aboutsummaryrefslogtreecommitdiff
path: root/qemu-char.c
AgeCommit message (Collapse)Author
2016-10-24char: remove use-after-free on win-stdioMarc-André Lureau
Found by reviewing the code, win_stdio_close() is called by qemu_chr_free() which then call qemu_chr_free_common() taking care of freeing CharDriverState*. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20161022095318.17775-3-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-10-13Revert "char: use a fixed idx for child muxed chr"Marc-André Lureau
That commit mis-used mux char: the frontend are multiplexed, not the backend. Fix the regression preventing "c-a c" to switch the focus. The following patches will fix the crash (when leaving or removing frontend) by tracking frontends with handler tags. This reverts commit 949055a2549afc4cde06b7972072c7288bb43722. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-10-10Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
virtio, pc: fixes and features more guest error handling for virtio devices virtio migration rework pc fixes Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon 10 Oct 2016 00:39:11 BST # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: (33 commits) intel-iommu: Check IOAPIC's Trigger Mode against the one in IRTE virtio: cleanup VMSTATE_VIRTIO_DEVICE vhost-vsock: convert VMSTATE_VIRTIO_DEVICE virtio-rng: convert VMSTATE_VIRTIO_DEVICE virtio-balloon: convert VMSTATE_VIRTIO_DEVICE virtio-scsi: convert VMSTATE_VIRTIO_DEVICE virtio-input: convert VMSTATE_VIRTIO_DEVICE virtio-gpu: convert VMSTATE_VIRTIO_DEVICE virtio-serial: convert VMSTATE_VIRTIO_DEVICE virtio-9p: convert VMSTATE_VIRTIO_DEVICE virtio-net: convert VMSTATE_VIRTIO_DEVICE virtio-blk: convert VMSTATE_VIRTIO_DEVICE virtio: prepare change VMSTATE_VIRTIO_DEVICE macro net: don't poke at chardev internal QemuOpts virtio-scsi: handle virtio_scsi_set_config() error virtio-scsi: convert virtio_scsi_bad_req() to use virtio_error() virtio-net: handle virtio_net_flush_tx() errors virtio-net: handle virtio_net_receive() errors virtio-net: handle virtio_net_handle_ctrl() error virtio-blk: handle virtio_blk_handle_request() errors ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-10-10Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into ↵Peter Maydell
staging trivial patches for 2016-10-08 # gpg: Signature made Sat 08 Oct 2016 09:56:38 BST # gpg: using RSA key 0x701B4F6B1A693E59 # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * remotes/mjt/tags/trivial-patches-fetch: (26 commits) net/filter-mirror: Fix mirror initial check typo virtio: rename the bar index field name in VirtIOPCIProxy linux-user: include <poll.h> instead of <sys/poll.h> char: fix missing return in error path for chardev TLS init CODING_STYLE: Fix a typo ("have" vs. "has") bitmap: refine and move BITMAP_{FIRST/LAST}_WORD_MASK build-sys: fix find-in-path m68k: change default system clock for m5208evb exec: remove unused compacted argument usb: ehci: fix memory leak in ehci_process_itd qapi: make the json schema files more regular. maint: Add module_block.h to .gitignore MAINTAINERS: Some updates related to the SH4 machines MAINTAINERS: Add some more MIPS related files MAINTAINERS: Add usermode related config files MAINTAINERS: Add some more pattern to recognize all win32 related files MAINTAINERS: Add some more rocker related files MAINTAINERS: Add header files to CRIS section MAINTAINERS: Add some more files to the virtio section MAINTAINERS: Add some SPARC machine related files ... # Conflicts: # MAINTAINERS
2016-10-10net: don't poke at chardev internal QemuOptsDaniel P. Berrange
The vhost-user & colo code is poking at the QemuOpts instance in the CharDriverState struct, not realizing that it is valid for this to be NULL. e.g. the following crash shows a codepath where it will be NULL: Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000055baf6ab4adc in qemu_opt_foreach (opts=0x0, func=0x55baf696b650 <net_vhost_chardev_opts>, opaque=0x7ffc51368c00, errp=0x7ffc51368e48) at util/qemu-option.c:617 617 QTAILQ_FOREACH(opt, &opts->head, next) { [Current thread is 1 (Thread 0x7f1d4970bb40 (LWP 6603))] (gdb) bt #0 0x000055baf6ab4adc in qemu_opt_foreach (opts=0x0, func=0x55baf696b650 <net_vhost_chardev_opts>, opaque=0x7ffc51368c00, errp=0x7ffc51368e48) at util/qemu-option.c:617 #1 0x000055baf696b7da in net_vhost_parse_chardev (opts=0x55baf8ff9260, errp=0x7ffc51368e48) at net/vhost-user.c:314 #2 0x000055baf696b985 in net_init_vhost_user (netdev=0x55baf8ff9250, name=0x55baf879d270 "hostnet2", peer=0x0, errp=0x7ffc51368e48) at net/vhost-user.c:360 #3 0x000055baf6960216 in net_client_init1 (object=0x55baf8ff9250, is_netdev=true, errp=0x7ffc51368e48) at net/net.c:1051 #4 0x000055baf6960518 in net_client_init (opts=0x55baf776e7e0, is_netdev=true, errp=0x7ffc51368f00) at net/net.c:1108 #5 0x000055baf696083f in netdev_add (opts=0x55baf776e7e0, errp=0x7ffc51368f00) at net/net.c:1186 #6 0x000055baf69608c7 in qmp_netdev_add (qdict=0x55baf7afaf60, ret=0x7ffc51368f50, errp=0x7ffc51368f48) at net/net.c:1205 #7 0x000055baf6622135 in handle_qmp_command (parser=0x55baf77fb590, tokens=0x7f1d24011960) at /path/to/qemu.git/monitor.c:3978 #8 0x000055baf6a9d099 in json_message_process_token (lexer=0x55baf77fb598, input=0x55baf75acd20, type=JSON_RCURLY, x=113, y=19) at qobject/json-streamer.c:105 #9 0x000055baf6abf7aa in json_lexer_feed_char (lexer=0x55baf77fb598, ch=125 '}', flush=false) at qobject/json-lexer.c:319 #10 0x000055baf6abf8f2 in json_lexer_feed (lexer=0x55baf77fb598, buffer=0x7ffc51369170 "}R\204\367\272U", size=1) at qobject/json-lexer.c:369 #11 0x000055baf6a9d13c in json_message_parser_feed (parser=0x55baf77fb590, buffer=0x7ffc51369170 "}R\204\367\272U", size=1) at qobject/json-streamer.c:124 #12 0x000055baf66221f7 in monitor_qmp_read (opaque=0x55baf77fb530, buf=0x7ffc51369170 "}R\204\367\272U", size=1) at /path/to/qemu.git/monitor.c:3994 #13 0x000055baf6757014 in qemu_chr_be_write_impl (s=0x55baf7610a40, buf=0x7ffc51369170 "}R\204\367\272U", len=1) at qemu-char.c:387 #14 0x000055baf6757076 in qemu_chr_be_write (s=0x55baf7610a40, buf=0x7ffc51369170 "}R\204\367\272U", len=1) at qemu-char.c:399 #15 0x000055baf675b3b0 in tcp_chr_read (chan=0x55baf90244b0, cond=G_IO_IN, opaque=0x55baf7610a40) at qemu-char.c:2927 #16 0x000055baf6a5d655 in qio_channel_fd_source_dispatch (source=0x55baf7610df0, callback=0x55baf675b25a <tcp_chr_read>, user_data=0x55baf7610a40) at io/channel-watch.c:84 #17 0x00007f1d3e80cbbd in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0 #18 0x000055baf69d3720 in glib_pollfds_poll () at main-loop.c:213 #19 0x000055baf69d37fd in os_host_main_loop_wait (timeout=126000000) at main-loop.c:258 #20 0x000055baf69d38ad in main_loop_wait (nonblocking=0) at main-loop.c:506 #21 0x000055baf676587b in main_loop () at vl.c:1908 #22 0x000055baf676d3bf in main (argc=101, argv=0x7ffc5136a6c8, envp=0x7ffc5136a9f8) at vl.c:4604 (gdb) p opts $1 = (QemuOpts *) 0x0 The crash occurred when attaching vhost-user net via QMP: { "execute": "chardev-add", "arguments": { "id": "charnet2", "backend": { "type": "socket", "data": { "addr": { "type": "unix", "data": { "path": "/var/run/openvswitch/vhost-user1" } }, "wait": false, "server": false } } }, "id": "libvirt-19" } { "return": { }, "id": "libvirt-19" } { "execute": "netdev_add", "arguments": { "type": "vhost-user", "chardev": "charnet2", "id": "hostnet2" }, "id": "libvirt-20" } Code using chardevs should not be poking at the internals of the CharDriverState struct. What vhost-user wants is a chardev that is operating as reconnectable network service, along with the ability to do FD passing over the connection. The colo code simply wants a network service. Add a feature concept to the char drivers so that chardev users can query the actual features they wish to have supported. The QemuOpts member is removed to prevent future mistakes in this area. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-08char: fix missing return in error path for chardev TLS initDaniel P. Berrange
If the qio_channel_tls_new_(server|client) methods fail, we disconnect the client. Unfortunately a missing return means we then go on to try and run the TLS handshake on a NULL I/O channel. This gives predictably segfaulty results. The main way to trigger this is to request a bogus TLS priority string for the TLS credentials. e.g. -object tls-creds-x509,id=tls0,priority=wibble,... Most other ways appear impossible to trigger except perhaps if OOM conditions cause gnutls initialization to fail. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-10-04char: update read handler in all casesMarc-André Lureau
In commit ac1b84dd1 (rhbz#1027181), a check was added to only update the "read handler" when the front-end is opened, because the read callbacks were not restored when a device is plugged. However, this seems not correct, the handler is correctly set back on hotplug (in virtconsole_realize) and the bug can no longer be reproduced. Calling chr_update_read_handler() allows to fix the mux driver to stop calling the child handlers (which may be going to be destroyed). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20161003094704.18087-2-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-10-04char: use a fixed idx for child muxed chrMarc-André Lureau
