aboutsummaryrefslogtreecommitdiff
path: root/util
AgeCommit message (Collapse)Author
2017-07-19util/cacheinfo: Add missing include for ppc linuxPhilippe Mathieu-Daudé
This include was forgotten when splitting cacheinfo.c out of tcg/ppc/tcg-target.inc.c (see commit b255b2c8). For a Centos7 host, the include path <signal.h> <bits/sigcontext.h> <asm/sigcontext.h> <asm/elf.h> <asm/auxvec.h> implicitly pulls in the desired AT_* defines. Not so for Debian Jessie. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20170711015524.22936-1-f4bug@amsat.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-07-18block: remove timer canceling in throttle_config()Manos Pitsidianakis
throttle_config() cancels the timers of the calling BlockBackend. This doesn't make sense because other BlockBackends in the group remain untouched. There's no need to cancel the timers in the one specific BlockBackend so let's not do that. Throttled requests will run as scheduled and future requests will follow the new configuration. This also allows a throttle group's configuration to be changed even when it has no members. Signed-off-by: Manos Pitsidianakis <el13635@mail.ntua.gr> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-07-18block: add clock_type field to ThrottleGroupManos Pitsidianakis
Clock type in throttling is currently inferred by the ThrottleTimer's clock type even though it is a per-ThrottleGroup property; it doesn't make sense to have different clock types in the same group. Moving this to a field in ThrottleGroup can simplify some of the throttle functions. Signed-off-by: Manos Pitsidianakis <el13635@mail.ntua.gr> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-07-18Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging # gpg: Signature made Mon 17 Jul 2017 16:40:18 BST # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: block: fix shadowed variable in bdrv_co_pdiscard util/aio-win32: Only select on what we are actually waiting for Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-07-17util/aio-win32: Only select on what we are actually waiting forAlistair Francis
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 9307b70e9876c4e9e3c4478524a32a23a3d5dd05.1499368180.git.alistair.francis@xilinx.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-07-17coroutine-lock: add qemu_co_rwlock_downgrade and qemu_co_rwlock_upgradePaolo Bonzini
These functions are more efficient in the presence of contention. qemu_co_rwlock_downgrade also guarantees not to block, which may be useful in some algorithms too. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20170629132749.997-3-pbonzini@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com>
2017-07-14sockets: ensure we don't accept IPv4 clients when IPv4 is disabledDaniel P. Berrange
Currently if you disable listening on IPv4 addresses, via the CLI flag ipv4=off, we still mistakenly accept IPv4 clients via the IPv6 listener socket due to IPV6_V6ONLY flag being unset. We must ensure IPV6_V6ONLY is always set if ipv4=off This fixes the following scenarios -incoming tcp::9000,ipv6=on -incoming tcp:[::]:9000,ipv6=on -chardev socket,id=cdev0,host=,port=9000,server,nowait,ipv4=off -chardev socket,id=cdev0,host=,port=9000,server,nowait,ipv6=on -chardev socket,id=cdev0,host=::,port=9000,server,nowait,ipv4=off -chardev socket,id=cdev0,host=::,port=9000,server,nowait,ipv6=on which all mistakenly accepted IPv4 clients Acked-by: Gerd Hoffmann <kraxel@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-07-14sockets: don't block IPv4 clients when listening on "::"Daniel P. Berrange
When inet_parse() parses the hostname, it is forcing the has_ipv6 && ipv6 flags if the address contains a ":". This means that if the user had set the ipv4=on flag, to try to restrict the listener to just ipv4, an error would not have been raised. eg -incoming tcp:[::]:9000,ipv4 should have raised an error because listening for IPv4 on "::" is a non-sensical combination. With this removed, we now call getaddrinfo() on "::" passing PF_INET and so getaddrinfo reports an error about the hostname being incompatible with the requested protocol: qemu-system-x86_64: -incoming tcp:[::]:9000,ipv4: address resolution failed for :::9000: Address family for hostname not supported Likewise it is explicitly setting the has_ipv4 & ipv4 flags when the address contains only digits + '.'. This has no ill-effect, but also has no benefit, so is removed. Acked-by: Gerd Hoffmann <kraxel@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-07-14sockets: ensure we can bind to both ipv4 & ipv6 separatelyDaniel P. Berrange
