summary refs log tree commit diff stats
Commit message (Collapse)AuthorAgeFilesLines
* block/vdi: Don't assume that blocks are larger than VdiHeaderDavid Edmondson2021-03-311-4/+6
| | | | | | | | | | | | | | | | Given that the block size is read from the header of the VDI file, a wide variety of sizes might be seen. Rather than re-using a block sized memory region when writing the VDI header, allocate an appropriately sized buffer. Signed-off-by: David Edmondson <david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Max Reitz <mreitz@redhat.com> Message-id: 20210325112941.365238-3-pbonzini@redhat.com Message-Id: <20210309144015.557477-3-david.edmondson@oracle.com> Acked-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* block/vdi: When writing new bmap entry fails, don't leak the bufferDavid Edmondson2021-03-311-0/+1
| | | | | | | | | | | | | | | | If a new bitmap entry is allocated, requiring the entire block to be written, avoiding leaking the buffer allocated for the block should the write fail. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: David Edmondson <david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Max Reitz <mreitz@redhat.com> Message-id: 20210325112941.365238-2-pbonzini@redhat.com Message-Id: <20210309144015.557477-2-david.edmondson@oracle.com> Acked-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* Update version for v6.0.0-rc1 releasePeter Maydell2021-03-301-1/+1
| | | | Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge remote-tracking branch ↵Peter Maydell2021-03-3010-29/+65
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/pmaydell/tags/pull-target-arm-20210330' into staging * net/npcm7xx_emc.c: Fix handling of receiving packets when RSDR not set * hw/display/xlnx_dp: Free FIFOs adding xlnx_dp_finalize() * hw/arm/smmuv3: Drop unused CDM_VALID() and is_cd_valid() * target/arm: Make number of counters in PMCR follow the CPU * hw/timer/renesas_tmr: Add default-case asserts in read_tcnt() # gpg: Signature made Tue 30 Mar 2021 14:23:33 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210330: hw/timer/renesas_tmr: Add default-case asserts in read_tcnt() target/arm: Make number of counters in PMCR follow the CPU hw/arm/smmuv3: Drop unused CDM_VALID() and is_cd_valid() hw/display/xlnx_dp: Free FIFOs adding xlnx_dp_finalize() net/npcm7xx_emc.c: Fix handling of receiving packets when RSDR not set Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/timer/renesas_tmr: Add default-case asserts in read_tcnt()Peter Maydell2021-03-301-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In commit 81b3ddaf8772ec we fixed a use of uninitialized data in read_tcnt(). However this change wasn't enough to placate Coverity, which is not smart enough to see that if we read a 2 bit field and then handle cases 0, 1, 2 and 3 then there cannot be a flow of execution through the switch default. Add explicit default cases which assert that they can't be reached, which should help silence Coverity. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210319162458.13760-1-peter.maydell@linaro.org
| * target/arm: Make number of counters in PMCR follow the CPUPeter Maydell2021-03-305-12/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently we give all the v7-and-up CPUs a PMU with 4 counters. This means that we don't provide the 6 counters that are required by the Arm BSA (Base System Architecture) specification if the CPU supports the Virtualization extensions. Instead of having a single PMCR_NUM_COUNTERS, make each CPU type specify the PMCR reset value (obtained from the appropriate TRM), and use the 'N' field of that value to define the number of counters provided. This means that we now supply 6 counters for Cortex-A53, A57, A72, A15 and A9 as well as '-cpu max'; Cortex-A7 and A8 stay at 4; and Cortex-R5 goes down to 3. Note that because we now use the PMCR reset value of the specific implementation, we no longer set the LC bit out of reset. This has an UNKNOWN value out of reset for all cores with any AArch32 support, so guest software should be setting it anyway if it wants it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> Message-id: 20210311165947.27470-1-peter.maydell@linaro.org Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
| * hw/arm/smmuv3: Drop unused CDM_VALID() and is_cd_valid()Zenghui Yu2021-03-301-7/+0
