aboutsummaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2020-08-13spapr/xive: Simplify error handling of kvmppc_xive_cpu_synchronize_state()Greg Kurz
Now that kvmppc_xive_cpu_get_state() returns negative on error, use that and get rid of the temporary Error object and error_propagate(). Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <159707852916.1489912.8376334685349668124.stgit@bahia.lan> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-08-13spapr/xive: Rework error handling of kvmppc_xive_set_source_config()Greg Kurz
Since kvm_device_access() returns a negative errno on failure, convert kvmppc_xive_set_source_config() to use it for error checking. This allows to get rid of the local_err boilerplate. Propagate the return value so that callers may use it as well to check failures. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <159707848764.1489912.17078842252160674523.stgit@bahia.lan> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-08-13spapr/xive: Rework error handling of kvmppc_xive_[gs]et_queue_config()Greg Kurz
Since kvm_device_access() returns a negative errno on failure, convert kvmppc_xive_get_queue_config() and kvmppc_xive_set_queue_config() to use it for error checking. This allows to get rid of the local_err boilerplate. Propagate the return value so that callers may use it as well to check failures. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <159707847357.1489912.2032291280645236480.stgit@bahia.lan> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-08-13spapr/xive: Rework error handling of kvmppc_xive_cpu_[gs]et_state()Greg Kurz
kvm_set_one_reg() returns a negative errno on failure, use that instead of errno. Also propagate it to callers so they can use it to check for failures and hopefully get rid of their local_err boilerplate. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <159707846665.1489912.14267225652103441921.stgit@bahia.lan> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-08-13spapr/xive: Rework error handling of kvmppc_xive_cpu_connect()Greg Kurz
Use error_setg_errno() instead of error_setg(strerror()). While here, use -ret instead of errno since kvm_vcpu_enable_cap() returns a negative errno on failure. Use ERRP_GUARD() to ensure that errp can be passed to error_append_hint(), and get rid of the local_err boilerplate. Propagate the return value so that callers may use it as well to check failures. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <159707844549.1489912.4862921680328017645.stgit@bahia.lan> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-08-13ppc/xive: Introduce dedicated kvm_irqchip_in_kernel() wrappersGreg Kurz
Calls to the KVM XIVE device are guarded by kvm_irqchip_in_kernel(). This ensures that QEMU won't try to use the device if KVM is disabled or if an in-kernel irqchip isn't required. When using ic-mode=dual with the pseries machine, we have two possible interrupt controllers: XIVE and XICS. The kvm_irqchip_in_kernel() helper will return true as soon as any of the KVM device is created. It might lure QEMU to think that the other one is also around, while it is not. This is exactly what happens with ic-mode=dual at machine init when claiming IRQ numbers, which must be done on all possible IRQ backends, eg. RTAS event sources or the PHB0 LSI table : only the KVM XICS device is active but we end up calling kvmppc_xive_source_reset_one() anyway, which fails. This doesn't cause any trouble because of another bug : kvmppc_xive_source_reset_one() lacks an error_setg() and callers don't see the failure. Most of the other kvmppc_xive_* functions have similar xive->fd checks to filter out the case when KVM XIVE isn't active. It might look safer to have idempotent functions but it doesn't really help to understand what's going on when debugging. Since we already have all the kvm_irqchip_in_kernel() in place, also have the callers to check xive->fd as well before calling KVM XIVE specific code. This is straight-forward for the spapr specific XIVE code. Some more care is needed for the platform agnostic XIVE code since it cannot access xive->fd directly. Introduce new in_kernel() methods in some base XIVE classes for this purpose and implement them only in spapr. In all cases, we still need to call kvm_irqchip_in_kernel() so that compilers can optimize the kvmppc_xive_* calls away when CONFIG_KVM isn't defined, thus avoiding the need for stubs. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <159679993438.876294.7285654331498605426.stgit@bahia.lan> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-08-13ppc/xive: Rework setup of XiveSource::esb_mmioGreg Kurz
