aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-04-01docs: simplify each section titleMarc-André Lureau
Now that we merged into one doc, it makes the nav looks nicer. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210323074704.4078381-1-marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com>
2021-04-01dbus-vmstate: Increase the size of input stream buffer used during loadPriyankar Jain
This commit fixes an issue where migration is failing in the load phase because of a false alarm about data unavailability. Following is the error received when the amount of data to be transferred exceeds the default buffer size setup by G_BUFFERED_INPUT_STREAM(4KiB), even when the maximum data size supported by this backend is 1MiB (DBUS_VMSTATE_SIZE_LIMIT): dbus_vmstate_post_load: Invalid vmstate size: 4364 qemu-kvm: error while loading state for instance 0x0 of device 'dbus-vmstate/dbus-vmstate' This commit sets the size of the input stream buffer used during load to DBUS_VMSTATE_SIZE_LIMIT which is the maximum amount of data a helper can send during save phase. Secondly, this commit makes sure that the input stream buffer is loaded before checking the size of the data available in it, rectifying the false alarm about data unavailability. Fixes: 5010cec2bc87 ("Add dbus-vmstate object") Signed-off-by: Priyankar Jain <priyankar.jain@nutanix.com> Message-Id: <cdaad4718e62bf22fd5e93ef3e252de20da5c17c.1612273156.git.priyankar.jain@nutanix.com> [ Modified printf format for gsize ] Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2021-04-01util: fix use-after-free in module_load_oneMarc-André Lureau
g_hash_table_add always retains ownership of the pointer passed in as the key. Its return status merely indicates whether the added entry was new, or replaced an existing entry. Thus key must never be freed after this method returns. Spotted by ASAN: ==2407186==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020003ac4f0 at pc 0x7ffff766659c bp 0x7fffffffd1d0 sp 0x7fffffffc980 READ of size 1 at 0x6020003ac4f0 thread T0 #0 0x7ffff766659b (/lib64/libasan.so.6+0x8a59b) #1 0x7ffff6bfa843 in g_str_equal ../glib/ghash.c:2303 #2 0x7ffff6bf8167 in g_hash_table_lookup_node ../glib/ghash.c:493 #3 0x7ffff6bf9b78 in g_hash_table_insert_internal ../glib/ghash.c:1598 #4 0x7ffff6bf9c32 in g_hash_table_add ../glib/ghash.c:1689 #5 0x5555596caad4 in module_load_one ../util/module.c:233 #6 0x5555596ca949 in module_load_one ../util/module.c:225 #7 0x5555596ca949 in module_load_one ../util/module.c:225 #8 0x5555596cbdf4 in module_load_qom_all ../util/module.c:349 Typical C bug... Fixes: 90629122d2e ("module: use g_hash_table_add()") Cc: qemu-stable@nongnu.org Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20210316134456.3243102-1-marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2021-04-01docs: Add a QEMU Code of Conduct and Conflict Resolution Policy documentPaolo Bonzini
In an ideal world, we would all get along together very well, always be polite and never end up in huge conflicts. And even if there are conflicts, we would always handle each other fair and respectfully. Unfortunately, this is not an ideal world and sometimes people forget how to interact with each other in a professional and respectful way. Fortunately, this seldom happens in the QEMU community, but for such rare cases it is preferrable to have a basic code of conduct document available to show to people who are misbehaving. In case that does not help yet, we should also have a conflict resolution policy ready that can be applied in the worst case. The Code of Conduct document tries to be short and to the point while trying to remain friendly and welcoming; it is based on the Fedora Code of Conduct[1] with extra detail added based on the Contributor Covenant 1.3.0[2]. Other proposals included the Contributor Covenant 1.3.0 itself or the Django Code of Conduct[3] (which is also a derivative of Fedora's) but, in any case, there was agreement on keeping the conflict resolution policy separate from the CoC itself. An important point is whether to apply the code of conduct to violations that occur outside public spaces. The text herein restricts that to individuals acting as a representative or a member of the project or its community. This is intermediate between the Contributor Covenant (which only mentions representatives of the community, for example using an official project e-mail address or posting via an official social media account), and the Django Code of Conduct, which says that violations of this code outside these spaces "may" be considered but otherwise applies no limit. The conflict resolution policy is based on the Drupal Conflict Resolution Policy[4] and its derivative, the Mozilla Consequence Ladder[5]. [1] https://www.fedoraproject.com/code-of-conduct/ [2] https://www.contributor-covenant.org/version/1/3/0/code-of-conduct/ [3] https://www.djangoproject.com/conduct/ [4] https://www.drupal.org/conflict-resolution [5] https://github.com/mozilla/diversity/blob/master/code-of-conduct-enforcement/consequence-ladder.md Co-developed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: David Edmondson <david.edmondson@oracle.