| | | | | | | | | | | | | | | | | | | | | | They were introduced in commit 9bde7f0674fe ("hw/arm/smmuv3: Implement translate callback") but never actually used. Drop them. Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> Acked-by: Eric Auger <eric.auger@redhat.com> Message-id: 20210325142702.790-1-yuzenghui@huawei.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/display/xlnx_dp: Free FIFOs adding xlnx_dp_finalize()Philippe Mathieu-Daudé2021-03-301-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When building with --enable-sanitizers we get: Direct leak of 16 byte(s) in 1 object(s) allocated from: #0 0x5618479ec7cf in malloc (qemu-system-aarch64+0x233b7cf) #1 0x7f675745f958 in g_malloc (/lib64/libglib-2.0.so.0+0x58958) #2 0x561847c2dcc9 in xlnx_dp_init hw/display/xlnx_dp.c:1259:5 #3 0x56184a5bdab8 in object_init_with_type qom/object.c:375:9 #4 0x56184a5a2bda in object_initialize_with_type qom/object.c:517:5 #5 0x56184a5a24d5 in object_initialize qom/object.c:536:5 #6 0x56184a5a2f6c in object_initialize_child_with_propsv qom/object.c:566:5 #7 0x56184a5a2e60 in object_initialize_child_with_props qom/object.c:549:10 #8 0x56184a5a3a1e in object_initialize_child_internal qom/object.c:603:5 #9 0x5618495aa431 in xlnx_zynqmp_init hw/arm/xlnx-zynqmp.c:273:5 The RX/TX FIFOs are created in xlnx_dp_init(), add xlnx_dp_finalize() to destroy them. Fixes: 58ac482a66d ("introduce xlnx-dp") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210323182958.277654-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * net/npcm7xx_emc.c: Fix handling of receiving packets when RSDR not setDoug Evans2021-03-302-10/+24
| | | | | | | | | | | | | | | | | | Turning REG_MCMDR_RXON is enough to start receiving packets. Signed-off-by: Doug Evans <dje@google.com> Message-id: 20210319195044.741821-1-dje@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2021-03-30' ↵Peter Maydell2021-03-3012-80/+319
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging Block patches for 6.0-rc1: - Mark the qcow2 cache clean timer as external to fix record/replay - Fix the mirror filter node's permissions so that an external process cannot grab an image while it is used as the mirror source - Add documentation about FUSE exports to the storage daemon - When creating a qcow2 image with the data-file-raw option, all metadata structures should be preallocated - iotest fixes # gpg: Signature made Tue 30 Mar 2021 13:38:40 BST # gpg: using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40 # gpg: issuer "mreitz@redhat.com" # gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full] # Primary key fingerprint: 91BE B60A 30DB 3E88 57D1 1829 F407 DB00 61D5 CF40 * remotes/maxreitz/tags/pull-block-2021-03-30: iotests/244: Test preallocation for data-file-raw qcow2: Force preallocation with data-file-raw qsd: Document FUSE exports block/mirror: Fix mirror_top's permissions iotests/046: Filter request length qcow2: use external virtual timers iotests/116: Fix reference output iotests: fix 051.out expected output after error text touchups iotests: Fix typo in iotest 051 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * iotests/244: Test preallocation for data-file-rawMax Reitz2021-03-302-0/+163
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Three test cases: (1) Adding a qcow2 (metadata) file to an existing data file, see whether we can read the existing data through the qcow2 image. (2) Append data to the data file, grow the qcow2 image accordingly, see whether we can read the new data through the qcow2 image. (3) At runtime, add a backing image to a freshly created qcow2 image with an external data file (with data-file-raw). Reading data from the qcow2 image must return the same result as reading data from the data file, so everything in the backing image must be ignored. (This did not use to be the case, because without the L2 tables preallocated, all clusters would appear as unallocated, and so the qcow2 driver would fall through to the backing file.) Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210326145509.163455-3-mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