When binding to an IPv6 socket we currently force the IPV6_V6ONLY flag to off. This means that the IPv6 socket will accept both IPv4 & IPv6 sockets when QEMU is launched with something like -vnc :::1 While this is good for that case, it is bad for other cases. For example if an empty hostname is given, getaddrinfo resolves it to 2 addresses 0.0.0.0 and ::, in that order. We will thus bind to 0.0.0.0 first, and then fail to bind to :: on the same port. The same problem can happen if any other hostname lookup causes the IPv4 address to be reported before the IPv6 address. When we get an IPv6 bind failure, we should re-try the same port, but with IPV6_V6ONLY turned on again, to avoid clash with any IPv4 listener. This ensures that -vnc :1 will bind successfully to both 0.0.0.0 and ::, and also avoid -vnc :1,to=2 from mistakenly using a 2nd port for the :: listener. This is a regression due to commit 396f935 "ui: add ability to specify multiple VNC listen addresses". Acked-by: Gerd Hoffmann <kraxel@gmail.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-07-14Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2017-07-13' ↵Peter Maydell
into staging Error reporting patches for 2017-07-13 # gpg: Signature made Thu 13 Jul 2017 12:55:45 BST # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-error-2017-07-13: Convert error_report*_err() to warn_report*_err() error: Implement the warn and free Error functions char-socket: Report TCP socket waiting as information Convert error_report() to warn_report() error: Functions to report warnings and informational messages util/qemu-error: Rename error_print_loc() to be more generic websock: Don't try to set *errp directly block: Don't try to set *errp directly xilinx: Fix latent error handling bug Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-07-13Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into ↵Peter Maydell
staging trivial patches for 2017-07-12 # gpg: Signature made Wed 12 Jul 2017 14:58:43 BST # gpg: using RSA key 0x701B4F6B1A693E59 # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * remotes/mjt/tags/trivial-patches-fetch: include/hw/ptimer.h: Add documentation comments hxtool: remove dead -q option qga-win32: Fix memory leak of device information set hw/core: fix missing return value in load_image_targphys_as() elf-loader: warn about invalid endianness configure: Handle having no c++ compiler in FORTIFY_SOURCE check hw/pci: define msi_nonbroken in pci-stub hw/misc: add missing includes configure: Fix build with pkg-config and --static --enable-sdl util/qemu-sockets: Drop unused helper socket_address_to_string() target/xtensa: gdbstub: drop dead return statement Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-07-13error: Implement the warn and free Error functionsAlistair Francis
Implement warn_report_err() and warn_reportf_err() functions which are the same as the error_report_err() and error_reportf_err() functions except report a warning instead of an error. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <276ff93eadc0b01b8243cc61ffc331f77922c0d0.1499866456.git.alistair.francis@xilinx.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-07-13error: Functions to report warnings and informational messagesAlistair Francis
Add warn_report(), warn_vreport() for reporting warnings, and info_report(), info_vreport() for informational messages. These are implemented them with a helper function factored out of error_vreport(), suitably generalized. This patch makes no changes to the output of the original error_report() function. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <c89e9980019f296ec9aa38d7689ac4d5c369296d.1499866456.git.alistair.francis@xilinx.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-07-13util/qemu-error: Rename error_print_loc() to be more genericAlistair Francis
Rename the error_print_loc() function in preparation for using it to print warnings as well. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <661b215695db878a0aef8401b506fb3da50e981a.1499866456.git.alistair.francis@xilinx.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-07-11qmp: add x-debug-block-dirty-bitmap-sha256Vladimir Sementsov-Ogievskiy
