summary refs log tree commit diff stats
path: root/python/qemu/console_socket.py (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-07-24target/i386: Save cc_op before loop insnsRichard Henderson1-0/+1
We forgot to update cc_op before these branch insns, which lead to losing track of the current eflags. Buglink: https://bugs.launchpad.net/qemu/+bug/1888165 Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200720154028.477457-1-richard.henderson@linaro.org>
2020-07-24target/hppa: Free some temps in do_subRichard Henderson1-0/+2
Two temps allocated but not freed. Do enough subtractions within a single TB and one can run out of temps entirely. Fixes: b2167459ae ("target-hppa: Implement basic arithmetic") Buglink: https://bugs.launchpad.net/qemu/+bug/1880287 Tested-by: Sven Schnelle <svens@stackframe.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200720174039.517902-1-richard.henderson@linaro.org>
2020-07-24tcg: update comments for save_iotlb_data in cputlbAlex Bennée1-6/+5
I missed Emilio's review comments: Message-ID: <20200718205107.GA994221@sff> and the patch got merged. Correcting the comments now. Reviewed-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20200720122358.26881-1-alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2020-07-24tpm_emulator: Report an error if chardev is missingStefan Berger1-15/+23
This patch fixes the odd error reporting when trying to send a file descriptor to the TPM emulator if one has not passed a valid chardev. $ x86_64-softmmu/qemu-system-x86_64 -tpmdev emulator,id=tpm0 qemu-system-x86_64: -tpmdev emulator,id=tpm0: tpm-emulator: Failed to send CMD_SET_DATAFD: Success qemu-system-x86_64: -tpmdev emulator,id=tpm0: tpm-emulator: Could not cleanly shutdown the TPM: Success This is the new error report: $ x86_64-softmmu/qemu-system-x86_64 -tpmdev emulator,id=tpm0 qemu-system-x86_64: -tpmdev emulator,id=tpm0: tpm-emulator: parameter 'chardev' is missing This change does not hide the display of supported TPM types if a non-existent type is passed: $ x86_64-softmmu/qemu-system-x86_64 -tpmdev nonexistent,id=tpm0 qemu-system-x86_64: -tpmdev nonexistent,id=tpm0: Parameter 'type' expects a TPM backend type Supported TPM types (choose only one): passthrough Passthrough TPM backend driver emulator TPM emulator backend driver Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
2020-07-24tpm: Improve help on TPM types when none are availableMarkus Armbruster1-4/+9
Help is a bit awkward when no TPM types are built into QEMU: $ qemu-system-x86_64 -tpmdev nonexistent,id=tpm0 qemu-system-x86_64: -tpmdev nonexistent,id=tpm0: Parameter 'type' expects a TPM backend type Supported TPM types (choose only one): Improve to qemu-system-x86_64: -tpmdev nonexistent,id=tpm0: Parameter 'type' expects a TPM backend type No TPM backend types are available Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
2020-07-24Revert "tpm: Clean up error reporting in tpm_init_tpmdev()"Markus Armbruster4-12/+27
This reverts commit d10e05f15d5c3dd5e5cc59c5dfff460d89d48580. We report some -tpmdev failures, but then continue as if all was fine. Reproducer: $ qemu-system-x86_64 -nodefaults -S -display none -monitor stdio -chardev null,id=tpm0 -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0 qemu-system-x86_64: -tpmdev emulator,id=tpm0,chardev=chrtpm: tpm-emulator: tpm chardev 'chrtpm' not found. qemu-system-x86_64: -tpmdev emulator,id=tpm0,chardev=chrtpm: tpm-emulator: Could not cleanly shutdown the TPM: No such file or directory QEMU 5.0.90 monitor - type 'help' for more information (qemu) qemu-system-x86_64: -device tpm-tis,tpmdev=tpm0: Property 'tpm-tis.tpmdev' can't find value 'tpm0' $ echo $? 1 This is a regression caused by commit d10e05f15d "tpm: Clean up error reporting in tpm_init_tpmdev()". It's incomplete: be->create(opts) continues to use error_report(), and we don't set an error when it fails. I figure converting the create() methods to Error would make some sense, but I'm not sure it's worth the effort right now. Revert the broken commit instead, and add a comment to tpm_init_tpmdev(). Straightforward conflict in tpm.c resolved. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