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-04-01hexagon: do not specify Python scripts as inputsPaolo Bonzini
Python scripts are not inputs, and putting them in @INPUT@. This puts requirements on the command line format, keeping all inputs close to the name of the script. Avoid that by not including the script in the command and not in the inputs. Also wrap "PYTHONPATH" usage with "env", since setting the environment this way is not valid under Windows. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-04-01hexagon: do not specify executables as inputsPaolo Bonzini
gen_semantics is an executable, not an input. Meson 0.57 special cases the first argument and @INPUT@ is not expanded there. Fix that by not including it in the input, only in the command. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-04-01configure: Do not use default_feature for EXESUFMiroslav Rezanina
Commit "c87ea11631 configure: add --without-default-features" use default_feature to set default values for configure option. This value is used for EXESUF too. However, EXESUF is not option to be tested, it is just append to any binary name so using --without-default-features set EXESUF to "n"o and all binaries using it has form <name>no (e.g. qemu-imgno). This is not expected behavior as disabling features should not cause generating different binary names. Reverting back to setting EXESUF to empty value unless needed otherwise. Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> Message-Id: <20210331081845.105089-1-mrezanin@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-04-01target/openrisc: fix icount handling for timer instructionsPavel Dovgalyuk
This patch adds icount handling to mfspr/mtspr instructions that may deal with hardware timers. Signed-off-by: Pavel Dovgalyuk <pavel.dovgalyuk@ispras.ru> Message-Id: <161700376169.1135890.8707223959310729949.stgit@pasha-ThinkPad-X280> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Stafford Horne <shorne@gmail.com>
2021-04-01replay: notify CPU on eventPavel Dovgalyuk
This patch enables vCPU notification to wake it up when new async event comes in replay mode. The motivation of this patch is the following. Consider recorded block async event. It is saved into the log with one of the checkpoints. This checkpoint may be passed in vCPU loop. In replay mode when this async event is read from the log, and block thread task is not finished yet, vCPU thread goes to sleep. That is why this patch adds waking up the vCPU to process this finished event. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru> Message-Id: <161726519158.1476949.7614181684462079836.stgit@pasha-ThinkPad-X280> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-04-01icount: get rid of static variablePavel Dovgalyuk
This patch moves static last_delta variable into timers_state structure to allow correct vmstate operations with icount shift=auto enabled. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru> Message-Id: <161701335066.1180180.7104085247702343395.stgit@pasha-ThinkPad-X280> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-04-01Revert "qom: use qemu_printf to print help for user-creatable objects"Thomas Huth
This reverts commit 6d9abb6de9cc53a508823db0283061824f2f98a2. The real code change had already been added by Kevin's commit da0a932bbf ("hmp: QAPIfy object_add") and commit 6d9abb6d just added a duplicated include statement as a left-over of a rebase. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210328054758.2351461-1-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-04-01replay: fix recursive checkpointsPavel Dovgalyuk