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-id: 20170628120530.31251-26-vsementsov@virtuozzo.com Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-07-11block/dirty-bitmap: add deserialize_ones funcVladimir Sementsov-Ogievskiy
Add bdrv_dirty_bitmap_deserialize_ones() function, which is needed for qcow2 bitmap loading, to handle unallocated bitmap parts, marked as all-ones. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 20170628120530.31251-7-vsementsov@virtuozzo.com Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-07-11hbitmap: improve dirty iterVladimir Sementsov-Ogievskiy
Make dirty iter resistant to resetting bits in corresponding HBitmap. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 20170628120530.31251-4-vsementsov@virtuozzo.com Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-07-11block: rip out all traces of password promptingDaniel P. Berrange
Now that qcow & qcow2 are wired up to get encryption keys via the QCryptoSecret object, nothing is relying on the interactive prompting for passwords. All the code related to password prompting can thus be ripped out. Reviewed-by: Alberto Garcia <berto@igalia.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20170623162419.26068-17-berrange@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-07-11util/qemu-sockets: Drop unused helper socket_address_to_string()Mao Zhongyi
Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-07-09util/cacheinfo: Fix warning generated by clangPranith Kumar
Clang generates the following warning on aarch64 host: CC util/cacheinfo.o /home/pranith/qemu/util/cacheinfo.c:121:48: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths] asm volatile("mrs\t%0, ctr_el0" : "=r"(ctr)); ^ /home/pranith/qemu/util/cacheinfo.c:121:28: note: use constraint modifier "w" asm volatile("mrs\t%0, ctr_el0" : "=r"(ctr)); ^~ %w0 Constraint modifier 'w' is not (yet?) accepted by gcc. Fix this by increasing the ctr size. Tested-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Pranith Kumar <bobby.prani@gmail.com> Message-Id: <20170630153946.11997-1-bobby.prani@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-07-04qemu-thread: Assert locks are initialized before usingFam Zheng
Not all platforms check whether a lock is initialized before used. In particular Linux seems to be more permissive than OSX. Check initialization state explicitly in our code to catch such bugs earlier. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170704122325.25634-1-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-07-04main_loop: Make main_loop_wait() return voidPeter Maydell
The last users of main_loop_wait() that cared about the return value have now been changed to no longer use it. Drop the now-useless return value and make the function return void. We avoid the awkwardness of ifdeffery to handle the 'ret' variable in main_loop_wait() only being wanted if CONFIG_SLIRP by simply dropping all the ifdefs. There are stub implementations of slirp_pollfds_poll() and slirp_pollfds_fill() already in stubs/slirp.c which do nothing, as required. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <1498584769-12439-3-git-send-email-peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-07-04util/oslib-win32: Remove if conditionalAlistair Francis
The original ready < nhandles - 1 can be re-written as ready + 1 < nhandles. The check was actually incorrect because WAIT_OBJECT_0 was not subtracted from ready; it worked because WAIT_OBJECT_0 is zero. After subtracting WAIT_OBJECT_0, the result is the same condition that we are checking on the first itteration of the for loop. This means we can remove the if statement and let the for loop check the code. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Message-Id: <a14083d681951f3999a0e9314605cb706381ae8d.1498756113.git.alistair.francis@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-07-04sockets: avoid formatting buffer that may not be NUL terminatedDaniel P. Berrange