mux_chr_update_read_handler() is adding a new mux_cnt each time mux_chr_update_read_handler() is called, it's not possible to actually update the "child" chr callbacks that were set previously. This may lead to crashes if the "child" chr is destroyed: valgrind x86_64-softmmu/qemu-system-x86_64 -chardev stdio,mux=on,id=char0 -mon chardev=char0,mode=control,default when quitting: ==4306== Invalid read of size 8 ==4306== at 0x8061D3: json_lexer_destroy (json-lexer.c:385) ==4306== by 0x7E39F8: json_message_parser_destroy (json-streamer.c:134) ==4306== by 0x3447F6: monitor_qmp_event (monitor.c:3908) ==4306== by 0x480153: mux_chr_send_event (qemu-char.c:630) ==4306== by 0x480694: mux_chr_event (qemu-char.c:734) ==4306== by 0x47F1E9: qemu_chr_be_event (qemu-char.c:205) ==4306== by 0x481207: fd_chr_close (qemu-char.c:1114) ==4306== by 0x481659: qemu_chr_close_stdio (qemu-char.c:1221) ==4306== by 0x486F07: qemu_chr_free (qemu-char.c:4146) ==4306== by 0x486F97: qemu_chr_delete (qemu-char.c:4154) ==4306== by 0x487E66: qemu_chr_cleanup (qemu-char.c:4678) ==4306== by 0x495A98: main (vl.c:4675) ==4306== Address 0x28439e90 is 112 bytes inside a block of size 240 free'd ==4306== at 0x4C2CD5A: free (vg_replace_malloc.c:530) ==4306== by 0x1E4CBF2D: g_free (in /usr/lib64/libglib-2.0.so.0.4800.2) ==4306== by 0x344DE9: monitor_cleanup (monitor.c:4058) ==4306== by 0x495A93: main (vl.c:4674) ==4306== Block was alloc'd at ==4306== at 0x4C2BBAD: malloc (vg_replace_malloc.c:299) ==4306== by 0x1E4CBE18: g_malloc (in /usr/lib64/libglib-2.0.so.0.4800.2) ==4306== by 0x344BF8: monitor_init (monitor.c:4021) ==4306== by 0x49063C: mon_init_func (vl.c:2417) ==4306== by 0x7FC6DE: qemu_opts_foreach (qemu-option.c:1116) ==4306== by 0x4954E0: main (vl.c:4473) Instead, keep the "child" chr associated with a particular idx so its handlers can be updated and removed to avoid the crash. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20161003094704.18087-3-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-27qemu-char: Add qemu_chr_add_handlers_full() for GMaincontextZhang Chen
Add qemu_chr_add_handlers_full() API, we can use this API pass in a GMainContext,make handler run in the context rather than main_loop. This comments from Daniel P . Berrange. Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com> Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com> Signed-off-by: Wen Congyang <wency@cn.fujitsu.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-09-14qemu-char: avoid segfault if user lacks of permisson of a given logfileLin Ma
Function qemu_chr_alloc returns NULL if it failed to open logfile by any reason, says no write permission. For backends tty, stdio and msmouse, They need to check this return value to avoid segfault in this case. Signed-off-by: Lin Ma <lma@suse.com> Cc: qemu-stable <qemu-stable@nongnu.org> Message-Id: <20160914062250.22226-1-lma@suse.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13char: convert qemu_chr_fe_write to qemu_chr_fe_write_allDaniel P. Berrange
The mux chardev was not checking the return value of any qemu_chr_fe_write() call so would silently loose data on EAGAIN. Similarly the qemu_chr_fe_printf method would not check errors and was not in a position to retry even if it could check. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1473170165-540-5-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13chardev: Add 'help' option to print all available chardev backend typesLin Ma
Signed-off-by: Lin Ma <lma@suse.com> Message-Id: <20160816171352.17021-1-lma@suse.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-08-16char: fix waiting for TLS and telnet connectionMarc-André Lureau
Since commit d7a04fd7d5008, tcp_chr_wait_connected() was introduced, so vhost-user could wait until a backend started successfully. In vhost-user case, the chr socket must be plain unix, and the chr+vhost setup happens synchronously during qemu startup. However, with TLS and telnet socket, initial socket setup happens asynchronously, and s->connected is not set after the socket is accepted. In order for tcp_chr_wait_connected() to not keep accepting new connections and proceed with the last accepted socket, it can check for s->ioc instead. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20160816083332.15088-1-marcandre.lureau@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-08-08char: free MuxDriver when closingMarc-André Lureau
Similarly to other chr_close callbacks, free char type specific data. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2016-08-08char: free the tcp connection data when closingMarc-André Lureau