Depending on whether XIVE is emultated or backed with a KVM XIVE device, the ESB MMIOs of a XIVE source point to an I/O memory region or a mapped memory region. This is currently handled by checking kvm_irqchip_in_kernel() returns false in xive_source_realize(). This is a bit awkward as we usually need to do extra things when we're using the in-kernel backend, not less. But most important, we can do better: turn the existing "xive.esb" memory region into a plain container, introduce an "xive.esb-emulated" I/O subregion and rename the existing "xive.esb" subregion in the KVM code to "xive.esb-kvm". Since "xive.esb-kvm" is added with overlap and a higher priority, it prevails over "xive.esb-emulated" (ie. a guest using KVM XIVE will interact with "xive.esb-kvm" instead of the default "xive.esb-emulated" region. While here, consolidate the computation of the MMIO region size in a common helper. Suggested-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <159679992680.876294.7520540158586170894.stgit@bahia.lan> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-08-12Update PowerPC AT_HWCAP2 definitionLijun Pan
Add PPC2_FEATURE2_ARCH_3_10 to the PowerPC AT_HWCAP2 definitions. Signed-off-by: Lijun Pan <ljp@linux.ibm.com> Message-Id: <20200724045845.89976-2-ljp@linux.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2020-08-04accel/xen: Fix xen_enabled() behavior on target-agnostic objectsPhilippe Mathieu-Daudé
CONFIG_XEN is generated by configure and stored in "config-target.h", which is (obviously) only include for target-specific objects. This is a problem for target-agnostic objects as CONFIG_XEN is never defined and xen_enabled() is always inlined as 'false'. Fix by following the KVM schema, defining CONFIG_XEN_IS_POSSIBLE when we don't know to force the call of the non-inlined function, returning the xen_allowed boolean. Fixes: da278d58a092 ("accel: Move Xen accelerator code under accel/xen/") Reported-by: Paul Durrant <pdurrant@amazon.com> Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paul Durrant <paul@xen.org> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Message-Id: <20200804074930.13104-2-philmd@redhat.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2020-08-03hw/intc/armv7m_nvic: Provide default "reset the system" behaviour for ↵Peter Maydell
SYSRESETREQ The NVIC provides an outbound qemu_irq "SYSRESETREQ" which it signals when the guest sets the SYSRESETREQ bit in the AIRCR register. This matches the hardware design (where the CPU has a signal of this name and it is up to the SoC to connect that up to an actual reset mechanism), but in QEMU it mostly results in duplicated code in SoC objects and bugs where SoC model implementors forget to wire up the SYSRESETREQ line. Provide a default behaviour for the case where SYSRESETREQ is not actually connected to anything: use qemu_system_reset_request() to perform a system reset. This will allow us to remove the implementations of SYSRESETREQ handling from the boards where that's exactly what it does, and also fixes the bugs in the board models which forgot to wire up the signal: * microbit * mps2-an385 * mps2-an505 * mps2-an511 * mps2-an521 * musca-a * musca-b1 * netduino * netduinoplus2 We still allow the board to wire up the signal if it needs to, in case we need to model more complicated reset controller logic or to model buggy SoC hardware which forgot to wire up the line itself. But defaulting to "reset the system" is more often going to be correct than defaulting to "do nothing". Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200728103744.6909-3-peter.maydell@linaro.org
2020-08-03include/hw/irq.h: New function qemu_irq_is_connected()Peter Maydell
Mostly devices don't need to care whether one of their output qemu_irq lines is connected, because functions like qemu_set_irq() silently do nothing if there is nothing on the other end. However sometimes a device might want to implement default behaviour for the case where the machine hasn't wired the line up to anywhere. Provide a function qemu_irq_is_connected() that devices can use for this purpose. (The test is trivial but encapsulating it in a function makes it easier to see where we're doing it in case we need to change the implementation later.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200728103744.6909-2-peter.maydell@linaro.org
2020-07-27Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
virtio,pci: bugfixes Minor bugfixes all over the places, including one CVE. Additionally, a fix for an ancient bug in migration - one has to wonder how come no one noticed. The fix is also non-trivial since we dare not break all existing machine types with pci - we have a work around in the works, for now we just skip the work-around for old machine types. Great job by Hogan Wang noticing, debugging and fixing it, and thanks to Dr. David Alan Gilbert for reviewing the patches. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon 27 Jul 2020 16:34:58 BST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: virtio-pci: fix virtio_pci_queue_enabled() MAINTAINERS: Cover the firmware JSON schema vhost-vdpa :Fix Coverity CID 1430270 / CID 1420267 libvhost-user: Report descriptor index on panic Fix vhost-user buffer over-read on ram hot-unplug hw/pci-host: save/restore pci host config register virtio-mem-pci: force virtio version 1 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-27virtio-pci: fix virtio_pci_queue_enabled()Laurent Vivier
