summary refs log tree commit diff stats
path: root/scripts/qapi/expr.py (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-08-10Update version for v6.1.0-rc3 releasePeter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-08-10MAINTAINERS: Name and email address changeHanna Reitz2-4/+5
I have changed my name and email address. Update the MAINTAINERS file to match, and .mailmap in case anyone wants to send me an email because of some past commit I authored. (As suggested by Philippe, I put the .mailmap line into the "preferred name forms" section, considering it counts as a git author config change.) Signed-off-by: Hanna Reitz <hreitz@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-08-10ui/sdl2: Check return value from g_setenv()Peter Maydell1-1/+4
Setting environment variables can fail; check the return value from g_setenv() and bail out if we couldn't set SDL_VIDEODRIVER. Fixes: Coverity 1458798 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210809161424.32355-1-peter.maydell@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-08-10audio: Never send migration sectionDr. David Alan Gilbert1-0/+10
The audio migration vmstate is empty, and always has been; we can't just remove it though because an old qemu might send it us. Changes with -audiodev now mean it's sometimes created when it didn't used to be, and can confuse migration to old qemu. Change it so that vmstate_audio is never sent; if it's received it should still be accepted, and old qemu's shouldn't be too upset if it's missing. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Tested-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20210809170956.78536-1-dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-08-10ui/gtk: retry sending VTE console inputVolker Rümelin1-6/+4
Commit 584af1f1d9 ("ui/gtk: add a keyboard fifo to the VTE consoles") changed the VTE chardev backend code to rely on the chr_accept_input() callback function. The code expects a chr_accept_input() call whenever qemu_chr_be_can_write() bytes were written. It turns out this is wrong. Some chardev frontends only call this callback after can_write was 0. Change the code to send data until the keyboard fifo is empty or qemu_chr_be_can_write() returns 0. Fixes: 584af1f1d9 ("ui/gtk: add a keyboard fifo to the VTE consoles") Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210810063257.17411-1-vr_qemu@t-online.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-08-09qga: fix leak of base64 decoded data on command errorDaniel P. Berrangé1-2/+2
If the guest command fails to be spawned, then we would leak the decoded base64 input used for the command's stdin feed. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Michael Roth <michael.roth@amd.com>
2021-08-09tests: filter out TLS distinguished name in certificate checksDaniel P. Berrangé3-3/+8
The version of GNUTLS in Fedora 34 has changed the order in which encodes fields when generating new TLS certificates. This in turn changes the order seen when querying the distinguished name. This ultimately breaks the expected output in the NBD TLS iotests. We don't need to be comparing the exact distinguished name text for the purpose of the test though, so it is fine to filter it out. Reported-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20210804180330.3469683-1-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: Eric Blake <eblake@redhat.com> Signed-off-by: Hanna Reitz <hreitz@redhat.com>
2021-08-09block/export/fuse.c: fix musl buildFabrice Fontaine1-2/+6
Fix the following build failure on musl raised since version 6.0.0 and https://gitlab.com/qemu-project/qemu/-/commit/4ca37a96a75aafe7a37ba51ab1912b09b7190a6b because musl does not define FALLOC_FL_ZERO_RANGE: ../block/export/fuse.c: In function 'fuse_fallocate': ../block/export/fuse.c:563:23: error: 'FALLOC_FL_ZERO_RANGE' undeclared (first use in this function) 563 | } else if (mode & FALLOC_FL_ZERO_RANGE) { | ^~~~~~~~~~~~~~~~~~~~ Fixes: - http://autobuild.buildroot.org/results/b96e3d364fd1f8bbfb18904a742e73327d308f64 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Message-Id: <20210809095101.1101336-1-fontaine.fabrice@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Denis V. Lunev <den@openvz.org> Signed-off-by: Hanna Reitz <hreitz@redhat.com>
2021-08-09hw/nvme: fix missing variable initializersKlaus Jensen1-3/+3