| * qcow2: Force preallocation with data-file-rawMax Reitz2021-03-302-5/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Setting the qcow2 data-file-raw bit means that you can ignore the qcow2 metadata when reading from the external data file. It does not mean that you have to ignore it, though. Therefore, the data read must be the same regardless of whether you interpret the metadata or whether you ignore it, and thus the L1/L2 tables must all be present and give a 1:1 mapping. This patch changes 244's output: First, the qcow2 file is larger right after creation, because of metadata preallocation. Second, the qemu-img map output changes: Everything that was not explicitly discarded or zeroed is now a data area. Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210326145509.163455-2-mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
| * qsd: Document FUSE exportsMax Reitz2021-03-292-0/+23
| | | | | | | | | | | | | | | | | | | | | | Implementing FUSE exports required no changes to the storage daemon, so we forgot to document them there. Considering that both NBD and vhost-user-blk exports are documented in its man page (and NBD exports in its --help text), we should probably do the same for FUSE. Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210217115844.62661-1-mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
| * block/mirror: Fix mirror_top's permissionsMax Reitz2021-03-291-7/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mirror_top currently shares all permissions, and takes only the WRITE permission (if some parent has taken that permission, too). That is wrong, though; mirror_top is a filter, so it should take permissions like any other filter does. For example, if the parent needs CONSISTENT_READ, we need to take that, too, and if it cannot share the WRITE permission, we cannot share it either. The exception is when mirror_top is used for active commit, where we cannot take CONSISTENT_READ (because it is deliberately unshared above the base node) and where we must share WRITE (so that it is shared for all images in the backing chain, so the mirror job can take it for the target BB). Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210211172242.146671-2-mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
| * iotests/046: Filter request lengthMax Reitz2021-03-292-53/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | For its concurrent requests, 046 has always filtered the offset, probably because concurrent requests may settle in any order. However, it did not filter the request length, and so if requests with different lengths settle in an unexpected order (notably the longer request before the shorter request), the test fails (for no good reason). Filter the length, too. Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20200918153323.108932-1-mreitz@redhat.com>
| * qcow2: use external virtual timersPavel Dovgalyuk2021-03-291-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Regular virtual timers are used to emulate timings related to vCPU and peripheral states. QCOW2 uses timers to clean the cache. These timers should have external flag. In the opposite case they affect the execution and it can't be recorded and replayed. This patch adds external flag to the timer for qcow2 cache clean. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <161700516327.1141158.8366564693714562536.stgit@pasha-ThinkPad-X280> Signed-off-by: Max Reitz <mreitz@redhat.com>
| * iotests/116: Fix reference outputMax Reitz2021-03-291-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 15ce94a68ca ("block/qed: bdrv_qed_do_open: deal with errp") has improved the qed driver's error reporting, though sadly did not add a test for it. The good news are: There already is such a test, namely 116. The bad news are: Its reference output was not adjusted, and so now it fails. Let's fix the reference output, which has the nice side effect of demonstrating 15ce94a68ca's improvements. Fixes: 15ce94a68ca6730466c565c3d29971aab3087bf1 ("block/qed: bdrv_qed_do_open: deal with errp") Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210326141419.156831-1-mreitz@redhat.com>
| * iotests: fix 051.out expected output after error text touchupsConnor Kuehl2021-03-291-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A patch was recently applied that touched up some error messages that pertained to key names like 'node-name'. The trouble is it only updated tests/qemu-iotests/051.pc.out and not tests/qemu-iotests/051.out as well. Do that now. Fixes: 785ec4b1b9 ("block: Clarify error messages pertaining to 'node-name'") Signed-off-by: Connor Kuehl <ckuehl@redhat.com> Message-Id: <20210318200949.1387703-2-ckuehl@redhat.com> Tested-by: Christian Borntraeger <borntraeger@de.ibm.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