The 'sun_path' field in the sockaddr_un struct is not required to be NUL termianted, so when reporting an error, we must use the separate 'path' variable which is guaranteed terminated. Fixes a bug spotted by coverity that was introduced in commit ad9579aaa16d5b385922d49edac2c96c79bcfb62 Author: Daniel P. Berrange <berrange@redhat.com> Date: Thu May 25 16:53:00 2017 +0100 sockets: improve error reporting if UNIX socket path is too long Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <20170626103756.22974-1-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-22Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2017-06-09-v2' ↵Peter Maydell
into staging QAPI patches for 2017-06-09 # gpg: Signature made Tue 20 Jun 2017 13:31:39 BST # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qapi-2017-06-09-v2: (41 commits) tests/qdict: check more get_try_int() cases console: use get_uint() for "head" property i386/cpu: use get_uint() for "min-level"/"min-xlevel" properties numa: use get_uint() for "size" property pnv-core: use get_uint() for "core-pir" property pvpanic: use get_uint() for "ioport" property auxbus: use get_uint() for "addr" property arm: use get_uint() for "mp-affinity" property xen: use get_uint() for "max-ram-below-4g" property pc: use get_uint() for "hpet-intcap" property pc: use get_uint() for "apic-id" property pc: use get_uint() for "iobase" property acpi: use get_uint() for "pci-hole*" properties acpi: use get_uint() for various acpi properties acpi: use get_uint() for "acpi-pcihp-io*" properties platform-bus: use get_uint() for "addr" property bcm2835_fb: use {get, set}_uint() for "vcram-size" and "vcram-base" aspeed: use {set, get}_uint() for "ram-size" property pcihp: use get_uint() for "bsel" property pc-dimm: make "size" property uint64 ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-22Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20170619' into stagingPeter Maydell
Queued TCG patches # gpg: Signature made Mon 19 Jun 2017 19:12:06 BST # gpg: using RSA key 0xAD1270CC4DD0279B # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>" # gpg: aka "Richard Henderson <rth@redhat.com>" # gpg: aka "Richard Henderson <rth@twiddle.net>" # Primary key fingerprint: 9CB1 8DDA F8E8 49AD 2AFC 16A4 AD12 70CC 4DD0 279B * remotes/rth/tags/pull-tcg-20170619: target/arm: Exit after clearing aarch64 interrupt mask target/s390x: Exit after changing PSW mask target/alpha: Use tcg_gen_lookup_and_goto_ptr tcg: Increase hit rate of lookup_tb_ptr tcg/arm: Use ldr (literal) for goto_tb tcg/arm: Try pc-relative addresses for movi tcg/arm: Remove limit on code buffer size tcg/arm: Use indirect branch for goto_tb tcg/aarch64: Use ADR in tcg_out_movi translate-all: consolidate tb init in tb_gen_code tcg: allocate TB structs before the corresponding translated code util: add cacheinfo Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-20qapi: merge QInt and QFloat in QNumMarc-André Lureau
We would like to use a same QObject type to represent numbers, whether they are int, uint, or floats. Getters will allow some compatibility between the various types if the number fits other representations. Add a few more tests while at it. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-7-marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [parse_stats_intervals() simplified a bit, comment in test_visitor_in_int_overflow() tidied up, suppress bogus warnings] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-19util: add cacheinfoEmilio G. Cota
Add helpers to gather cache info from the host at init-time. For now, only export the host's I/D cache line sizes, which we will use to improve cache locality to avoid false sharing. Suggested-by: Richard Henderson <rth@twiddle.net> Suggested-by: Geert Martin Ijewski <gm.ijewski@web.de> Tested-by: Geert Martin Ijewski <gm.ijewski@web.de> Signed-off-by: Emilio G. Cota <cota@braap.org> Message-Id: <1496794624-4083-1-git-send-email-cota@braap.org> [rth: Move all implementations from tcg/ppc/] Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-06-16util: add stats64 modulePaolo Bonzini
This module provides fast paths for 64-bit atomic operations on machines that only have 32-bit atomic access. Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170605123908.18777-11-pbonzini@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com>