2020-07-24configure: Allow to build tools without pixmanThomas Huth1-1/+1
If pixman is not installed, it is currently not possible to run: .../configure --disable-system --enable-tools Seems like there was a dependency from one of the required source files to pixman in the past, but since commit 1ac0206b2ae1ffaeec56 ("qemu-timer.c: Trim list of included headers"), this dependency should be gone. Thus allow to compile the tools without pixman now. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 20200723141123.14765-1-thuth@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-07-24hw/input/virtio-input-hid.c: Don't undef CONFIG_CURSESPeter Maydell1-1/+0
virtio-input-hid.c undefines CONFIG_CURSES before including ui/console.h. However since commits e2f82e924d057935 and b0766612d16da18 that header does not have behaviour dependent on CONFIG_CURSES. Remove the now-unneeded undef. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20200723192457.28136-1-peter.maydell@linaro.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-07-24hw: Only compile the usb-dwc2 controller if it is really neededThomas Huth2-1/+1
The USB_DWC2 switch is currently "default y", so it is included in all qemu-system-* builds, even if it is not needed. Even worse, it does a "select USB", so USB devices are now showing up as available on targets that do not support USB at all. This sysbus device should only be included by the boards that need it, i.e. by the Raspi machines. Fixes: 153ef1662c ("dwc-hsotg (dwc2) USB host controller emulation") Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200722154719.10130-1-thuth@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-07-24qapi/error: Check format string argument in error_*prepend()Philippe Mathieu-Daudé1-2/+4
error_propagate_prepend() "behaves like error_prepend()", and error_prepend() uses "formatting @fmt, ... like printf()". error_prepend() checks its format string argument, but error_propagate_prepend() does not. Fix by addint the format attribute to error_propagate_prepend() and error_vprepend(). This would have caught the bug fixed in the previous commit. Missed in commit 4b5766488f "error: Fix use of error_prepend() with &error_fatal, &error_abort". Inspired-by: Stefan Weil <sw@weilnetz.de> Suggested-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200723171205.14949-1-philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2020-07-24sd/milkymist-memcard: Fix format stringStefan Weil1-1/+1
Fixes: b98e8d1230ff7023bb34ddeb7194424dfcbaf789 Signed-off-by: Stefan Weil <sw@weilnetz.de> Message-Id: <20200722204054.1400555-1-sw@weilnetz.de> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> [Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2020-07-24error: Strip trailing '\n' from error string arguments (again)Markus Armbruster2-4/+4
Tracked down with scripts/coccinelle/err-bad-newline.cocci. Cc: Peter Xu <peterx@redhat.com> Cc: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200722084048.1726105-3-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Peter Xu <peterx@redhat.com>
2020-07-24coccinelle/err-bad-newline: Fix for Python 3, and add patternsMarkus Armbruster1-2/+22
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200722084048.1726105-2-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2020-07-23KVM: fix CPU reset wrt HF2_GIF_MASKVitaly Kuznetsov1-5/+11
HF2_GIF_MASK is set in env->hflags2 unconditionally on CPU reset (see x86_cpu_reset()) but when calling KVM_SET_NESTED_STATE, KVM_STATE_NESTED_GIF_SET is only valid for nSVM as e.g. nVMX code looks like if (kvm_state->hdr.vmx.vmxon_pa == -1ull) { if (kvm_state->flags & ~KVM_STATE_NESTED_EVMCS) return -EINVAL; } Also, when adjusting the environment after KVM_GET_NESTED_STATE we need not reset HF2_GIF_MASK on VMX as e.g. x86_cpu_pending_interrupt() expects it to be set. Alternatively, we could've made env->hflags2 SVM-only. Reported-by: Jan Kiszka <jan.kiszka@siemens.com> Fixes: b16c0e20c742 ("KVM: add support for AMD nested live migration") Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Message-Id: <20200723142701.2521161-1-vkuznets@redhat.com> Tested-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-07-22target/riscv: Fix the range of pmpcfg of CSR funcion tableZong Li1-1/+1