Make sure the connection data got freed when closing the chardev, to avoid leaks. Introduce tcp_chr_free_connection() to clean all connection related data, and move some tcp_chr_close() clean-ups there. (while at it, set write_msgfds_num to 0 when clearing array in tcp_set_msgfds()) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
2016-08-05wxx: Fix handling of files used for character devicesStefan Weil
On Windows, such files were not truncated like on all other hosts. Now we also test whether truncation is needed when running on Windows. The append case was also incorrect because it needs a different value for the desired access mode. Reported-by: Benjamin David Lunt <fys@fysnet.net> Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1470114877-1466-1-git-send-email-sw@weilnetz.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-29char: add and use tcp_chr_wait_connectedMarc-André Lureau
Add a chr_wait_connected for the tcp backend, and use it in the open_socket() function. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-07-29char: add chr_wait_connected callbackMarc-André Lureau
A function to wait on the backend to be connected, to be used in the following patches. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-07-29qemu-char: fix qemu_chr_fe_set_msgfds() crash when disconnectedMarc-André Lureau
Calling qemu_chr_fe_set_msgfds() on unconnected socket leads to crash since s->ioc is NULL in this case. Return an error earlier instead. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-07-13char: do not use atexit cleanup handlerMarc-André Lureau
It turns out qemu is calling exit() in various places from various threads without taking much care of resources state. The atexit() cleanup handlers cannot easily destroy resources that are in use (by the same thread or other). Since c1111a24a3, TCG arm guests run into the following abort() when running tests, the chardev mutex is locked during the write, so qemu_mutex_destroy() returns an error: #0 0x00007fffdbb806f5 in raise () at /lib64/libc.so.6 #1 0x00007fffdbb822fa in abort () at /lib64/libc.so.6 #2 0x00005555557616fe in error_exit (err=<optimized out>, msg=msg@entry=0x555555c38c30 <__func__.14622> "qemu_mutex_destroy") at /home/drjones/code/qemu/util/qemu-thread-posix.c:39 #3 0x0000555555b0be20 in qemu_mutex_destroy (mutex=mutex@entry=0x5555566aa0e0) at /home/drjones/code/qemu/util/qemu-thread-posix.c:57 #4 0x00005555558aab00 in qemu_chr_free_common (chr=0x5555566aa0e0) at /home/drjones/code/qemu/qemu-char.c:4029 #5 0x00005555558b05f9 in qemu_chr_delete (chr=<optimized out>) at /home/drjones/code/qemu/qemu-char.c:4038 #6 0x00005555558b05f9 in qemu_chr_delete (chr=<optimized out>) at /home/drjones/code/qemu/qemu-char.c:4044 #7 0x00005555558b062c in qemu_chr_cleanup () at /home/drjones/code/qemu/qemu-char.c:4557 #8 0x00007fffdbb851e8 in __run_exit_handlers () at /lib64/libc.so.6 #9 0x00007fffdbb85235 in () at /lib64/libc.so.6 #10 0x00005555558d1b39 in testdev_write (testdev=0x5555566aa0a0) at /home/drjones/code/qemu/backends/testdev.c:71 #11 0x00005555558d1b39 in testdev_write (chr=<optimized out>, buf=0x7fffc343fd9a "", len=0) at /home/drjones/code/qemu/backends/testdev.c:95 #12 0x00005555558adced in qemu_chr_fe_write (s=0x5555566aa0e0, buf=buf@entry=0x7fffc343fd98 "0q", len=len@entry=2) at /home/drjones/code/qemu/qemu-char.c:282 Instead of using a atexit() handler, only run the chardev cleanup as initially proposed at the end of main(), where there are less chances (hic) of conflicts or other races. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reported-by: Andrew Jones <drjones@redhat.com> Message-Id: <20160704153823.16879-1-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-07-06sockets: Use new QAPI cloningEric Blake
Rather than rolling our own clone via an expensive conversion in and back out of QObject, use the new clone visitor. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1465490926-28625-15-git-send-email-eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-06-29char: clean up remaining chardevs when leavingMarc-André Lureau
This helps to remove various chardev resources leaks when leaving qemu. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <1466105332-10285-2-git-send-email-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29char: change qemu_chr_fe_add_watch to return unsignedPaolo Bonzini