| * iotests: Fix typo in iotest 051Tao Xu2021-03-292-3/+3
| | | | | | | | | | | | | | | | There is an typo in iotest 051, correct it. Signed-off-by: Tao Xu <tao3.xu@intel.com> Message-Id: <20210324084321.90952-1-tao3.xu@intel.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
* | Merge remote-tracking branch ↵Peter Maydell2021-03-292-3/+9
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/nvme/tags/nvme-fixes-for-6.0-pull-request' into staging emulated nvme fixes # gpg: Signature made Mon 29 Mar 2021 18:03:30 BST # gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9 # gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown] # gpg: aka "Klaus Jensen <k.jensen@samsung.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838 # Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9 * remotes/nvme/tags/nvme-fixes-for-6.0-pull-request: hw/block/nvme: fix ref counting in nvme_format_ns hw/block/nvme: fix resource leak in nvme_dif_rw Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/block/nvme: fix ref counting in nvme_format_nsKlaus Jensen2021-03-291-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Max noticed that since blk_aio_pwrite_zeroes() may invoke the callback before returning, the callbacks will never see *count == 0 and thus never free the count variable or decrement num_formats causing a CQE to never be posted. Coverity (CID 1451082) also picked up on the fact that count would not be free'ed if the namespace was of zero size. Fix both of these issues by explicitly checking *count and finalize for the given namespace if --(*count) is zero. Enqueing a CQE if there are no AIOs outstanding after this case is already handled by nvme_format() by inspecting *num_formats. Reported-by: Max Reitz <mreitz@redhat.com> Reported-by: Coverity (CID 1451082) Fixes: dc04d25e2f3f ("hw/block/nvme: add support for the format nvm command") Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com>
| * hw/block/nvme: fix resource leak in nvme_dif_rwKlaus Jensen2021-03-291-1/+1
|/ | | | | | | | | | | If nvme_map_dptr() fails, nvme_dif_rw() will leak the bounce context. Fix this by using the same error handling as everywhere else in the function. Reported-by: Coverity (CID 1451080) Fixes: 146f720c5563 ("hw/block/nvme: end-to-end data protection") Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com>
* Merge remote-tracking branch ↵Peter Maydell2021-03-282-5/+11
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/vivier2/tags/linux-user-for-6.0-pull-request' into staging linux-user pull request 20210328 - Fix recvfrom with NULL msg - Fix sigreturn address on s390x # gpg: Signature made Sun 28 Mar 2021 17:05:45 BST # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/linux-user-for-6.0-pull-request: linux-user: allow NULL msg in recvfrom linux-user/s390x: Use the guest pointer for the sigreturn stub Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * linux-user: allow NULL msg in recvfromZach Reizner2021-03-271-3/+8
| | | | | | | | | | | | | | | | | | | | | | | | The kernel allows a NULL msg in recvfrom so that he size of the next message may be queried before allocating a correctly sized buffer. This change allows the syscall translator to pass along the NULL msg pointer instead of returning early with EFAULT. Signed-off-by: Zach Reizner <zachr@google.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <CAFNex=DvFCq=AQf+=19fTfw-T8eZZT=3NnFFm2JMFvVr5QgQyA@mail.gmail.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
| * linux-user/s390x: Use the guest pointer for the sigreturn stubAndreas Krebbel2021-03-251-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When setting up the pointer for the sigreturn stub in the return address register (r14) we currently use the host frame address instead of the guest frame address. Note: This only caused problems if Qemu has been built with --disable-pie (as it is in distros nowadays). Otherwise guest_base defaults to 0 hiding the actual problem. Signed-off-by: Andreas Krebbel <krebbel@linux.ibm.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210324185128.63971-1-krebbel@linux.ibm.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* | Merge remote-tracking branch ↵Peter Maydell2021-03-2618-58/+85