In legacy mode, virtio_pci_queue_enabled() falls back to virtio_queue_enabled() to know if the queue is enabled. But virtio_queue_enabled() calls again virtio_pci_queue_enabled() if k->queue_enabled is set. This ends in a crash after a stack overflow. The problem can be reproduced with "-device virtio-net-pci,disable-legacy=off,disable-modern=true -net tap,vhost=on" And a look to the backtrace is very explicit: ... #4 0x000000010029a438 in virtio_queue_enabled () #5 0x0000000100497a9c in virtio_pci_queue_enabled () ... #130902 0x000000010029a460 in virtio_queue_enabled () #130903 0x0000000100497a9c in virtio_pci_queue_enabled () #130904 0x000000010029a460 in virtio_queue_enabled () #130905 0x0000000100454a20 in vhost_net_start () ... This patch fixes the problem by introducing a new function for the legacy case and calls it from virtio_pci_queue_enabled(). It also calls it from virtio_queue_enabled() to avoid code duplication. Fixes: f19bcdfedd53 ("virtio-pci: implement queue_enabled method") Cc: Jason Wang <jasowang@redhat.com> Cc: Cindy Lu <lulu@redhat.com> CC: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20200727153319.43716-1-lvivier@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-27hw/pci-host: save/restore pci host config registerHogan Wang
The pci host config register is used to save PCI address for read/write config data. If guest writes a value to config register, and then QEMU pauses the vcpu to migrate, after the migration, the guest will continue to write pci config data, and the write data will be ignored because of new qemu process losing the config register state. To trigger the bug: 1. guest is booting in seabios. 2. guest enables the SMRAM in seabios:piix4_apmc_smm_setup, and then expects to disable the SMRAM by pci_config_writeb. 3. after guest writes the pci host config register, QEMU pauses vcpu to finish migration. 4. guest write of config data(0x0A) fails to disable the SMRAM because the config register state is lost. 5. guest continues to boot and crashes in ipxe option ROM due to SMRAM in enabled state. Example Reproducer: step 1. Make modifications to seabios and qemu for increase reproduction efficiency, write 0xf0 to 0x402 port notify qemu to stop vcpu after 0x0cf8 port wrote i440 configure register. qemu stop vcpu when catch 0x402 port wrote 0xf0. seabios:/src/hw/pci.c @@ -52,6 +52,11 @@ void pci_config_writeb(u16 bdf, u32 addr, u8 val) writeb(mmconfig_addr(bdf, addr), val); } else { outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD); + if (bdf == 0 && addr == 0x72 && val == 0xa) { + dprintf(1, "stop vcpu\n"); + outb(0xf0, 0x402); // notify qemu to stop vcpu + dprintf(1, "resume vcpu\n"); + } outb(val, PORT_PCI_DATA + (addr & 3)); } } qemu:hw/char/debugcon.c @@ -60,6 +61,9 @@ static void debugcon_ioport_write(void *opaque, hwaddr addr, uint64_t val, printf(" [debugcon: write addr=0x%04" HWADDR_PRIx " val=0x%02" PRIx64 "]\n", addr, val); #endif + if (ch == 0xf0) { + vm_stop(RUN_STATE_PAUSED); + } /* XXX this blocks entire thread. Rewrite to use * qemu_chr_fe_write and background I/O callbacks */ qemu_chr_fe_write_all(&s->chr, &ch, 1); step 2. start vm1 by the following command line, and then vm stopped. $ qemu-system-x86_64 -machine pc-i440fx-5.0,accel=kvm\ -netdev tap,ifname=tap-test,id=hostnet0,vhost=on,downscript=no,script=no\ -device virtio-net-pci,netdev=hostnet0,id=net0,bus=pci.0,addr=0x13,bootindex=3\ -device cirrus-vga,id=video0,vgamem_mb=16,bus=pci.0,addr=0x2\ -chardev file,id=seabios,path=/var/log/test.seabios,append=on\ -device isa-debugcon,iobase=0x402,chardev=seabios\ -monitor stdio step 3. start vm2 to accept vm1 state. $ qemu-system-x86_64 -machine pc-i440fx-5.0,accel=kvm\ -netdev tap,ifname=tap-test1,id=hostnet0,vhost=on,downscript=no,script=no\ -device virtio-net-pci,netdev=hostnet0,id=net0,bus=pci.0,addr=0x13,bootindex=3\ -device cirrus-vga,id=video0,vgamem_mb=16,bus=pci.0,addr=0x2\ -chardev file,id=seabios,path=/var/log/test.seabios,append=on\ -device isa-debugcon,iobase=0x402,chardev=seabios\ -monitor stdio \ -incoming tcp:127.0.0.1:8000 step 4. execute the following qmp command in vm1 to migrate. (qemu) migrate tcp:127.0.0.1:8000 step 5. execute the following qmp command in vm2 to resume vcpu. (qemu) cont Before this patch, we get KVM "emulation failure" error on vm2. This patch fixes it. Cc: qemu-stable@nongnu.org Signed-off-by: Hogan Wang <hogan.wang@huawei.com> Message-Id: <20200727084621.3279-1-hogan.wang@huawei.com> Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-27linux-user: don't use MAP_FIXED in pgd_find_hole_fallbackAlex Bennée
Plain MAP_FIXED has the undesirable behaviour of splatting exiting maps so we don't actually achieve what we want when looking for gaps. We should be using MAP_FIXED_NOREPLACE. As this isn't always available we need to potentially check the returned address to see if the kernel gave us what we asked for. Fixes: ad592e37dfc ("linux-user: provide fallback pgd_find_hole for bare chroots") Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200724064509.331-9-alex.bennee@linaro.org>