The range of Physical Memory Protection should be from CSR_PMPCFG0 to CSR_PMPCFG3, not to CSR_PMPADDR9. Signed-off-by: Zong Li <zong.li@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Message-Id: <eae49e9252c9596e4f3bdb471772f79235141a87.1595335112.git.zong.li@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-07-22hw/riscv: sifive_e: Correct debug block sizeBin Meng1-1/+1
Currently the debug region size is set to 0x100, but according to FE310-G000 and FE310-G002 manuals: FE310-G000: 0x100 - 0xFFF FE310-G002: 0x0 - 0xFFF Change the size to 0x1000 that applies to both. Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <1594891856-15474-1-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-07-22target/riscv: fix vector index load/store constraintsLIU Zhiwei1-1/+9
Although not explicitly specified that the the destination vector register groups cannot overlap the source vector register group, it is still necessary. And this constraint has been added to the v0.8 spec. Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200721133742.2298-2-zhiwei_liu@c-sky.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-07-22target/riscv: Quiet Coverity complains about vamo*LIU Zhiwei1-0/+1
Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200721133742.2298-1-zhiwei_liu@c-sky.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-07-22goldfish_rtc: Fix non-atomic read behaviour of TIME_LOW/TIME_HIGHJessica Clarke2-3/+15
The specification says: 0x00 TIME_LOW R: Get current time, then return low-order 32-bits. 0x04 TIME_HIGH R: Return high 32-bits from previous TIME_LOW read. ... To read the value, the kernel must perform an IO_READ(TIME_LOW), which returns an unsigned 32-bit value, before an IO_READ(TIME_HIGH), which returns a signed 32-bit value, corresponding to the higher half of the full value. However, we were just returning the current time for both. If the guest is unlucky enough to read TIME_LOW and TIME_HIGH either side of an overflow of the lower half, it will see time be in the future, before jumping backwards on the next read, and Linux currently relies on the atomicity guaranteed by the spec so is affected by this. Fix this violation of the spec by caching the correct value for TIME_HIGH whenever TIME_LOW is read, and returning that value for any TIME_HIGH read. Signed-off-by: Jessica Clarke <jrtc27@jrtc27.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200718004934.83174-1-jrtc27@jrtc27.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-07-22virtio-pci: Changed vdev to proxy for VirtIO PCI BAR callbacks.Andrew Melnychenko1-10/+24
There is an issue when callback may be called with invalid vdev. It happens on unplug when vdev already deleted and VirtIOPciProxy is not. So now, callbacks accept proxy device, and vdev retrieved from it. Technically memio callbacks should be removed during the flatview update, but memoryregions remain til PCI device(and it's address space) completely deleted. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1716352 Signed-off-by: Andrew Melnychenko <andrew@daynix.com> Message-Id: <20200706112123.971087-1-andrew@daynix.com> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22intel_iommu: Use correct shift for 256 bits qi descriptorLiu Yi L2-2/+8
In chapter 10.4.23 of VT-d spec 3.0, Descriptor Width bit was introduced in VTD_IQA_REG. Software could set this bit to tell VT-d the QI descriptor from software would be 256 bits. Accordingly, the VTD_IQH_QH_SHIFT should be 5 when descriptor size is 256 bits. This patch adds the DW bit check when deciding the shift used to update VTD_IQH_REG. Signed-off-by: Liu Yi L <yi.l.liu@intel.com> Message-Id: <1593850035-35483-1-git-send-email-yi.l.liu@intel.com> Reviewed-by: Peter Xu <peterx@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22virtio: verify that legacy support is not accidentally onCornelia Huck2-0/+10