Record/replay uses checkpoints to synchronize the execution of the threads and timers. Hardware events such as BH are processed at the checkpoints too. Event processing can cause refreshing the virtual timers and calling the icount-related functions, that also use checkpoints. This patch prevents recursive processing of such checkpoints, because they have their own records in the log and should be processed later. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru> Message-Id: <161700476500.1140362.10108444973730452257.stgit@pasha-ThinkPad-X280> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-04-01qapi: qom: do not use target-specific conditionalsPaolo Bonzini
ObjectType and ObjectOptions are defined in a target-independent file, therefore they do not have access to target-specific configuration symbols such as CONFIG_PSERIES or CONFIG_SEV. For this reason, pef-guest and sev-guest are currently omitted when compiling the generated QAPI files. In addition, this causes ObjectType to have different definitions depending on the file that is including qapi-types-qom.h (currently this is not causing any issues, but it is wrong). Define the two enum entries and the SevGuestProperties type unconditionally to avoid the issue. We do not expect to have many target-dependent user-creatable classes, so it is not particularly problematic. Reported-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-04-01target/i386: Verify memory operand for lcall and ljmpRichard Henderson
These two opcodes only allow a memory operand. Lacking the check for a register operand, we used the A0 temp without initialization, which led to a tcg abort. Buglink: https://bugs.launchpad.net/qemu/+bug/1921138 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210324164650.128608-1-richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-04-01meson: Propagate gnutls dependency to migrationJessica Clarke
Commit 3eacf70bb5a83e4775ad8003cbca63a40f70c8c2 neglected to fix this for softmmu configs, which pull in migration's use of gnutls. This fixes the following compilation failure on Arm-based Macs: In file included from migration/multifd.c:23: In file included from migration/tls.h:25: In file included from include/io/channel-tls.h:26: In file included from include/crypto/tlssession.h:24: include/crypto/tlscreds.h:28:10: fatal error: 'gnutls/gnutls.h' file not found #include <gnutls/gnutls.h> ^~~~~~~~~~~~~~~~~ 1 error generated. (as well as for channel.c and tls.c) Signed-off-by: Jessica Clarke <jrtc27@jrtc27.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-Id: <20210320171221.37437-1-jrtc27@jrtc27.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-04-01MAINTAINERS: add/replace backups for some s390 areasMatthew Rosato
S390 PCI currently has no backup, add one. Add an additional backup for vfio-ccw and refresh the backup for vfio-ap. Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Acked-by: Jason J. Herne <jjherne@linux.ibm.com> Acked-by: Eric Farman <farman@linux.ibm.com> Acked-by: Pierre Morel <pmorel@linux.ibm.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Acked-by: Halil Pasic <pasic@linux.ibm.com> Message-Id: <1616680509-8339-1-git-send-email-mjrosato@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-04-01MAINTAINERS: Fix tests/migration maintainersHyman Huang(黄勇)
when executing the following scripts, it throw error message: $ ./scripts/get_maintainer.pl -f tests/migration/guestperf.py get_maintainer.pl: No maintainers found, printing recent contributors. get_maintainer.pl: Do not blindly cc: them on patches! Use common sense. add the tests/migration to the "Migration" section of MAINTAINERS Signed-off-by: Hyman Huang(黄勇) <huangy81@chinatelecom.cn> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <91d5978357fb8709ef61d2030984f7142847037d.1616141556.git.huangy81@chinatelecom.cn> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-03-31Merge remote-tracking branch ↵Peter Maydell
'remotes/stefanha-gitlab/tags/block-pull-request' into staging Pull request A fix for VDI image files and more generally for CoRwlock. # gpg: Signature made Wed 31 Mar 2021 10:50:39 BST # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha-gitlab/tags/block-pull-request: test-coroutine: Add rwlock downgrade test test-coroutine: Add rwlock upgrade test coroutine-lock: Reimplement CoRwlock to fix downgrade bug coroutine-lock: Store the coroutine in the CoWaitRecord only once block/vdi: Don't assume that blocks are larger than VdiHeader block/vdi: When writing new bmap entry fails, don't leak the buffer Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-31Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.0-20210331' ↵Peter Maydell