g_source_attach can return any value between 1 and UINT_MAX if you let QEMU run long enough. However, qemu_chr_fe_add_watch can also return a negative errno value when the device is disconnected or does not support chr_add_watch. Change it to return zero to avoid overloading these values. Fix the cadence_uart which asserts in this case (easily obtained with "-serial pty"). Tested-by: Bret Ketchum <bcketchum@gmail.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-17Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pc, pci, virtio: new features, cleanups, fixes Beginning of reconnect support for vhost-user. Misc cleanups and fixes. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Fri 17 Jun 2016 01:28:39 BST # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: MAINTAINERS: add Marcel to PCI msi_init: change return value to 0 on success fix some coding style problems pci core: assert ENOSPC when add capability test: start vhost-user reconnect test tests: append i386 tests vhost-net: save & restore vring enable state vhost-net: save & restore vhost-user acked features vhost-net: do not crash if backend is not present vhost-user: disconnect on start failure qemu-char: add qemu_chr_disconnect to close a fd accepted by listen fd tests/vhost-user-bridge: workaround stale vring base tests/vhost-user-bridge: add client mode vhost-user: add ability to know vhost-user backend disconnection pci: fix pci_requester_id() Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Conflicts: tests/Makefile.include
2016-06-17qemu-char: add qemu_chr_disconnect to close a fd accepted by listen fdTetsuya Mukawa
The patch introduces qemu_chr_disconnect(). The function is used for closing a fd accepted by listen fd. Though we already have qemu_chr_delete(), but it closes not only accepted fd but also listen fd. This new function is used when we still want to keep listen fd. Signed-off-by: Tetsuya Mukawa <mukawa@igel.co.jp> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: Yuanhan Liu <yuanhan.liu@linux.intel.com> Reviewed-by: Yuanhan Liu <yuanhan.liu@linux.intel.com> Reviewed-by: Victor Kaplansky <victork@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-06-16os-posix: include sys/mman.hPaolo Bonzini
qemu/osdep.h checks whether MAP_ANONYMOUS is defined, but this check is bogus without a previous inclusion of sys/mman.h. Include it in sysemu/os-posix.h and remove it from everywhere else. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-06char: get rid of qemu_char_get_next_serialxiaoqiang zhao
since there is no user of qemu_char_get_next_serial any more, it's time to let it go away. Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Message-id: 1465028065-5855-7-git-send-email-zxq_yx_007@163.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-05char: ensure all clients are in non-blocking modeDaniel P. Berrange
Only some callers of tcp_chr_new_client are putting the socket client into non-blocking mode. Move the call to qio_channel_set_blocking() into the tcp_chr_new_client method to guarantee that all code paths set non-blocking mode Reported-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Reported-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1458324041-22709-1-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-04-05char: fix broken EAGAIN retry on OS-X due to errno clobberingDaniel P. Berrange
Some of the chardev I/O paths really want to write the complete data buffer even though the channel is in non-blocking mode. To achieve this they look for EAGAIN and g_usleep() for 100ms. Unfortunately the code is set to check errno == EAGAIN a second time, after the g_usleep() call has completed. On OS-X at least, g_usleep clobbers errno to ETIMEDOUT, causing the retry to be skipped. This failure to retry means the full data isn't written to the chardev backend, which causes various failures including making the tests/ahci-test qtest hang. Rather than playing games trying to reset errno just simplify the code to use a goto to retry instead of a a loop. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1459438168-8146-2-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-03-22char: translate from QIOChannel error to errnoMarc-André Lureau
Caller of CharDriverState.chr* callback assume errno error conventions. Translate QIOChannel error to errno (this fixes potential EAGAIN regression, for ex if a vhost-user backend block, qemu_chr_fe_read_all() could get error -2 and not wait) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <1457718924-19338-1-git-send-email-marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-03-22util: move declarations out of qemu-common.hVeronia Bahaa
Move declarations out of qemu-common.h for functions declared in utils/ files: e.g. include/qemu/path.h for utils/path.c. Move inline functions out of qemu-common.h and into new files (e.g. include/qemu/bcd.h) Signed-off-by: Veronia Bahaa <veroniabahaa@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-03-18qapi: Don't special-case simple union wrappersEric Blake