If a virtio device does not have legacy support, make sure that it is actually off, and bail out if not. For virtio-pci, this means that any device without legacy support that has been specified to modern-only (or that has been forced to it) will work. For virtio-ccw, this duplicates the check that is currently done prior to realization for any device that explicitly specified no support for legacy. This catches devices that have not been fenced properly. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200707105446.677966-3-cohuck@redhat.com> Cc: qemu-stable@nongnu.org Acked-by: Halil Pasic <pasic@linux.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22virtio: list legacy-capable devicesCornelia Huck2-0/+27
Several types of virtio devices had already been around before the virtio standard was specified. These devices support virtio in legacy (and transitional) mode. Devices that have been added in the virtio standard are considered non-transitional (i.e. with no support for legacy virtio). Provide a helper function so virtio transports can figure that out easily. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200707105446.677966-2-cohuck@redhat.com> Cc: qemu-stable@nongnu.org Acked-by: Halil Pasic <pasic@linux.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22virtio-balloon: Replace free page hinting references to 'report' with 'hint'Alexander Duyck2-48/+48
Recently a feature named Free Page Reporting was added to the virtio balloon. In order to avoid any confusion we should drop the use of the word 'report' when referring to Free Page Hinting. So what this patch does is go through and replace all instances of 'report' with 'hint" when we are referring to free page hinting. Acked-by: David Hildenbrand <david@redhat.com> Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com> Message-Id: <20200720175128.21935.93927.stgit@localhost.localdomain> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22virtio-balloon: Add locking to prevent possible race when starting hintingAlexander Duyck1-0/+4
There is already locking in place when we are stopping free page hinting but there is not similar protections in place when we start. I can only assume this was overlooked as in most cases the page hinting should not be occurring when we are starting the hinting, however there is still a chance we could be processing hints by the time we get back around to restarting the hinting so we are better off making sure to protect the state with the mutex lock rather than just updating the value with no protections. Based on feedback from Peter Maydell this issue had also been spotted by Coverity: CID 1430269 Acked-by: David Hildenbrand <david@redhat.com> Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com> Message-Id: <20200720175122.21935.78013.stgit@localhost.localdomain> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22virtio-balloon: Prevent guest from starting a report when we didn't request oneAlexander Duyck1-1/+2
Based on code review it appears possible for the driver to force the device out of a stopped state when hinting by repeating the last ID it was provided. Prevent this by only allowing a transition to the start state when we are in the requested state. This way the driver is only allowed to send one descriptor that will transition the device into the start state. All others will leave it in the stop state once it has finished. Fixes: c13c4153f76d ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT") Acked-by: David Hildenbrand <david@redhat.com> Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com> Message-Id: <20200720175115.21935.99563.stgit@localhost.localdomain> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22virtio: Drop broken and superfluous object_property_set_link()Markus Armbruster4-11/+0
virtio_crypto_pci_realize() and copies the value of vcrypto->vdev's property "cryptodev" to vcrypto's property: object_property_set_link(OBJECT(vrng), "rng", OBJECT(vrng->vdev.conf.rng), NULL); Since it does so only after realize, this always fails, but the error is ignored. It's actually superfluous: vcrypto's property is an alias of vcrypto->vdev's property, created by virtio_instance_init_common(). Drop the call. Same for virtio_ccw_crypto_realize(), virtio_rng_pci_realize(), virtio_ccw_rng_realize(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200721121153.1128844-1-armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22acpi: accept byte and word access to core ACPI registersMichael Tokarev1-3/+6