into staging ppc patch queue for 2021-03-31 Here's another set of patches for the ppc target and associated machine types. I'd hoped to send this closer to the hard freeze, but got caught up for some time chasing what looked like a strange regression, before finally concluding it was due to unrelated failures on the CI. This is just a handful of fairly straightforward fixes, plus one performance improvement that's simple and beneficial enough that I'm considering it a "performance bug fix". # gpg: Signature made Wed 31 Mar 2021 07:22:17 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dg-gitlab/tags/ppc-for-6.0-20210331: hw/net: fsl_etsec: Tx padding length should exclude CRC spapr: Fix typo in the patb_entry comment spapr: Assert DIMM unplug state in spapr_memory_unplug() target/ppc/kvm: Cache timebase frequency hw/ppc: e500: Add missing #address-cells and #size-cells in the eTSEC node Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-31Merge remote-tracking branch ↵Peter Maydell
'remotes/vivier2/tags/linux-user-for-6.0-pull-request' into staging linux-user Pull request 20210330 Fix NETLINK_LIST_MEMBERSHIPS with NULL/invalid pointer and 0 length # gpg: Signature made Tue 30 Mar 2021 15:38:35 BST # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/linux-user-for-6.0-pull-request: linux-user: NETLINK_LIST_MEMBERSHIPS: Allow bad ptr if its length is 0 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-31test-coroutine: Add rwlock downgrade testDavid Edmondson
Test that downgrading an rwlock does not result in a failure to schedule coroutines queued on the rwlock. The diagram associated with test_co_rwlock_downgrade() describes the intended behaviour, but what was observed previously corresponds to: | c1 | c2 | c3 | c4 | |--------+------------+------------+----------| | rdlock | | | | | yield | | | | | | wrlock | | | | | <queued> | | | | | | rdlock | | | | | <queued> | | | | | | wrlock | | | | | <queued> | | unlock | | | | | yield | | | | | | <dequeued> | | | | | downgrade | | | | | ... | | | | | unlock | | | | | | <dequeued> | | | | | <queued> | | This results in a failure... ERROR:../tests/test-coroutine.c:369:test_co_rwlock_downgrade: assertion failed: (c3_done) Bail out! ERROR:../tests/test-coroutine.c:369:test_co_rwlock_downgrade: assertion failed: (c3_done) ...as a result of the c3 coroutine failing to run to completion. Signed-off-by: David Edmondson <david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20210325112941.365238-7-pbonzini@redhat.com Message-Id: <20210309144015.557477-5-david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-03-31test-coroutine: Add rwlock upgrade testPaolo Bonzini
Test that rwlock upgrade is fair, and that readers go back to sleep if a writer is in line. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20210325112941.365238-6-pbonzini@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-03-31coroutine-lock: Reimplement CoRwlock to fix downgrade bugPaolo Bonzini
An invariant of the current rwlock is that if multiple coroutines hold a reader lock, all must be runnable. The unlock implementation relies on this, choosing to wake a single coroutine when the final read lock holder exits the critical section, assuming that it will wake a coroutine attempting to acquire a write lock. The downgrade implementation violates this assumption by creating a read lock owning coroutine that is exclusively runnable - any other coroutines that are waiting to acquire a read lock are *not* made runnable when the write lock holder converts its ownership to read only. More in general, the old implementation had lots of other fairness bugs. The root cause of the bugs was that CoQueue would wake up readers even if there were pending writers, and would wake up writers even if there were readers. In that case, the coroutine would go back to sleep *at the end* of the CoQueue, losing its place at the head of the line. To fix this, keep the queue of waiters explicitly in the CoRwlock instead of using CoQueue, and store for each whether it is a potential reader or a writer. This way, downgrade can look at the first queued coroutines and wake it only if it is a reader, causing all other readers in line to be released in turn. Reported-by: David Edmondson <david.edmondson@oracle.com> Reviewed-by: David Edmondson <david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20210325112941.365238-5-pbonzini@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-03-31coroutine-lock: Store the coroutine in the CoWaitRecord only onceDavid Edmondson