Simple unions were carrying a special case that hid their 'data' QMP member from the resulting C struct, via the hack method QAPISchemaObjectTypeVariant.simple_union_type(). But by using the work we started by unboxing flat union and alternate branches, coupled with the ability to visit the members of an implicit type, we can now expose the simple union's implicit type in qapi-types.h: | struct q_obj_ImageInfoSpecificQCow2_wrapper { | ImageInfoSpecificQCow2 *data; | }; | | struct q_obj_ImageInfoSpecificVmdk_wrapper { | ImageInfoSpecificVmdk *data; | }; ... | struct ImageInfoSpecific { | ImageInfoSpecificKind type; | union { /* union tag is @type */ | void *data; |- ImageInfoSpecificQCow2 *qcow2; |- ImageInfoSpecificVmdk *vmdk; |+ q_obj_ImageInfoSpecificQCow2_wrapper qcow2; |+ q_obj_ImageInfoSpecificVmdk_wrapper vmdk; | } u; | }; Doing this removes asymmetry between QAPI's QMP side and its C side (both sides now expose 'data'), and means that the treatment of a simple union as sugar for a flat union is now equivalent in both languages (previously the two approaches used a different layer of dereferencing, where the simple union could be converted to a flat union with equivalent C layout but different {} on the wire, or to an equivalent QMP wire form but with different C representation). Using the implicit type also lets us get rid of the simple_union_type() hack. Of course, now all clients of simple unions have to adjust from using su->u.member to using su->u.member.data; while this touches a number of files in the tree, some earlier cleanup patches helped minimize the change to the initialization of a temporary variable rather than every single member access. The generated qapi-visit.c code is also affected by the layout change: |@@ -7393,10 +7393,10 @@ void visit_type_ImageInfoSpecific_member | } | switch (obj->type) { | case IMAGE_INFO_SPECIFIC_KIND_QCOW2: |- visit_type_ImageInfoSpecificQCow2(v, "data", &obj->u.qcow2, &err); |+ visit_type_q_obj_ImageInfoSpecificQCow2_wrapper_members(v, &obj->u.qcow2, &err); | break; | case IMAGE_INFO_SPECIFIC_KIND_VMDK: |- visit_type_ImageInfoSpecificVmdk(v, "data", &obj->u.vmdk, &err); |+ visit_type_q_obj_ImageInfoSpecificVmdk_wrapper_members(v, &obj->u.vmdk, &err); | break; | default: | abort(); Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1458254921-17042-13-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-03-17block: Use blk_{commit,flush}_all() consistentlyMax Reitz
Replace bdrv_commmit_all() and bdrv_flush_all() by their BlockBackend equivalents. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-03-15replay: character devicesPavel Dovgalyuk
This patch implements record and replay of character devices. It records chardevs communication in replay mode. Recorded information include data read from backend and counter of bytes written from frontend to backend to preserve frontend internal state. If character device was configured through the command line in record mode, then in replay mode it should be also added to command line. Backend of the character device could be changed in replay mode. Replaying of devices that perform ioctl and get_msgfd operations is not supported. gdbstub which also acts as a backend is not recorded to allow controlling the replaying through gdb. Monitor backends are also not recorded. Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Message-Id: <20160314074436.4980.83856.stgit@PASHA-ISP> [Add stubs. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-03-15Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
vhost, virtio, pci, pc, acpi nvdimm work sparse cpu id rework ipmi enhancements fixes all over the place pxb option to tweak chassis number Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Tue 15 Mar 2016 14:33:10 GMT using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: (51 commits) hw/acpi: fix GSI links UID ipmi: add some local variables in ipmi_sdr_init ipmi: remove the need of an ending record in the SDR table ipmi: use a function to initialize the SDR table ipmi: add a realize function to the device class ipmi: add rsp_buffer_set_error() helper ipmi: remove IPMI_CHECK_RESERVATION() macro ipmi: replace IPMI_ADD_RSP_DATA() macro with inline helpers ipmi: remove IPMI_CHECK_CMD_LEN() macro MAINTAINERS: machine core MAINTAINERS: Add an entry for virtio header files pc: acpi: clarify why possible LAPIC entries must be present in MADT pc: acpi: drop cpu->found_cpus bitmap pc: acpi: create Processor and Notify objects only for valid lapics pc: acpi: create MADT.lapic entries only for valid lapics pc: acpi: SRAT: create only valid processor lapic entries pc: acpi: cleanup qdev_get_machine() calls machine: introduce MachineClass.possible_cpu_arch_ids() hook pc: init pcms->apic_id_limit once and use it throughout pc.c pc: acpi: remove NOP assignment ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-11qemu-char: make tcp_chr_disconnect() reentrant-safeMarc-André Lureau