2020-07-27target/i386: floatx80: avoid compound literals in static initializersLaszlo Ersek
Quoting ISO C99 6.7.8p4, "All the expressions in an initializer for an object that has static storage duration shall be constant expressions or string literals". The compound literal produced by the make_floatx80() macro is not such a constant expression, per 6.6p7-9. (An implementation may accept it, according to 6.6p10, but is not required to.) Therefore using "floatx80_zero" and make_floatx80() for initializing "f2xm1_table" and "fpatan_table" is not portable. And gcc-4.8 in RHEL-7.6 actually chokes on them: > target/i386/fpu_helper.c:871:5: error: initializer element is not constant > { make_floatx80(0xbfff, 0x8000000000000000ULL), > ^ We've had the make_floatx80_init() macro for this purpose since commit 3bf7e40ab914 ("softfloat: fix for C99", 2012-03-17), so let's use that macro again. Fixes: eca30647fc0 ("target/i386: reimplement f2xm1 using floatx80 operations") Fixes: ff57bb7b632 ("target/i386: reimplement fpatan using floatx80 operations") Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: Joseph Myers <joseph@codesourcery.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Maydell <peter.maydell@linaro.org> Link: https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg06566.html Link: https://lists.gnu.org/archive/html/qemu-devel/2020-07/msg04714.html Message-Id: <20200716144251.23004-1-lersek@redhat.com> Message-Id: <20200724064509.331-8-alex.bennee@linaro.org>
2020-07-27util: add qemu_get_host_physmem utility functionAlex Bennée
This will be used in a future patch. For POSIX systems _SC_PHYS_PAGES isn't standardised but at least appears in the man pages for Open/FreeBSD. The result is advisory so any users of it shouldn't just fail if we can't work it out. The win32 stub currently returns 0 until someone with a Windows system can develop and test a patch. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Cc: BALATON Zoltan <balaton@eik.bme.hu> Cc: Christian Ehrhardt <christian.ehrhardt@canonical.com> Message-Id: <20200724064509.331-5-alex.bennee@linaro.org>
2020-07-25Merge remote-tracking branch ↵Peter Maydell
'remotes/stefanberger/tags/pull-tpm-2020-07-24-1' into staging Merge tpm 2020/07/24 v1 # gpg: Signature made Sat 25 Jul 2020 01:13:22 BST # gpg: using RSA key B818B9CADF9089C2D5CEC66B75AD65802A0B4211 # gpg: Good signature from "Stefan Berger <stefanb@linux.vnet.ibm.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: B818 B9CA DF90 89C2 D5CE C66B 75AD 6580 2A0B 4211 * remotes/stefanberger/tags/pull-tpm-2020-07-24-1: tpm_emulator: Report an error if chardev is missing tpm: Improve help on TPM types when none are available Revert "tpm: Clean up error reporting in tpm_init_tpmdev()" Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-24Revert "tpm: Clean up error reporting in tpm_init_tpmdev()"Markus Armbruster
This reverts commit d10e05f15d5c3dd5e5cc59c5dfff460d89d48580. We report some -tpmdev failures, but then continue as if all was fine. Reproducer: $ qemu-system-x86_64 -nodefaults -S -display none -monitor stdio -chardev null,id=tpm0 -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0 qemu-system-x86_64: -tpmdev emulator,id=tpm0,chardev=chrtpm: tpm-emulator: tpm chardev 'chrtpm' not found. qemu-system-x86_64: -tpmdev emulator,id=tpm0,chardev=chrtpm: tpm-emulator: Could not cleanly shutdown the TPM: No such file or directory QEMU 5.0.90 monitor - type 'help' for more information (qemu) qemu-system-x86_64: -device tpm-tis,tpmdev=tpm0: Property 'tpm-tis.tpmdev' can't find value 'tpm0' $ echo $? 1 This is a regression caused by commit d10e05f15d "tpm: Clean up error reporting in tpm_init_tpmdev()". It's incomplete: be->create(opts) continues to use error_report(), and we don't set an error when it fails. I figure converting the create() methods to Error would make some sense, but I'm not sure it's worth the effort right now. Revert the broken commit instead, and add a comment to tpm_init_tpmdev(). Straightforward conflict in tpm.c resolved. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
2020-07-24qapi/error: Check format string argument in error_*prepend()Philippe Mathieu-Daudé
error_propagate_prepend() "behaves like error_prepend()", and error_prepend() uses "formatting @fmt, ... like printf()". error_prepend() checks its format string argument, but error_propagate_prepend() does not. Fix by addint the format attribute to error_propagate_prepend() and error_vprepend(). This would have caught the bug fixed in the previous commit. Missed in commit 4b5766488f "error: Fix use of error_prepend() with &error_fatal, &error_abort". Inspired-by: Stefan Weil <sw@weilnetz.de> Suggested-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200723171205.14949-1-philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2020-07-23Merge remote-tracking branch ↵Peter Maydell