Coverity found that 'uuid', 'csi' and 'eui64' are uninitialized. While we set most of the fields, we do not explicitly set the rsvd2 field in the NvmeIdNsDescr header. Fix this by explicitly zero-initializing the variables. Reported-by: Coverity (CID 1458835, 1459295 and 1459580) Fixes: 6870cfb8140d ("hw/nvme: namespace parameter for EUI-64") Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2021-08-06meson: fix logic for gnutls checkAlyssa Ross1-1/+1
The logic before was if not get_option('gnutls').auto() or have_system Which is equivalent to if get_option('gnutls').enabled() or get_option('gnutls').disabled() or have_system This means that the check for gnutls is performed even if gnutls is disabled, which means that the build system will insist on having libtasn1 if gnutls is found, even if gnutls support is disabled. When gnutls is disabled, the check for gnutls shouldn't be performed, to ensure that further build system logic (like the check for libtasn1) doesn't make decisions based on the presence of gnutls, rather than the gnutls option. After making this change, I can successfully ./configure --disable-gnutls on my system with gnutls installed, but not libtasn1. Signed-off-by: Alyssa Ross <hi@alyssa.is> Message-Id: <20210806144947.321647-1-hi@alyssa.is> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
2021-08-05chardev: report a simpler error about duplicated idMarc-André Lureau1-0/+5
Report: "Chardev with id 'char2' already exists" Rather than: "Failed to add chardev 'char2': duplicate yank instance" Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2021-08-05chardev: give some context on chardev-add errorMarc-André Lureau1-6/+9
Description from Daniel P. Berrangé: > The original code reported: > > "attempt to add duplicate property 'char2' to object (type 'container')" > > Since adding yank support, the current code reports > > "duplicate yank instance" > > With this patch applied it now reports: > > "Failed to add chardev 'char2': duplicate yank instance" > > This is marginally better, but still not great, not that the original > error was great either. > > It would be nice if we could report > > "chardev with id 'char2' already exists" Related to: https://bugzilla.redhat.com/show_bug.cgi?id=1984721 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2021-08-05chardev: fix qemu_chr_open_fd() with fd_in==fd_outMarc-André Lureau1-4/+15
The "serial" chardev calls qemu_chr_open_fd() with the same fd. This may lead to double-close as each QIOChannel owns the fd. Instead, share the reference to the same QIOChannel. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2021-08-05chardev: fix qemu_chr_open_fd() being called with fd=-1Marc-André Lureau1-9/+17
The "file" chardev may call qemu_chr_open_fd() with fd_in=-1. This may cause invalid system calls, as the QIOChannel is assumed to be properly initialized later on. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2021-08-05chardev: fix fd_chr_add_watch() when in != outMarc-André Lureau1-1/+77
Create child sources for the different streams, and dispatch on the parent source with the synthesized conditions. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2021-08-05chardev: mark explicitly first argument as poisonedMarc-André Lureau12-13/+19
Since commit 9894dc0cdcc397ee5b26370bc53da6d360a363c2 "char: convert from GIOChannel to QIOChannel", the first argument to the watch callback can actually be a QIOChannel, which is not a GIOChannel (but a QEMU Object). Even though we never used that pointer, change the callback type to warn the users. Possibly a better fix later, we may want to store the callback and call it from intermediary functions. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2021-08-05linux-user/elfload: byteswap i386 registers when dumping coreIlya Leoshkevich1-44/+44
Core dumps from emulating x86_64 on big-endian hosts contain incorrect register values. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210803172013.148446-1-iii@linux.ibm.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-08-05linux-user: fix guest/host address mixup in i386 setup_rt_frame()Ilya Leoshkevich1-4/+4
setup_rt_frame() passes siginfo and ucontext host addresses to guest signal handlers, causing problems when e.g. emulating x86_64 on s390x. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210803171858.148394-1-iii@linux.ibm.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-08-04chardev/socket: print a more correct command-line addressMarc-André Lureau1-2/+2