During CHR_EVENT_CLOSED, the function could be reentered, make this case safe. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-03-11qemu-char: remove all msgfds on disconnectMarc-André Lureau
Disconnect should reset context. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-03-11qemu-char: avoid potential double-freeMarc-André Lureau
If tcp_set_msgfds() is called several time with NULL fds, this could lead to double-free. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-03-10char: remove qemu_chr_open_socket_fd methodDaniel P. Berrange
The qemu_chr_open_socket_fd method takes care of either doing a synchronous socket connect, or creating a listener socket. Part of the work when creating the listener socket is to register a watch for incoming clients. The caller of qemu_chr_open_socket_fd may not want this watch created, as it might be doing a synchronous wait for the first client. Rather than passing yet more parameters into qemu_chr_open_socket_fd to let it handle this, just remove the qemu_chr_open_socket_fd method an inline its functionality into the caller. This allows for a clearer control flow and shorter code. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2016-03-10char: remove socket_try_connect methodDaniel P. Berrange
The qemu_chr_open_socket_fd() method multiplexes three different actions into one method. The socket_try_connect() method is one of its callers, but it only ever want one specific action performed. By inlining that action into socket_try_connect() we see that there is not in fact any failure scenario, so there is not even any reason for socket_try_connect to exist. Just inline the asynchronous connection attempts directly at the places that need them. This shortens & clarifies the code. Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2016-03-10char: remove qemu_chr_finish_socket_connection methodDaniel P. Berrange
The qemu_chr_finish_socket_connection method is multiplexing two different actions into one method. Each caller of it though, only wants one specific action. The code is shorter & clearer if we thus remove the method and just inline the specific actions where needed. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2016-03-05chardev: Drop useless ChardevDummy typeEric Blake
Commit d0d7708b made ChardevDummy be an empty wrapper type around ChardevCommon. But there is no technical reason for this indirection, so simplify the code by directly using the base type. Also change the fallback assignment to assign u.null rather than u.data, since a future patch will remove the data member of the C struct generated for QAPI unions. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1457106160-23614-1-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-03-05util: Shorten references into SocketAddressEric Blake
An upcoming patch will alter how simple unions, like SocketAddress, are laid out, which will impact all lines of the form 'addr->u.XXX' (expanding it to the longer 'addr->u.XXX.data'). For better legibility in that patch, and less need for line wrapping, it's better to use a temporary variable to reduce the effect of a layout change to just the variable initializations, rather than every reference within a SocketAddress. Also, take advantage of some C99 initialization where it makes sense (simplifying g_new0() to g_new()). Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1457021813-10704-7-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-03-05chardev: Shorten references into ChardevBackendEric Blake
An upcoming patch will alter how simple unions, like ChardevBackend, are laid out, which will impact all lines of the form 'backend->u.XXX' (expanding it to the longer 'backend->u.XXX.data'). For better legibility in that patch, and less need for line wrapping, it's better to use a temporary variable to reduce the effect of a layout change to just the variable initializations, rather than every reference within a ChardevBackend. It doesn't hurt that this also makes the code more consistent: some clients touched here already had a temporary variable but weren't using it. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-By: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1457021813-10704-6-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-02-25chardev: Properly initialize ChardevCommon componentsEric Blake