'remotes/alistair/tags/pull-riscv-to-apply-20200722-1' into staging This PR contains a few RISC-V fixes. The main fix is the correction of the goldfish RTC time. On top of that some small fixes to the recently added vector extensions have been added (including an assert that fixed a coverity report). There is a change in the SiFive E debug memory size to match hardware. Finally there is a fix for PMP accesses. # gpg: Signature made Wed 22 Jul 2020 17:43:59 BST # gpg: using RSA key F6C4AC46D4934868D3B8CE8F21E10D29DF977054 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [full] # Primary key fingerprint: F6C4 AC46 D493 4868 D3B8 CE8F 21E1 0D29 DF97 7054 * remotes/alistair/tags/pull-riscv-to-apply-20200722-1: target/riscv: Fix the range of pmpcfg of CSR funcion table hw/riscv: sifive_e: Correct debug block size target/riscv: fix vector index load/store constraints target/riscv: Quiet Coverity complains about vamo* goldfish_rtc: Fix non-atomic read behaviour of TIME_LOW/TIME_HIGH Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-23Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
acpi,virtio,pc: bugfixes Fix bug in ACPI which were tripping up guests. Fix a use-after-free with hotplug of virtio devices. Block ability to create legacy devices which shouldn't have been there in the first place. Fix migration error handling with balloon. Drop some dead code in virtio. vtd emulation fixup. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 22 Jul 2020 13:07:26 BST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: virtio-pci: Changed vdev to proxy for VirtIO PCI BAR callbacks. intel_iommu: Use correct shift for 256 bits qi descriptor virtio: verify that legacy support is not accidentally on virtio: list legacy-capable devices virtio-balloon: Replace free page hinting references to 'report' with 'hint' virtio-balloon: Add locking to prevent possible race when starting hinting virtio-balloon: Prevent guest from starting a report when we didn't request one virtio: Drop broken and superfluous object_property_set_link() acpi: accept byte and word access to core ACPI registers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-23Merge remote-tracking branch 'remotes/philmd-gitlab/tags/avr-20200721' into ↵Peter Maydell
staging AVR patches Fixes a memory leak reported by Coverity (CID 1430449). CI jobs result: . https://gitlab.com/philmd/qemu/-/pipelines/168722631 # gpg: Signature made Tue 21 Jul 2020 19:00:03 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd-gitlab/tags/avr-20200721: hw/avr/boot: Fix memory leak in avr_load_firmware() qemu-common: Document qemu_find_file() qemu/osdep: Reword qemu_get_exec_dir() documentation qemu/osdep: Document os_find_datadir() return value Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-22goldfish_rtc: Fix non-atomic read behaviour of TIME_LOW/TIME_HIGHJessica Clarke
The specification says: 0x00 TIME_LOW R: Get current time, then return low-order 32-bits. 0x04 TIME_HIGH R: Return high 32-bits from previous TIME_LOW read. ... To read the value, the kernel must perform an IO_READ(TIME_LOW), which returns an unsigned 32-bit value, before an IO_READ(TIME_HIGH), which returns a signed 32-bit value, corresponding to the higher half of the full value. However, we were just returning the current time for both. If the guest is unlucky enough to read TIME_LOW and TIME_HIGH either side of an overflow of the lower half, it will see time be in the future, before jumping backwards on the next read, and Linux currently relies on the atomicity guaranteed by the spec so is affected by this. Fix this violation of the spec by caching the correct value for TIME_HIGH whenever TIME_LOW is read, and returning that value for any TIME_HIGH read. Signed-off-by: Jessica Clarke <jrtc27@jrtc27.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200718004934.83174-1-jrtc27@jrtc27.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-07-22virtio: list legacy-capable devicesCornelia Huck
Several types of virtio devices had already been around before the virtio standard was specified. These devices support virtio in legacy (and transitional) mode. Devices that have been added in the virtio standard are considered non-transitional (i.e. with no support for legacy virtio). Provide a helper function so virtio transports can figure that out easily. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200707105446.677966-2-cohuck@redhat.com> Cc: qemu-stable@nongnu.org Acked-by: Halil Pasic <pasic@linux.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22virtio-balloon: Replace free page hinting references to 'report' with 'hint'Alexander Duyck
Recently a feature named Free Page Reporting was added to the virtio balloon. In order to avoid any confusion we should drop the use of the word 'report' when referring to Free Page Hinting. So what this patch does is go through and replace all instances of 'report' with 'hint" when we are referring to free page hinting. Acked-by: David Hildenbrand <david@redhat.com> Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com> Message-Id: <20200720175128.21935.93927.stgit@localhost.localdomain> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22Merge remote-tracking branch 'remotes/philmd-gitlab/tags/fw_cfg-20200721' ↵Peter Maydell