2017-06-12Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging # gpg: Signature made Wed 07 Jun 2017 19:06:51 BST # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: configure: split c and cxx extra flags coroutine-lock: do not touch coroutine after another one has been entered .gdbinit: load QEMU sub-commands when gdb starts coccinelle: fix typo in comment oslib: strip trailing '\n' from error_setg() string argument Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-07sockets: improve error reporting if UNIX socket path is too longDaniel P. Berrange
The 'struct sockaddr_un' only allows 108 bytes for the socket path. If the user supplies a path, QEMU uses snprintf() to silently truncate it when too long. This is undesirable because the user will then be unable to connect to the path they asked for. If the user doesn't supply a path, QEMU builds one based on TMPDIR, but if that leads to an overlong path, it mistakenly uses error_setg_errno() with a stale errno value, because snprintf() does not set errno on truncation. In solving this the code needed some refactoring to ensure we don't pass 'un.sun_path' directly to any APIs which expect NUL-terminated strings, because the path is not required to be terminated. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <20170525155300.22743-1-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-07coroutine-lock: do not touch coroutine after another one has been enteredRoman Pen
Submission of requests on linux aio is a bit tricky and can lead to requests completions on submission path: 44713c9e8547 ("linux-aio: Handle io_submit() failure gracefully") 0ed93d84edab ("linux-aio: process completions from ioq_submit()") That means that any coroutine which has been yielded in order to wait for completion can be resumed from submission path and be eventually terminated (freed). The following use-after-free crash was observed when IO throttling was enabled: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7f5813dff700 (LWP 56417)] virtqueue_unmap_sg (elem=0x7f5804009a30, len=1, vq=<optimized out>) at virtio.c:252 (gdb) bt #0 virtqueue_unmap_sg (elem=0x7f5804009a30, len=1, vq=<optimized out>) at virtio.c:252 ^^^^^^^^^^^^^^ remember the address #1 virtqueue_fill (vq=0x5598b20d21b0, elem=0x7f5804009a30, len=1, idx=0) at virtio.c:282 #2 virtqueue_push (vq=0x5598b20d21b0, elem=elem@entry=0x7f5804009a30, len=<optimized out>) at virtio.c:308 #3 virtio_blk_req_complete (req=req@entry=0x7f5804009a30, status=status@entry=0 '\000') at virtio-blk.c:61 #4 virtio_blk_rw_complete (opaque=<optimized out>, ret=0) at virtio-blk.c:126 #5 blk_aio_complete (acb=0x7f58040068d0) at block-backend.c:923 #6 coroutine_trampoline (i0=<optimized out>, i1=<optimized out>) at coroutine-ucontext.c:78 (gdb) p * elem $8 = {index = 77, out_num = 2, in_num = 1, in_addr = 0x7f5804009ad8, out_addr = 0x7f5804009ae0, in_sg = 0x0, out_sg = 0x7f5804009a50} ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'in_sg' and 'out_sg' are invalid. e.g. it is impossible that 'in_sg' is zero, instead its value must be equal to: (gdb) p/x 0x7f5804009ad8 + sizeof(elem->in_addr[0]) + 2 * sizeof(elem->out_addr[0]) $26 = 0x7f5804009af0 Seems 'elem' was corrupted. Meanwhile another thread raised an abort: Thread 12 (Thread 0x7f57f2ffd700 (LWP 56426)): #0 raise () from /lib/x86_64-linux-gnu/libc.so.6 #1 abort () from /lib/x86_64-linux-gnu/libc.so.6 #2 qemu_coroutine_enter (co=0x7f5804009af0) at qemu-coroutine.c:113 #3 qemu_co_queue_run_restart (co=0x7f5804009a30) at qemu-coroutine-lock.c:60 #4 qemu_coroutine_enter (co=0x7f5804009a30) at qemu-coroutine.c:119 ^^^^^^^^^^^^^^^^^^ WTF?? this is equal to elem from crashed thread #5 qemu_co_queue_run_restart (co=0x7f57e7f16ae0) at qemu-coroutine-lock.c:60 #6 qemu_coroutine_enter (co=0x7f57e7f16ae0) at qemu-coroutine.c:119 #7 qemu_co_queue_run_restart (co=0x7f5807e112a0) at qemu-coroutine-lock.c:60 #8 qemu_coroutine_enter (co=0x7f5807e112a0) at qemu-coroutine.c:119 #9 qemu_co_queue_run_restart (co=0x7f5807f17820) at qemu-coroutine-lock.c:60 #10 qemu_coroutine_enter (co=0x7f5807f17820) at qemu-coroutine.c:119 #11 qemu_co_queue_run_restart (co=0x7f57e7f18e10) at qemu-coroutine-lock.c:60 #12 qemu_coroutine_enter (co=0x7f57e7f18e10) at qemu-coroutine.c:119 #13 qemu_co_enter_next (queue=queue@entry=0x5598b1e742d0) at qemu-coroutine-lock.c:106 #14 timer_cb (blk=0x5598b1e74280, is_write=<optimized out>) at throttle-groups.c:419 Crash can be explained by access of 'co' object from the loop inside qemu_co_queue_run_restart(): while ((next = QSIMPLEQ_FIRST(&co->co_queue_wakeup))) { QSIMPLEQ_REMOVE_HEAD(&co->co_queue_wakeup, co_queue_next); ^^^^^^^^^^^^^^^^^^^^ on each iteration 'co' is accessed, but 'co' can be already freed qemu_coroutine_enter(next); } When 'next' coroutine is resumed (entered) it can in its turn resume 'co', and eventually free it. That's why we see 'co' (which was freed) has the same address as 'elem' from the first backtrace. The fix is obvious: use temporary queue and do not touch coroutine after first qemu_coroutine_enter() is invoked. The issue is quite rare and happens every ~12 hours on very high IO and CPU load (building linux kernel with -j512 inside guest) when IO throttling is enabled. With the fix applied guest is running ~35 hours and is still alive so far. Signed-off-by: Roman Pen <roman.penyaev@profitbricks.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20170601160847.23720-1-roman.penyaev@profitbricks.com Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Fam Zheng <famz@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: qemu-devel@nongnu.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-06-07oslib: strip trailing '\n' from error_setg() string argumentPhilippe Mathieu-Daudé
spotted by Coccinelle script scripts/coccinelle/err-bad-newline.cocci Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-06-06Check the return value of fcntl in qemu_set_cloexecStefano Stabellini
Assert that the return value is not an error. This issue was found by Coverity. CID: 1374831 Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> CC: groug@kaod.org CC: pbonzini@redhat.com CC: Eric Blake <eblake@redhat.com> Message-Id: <1494356693-13190-2-git-send-email-sstabellini@kernel.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-02Remove/replace sysemu/char.h inclusionMarc-André Lureau
Those are apparently unnecessary includes. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2017-06-01Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2017-05-31' into ↵Peter Maydell
staging QAPI patches for 2017-05-31 # gpg: Signature made Wed 31 May 2017 18:06:39 BST # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qapi-2017-05-31: qapi: Reject alternates that can't work with keyval_parse() tests/qapi-schema: Avoid 'str' in alternate test cases qapi: Document visit_type_any() issues with keyval input qobject-input-visitor: Reject non-finite numbers with keyval Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-01Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell
Various bugfixes and code cleanups. Most notably, it fixes metadata handling in mapped-file security mode (especially for the virtfs root). # gpg: Signature made Tue 30 May 2017 14:36:22 BST # gpg: using DSA key 0x02FC3AEB0101DBC2 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Greg Kurz <groug@free.fr>" # gpg: aka "Greg Kurz <gkurz@linux.vnet.ibm.com>" # gpg: aka "Gregory Kurz (Groug) <groug@free.fr>" # gpg: aka "[jpeg image of size 3330]" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2BD4 3B44 535E C0A7 9894 DBA2 02FC 3AEB 0101 DBC2 * remotes/gkurz/tags/for-upstream: 9pfs: local: metadata file for the VirtFS root 9pfs: local: simplify file opening 9pfs: local: resolve special directories in paths 9pfs: check return value of v9fs_co_name_to_path() util: drop old utimensat() compat code 9pfs: assume utimensat() and futimens() are present fsdev: fix virtfs-proxy-helper cwd 9pfs: local: fix unlink of alien files in mapped-file mode 9pfs: drop pdu_push_and_notify() fsdev: don't allow unknown format in marshal/unmarshal virtio-9p/xen-9p: move 9p specific bits to core 9p code Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-05-31qapi: Reject alternates that can't work with keyval_parse()Markus Armbruster
Alternates are sum types like unions, but use the JSON type on the wire / QType in QObject instead of an explicit tag. That's why we require alternate members to have distinct QTypes. The recently introduced keyval_parse() (commit d454dbe) can only produce string scalars. The qobject_input_visitor_new_keyval() input visitor mostly hides the difference, so code using a QObject input visitor doesn't have to care whether its input was parsed from JSON or KEY=VALUE,... The difference leaks for alternates, as noted in commit 0ee9ae7: a non-string, non-enum scalar alternate value can't currently be expressed. In part, this is just our insufficiently sophisticated