When taking the slow path for mutex acquisition, set the coroutine value in the CoWaitRecord in push_waiter(), rather than both there and in the caller. Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: David Edmondson <david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20210325112941.365238-4-pbonzini@redhat.com Message-Id: <20210309144015.557477-4-david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-03-31block/vdi: Don't assume that blocks are larger than VdiHeaderDavid Edmondson
Given that the block size is read from the header of the VDI file, a wide variety of sizes might be seen. Rather than re-using a block sized memory region when writing the VDI header, allocate an appropriately sized buffer. Signed-off-by: David Edmondson <david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Max Reitz <mreitz@redhat.com> Message-id: 20210325112941.365238-3-pbonzini@redhat.com Message-Id: <20210309144015.557477-3-david.edmondson@oracle.com> Acked-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-03-31block/vdi: When writing new bmap entry fails, don't leak the bufferDavid Edmondson
If a new bitmap entry is allocated, requiring the entire block to be written, avoiding leaking the buffer allocated for the block should the write fail. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: David Edmondson <david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Max Reitz <mreitz@redhat.com> Message-id: 20210325112941.365238-2-pbonzini@redhat.com Message-Id: <20210309144015.557477-2-david.edmondson@oracle.com> Acked-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-03-31hw/net: fsl_etsec: Tx padding length should exclude CRCBin Meng
As the comment of tx_padding_and_crc() says: "Never add CRC in QEMU", min_frame_len should excluce CRC, so it should be 60 instead of 64. Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210316081505.72898-1-bmeng.cn@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-31spapr: Fix typo in the patb_entry commentAlexey Kardashevskiy
There is no H_REGISTER_PROCESS_TABLE, it is H_REGISTER_PROC_TBL handler for which is still called h_register_process_table() though. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Message-Id: <20210225032335.64245-1-aik@ozlabs.ru> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-31spapr: Assert DIMM unplug state in spapr_memory_unplug()Greg Kurz
spapr_memory_unplug() is the last step of the hot unplug sequence. It is indirectly called by: spapr_lmb_release() hotplug_handler_unplug() and spapr_lmb_release() already buys us that DIMM unplug state is present : it gets restored with spapr_recover_pending_dimm_state() if missing. g_assert() that spapr_pending_dimm_unplugs_find() cannot return NULL in spapr_memory_unplug() to make this clear and silence Coverity. Fixes: Coverity CID 1450767 Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <161562021166.948373.15092876234470478331.stgit@bahia.lan> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-31target/ppc/kvm: Cache timebase frequencyGreg Kurz
Each vCPU core exposes its timebase frequency in the DT. When running under KVM, this means parsing /proc/cpuinfo in order to get the timebase frequency of the host CPU. The parsing appears to slow down the boot quite a bit with higher number of cores: # of cores seconds spent in spapr_dt_cpus() 8 0.550122 16 1.342375 32 2.850316 64 5.922505 96 9.109224 128 12.245504 256 24.957236 384 37.389113 The timebase frequency of the host CPU is identical for all cores and it is an invariant for the VM lifetime. Cache it instead of doing the same expensive parsing again and again. Rename kvmppc_get_tbfreq() to kvmppc_get_tbfreq_procfs() and rename the 'retval' variable to make it clear it is used as fallback only. Come up with a new version of kvmppc_get_tbfreq() that calls kvmppc_get_tbfreq_procfs() only once and keep the value in a static. Zero is certainly not a valid value for the timebase frequency. Treat atoi() returning zero as another parsing error and return the fallback value instead. This allows kvmppc_get_tbfreq() to use zero as an indicator that kvmppc_get_tbfreq_procfs() hasn't been called yet. With this patch applied: 384 0.518382 Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <161600382766.1780699.6787739229984093959.stgit@bahia.lan> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-31hw/ppc: e500: Add missing #address-cells and #size-cells in the eTSEC nodeBin Meng