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/kraxel/tags/fixes-20210326-pull-request' into staging fixes for usb, virtio-gpu and vhost-gpu # gpg: Signature made Fri 26 Mar 2021 12:49:14 GMT # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-20210326-pull-request: hw/usb/hcd-ehci: Fix crash when showing help of EHCI devices s390x: modularize virtio-gpu-ccw s390x: add have_virtio_ccw s390x: move S390_ADAPTER_SUPPRESSIBLE hw/usb/hcd-ehci-sysbus: Free USBPacket on instance finalize() vhost-user-gpu: fix cursor move/update vhost-user-gpu: fix vugbm_device_init fallback vhost-user-gpu: glFlush before notifying clients usb: Remove "-usbdevice ccid" Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/usb/hcd-ehci: Fix crash when showing help of EHCI devicesThomas Huth2021-03-261-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | QEMU crashes with certain targets when trying to show the help output of EHCI devices: $ ./qemu-system-aarch64 -device ich9-usb-ehci1,help qemu-system-aarch64: ../../devel/qemu/softmmu/physmem.c:1154: phys_section_add: Assertion `map->sections_nb < TARGET_PAGE_SIZE' failed. Aborted (core dumped) This happens because the device is doing things at "instance_init" time that should be done at "realize" time instead. So move the related code to the realize() function instead. (NB: This now also matches the memory_region_del_subregion() calls which are done in usb_ehci_unrealize(), and not during finalize()). Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210326095155.1994604-1-thuth@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | s390x: modularize virtio-gpu-ccwGerd Hoffmann2021-03-263-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the virtio-gpu-ccw device depends on the hw-display-virtio-gpu module, which provides the type virtio-gpu-device, packaging the hw-display-virtio-gpu module as a separate package that may or may not be installed along with the qemu package leads to problems. Namely if the hw-display-virtio-gpu is absent, qemu continues to advertise virtio-gpu-ccw, but it aborts not only when one attempts using virtio-gpu-ccw, but also when libvirtd's capability probing tries to instantiate the type to introspect it. Let us thus introduce a module named hw-s390x-virtio-gpu-ccw that is going to provide the virtio-gpu-ccw device. The hw-s390x prefix was chosen because it is not a portable device. With virtio-gpu-ccw built as a module, the correct way to package a modularized qemu is to require that hw-display-virtio-gpu must be installed whenever the module hw-s390x-virtio-gpu-ccw. Signed-off-by: Halil Pasic <pasic@linux.ibm.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Halil Pasic <pasic@linux.ibm.com> Tested-by: Halil Pasic <pasic@linux.ibm.com> Message-Id: <20210317095622.2839895-4-kraxel@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | s390x: add have_virtio_ccwGerd Hoffmann2021-03-262-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce a symbol which can be used to prevent ccw modules being loaded into system emulators without ccw support. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Halil Pasic <pasic@linux.ibm.com> Tested-by: Halil Pasic <pasic@linux.ibm.com> Message-Id: <20210317095622.2839895-3-kraxel@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | s390x: move S390_ADAPTER_SUPPRESSIBLEGerd Hoffmann2021-03-263-10/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The definition S390_ADAPTER_SUPPRESSIBLE was moved to "cpu.h", per suggestion of Thomas Huth. From interface design perspective, IMHO, not a good thing as it belongs to the public interface of css_register_io_adapters(). We did this because CONFIG_KVM requeires NEED_CPU_H and Thomas, and other commenters did not like the consequences of that. Moving the interrupt related declarations to s390_flic.h was suggested by Cornelia Huck. Signed-off-by: Halil Pasic <pasic@linux.ibm.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Halil Pasic <pasic@linux.ibm.com> Tested-by: Halil Pasic <pasic@linux.ibm.com> Message-Id: <20210317095622.2839895-2-kraxel@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | hw/usb/hcd-ehci-sysbus: Free USBPacket on instance finalize()Philippe Mathieu-Daudé2021-03-261-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When building with --enable-sanitizers we get: Direct leak of 32 byte(s) in 2 object(s) allocated from: #0 0x5618479ec7cf in malloc (qemu-system-aarch64+0x233b7cf) #1 0x7f675745f958 in g_malloc (/lib64/libglib-2.0.so.0+0x58958) #2 0x561847f02ca2 in usb_packet_init hw/usb/core.c:531:5 #3 0x561848df4df4 in usb_ehci_init