Commit d0d7708b forgot to parse logging for spice chardevs and virtual consoles. This requires making qemu_chr_parse_common() non-static. While at it, use a temporary variable to make the code shorter, as well as reduce the churn when a later patch alters the layout of simple unions. Signed-off-by: Eric Blake <eblake@redhat.com> CC: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1455927587-28033-2-git-send-email-eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-02-16char: fix handling of QIO_CHANNEL_ERR_BLOCKDaniel P. Berrange
If io_channel_send_full gets QIO_CHANNEL_ERR_BLOCK it and has already sent some of the data, it should return that amount of data, not EAGAIN, as that would cause the caller to re-try already sent data. Unfortunately due to a previous rebase conflict resolution error, the code for dealing with this was in the wrong part of the conditional, and so mistakenly ran on other I/O errors. This be seen running qemu-system-x86_64 -monitor stdio and entering 'info mtree', when running on a slow console (eg a slow remote ssh session). The monitor would get into an indefinite loop writing the same data until it managed to send it all without getting EAGAIN. Reported-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1455288410-27046-1-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-02-16Revert "qemu-char: Keep pty slave file descriptor open until the master is ↵Paolo Bonzini
closed" This reverts commit 34689e206abddac87a5217d458534e24f2a05562. Marc-André Lureau provided the following commentary: "It looks like if a the slave is opened, then Linux will buffer the master writes, up to a few kb and then throttle, so it's not entirely blocked but eventually the guest VM dies. However, not having any slave open it will simply let the write go and discard the data. At least, virt-install configures a pty for the serial but viewers like virt-manager do not necessarily open it. And, if there are no viewers, it will just hang. If qemu starts reading all the data from the slave, I don't think interactions with other slaves will work. I don't see much options but to close the slave, thus reverting this patch." Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-02-11char: fix parameter name / type in BSD codepathDaniel P. Berrange
The BSD impl of qemu_chr_open_pp_fd had mis-declared its parameter type as ChardevBackend instead of ChardevCommon. It had also mistakenly used the variable name 'common' instead of 'backend'. Tested-by: Sean Bruno <sbruno@freebsd.org> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-02-09qemu-char, io: fix ordering of arguments for UDP socket creationPaolo Bonzini
Two wrongs make a right, but they should be fixed anyway. Cc: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1455015557-15106-1-git-send-email-pbonzini@redhat.com>
2016-02-09char: fix repeated registration of tcp chardev I/O handlersDaniel P. Berrange
In previous commit: commit f2001a7e0555b66d6db25a3ff1801540814045bb Author: Daniel P. Berrange <berrange@redhat.com> Date: Tue Jan 19 11:14:30 2016 +0000 char: don't assume telnet initialization will not block The code which writes the telnet initialization sequence moved to an event loop callback. If the TCP chardev is opened as a server in blocking mode (ie -serial telnet:0.0.0.0:3000,server,wait) this results in a state where the TCP chardev is connected, but not yet ready to send/recv data when virtual hardware is created. When the virtual hardware initialization registers its chardev callbacks, it triggers tcp_chr_update_read_handler, which will add I/O watches to the connection. When the telnet initialization finally runs, it will then call tcp_chr_connect to finish the connection setup. This will in turn add I/O watches to the connection too. There are now two sets of I/O watches registered on the same connection. This ultimately causes data loss on the connection, for example, when typing into the telnet console only every second byte is echoed back to the client. The same flaw can affect channels running with TLS encryption too, since they also have delayed connection setup completion. The fix is to update tcp_chr_update_read_handler so that it avoids registering watches if the connection is not fully setup yet. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1454939707-10869-1-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-23 08:31:12 +0000