Per devicetree spec v0.3 [1] chapter 2.3.5: The #address-cells and #size-cells properties are not inherited from ancestors in the devicetree. They shall be explicitly defined. If missing, a client program should assume a default value of 2 for #address-cells, and a value of 1 for #size-cells. These properties are currently missing, causing the <reg> property of the queue-group subnode to be incorrectly parsed using default values. [1] https://github.com/devicetree-org/devicetree-specification/releases/download/v0.3/devicetree-specification-v0.3.pdf Fixes: fdfb7f2cdb2d ("e500: Add support for eTSEC in device tree") Signed-off-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20210311081608.66891-1-bmeng.cn@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-30Update version for v6.0.0-rc1 releasev6.0.0-rc1Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-30Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20210330' into staging * net/npcm7xx_emc.c: Fix handling of receiving packets when RSDR not set * hw/display/xlnx_dp: Free FIFOs adding xlnx_dp_finalize() * hw/arm/smmuv3: Drop unused CDM_VALID() and is_cd_valid() * target/arm: Make number of counters in PMCR follow the CPU * hw/timer/renesas_tmr: Add default-case asserts in read_tcnt() # gpg: Signature made Tue 30 Mar 2021 14:23:33 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210330: hw/timer/renesas_tmr: Add default-case asserts in read_tcnt() target/arm: Make number of counters in PMCR follow the CPU hw/arm/smmuv3: Drop unused CDM_VALID() and is_cd_valid() hw/display/xlnx_dp: Free FIFOs adding xlnx_dp_finalize() net/npcm7xx_emc.c: Fix handling of receiving packets when RSDR not set Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-30Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2021-03-30' ↵Peter Maydell
into staging Block patches for 6.0-rc1: - Mark the qcow2 cache clean timer as external to fix record/replay - Fix the mirror filter node's permissions so that an external process cannot grab an image while it is used as the mirror source - Add documentation about FUSE exports to the storage daemon - When creating a qcow2 image with the data-file-raw option, all metadata structures should be preallocated - iotest fixes # gpg: Signature made Tue 30 Mar 2021 13:38:40 BST # gpg: using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40 # gpg: issuer "mreitz@redhat.com" # gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full] # Primary key fingerprint: 91BE B60A 30DB 3E88 57D1 1829 F407 DB00 61D5 CF40 * remotes/maxreitz/tags/pull-block-2021-03-30: iotests/244: Test preallocation for data-file-raw qcow2: Force preallocation with data-file-raw qsd: Document FUSE exports block/mirror: Fix mirror_top's permissions iotests/046: Filter request length qcow2: use external virtual timers iotests/116: Fix reference output iotests: fix 051.out expected output after error text touchups iotests: Fix typo in iotest 051 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-30hw/timer/renesas_tmr: Add default-case asserts in read_tcnt()Peter Maydell
In commit 81b3ddaf8772ec we fixed a use of uninitialized data in read_tcnt(). However this change wasn't enough to placate Coverity, which is not smart enough to see that if we read a 2 bit field and then handle cases 0, 1, 2 and 3 then there cannot be a flow of execution through the switch default. Add explicit default cases which assert that they can't be reached, which should help silence Coverity. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210319162458.13760-1-peter.maydell@linaro.org
2021-03-30target/arm: Make number of counters in PMCR follow the CPUPeter Maydell
Currently we give all the v7-and-up CPUs a PMU with 4 counters. This means that we don't provide the 6 counters that are required by the Arm BSA (Base System Architecture) specification if the CPU supports the Virtualization extensions. Instead of having a single PMCR_NUM_COUNTERS, make each CPU type specify the PMCR reset value (obtained from the appropriate TRM), and use the 'N' field of that value to define the number of counters provided. This means that we now supply 6 counters for Cortex-A53, A57, A72, A15 and A9 as well as '-cpu max'; Cortex-A7 and A8 stay at 4; and Cortex-R5 goes down to 3. Note that because we now use the PMCR reset value of the specific implementation, we no longer set the LC bit out of reset. This has an UNKNOWN value out of reset for all cores with any AArch32 support, so guest software should be setting it anyway if it wants it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> Message-id: 20210311165947.27470-1-peter.maydell@linaro.org Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2021-03-30hw/arm/smmuv3: Drop unused CDM_VALID() and is_cd_valid()Zenghui Yu