implementation. Consider alternate type 'GuestFileWhence'. It has an integer member and a 'QGASeek' member. The latter is an enumeration with values 'set', 'cur', 'end'. The meaning of b=set, b=cur, b=end, b=0, b=1 and so forth is perfectly obvious. However, our current implementation falls apart at run time for b=0, b=1, and so forth. Fixable, but not today; add a test case and a TODO comment. Now consider an alternate type with a string and an integer member. What's the meaning of a=42? Is it the string "42" or the integer 42? Whichever meaning you pick makes the other inexpressible. This isn't just an implementation problem, it's fundamental. Our current implementation will pick string. So far, we haven't needed such alternates. To make sure we stop and think before we add one that cannot sanely work with keyval_parse(), let's require alternate members to have sufficiently distinct representation in KEY=VALUE,... syntax: * A string member clashes with any other scalar member * An enumeration member clashes with bool members when it has value 'on' or 'off'. * An enumeration member clashes with numeric members when it has a value that starts with '-', '+', or a decimal digit. This is a rather lazy approximation of the actual number syntax accepted by the visitor. Note that enumeration values starting with '-' and '+' are rejected elsewhere already, but better safe than sorry. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1495471335-23707-5-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2017-05-25util: drop old utimensat() compat codeGreg Kurz
Now that 9pfs and virtfs-proxy-helper have been converted to utimensat(), we don't need to keep qemu_utimens() anymore. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-05-23sockets: Plug memory leak in socket_address_flatten()Markus Armbruster
socket_address_flatten() leaks a SocketAddress when its argument is null. Happens when opening a ChardevBackend of type 'udp' that is configured without a local address. Screwed up in commit bd269ebc due to last minute semantic conflict resolution. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1494866344-11013-1-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-05-17utils: provide size_to_str()Peter Xu
Moving the algorithm from print_type_size() into size_to_str() so that other component can also leverage it. With that, refactor print_type_size(). The assert() in that logic is removed though, since even UINT64_MAX would not overflow. Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1494562661-9063-3-git-send-email-peterx@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2017-05-12Merge tag 'block-pull-request' into stagingStefan Hajnoczi
# gpg: Signature made Fri 12 May 2017 10:37:12 AM EDT # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * tag 'block-pull-request': aio: add missing aio_notify() to aio_enable_external() block: Simplify BDRV_BLOCK_RAW recursion coroutine: remove GThread implementation Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-12Merge remote-tracking branch 'kwolf/tags/for-upstream' into stagingStefan Hajnoczi
Block layer patches # gpg: Signature made Thu 11 May 2017 10:31:37 AM EDT # gpg: using RSA key 0x7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * kwolf/tags/for-upstream: (58 commits) MAINTAINERS: Add qemu-progress to the block layer qcow2: Discard/zero clusters by byte count qcow2: Assert that cluster operations are aligned qcow2: Optimize write zero of unaligned tail cluster iotests: Add test 179 to cover write zeroes with unmap iotests: Improve _filter_qemu_img_map qcow2: Optimize zero_single_l2() to minimize L2 churn qcow2: Make distinction between zero cluster types obvious qcow2: Name typedef for cluster type qcow2: Correctly report status of preallocated zero clusters block: Update comments on BDRV_BLOCK_* meanings qcow2: Use consistent switch indentation qcow2: Nicer variable names in qcow2_update_snapshot_refcount() tests: Add coverage for recent block geometry fixes blkdebug: Add ability to override unmap geometries blkdebug: Simplify override logic blkdebug: Add pass-through write_zero and discard support blkdebug: Refactor error injection blkdebug: Sanity check block layer guarantees qemu-io: Switch 'map' output to byte-based reporting ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-12coroutine: remove GThread implementationDaniel P. Berrange