into staging fw_cfg patches Fixes the DEADCODE issue reported by Coverity (CID 1430396). CI jobs result: . https://gitlab.com/philmd/qemu/-/pipelines/169086301 # gpg: Signature made Tue 21 Jul 2020 18:52:46 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd-gitlab/tags/fw_cfg-20200721: hw/nvram/fw_cfg: Let fw_cfg_add_from_generator() return boolean value hw/nvram/fw_cfg: Simplify fw_cfg_add_from_generator() error propagation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-21Merge remote-tracking branch 'remotes/armbru/tags/pull-qom-2020-07-21' into ↵Peter Maydell
staging QOM patches for 2020-07-21 # gpg: Signature made Tue 21 Jul 2020 16:40:27 BST # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qom-2020-07-21: qom: Make info qom-tree sort children more efficiently qom: Document object_get_canonical_path() returns malloced string qom: Change object_get_canonical_path_component() not to malloc Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-21hw/nvram/fw_cfg: Let fw_cfg_add_from_generator() return boolean valuePhilippe Mathieu-Daudé
Commits b6d7e9b66f..a43770df5d simplified the error propagation. Similarly to commit 6fd5bef10b "qom: Make functions taking Error** return bool, not void", let fw_cfg_add_from_generator() return a boolean value, not void. This allow to simplify parse_fw_cfg() and fixes the error handling issue reported by Coverity (CID 1430396): In parse_fw_cfg(): Variable assigned once to a constant guards dead code. Local variable local_err is assigned only once, to a constant value, making it effectively constant throughout its scope. If this is not the intent, examine the logic to see if there is a missing assignment that would make local_err not remain constant. It's the call of fw_cfg_add_from_generator(): Error *local_err = NULL; fw_cfg_add_from_generator(fw_cfg, name, gen_id, errp); if (local_err) { error_propagate(errp, local_err); return -1; } return 0; If it fails, parse_fw_cfg() sets an error and returns 0, which is wrong. Harmless, because the only caller passes &error_fatal. Reported-by: Peter Maydell <peter.maydell@linaro.org> Fixes: Coverity CID 1430396: 'Constant' variable guards dead code (DEADCODE) Fixes: 6552d87c48 ("softmmu/vl: Let -fw_cfg option take a 'gen_id' argument") Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200721131911.27380-3-philmd@redhat.com>
2020-07-21hw/nvram/fw_cfg: Simplify fw_cfg_add_from_generator() error propagationPhilippe Mathieu-Daudé
Document FWCfgDataGeneratorClass::get_data() return NULL on error, and non-NULL on success. This allow us to simplify fw_cfg_add_from_generator(). Since we don't need a local variable to propagate the error, we can remove the ERRP_GUARD() macro. Suggested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200721131911.27380-2-philmd@redhat.com>
2020-07-21qom: Document object_get_canonical_path() returns malloced stringMarkus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200714160202.3121879-5-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-07-21qom: Change object_get_canonical_path_component() not to mallocMarkus Armbruster
object_get_canonical_path_component() returns a malloced copy of a property name on success, null on failure. 19 of its 25 callers immediately free the returned copy. Change object_get_canonical_path_component() to return the property name directly. Since modifying the name would be wrong, adjust the return type to const char *. Drop the free from the 19 callers become simpler, add the g_strdup() to the other six. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200714160202.3121879-4-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com>
2020-07-21qemu-common: Document qemu_find_file()Philippe Mathieu-Daudé
Document qemu_find_file(), in particular the returned value which must be freed. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Michael Rolnik <mrolnik@gmail.com> Tested-by: Michael Rolnik <mrolnik@gmail.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20200714164257.23330-4-f4bug@amsat.org>
2020-07-21qemu/osdep: Reword qemu_get_exec_dir() documentationPhilippe Mathieu-Daudé
This comment is confuse, reword it a bit. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Michael Rolnik <mrolnik@gmail.com> Tested-by: Michael Rolnik <mrolnik@gmail.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20200714164257.23330-3-f4bug@amsat.org>
2020-07-21hw/net: Added plen fix for IPv6Andrew