All ISA registers should be accessible as bytes, words or dwords (if wide enough). Fix the access constraints for acpi-pm-evt, acpi-pm-tmr & acpi-cnt registers. Fixes: 5d971f9e67 (memory: Revert "memory: accept mismatching sizes in memory_region_access_valid") Fixes: afafe4bbe0 (apci: switch cnt to memory api) Fixes: 77d58b1e47 (apci: switch timer to memory api) Fixes: b5a7c024d2 (apci: switch evt to memory api) Buglink: https://lore.kernel.org/xen-devel/20200630170913.123646-1-anthony.perard@citrix.com/T/ Buglink: https://bugs.debian.org/964793 BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964247 BugLink: https://bugs.launchpad.net/bugs/1886318 Reported-By: Simon John <git@the-jedi.co.uk> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Message-Id: <20200720160627.15491-1-mjt@msgid.tls.msk.ru> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-21Update version for v5.1.0-rc1 releasePeter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-21iotests: Test sparseness for qemu-img convert -nKevin Wolf2-0/+47
Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20200721135520.72355-3-kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2020-07-21qom: Make info qom-tree sort children more efficientlyMarkus Armbruster1-12/+13
Commit e8c9e65816 "qom: Make "info qom-tree" show children sorted" sorts children the simple, stupid, quadratic way. I thought the number of children would be small enough for this not to matter. I was wrong: there are outliers with several hundred children, e.g ARM machines nuri and smdkc210 each have a node with 513 children. While n^2 sorting isn't noticeable in normal, human usage even for n=513, it can be quite noticeable in certain automated tests. In particular, the sort made device-introspect-test even slower. Commit 3e7b80f84d "tests: improve performance of device-introspect-test" just fixed that by cutting back its excessive use of "info qom-tree". Sorting more efficiently makes sense regardless, so do it. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200714160202.3121879-6-armbru@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-07-21qdev: Fix device_add DRIVER,help to print to monitorMarkus Armbruster1-1/+1
Help on device properties gets printed to stdout instead of the monitor. If you have the monitor anywhere else, no help for you. Broken when commit e1043d674d "qdev: use object_property_help()" accidentally switched from qemu_printf() to printf(). Switch right back. Fixes: e1043d674d792ff64aebae1a3eafc08b38a8a085 Cc: Marc-André Lureau <marcandre.lureau@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200714160202.3121879-2-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-07-21hw/nvram/fw_cfg: Let fw_cfg_add_from_generator() return boolean valuePhilippe Mathieu-Daudé3-10/+10
Commits b6d7e9b66f..a43770df5d simplified the error propagation. Similarly to commit 6fd5bef10b "qom: Make functions taking Error** return bool, not void", let fw_cfg_add_from_generator() return a boolean value, not void. This allow to simplify parse_fw_cfg() and fixes the error handling issue reported by Coverity (CID 1430396): In parse_fw_cfg(): Variable assigned once to a constant guards dead code. Local variable local_err is assigned only once, to a constant value, making it effectively constant throughout its scope. If this is not the intent, examine the logic to see if there is a missing assignment that would make local_err not remain constant. It's the call of fw_cfg_add_from_generator(): Error *local_err = NULL; fw_cfg_add_from_generator(fw_cfg, name, gen_id, errp); if (local_err) { error_propagate(errp, local_err); return -1; } return 0; If it fails, parse_fw_cfg() sets an error and returns 0, which is wrong. Harmless, because the only caller passes &error_fatal. Reported-by: Peter Maydell <peter.maydell@linaro.org> Fixes: Coverity CID 1430396: 'Constant' variable guards dead code (DEADCODE) Fixes: 6552d87c48 ("softmmu/vl: Let -fw_cfg option take a 'gen_id' argument") Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200721131911.27380-3-philmd@redhat.com>
2020-07-21hw/nvram/fw_cfg: Simplify fw_cfg_add_from_generator() error propagationPhilippe Mathieu-Daudé2-3/+4
Document FWCfgDataGeneratorClass::get_data() return NULL on error, and non-NULL on success. This allow us to simplify fw_cfg_add_from_generator(). Since we don't need a local variable to propagate the error, we can remove the ERRP_GUARD() macro. Suggested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200721131911.27380-2-philmd@redhat.com>
2020-07-21qcow2: Implement v2 zero writes with discard if possibleKevin Wolf1-1/+8
qcow2 version 2 images don't support the zero flag for clusters, so for write_zeroes requests, we return -ENOTSUP and get explicit zero buffer writes. If the image doesn't have a backing file, we can do better: Just discard the respective clusters. This is relevant for 'qemu-img convert -O qcow2 -n', where qemu-img has to assume that the existing target image may contain any data, so it has to write zeroes. Without this patch, this results in a fully allocated target image, even if the source image was empty. Reported-by: Nir Soffer <nsoffer@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20200721135520.72355-2-kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2020-07-21file-posix: Handle `EINVAL` fallocate return valueAntoine Damhet1-1/+5
The `detect-zeroes=unmap` option may issue unaligned `FALLOC_FL_PUNCH_HOLE` requests, raw block devices can (and will) return `EINVAL`, qemu should then write the zeroes to the blockdev instead of issuing an `IO_ERROR`. The problem can be reprodced like this: $ qemu-io -c 'write -P 0 42 1234' --image-opts driver=host_device,filename=/dev/loop0,detect-zeroes=unmap write failed: Invalid argument Signed-off-by: Antoine Damhet <antoine.damhet@blade-group.com> Message-Id: <20200717135603.51180-1-antoine.damhet@blade-group.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2020-07-21qom: Document object_get_canonical_path() returns malloced stringMarkus Armbruster1-2/+3
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200714160202.3121879-5-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-07-21qom: Change object_get_canonical_path_component() not to mallocMarkus Armbruster23-61/+41
object_get_canonical_path_component() returns a malloced copy of a property name on success, null on failure. 19 of its 25 callers immediately free the returned copy. Change object_get_canonical_path_component() to return the property name directly. Since modifying the name would be wrong, adjust the return type to const char *. Drop the free from the 19 callers become simpler, add the g_strdup() to the other six. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200714160202.3121879-4-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com>
2020-07-21hw/avr/boot: Fix memory leak in avr_load_firmware()Philippe Mathieu-Daudé1-1/+1
The value returned by qemu_find_file() must be freed. This fixes Coverity issue CID 1430449, which points out that the memory returned by qemu_find_file() is leaked. Fixes: Coverity CID 1430449 (RESOURCE_LEAK) Fixes: 7dd8f6fde4 ('hw/avr: Add support for loading ELF/raw binaries') Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Michael Rolnik <mrolnik@gmail.com> Tested-by: Michael Rolnik <mrolnik@gmail.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20200714164257.23330-5-f4bug@amsat.org>
2020-07-21qemu-common: Document qemu_find_file()Philippe Mathieu-Daudé1-0/+17
Document qemu_find_file(), in particular the returned value which must be freed. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Michael Rolnik <mrolnik@gmail.com> Tested-by: Michael Rolnik <mrolnik@gmail.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20200714164257.23330-4-f4bug@amsat.org>
2020-07-21qemu/osdep: Reword qemu_get_exec_dir() documentationPhilippe Mathieu-Daudé1-1/+4