The GThread implementation is not functional enough to actually run QEMU reliably. While it was potentially useful for debugging, we have a scripts/qemugdb/coroutine.py to enable tracing of ucontext coroutines in GDB, so that removes the only reason for GThread to exist. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Acked-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-11osdep: Fall back to posix lock when OFD lock is unavailableFam Zheng
Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-05-11osdep: Add qemu_lock_fd and qemu_unlock_fdFam Zheng
They are wrappers of POSIX fcntl "file private locking", with a convenient "try lock" wrapper implemented with F_OFD_GETLK. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-05-10Merge remote-tracking branch 'mjt/tags/trivial-patches-fetch' into stagingStefan Hajnoczi
trivial patches for 2017-05-10 # gpg: Signature made Wed 10 May 2017 03:19:30 AM EDT # gpg: using RSA key 0x701B4F6B1A693E59 # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * mjt/tags/trivial-patches-fetch: (23 commits) tests: Remove redundant assignment MAINTAINERS: Update paths for AioContext implementation MAINTAINERS: Update paths for main loop jazz_led: fix bad snprintf tests: Ignore another built executable (test-hmp) scripts: Switch to more portable Perl shebang scripts/qemu-binfmt-conf.sh: Fix shell portability issue virtfs: allow a device id to be specified in the -virtfs option hw/core/generic-loader: Fix crash when running without CPU virtio-blk: Remove useless condition around g_free() qemu-doc: Fix broken URLs of amnhltm.zip and dosidle210.zip use _Static_assert in QEMU_BUILD_BUG_ON channel-file: fix wrong parameter comments block: Make 'replication_state' an enum util: Use g_malloc/g_free in envlist.c qga: fix compiler warnings (clang 5) device_tree: fix compiler warnings (clang 5) usb-ccid: make ccid_write_data_block() cope with null buffers tests: Ignore more test executables Add 'none' as type for drive's if option ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-09Merge remote-tracking branch 'armbru/tags/pull-qapi-2017-05-04-v3' into stagingStefan Hajnoczi
QAPI patches for 2017-05-04 # gpg: Signature made Tue 09 May 2017 03:16:12 AM EDT # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * armbru/tags/pull-qapi-2017-05-04-v3: (28 commits) qmp-shell: improve help qmp-shell: don't show version greeting if unavailable qmp-shell: Cope with query-commands error qmp-shell: add -N option to skip negotiate qmp-shell: add persistent command history qobject-input-visitor: Catch misuse of end_struct vs. end_list qapi: Document intended use of @name within alternate visits qobject-input-visitor: Document full_name_nth() qmp: Improve QMP dispatch error messages sockets: Delete unused helper socket_address_crumple() sockets: Limit SocketAddressLegacy to external interfaces sockets: Rename SocketAddressFlat to SocketAddress sockets: Rename SocketAddress to SocketAddressLegacy qapi: New QAPI_CLONE_MEMBERS() sockets: Prepare inet_parse() for flattened SocketAddress sockets: Prepare vsock_parse() for flattened SocketAddress test-qga: Actually test 0xff sync bytes fdc-test: Avoid deprecated 'change' command QemuOpts: Simplify qemu_opts_to_qdict() block: Simplify bdrv_append_temp_snapshot() logic ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-09sockets: Delete unused helper socket_address_crumple()Markus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1493192202-3184-8-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> [Commit message typo fixed]
2017-05-09sockets: Limit SocketAddressLegacy to external interfacesMarkus Armbruster
SocketAddressLegacy is a simple union, and simple unions are awkward: they have their variant members wrapped in a "data" object on the wire, and require additional indirections in C. SocketAddress is the equivalent flat union. Convert all users of SocketAddressLegacy to SocketAddress, except for existing external interfaces. See also commit fce5d53..9445673 and 85a82e8..c5f1ae3. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1493192202-3184-7-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> [Minor editing accident fixed, commit message and a comment tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-28 23:37:08 +0000