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1708065 With network backend with 'virtual header' - there was an issue in 'plen' field. Overall, during TSO, 'plen' would be changed, but with 'vheader' this field should be set to the size of the payload itself instead of '0'. Signed-off-by: Andrew Melnychenko <andrew@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-07-20Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20200720' into staging target-arm queue: * virt: Don't enable MTE emulation by default * virt: Diagnose attempts to use MTE with memory-hotplug or KVM (rather than silently not working correctly) * util: Implement qemu_get_thread_id() for OpenBSD * qdev: Add doc comments for qdev_unrealize and GPIO functions, and standardize on doc-comments-in-header-file * hw/arm/armsse: Assert info->num_cpus is in-bounds in armsse_realize() * docs/system: Document canon-a1100, collie, gumstix, virt boards # gpg: Signature made Mon 20 Jul 2020 13:55:36 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20200720: docs/system: Document the arm virt board docs/system: Briefly document gumstix boards docs/system: Briefly document collie board docs/system: Briefly document canon-a1100 board hw/arm/armsse: Assert info->num_cpus is in-bounds in armsse_realize() qdev: Document GPIO related functions qdev: Document qdev_unrealize() qdev: Move doc comments from qdev.c to qdev-core.h util: Implement qemu_get_thread_id() for OpenBSD hw/arm/virt: Disable memory hotplug when MTE is enabled hw/arm/virt: Error for MTE enabled with KVM hw/arm/virt: Enable MTE via a machine property Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-20qdev: Document GPIO related functionsPeter Maydell
Add documentation comments for the various qdev functions related to creating and connecting GPIO lines. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200711142425.16283-4-peter.maydell@linaro.org
2020-07-20qdev: Document qdev_unrealize()Peter Maydell
Add a doc comment for qdev_unrealize(), to go with the new documentation for the realize part of the qdev lifecycle. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200711142425.16283-3-peter.maydell@linaro.org
2020-07-20qdev: Move doc comments from qdev.c to qdev-core.hPeter Maydell
The doc-comments which document the qdev API are split between the header file and the C source files, because as a project we haven't been consistent about where we put them. Move all the doc-comments in qdev.c to the header files, so that users of the APIs don't have to look at the implementation files for this information. In the process, unify them into our doc-comment format and expand on them in some cases to clarify expected use cases. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200711142425.16283-2-peter.maydell@linaro.org
2020-07-20hw/arm/virt: Enable MTE via a machine propertyRichard Henderson
Control this cpu feature via a machine property, much as we do with secure=on, since both require specialized support in the machine setup to be functional. Default MTE to off, since this feature implies extra overhead. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200713213341.590275-2-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-20Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-5.1-20200720' ↵Peter Maydell
into staging ppc patch queue 20200720 Here are some assorted fixes for qemu-5.1: * SLOF update with improved TPM handling, and fix for possible stack overflows on many-vcpu machines * Fix for NUMA distances on NVLink2 attached GPU memory nodes * Fixes to fail more gracefully on attempting to plug unsupported PCI bridge types * Don't allow pnv-psi device to be user created # gpg: Signature made Mon 20 Jul 2020 06:29:21 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-5.1-20200720: pseries: Update SLOF firmware image spapr: Add a new level of NUMA for GPUs spapr_pci: Robustify support of PCI bridges ppc/pnv: Make PSI device types not user creatable Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-20Merge remote-tracking branch 'remotes/cminyard/tags/for-qemu-i2c-5' into stagingPeter Maydell
Minor changes to: Add an SMBus config entry Cleanup/simplify/document some I2C interfaces # gpg: Signature made Thu 16 Jul 2020 18:46:55 BST # gpg: using RSA key FD0D5CE67CE0F59A6688268661F38C90919BFF81 # gpg: Good signature from "Corey Minyard <cminyard@mvista.com>" [unknown] # gpg: aka "Corey Minyard <minyard@acm.org>" [unknown] # gpg: aka "Corey Minyard <corey@minyard.net>" [unknown] # gpg: aka "Corey Minyard <minyard@mvista.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: FD0D 5CE6 7CE0 F59A 6688 2686 61F3 8C90 919B FF81 * remotes/cminyard/tags/for-qemu-i2c-5: hw/i2c: Document the I2C qdev helpers hw/i2c: Rename i2c_create_slave() as i2c_slave_create_simple() hw/i2c: Rename i2c_realize_and_unref() as i2c_slave_realize_and_unref() hw/i2c: Rename i2c_try_create_slave() as i2c_slave_new() hw/i2c/aspeed_i2c: Simplify aspeed_i2c_get_bus() hw/i2c/Kconfig: Add an entry for the SMBus Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-20spapr: Add a new level of NUMA for GPUsReza Arbab