They were introduced in commit 9bde7f0674fe ("hw/arm/smmuv3: Implement translate callback") but never actually used. Drop them. Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> Acked-by: Eric Auger <eric.auger@redhat.com> Message-id: 20210325142702.790-1-yuzenghui@huawei.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-30hw/display/xlnx_dp: Free FIFOs adding xlnx_dp_finalize()Philippe Mathieu-Daudé
When building with --enable-sanitizers we get: Direct leak of 16 byte(s) in 1 object(s) allocated from: #0 0x5618479ec7cf in malloc (qemu-system-aarch64+0x233b7cf) #1 0x7f675745f958 in g_malloc (/lib64/libglib-2.0.so.0+0x58958) #2 0x561847c2dcc9 in xlnx_dp_init hw/display/xlnx_dp.c:1259:5 #3 0x56184a5bdab8 in object_init_with_type qom/object.c:375:9 #4 0x56184a5a2bda in object_initialize_with_type qom/object.c:517:5 #5 0x56184a5a24d5 in object_initialize qom/object.c:536:5 #6 0x56184a5a2f6c in object_initialize_child_with_propsv qom/object.c:566:5 #7 0x56184a5a2e60 in object_initialize_child_with_props qom/object.c:549:10 #8 0x56184a5a3a1e in object_initialize_child_internal qom/object.c:603:5 #9 0x5618495aa431 in xlnx_zynqmp_init hw/arm/xlnx-zynqmp.c:273:5 The RX/TX FIFOs are created in xlnx_dp_init(), add xlnx_dp_finalize() to destroy them. Fixes: 58ac482a66d ("introduce xlnx-dp") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210323182958.277654-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-30net/npcm7xx_emc.c: Fix handling of receiving packets when RSDR not setDoug Evans
Turning REG_MCMDR_RXON is enough to start receiving packets. Signed-off-by: Doug Evans <dje@google.com> Message-id: 20210319195044.741821-1-dje@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-30iotests/244: Test preallocation for data-file-rawMax Reitz
Three test cases: (1) Adding a qcow2 (metadata) file to an existing data file, see whether we can read the existing data through the qcow2 image. (2) Append data to the data file, grow the qcow2 image accordingly, see whether we can read the new data through the qcow2 image. (3) At runtime, add a backing image to a freshly created qcow2 image with an external data file (with data-file-raw). Reading data from the qcow2 image must return the same result as reading data from the data file, so everything in the backing image must be ignored. (This did not use to be the case, because without the L2 tables preallocated, all clusters would appear as unallocated, and so the qcow2 driver would fall through to the backing file.) Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210326145509.163455-3-mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2021-03-30qcow2: Force preallocation with data-file-rawMax Reitz
Setting the qcow2 data-file-raw bit means that you can ignore the qcow2 metadata when reading from the external data file. It does not mean that you have to ignore it, though. Therefore, the data read must be the same regardless of whether you interpret the metadata or whether you ignore it, and thus the L1/L2 tables must all be present and give a 1:1 mapping. This patch changes 244's output: First, the qcow2 file is larger right after creation, because of metadata preallocation. Second, the qemu-img map output changes: Everything that was not explicitly discarded or zeroed is now a data area. Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210326145509.163455-2-mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2021-03-29linux-user: NETLINK_LIST_MEMBERSHIPS: Allow bad ptr if its length is 0Frédéric Fortier
getsockopt(fd, SOL_NETLINK, NETLINK_LIST_MEMBERSHIPS, *optval, *optlen) syscall allows optval to be NULL/invalid if optlen points to a size of zero. This allows userspace to query the length of the array they should use to get the full membership list before allocating memory for said list, then re-calling getsockopt with proper optval/optlen arguments. Notable users of this pattern include systemd-networkd, which in the (albeit old) version 237 tested, cannot start without this fix. Signed-off-by: Frédéric Fortier <frf@ghgsat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210328180135.88449-1-frf@ghgsat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-03-29Merge remote-tracking branch ↵Peter Maydell