Better reflect the command line version of the socket address arguments, following the now recommended long-form opt=on syntax. Complement/fixes commit 9d902d51 "chardev: do not use short form boolean options in non-QemuOpts character device descriptions". Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2021-08-04util: fix abstract socket path copyMarc-André Lureau1-1/+4
Commit 776b97d360 "qemu-sockets: add abstract UNIX domain socket support" neglected to update socket_sockaddr_to_address_unix() and copied the whole sun_path without taking "salen" into account. Later, commit 3b14b4ec49 "sockets: Fix socket_sockaddr_to_address_unix() for abstract sockets" handled the abstract UNIX path, by stripping the leading \0 character and fixing address details, but didn't use salen either. Not taking "salen" into account may result in incorrect "path" being returned in monitors commands, as we read past the address which is not necessarily \0-terminated. Fixes: 776b97d3605ed0fc94443048fdf988c7725e38a9 Fixes: 3b14b4ec49a801067da19d6b8469eb1c1911c020 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2021-08-04Update version for v6.1.0-rc2 releasePeter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-08-04docs: convert writing-qmp-commands.txt to writing-qmp-commands.rstJohn Snow2-285/+311
This does about the bare minimum, converting section headers to ReST ones and adding an indent for code blocks. Signed-off-by: John Snow <jsnow@redhat.com> Message-Id: <20210721165015.2180311-1-jsnow@redhat.com> Reviewed-by: Connor Kuehl <ckuehl@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2021-08-04docs/qapi-code-gen: add cross-referencesJohn Snow1-49/+58
Add clickables to many places. Signed-off-by: John Snow <jsnow@redhat.com> Message-Id: <20210720235619.2048797-4-jsnow@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2021-08-04docs/qapi-code-gen: Beautify formattingJohn Snow1-83/+91
Mostly, add ``literal`` markers to a lot of things like C types, add code blocks, and fix the way a few things render. Signed-off-by: John Snow <jsnow@redhat.com> Message-Id: <20210720235619.2048797-3-jsnow@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2021-08-04docs: convert qapi-code-gen.txt to ReSTJohn Snow2-252/+316
This is a very rudimentary conversion from .txt to .rst changing as little as possible, but getting it to render somewhat nicely; without using any Sphinx directives. (It is 'native' ReST.) Further patches will add cross-references and Sphinx-specific extensions to make it sparkle. Signed-off-by: John Snow <jsnow@redhat.com> Message-Id: <20210720235619.2048797-2-jsnow@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2021-08-04docs/devel/qapi-code-gen: Update examples to match current codeMarkus Armbruster1-7/+16
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20210712150214.624281-1-armbru@redhat.com> Acked-by: John Snow <jsnow@redhat.com>
2021-08-03Drop _DSM 5 from expected DSDTs on ARMMichael S. Tsirkin6-5/+0
diff -rup /tmp/old/tests/data/acpi/microvm/DSDT.pcie.dsl /tmp/new/tests/data/acpi/microvm/DSDT.pcie.dsl --- /tmp/old/tests/data/acpi/microvm/DSDT.pcie.dsl 2021-08-03 16:22:52.289295442 -0400 +++ /tmp/new/tests/data/acpi/microvm/DSDT.pcie.dsl 2021-08-03 16:22:40.102286317 -0400 @@ -1302,14 +1302,9 @@ DefinitionBlock ("", "DSDT", 2, "BOCHS " { Return (Buffer (One) { - 0x21 // ! + 0x01 // . }) } - - If ((Arg2 == 0x05)) - { - Return (Zero) - } } Return (Buffer (One) Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-08-03Revert "acpi/gpex: Inform os to keep firmware resource map"Michael S. Tsirkin1-18/+2
This reverts commit 0cf8882fd06ba0aeb1e90fa6f23fce85504d7e14. Which this commit, with aarch64 when using efi PCI devices with IO ports do not work. The reason is that EFI creates I/O port mappings below 0x1000 (in fact, at 0). However Linux, for legacy reasons, does not support I/O ports <= 0x1000 on PCI, so the I/O assignment created by EFI is rejected. EFI creates the mappings primarily for itself, and up until DSM #5 started to be enforced, all PCI resource allocations that existed at boot were ignored by Linux and recreated from scratch. Also, the commit in question looks dubious - it seems unlikely that Linux would fail to create a resource tree. What does happen is that BARs get moved around, which may cause trouble in some cases: for instance, