl(KVM_SET_USER_MEMORY_REGION) return valuePhilippe Mathieu-Daudé
kvm_vm_ioctl() can fail, check its return value, and log an error when it failed. This fixes Coverity CID 1412229: Unchecked return value (CHECKED_RETURN) check_return: Calling kvm_vm_ioctl without checking return value Reported-by: Coverity (CID 1412229) Fixes: 235e8982ad3 ("support using KVM_MEM_READONLY flag for regions") Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Message-Id: <20200221163336.2362-1-philmd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-18 08:13:38 +0000