'remotes/nvme/tags/nvme-fixes-for-6.0-pull-request' into staging emulated nvme fixes # gpg: Signature made Mon 29 Mar 2021 18:03:30 BST # gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9 # gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown] # gpg: aka "Klaus Jensen <k.jensen@samsung.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838 # Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9 * remotes/nvme/tags/nvme-fixes-for-6.0-pull-request: hw/block/nvme: fix ref counting in nvme_format_ns hw/block/nvme: fix resource leak in nvme_dif_rw Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-29hw/block/nvme: fix ref counting in nvme_format_nsKlaus Jensen
Max noticed that since blk_aio_pwrite_zeroes() may invoke the callback before returning, the callbacks will never see *count == 0 and thus never free the count variable or decrement num_formats causing a CQE to never be posted. Coverity (CID 1451082) also picked up on the fact that count would not be free'ed if the namespace was of zero size. Fix both of these issues by explicitly checking *count and finalize for the given namespace if --(*count) is zero. Enqueing a CQE if there are no AIOs outstanding after this case is already handled by nvme_format() by inspecting *num_formats. Reported-by: Max Reitz <mreitz@redhat.com> Reported-by: Coverity (CID 1451082) Fixes: dc04d25e2f3f ("hw/block/nvme: add support for the format nvm command") Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com>
2021-03-29hw/block/nvme: fix resource leak in nvme_dif_rwKlaus Jensen
If nvme_map_dptr() fails, nvme_dif_rw() will leak the bounce context. Fix this by using the same error handling as everywhere else in the function. Reported-by: Coverity (CID 1451080) Fixes: 146f720c5563 ("hw/block/nvme: end-to-end data protection") Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com>
2021-03-29qsd: Document FUSE exportsMax Reitz
Implementing FUSE exports required no changes to the storage daemon, so we forgot to document them there. Considering that both NBD and vhost-user-blk exports are documented in its man page (and NBD exports in its --help text), we should probably do the same for FUSE. Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210217115844.62661-1-mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2021-03-29block/mirror: Fix mirror_top's permissionsMax Reitz
mirror_top currently shares all permissions, and takes only the WRITE permission (if some parent has taken that permission, too). That is wrong, though; mirror_top is a filter, so it should take permissions like any other filter does. For example, if the parent needs CONSISTENT_READ, we need to take that, too, and if it cannot share the WRITE permission, we cannot share it either. The exception is when mirror_top is used for active commit, where we cannot take CONSISTENT_READ (because it is deliberately unshared above the base node) and where we must share WRITE (so that it is shared for all images in the backing chain, so the mirror job can take it for the target BB). Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210211172242.146671-2-mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2021-03-29iotests/046: Filter request lengthMax Reitz
For its concurrent requests, 046 has always filtered the offset, probably because concurrent requests may settle in any order. However, it did not filter the request length, and so if requests with different lengths settle in an unexpected order (notably the longer request before the shorter request), the test fails (for no good reason). Filter the length, too. Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20200918153323.108932-1-mreitz@redhat.com>
2021-03-29qcow2: use external virtual timersPavel Dovgalyuk
Regular virtual timers are used to emulate timings related to vCPU and peripheral states. QCOW2 uses timers to clean the cache. These timers should have external flag. In the opposite case they affect the execution and it can't be recorded and replayed. This patch adds external flag to the timer for qcow2 cache clean. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <161700516327.1141158.8366564693714562536.stgit@pasha-ThinkPad-X280> Signed-off-by: Max Reitz <mreitz@redhat.com>
2021-03-29iotests/116: Fix reference outputMax Reitz
15ce94a68ca ("block/qed: bdrv_qed_do_open: deal with errp") has improved the qed driver's error reporting, though sadly did not add a test for it. The good news are: There already is such a test, namely 116. The bad news are: Its reference output was not adjusted, and so now it fails. Let's fix the reference output, which has the nice side effect of demonstrating 15ce94a68ca's improvements. Fixes: 15ce94a68ca6730466c565c3d29971aab3087bf1 ("block/qed: bdrv_qed_do_open: deal with errp") Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210326141419.156831-1-mreitz@redhat.com>