hw/usb/hcd-ehci.c:2575:5 #4 0x561847c119ac in ehci_sysbus_init hw/usb/hcd-ehci-sysbus.c:73:5 #5 0x56184a5bdab8 in object_init_with_type qom/object.c:375:9 #6 0x56184a5bd955 in object_init_with_type qom/object.c:371:9 #7 0x56184a5a2bda in object_initialize_with_type qom/object.c:517:5 #8 0x56184a5a24d5 in object_initialize qom/object.c:536:5 #9 0x56184a5a2f6c in object_initialize_child_with_propsv qom/object.c:566:5 #10 0x56184a5a2e60 in object_initialize_child_with_props qom/object.c:549:10 #11 0x56184a5a3a1e in object_initialize_child_internal qom/object.c:603:5 #12 0x561849542d18 in npcm7xx_init hw/arm/npcm7xx.c:427:5 Similarly to commit d710e1e7bd3 ("usb: ehci: fix memory leak in ehci"), fix by calling usb_ehci_finalize() to free the USBPacket. Fixes: 7341ea075c0 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210323183701.281152-1-f4bug@amsat.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix cursor move/updateMarc-André Lureau2021-03-261-6/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "move" is incorrectly initialized. Fix it by using a switch statement and also treating unknown commands with a fallback. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210312100108.2706195-5-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix vugbm_device_init fallbackMarc-André Lureau2021-03-263-30/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | vugbm implements GBM device wrapping, udmabuf and memory fallback. However, the fallback/detection logic is flawed, as if "/dev/udmabuf" failed to be opened, it will not initialize vugbm and crash later. Rework the vugbm_device_init() logic to initialize correctly in all cases. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210312100108.2706195-4-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: glFlush before notifying clientsMarc-André Lureau2021-03-262-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For similar reasons as commit 3af1671852 ("spice: flush on GL update before notifying client"), vhost-user-gpu must ensure the GL state is flushed before sharing its rendering result. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210312100108.2706195-3-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | usb: Remove "-usbdevice ccid"Thomas Huth2021-03-263-4/+6
| |/ | | | | | | | | | | | | | | | | | | | | "-usbdevice ccid" was not documented and -usbdevice itself was marked as deprecated before QEMU v6.0. And searching for "-usbdevice ccid" in the internet does not show any useful results, so likely nobody was using the ccid device via the -usbdevice option. Remove it now. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210311092829.1479051-1-thuth@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | Merge remote-tracking branch ↵Peter Maydell2021-03-252-0/+16
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/stefanha-gitlab/tags/block-pull-request' into staging Pull request This dirty bitmap fix solves a crash that can be triggered in the destination QEMU process during live migration. # gpg: Signature made Wed 24 Mar 2021 14:51:31 GMT # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha-gitlab/tags/block-pull-request: migrate-bitmaps-postcopy-test: check that we can't remove in-flight bitmaps migration/block-dirty-bitmap: make incoming disabled bitmaps busy Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * migrate-bitmaps-postcopy-test: check that we can't remove in-flight bitmapsVladimir Sementsov-Ogievskiy2021-03-241-0/+10
| | | | | | | | | | | | | | | | | | Check that we can't remove bitmaps being migrated on destination vm. The new check proves that previous commit helps. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210322094906.5079-3-vsementsov@virtuozzo.com>
| * migration/block-dirty-bitmap: make incoming disabled bitmaps busyVladimir Sementsov-Ogievskiy2021-03-241-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Incoming enabled bitmaps are busy, because we do bdrv_dirty_bitmap_create_successor() for them. But disabled bitmaps being migrated are not marked busy, and user can remove them during the incoming migration. Then we may crash in cancel_incoming_locked() when try to remove the bitmap that was already removed by user, like this: #0 qemu_mutex_lock_impl (mutex=0x5593d88c50d1, file=0x559680554b20 "../block/dirty-bitmap.c", line=64) at ../util/qemu-thread-posix.c:77 #1 bdrv_dirty_bitmaps_lock (bs=0x5593d88c0ee9) at ../block/dirty-bitmap.c:64 #2 bdrv_release_dirty_bitmap (bitmap=0x5596810e9570) at ../block/dirty-bitmap.c:362 #3 cancel_incoming_locked (s=0x559680be8208 <dbm_state+40>) at ../migration/block-dirty-bitmap.c:918 #4 dirty_bitmap_load (f=0x559681d02b10, opaque=0x559680be81e0 <dbm_state>, version_id=1) at ../migration/block-dirty-bitmap.c:1194 #5 vmstate_load (f=0x559681d02b10, se=0x559680fb5810) at ../migration/savevm.c:908 #6 qemu_loadvm_section_part_end (f=0x559681d02b10, mis=0x559680fb4a30) at ../migration/savevm.c:2473 #7 qemu_loadvm_state_main (f=0x559681d02b10, mis=0x559680fb4a30) at ../migration/savevm.c:2626 #8 postcopy_ram_listen_thread (opaque=0x0) at ../migration/savevm.c:1871 #9 qemu_thread_start (args=0x5596817ccd10) at ../util/qemu-thread-posix.c:521 #10 start_thread () at /lib64/libpthread.so.0 #11 clone () at /lib64/libc.so.6 Note bs pointer taken from bitmap: it's definitely bad aligned. That's because we are in use after free, bitmap is already freed. So, let's make disabled bitmaps (being migrated) busy during incoming migration. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210322094906.5079-2-vsementsov@virtuozzo.com>
* | Update version for v6.0.0-rc0 releasePeter Maydell2021-03-241-1/+1
| | | | | | | | Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | Merge remote-tracking branch ↵Peter Maydell2021-03-2443-271/+548
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/stsquad/tags/pull-6.0-rc0-fixed-240321-1' into staging Various fixes for 6.0: - include kernel-doc API reference for plugins - fix semihosting SYS_HEAPINFO - various tweaks to improve CI runtime - more stroz fixes - fix iotest CI regressions # gpg: Signature made Wed 24 Mar 2021 14:28:24 GMT # gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44 # gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [full] # Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44 * remotes/stsquad/tags/pull-6.0-rc0-fixed-240321-1: (22 commits) gitlab: default to not building the documentation iotests: iothreads need ioeventfd iotests: test m68k with the virt machine iotests: Revert "iotests: use -ccw on s390x for 040, 139, and 182" blockdev: with -drive if=virtio, use generic virtio-blk m68k: add the virtio devices aliases qdev: define list of archs with virtio-pci or virtio-ccw gitlab: extend timeouts for CFI builds utils: Work around mingw strto*l bug with 0x utils: Tighter tests for qemu_strtosz cirrus.yml: Update the FreeBSD task to version 12.2 configure: Don't use the __atomic_*_16 functions for testing 128-bit support gitlab-ci.yml: Merge the trace-backend testing into other jobs tests/tcg: add HeapInfo checking to semihosting test linux-user/riscv: initialise the TaskState heap/stack info semihosting/arm-compat-semi: don't use SET_ARG to report SYS_HEAPINFO semihosting/arm-compat-semi: unify GET/SET_ARG helpers semihosting: move semihosting tests to multiarch tools/virtiofsd: include --socket-group in help docs/devel: expand style section of memory management ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | gitlab: default to not building the documentationAlex Bennée2021-03-242-12/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In d0f26e68a0 ("gitlab: force enable docs build in Fedora, Ubuntu, Debian") we made sure we can build the documents on more than one system. However we don't want to build documents all the time as it's a waste of cycles (and energy). So lets reduce the total amount of documentation we build while still keeping coverage of at least one build on each supported target. Fixes: a8a3abe0b3 ("gitlab: move docs and tools build across from Travis") Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210323165308.15244-23-alex.bennee@linaro.org>
| * | iotests: iothreads need ioeventfdLaurent Vivier2021-03-244-3/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | And ioeventfd are only available with virtio-scsi-pci or virtio-scsi-ccw, use the alias but add a rule to require virtio-scsi-pci or virtio-scsi-ccw for the tests that use iothreads. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210319202335.2397060-7-laurent@vivier.eu> Message-Id: <20210323165308.15244-22-alex.bennee@linaro.org>
| * | iotests: test m68k with the virt machineLaurent Vivier2021-03-241-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This allows to cover the virtio tests with a 32bit big-endian virtio-mmio machine. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20210319202335.2397060-6-laurent@vivier.eu> Message-Id: <20210323165308.15244-21-alex.bennee@linaro.org>