This comment is confuse, reword it a bit. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Michael Rolnik <mrolnik@gmail.com> Tested-by: Michael Rolnik <mrolnik@gmail.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20200714164257.23330-3-f4bug@amsat.org>
2020-07-21qemu/osdep: Document os_find_datadir() return valuePhilippe Mathieu-Daudé2-1/+9
Document os_find_datadir() returned data must be freed. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Michael Rolnik <mrolnik@gmail.com> Tested-by: Michael Rolnik <mrolnik@gmail.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20200714164257.23330-2-f4bug@amsat.org>
2020-07-21hw/net/xgmac: Fix buffer overflow in xgmac_enet_send()Mauro Matteo Cascella1-2/+12
A buffer overflow issue was reported by Mr. Ziming Zhang, CC'd here. It occurs while sending an Ethernet frame due to missing break statements and improper checking of the buffer size. Reported-by: Ziming Zhang <ezrakiez@gmail.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-07-21hw/net: Added plen fix for IPv6Andrew3-0/+38
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1708065 With network backend with 'virtual header' - there was an issue in 'plen' field. Overall, during TSO, 'plen' would be changed, but with 'vheader' this field should be set to the size of the payload itself instead of '0'. Signed-off-by: Andrew Melnychenko <andrew@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-07-21qapi: Fix visit_type_STRUCT() not to fail for null objectMarkus Armbruster1-0/+1
To make deallocating partially constructed objects work, the visit_type_STRUCT() need to succeed without doing anything when passed a null object. Commit cdd2b228b9 "qapi: Smooth visitor error checking in generated code" broke that. To reproduce, run tests/test-qobject-input-visitor with AddressSanitizer: ==4353==ERROR: LeakSanitizer: detected memory leaks Direct leak of 16 byte(s) in 1 object(s) allocated from: #0 0x7f192d0c5d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f192cd21b10 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51b10) #2 0x556725f6bbee in visit_next_list qapi/qapi-visit-core.c:86 #3 0x556725f49e15 in visit_type_UserDefOneList tests/test-qapi-visit.c:474 #4 0x556725f4489b in test_visitor_in_fail_struct_in_list tests/test-qobject-input-visitor.c:1086 #5 0x7f192cd42f29 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x72f29) SUMMARY: AddressSanitizer: 16 byte(s) leaked in 1 allocation(s). Test case /visitor/input/fail/struct-in-list feeds a list with a bad element to the QObject input visitor. Visiting that element duly fails, and aborts the visit with the list only partially constructed: the faulty object is null. Cleaning up the partially constructed list visits that null object, fails, and aborts the visit before the list node gets freed. Fix the the generated visit_type_STRUCT() to succeed for null objects. Fixes: cdd2b228b973d2a29edf7696ef6e8b08ec329019 Reported-by: Li Qiang <liq3ea@163.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200716150617.4027356-1-armbru@redhat.com> Tested-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Li Qiang <liq3ea@gmail.com>
2020-07-21block: fix bdrv_aio_cancel() for ENOMEDIUM requestsStefan Hajnoczi1-0/+8
bdrv_aio_cancel() calls aio_poll() on the AioContext for the given I/O request until it has completed. ENOMEDIUM requests are special because there is no BlockDriverState when the drive has no medium! Define a .get_aio_context() function for BlkAioEmAIOCB requests so that bdrv_aio_cancel() can find the AioContext where the completion BH is pending. Without this function bdrv_aio_cancel() aborts on ENOMEDIUM requests! libFuzzer triggered the following assertion: cat << EOF | qemu-system-i386 -M pc-q35-5.0 \ -nographic -monitor none -serial none \ -qtest stdio -trace ide\* outl 0xcf8 0x8000fa24 outl 0xcfc 0xe106c000 outl 0xcf8 0x8000fa04 outw 0xcfc 0x7 outl 0xcf8 0x8000fb20 write 0x0 0x3 0x2780e7 write 0xe106c22c 0xd 0x1130c218021130c218021130c2 write 0xe106c218 0x15 0x110010110010110010110010110010110010110010 EOF ide_exec_cmd IDE exec cmd: bus 0x56170a77a2b8; state 0x56170a77a340; cmd 0xe7 ide_reset IDEstate 0x56170a77a340 Aborted (core dumped) (gdb) bt #1 0x00007ffff4f93895 in abort () at /lib64/libc.so.6 #2 0x0000555555dc6c00 in bdrv_aio_cancel (acb=0x555556765550) at block/io.c:2745 #3 0x0000555555dac202 in blk_aio_cancel (acb=0x555556765550) at block/block-backend.c:1546 #4 0x0000555555b1bd74 in ide_reset (s=0x555557213340) at hw/ide/core.c:1318 #5 0x0000555555b1e3a1 in ide_bus_reset (bus=0x5555572132b8) at hw/ide/core.c:2422 #6 0x0000555555b2aa27 in ahci_reset_port (s=0x55555720eb50, port=2) at hw/ide/ahci.c:650 #7 0x0000555555b29fd7 in ahci_port_write (s=0x55555720eb50, port=2, offset=44, val=16) at hw/ide/ahci.c:360 #8 0x0000555555b2a564 in ahci_mem_write (opaque=0x55555720eb50, addr=556, val=16, size=1) at hw/ide/ahci.c:513 #9 0x000055555598415b in memory_region_write_accessor (mr=0x55555720eb80, addr=556, value=0x7fffffffb838, size=1, shift=0, mask=255, attrs=...) at softmmu/memory.c:483 Looking at bdrv_aio_cancel: 2728 /* async I/Os */ 2729 2730 void bdrv_aio_cancel(BlockAIOCB *acb) 2731 { 2732 qemu_aio_ref(acb); 2733 bdrv_aio_cancel_async(acb); 2734 while (acb->refcnt > 1) { 2735 if (acb->aiocb_info->get_aio_context) { 2736 aio_poll(acb->aiocb_info->get_aio_context(acb), true); 2737 } else if (acb->bs) { 2738 /* qemu_aio_ref and qemu_aio_unref are not thread-safe, so 2739 * assert that we're not using an I/O thread. Thread-safe 2740 * code should use bdrv_aio_cancel_async exclusively. 2741 */ 2742 assert(bdrv_get_aio_context(acb->bs) == qemu_get_aio_context()); 2743 aio_poll(bdrv_get_aio_context(acb->bs), true); 2744 } else { 2745 abort(); <=============== 2746 } 2747 } 2748 qemu_aio_unref(acb); 2749 } Fixes: 02c50efe08736116048d5fc355043080f4d5859c ("block: Add bdrv_aio_cancel_async") Reported-by: Alexander Bulekov <alxndr@bu.edu> Buglink: https://bugs.launchpad.net/qemu/+bug/1878255 Originally-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20200720100141.129739-1-stefanha@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2020-07-21module: ignore NULL typeGerd Hoffmann1-0/+3
Just return in case module_load_qom_one(NULL) is called. vga_interface_available() can do that. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20200720100352.2477-3-kraxel@redhat.com>
2020-07-21qxl: fix modular builds with dtraceGerd Hoffmann1-0/+9
Checking the enable/disable state of tracepoints via trace_event_get_state_backends() does not work for modules. qxl checks the state for a small optimization (avoid g_strndup call in case log_buf will not be used anyway), so we can just drop that check for modular builds. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20200720100352.2477-2-kraxel@redhat.com>
2020-07-21xhci: fix valid.max_access_size to access address registersLaurent Vivier1-2/+2
QEMU XHCI advertises AC64 (64-bit addressing) but doesn't allow 64-bit mode access in "runtime" and "operational" MemoryRegionOps. Set the max_access_size based on sizeof(dma_addr_t) as AC64 is set. XHCI specs: "If the xHC supports 64-bit addressing (AC64 = ‘1’), then software should write 64-bit registers using only Qword accesses. If a system is incapable of issuing Qword accesses, then writes to the 64-bit address fields shall be performed using 2 Dword accesses; low Dword-first, high-Dword second. If the xHC supports 32-bit addressing (AC64 = ‘0’), then the high Dword of registers containing 64-bit address fields are unused and software should write addresses using only Dword accesses" The problem has been detected with SLOF, as linux kernel always accesses registers using 32-bit access even if AC64 is set and revealed by 5d971f9e6725 ("memory: Revert "memory: accept mismatching sizes in memory_region_access_valid"") Suggested-by: Alexey Kardashevskiy <aik@au1.ibm.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-id: 20200721083322.90651-1-lvivier@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-07-21qemu-iotests: add testcase for bz #1857490Maxim Levitsky2-3/+53
Test that we can't write-share raw luks images by default, but we still can with share-rw=on Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Message-Id: <20200719122059.59843-3-mlevitsk@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>