NUMA nodes corresponding to GPU memory currently have the same affinity/distance as normal memory nodes. Add a third NUMA associativity reference point enabling us to give GPU nodes more distance. This is guest visible information, which shouldn't change under a running guest across migration between different qemu versions, so make the change effective only in new (pseries > 5.0) machine types. Before, `numactl -H` output in a guest with 4 GPUs (nodes 2-5): node distances: node 0 1 2 3 4 5 0: 10 40 40 40 40 40 1: 40 10 40 40 40 40 2: 40 40 10 40 40 40 3: 40 40 40 10 40 40 4: 40 40 40 40 10 40 5: 40 40 40 40 40 10 After: node distances: node 0 1 2 3 4 5 0: 10 40 80 80 80 80 1: 40 10 80 80 80 80 2: 80 80 10 80 80 80 3: 80 80 80 10 80 80 4: 80 80 80 80 10 80 5: 80 80 80 80 80 10 These are the same distances as on the host, mirroring the change made to host firmware in skiboot commit f845a648b8cb ("numa/associativity: Add a new level of NUMA for GPU's"). Signed-off-by: Reza Arbab <arbab@linux.ibm.com> Message-Id: <20200716225655.24289-1-arbab@linux.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-07-16hw/i2c: Document the I2C qdev helpersPhilippe Mathieu-Daudé
In commit d88c42ff2c we added new prototype but neglected to add their documentation. Fix that. Reported-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Corey Minyard <cminyard@mvista.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200705224154.16917-6-f4bug@amsat.org> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-07-16hw/i2c: Rename i2c_create_slave() as i2c_slave_create_simple()Philippe Mathieu-Daudé
We use "create_simple" names for functions that allocate, initialize, configure and realize device objects: pci_create_simple(), isa_create_simple(), usb_create_simple(). For consistency, rename i2c_create_slave() as i2c_slave_create_simple(). Since we have to update all the callers, also let it return a I2CSlave object. Suggested-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Corey Minyard <cminyard@mvista.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200705224154.16917-5-f4bug@amsat.org> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-07-16hw/i2c: Rename i2c_realize_and_unref() as i2c_slave_realize_and_unref()Philippe Mathieu-Daudé
The other i2c functions are called i2c_slave_FOO(). Rename as i2c_slave_realize_and_unref() to be consistent. Suggested-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200705224154.16917-4-f4bug@amsat.org> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-07-16hw/i2c: Rename i2c_try_create_slave() as i2c_slave_new()Philippe Mathieu-Daudé
We use "new" names for functions that allocate and initialize device objects: pci_new(), isa_new(), usb_new(). Let's call this one i2c_slave_new(). Since we have to update all the callers, also let it return a I2CSlave object. Suggested-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200705224154.16917-3-f4bug@amsat.org> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-07-16hw/i2c/aspeed_i2c: Simplify aspeed_i2c_get_bus()Philippe Mathieu-Daudé
All the callers of aspeed_i2c_get_bus() have a AspeedI2CState and cast it to a DeviceState with DEVICE(), then aspeed_i2c_get_bus() cast the DeviceState to an AspeedI2CState with ASPEED_I2C()... Simplify aspeed_i2c_get_bus() callers by using AspeedI2CState argument. Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200705224154.16917-2-f4bug@amsat.org> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-07-16Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell
staging # gpg: Signature made Wed 15 Jul 2020 14:49:07 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: ftgmac100: fix dblac write test net: detect errors from probing vnet hdr flag for TAP devices net: check if the file descriptor is valid before using it qemu-options.hx: Clean up and fix typo for colo-compare net/colo-compare.c: Expose compare "max_queue_size" to users hw/net: Added CSO for IPv6 virtio-net: fix removal of failover device Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-15net: check if the file descriptor is valid before using itLaurent Vivier
qemu_set_nonblock() checks that the file descriptor can be used and, if not, crashes QEMU. An assert() is used for that. The use of assert() is used to detect programming error and the coredump will allow to debug the problem. But in the case of the tap device, this assert() can be triggered by a misconfiguration by the user. At startup, it's not a real problem, but it can also happen during the hot-plug of a new device, and here it's a problem because we can crash a perfectly healthy system. For instance: # ip link add link virbr0 name macvtap0 type macvtap mode bridge # ip link set macvtap0 up # TAP=/dev/tap$(ip -o link show macvtap0 | cut -d: -f1) # qemu-system-x86_64 -machine q35 -device pcie-root-port,id=pcie-root-port-0 -monitor stdio 9<> $TAP (qemu) netdev_add type=tap,id=hostnet0,vhost=on,fd=9 (qemu) device_add driver=virtio-net-pci,netdev=hostnet0,id=net0,bus=pcie-root-port-0 (qemu) device_del net0 (qemu) netdev_del hostnet0 (qemu) netdev_add type=tap,id=hostnet1,vhost=on,fd=9 qemu-system-x86_64: .../util/oslib-posix.c:247: qemu_set_nonblock: Assertion `f != -1' failed. Aborted (core dumped) To avoid that, add a function, qemu_try_set_nonblock(), that allows to report the problem without crashing. In the same way, we also update the function for vhostfd in net_init_tap_one() and for fd in net_init_socket() (both descriptors are provided by the user and can be wrong). Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-07 22:36:21 +0000