| * | iotests: Revert "iotests: use -ccw on s390x for 040, 139, and 182"Laurent Vivier2021-03-2413-55/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit f1d5516ab583 introduces a test in some iotests to check if the machine is a s390-ccw-virtio and to select virtio-*-ccw rather than virtio-*-pci. We don't need that because QEMU already provides aliases to use the correct virtio interface according to the machine type. This patch removes all virtio-*-pci and virtio-*-ccw to use virtio-* instead and remove get_virtio_scsi_device(). This also enables virtio-mmio devices (virtio-*-device) Signed-off-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20210319202335.2397060-5-laurent@vivier.eu> Message-Id: <20210323165308.15244-20-alex.bennee@linaro.org>
| * | blockdev: with -drive if=virtio, use generic virtio-blkLaurent Vivier2021-03-241-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rather than checking if the machine is an s390x to use virtio-blk-ccw instead of virtio-blk-pci, use the alias virtio-blk that is set to the expected target. This also enables the use of virtio-blk-device for targets without PCI or CCW. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20210319202335.2397060-4-laurent@vivier.eu> Message-Id: <20210323165308.15244-19-alex.bennee@linaro.org>
| * | m68k: add the virtio devices aliasesLaurent Vivier2021-03-242-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Similarly to 5f629d943cb0 ("s390x: fix s390 virtio aliases"), define the virtio aliases. This allows to start machines with virtio devices without knowledge of the implementation type. For instance, we can use "-device virtio-scsi" on m68k, s390x or PC, and the device will be respectively "virtio-scsi-device", "virtio-scsi-ccw" or "virtio-scsi-pci". This already exists for s390x and -ccw interfaces, add them for m68k and MMIO (-device) interfaces. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20210319202335.2397060-3-laurent@vivier.eu> Message-Id: <20210323165308.15244-18-alex.bennee@linaro.org>
| * | qdev: define list of archs with virtio-pci or virtio-ccwLaurent Vivier2021-03-242-28/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is used to define virtio-*-pci and virtio-*-ccw aliases rather than substracting the CCW architecture from all the others. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20210319202335.2397060-2-laurent@vivier.eu> Message-Id: <20210323165308.15244-17-alex.bennee@linaro.org>
| * | gitlab: extend timeouts for CFI buildsAlex Bennée2021-03-241-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These builds are running very close to the default build limit and as they are already pared down the only other option is to extend the timeout a little to give some breathing room. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210323165308.15244-16-alex.bennee@linaro.org>
| * | utils: Work around mingw strto*l bug with 0xEric Blake2021-03-242-8/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Mingw recognizes that "0x" has value 0 without setting errno, but fails to advance endptr to the trailing garbage 'x'. This in turn showed up in our recent testsuite additions for qemu_strtosz (commit 1657ba44b4 utils: Enhance testsuite for do_strtosz()); adjust our remaining tests to show that we now work around this windows bug. This patch intentionally fails check-syntax for use of strtol. Signed-off-by: Eric Blake <eblake@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210317143325.2165821-3-eblake@redhat.com> Message-Id: <20210323165308.15244-15-alex.bennee@linaro.org>
| * | utils: Tighter tests for qemu_strtoszEric Blake2021-03-242-7/+114
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Our tests were not validating the return value in all cases, nor was it guaranteeing our documented claim that 'res' is unchanged on error. For that matter, it wasn't as thorough as the existing tests for qemu_strtoi() and friends for proving that endptr and res are sanely set. Enhancing the test found one case where we violated our documentation: namely, when failing with EINVAL when endptr is NULL, we shouldn't modify res. Signed-off-by: Eric Blake <eblake@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210317143325.2165821-2-eblake@redhat.com> Message-Id: <20210323165308.15244-14-alex.bennee@linaro.org>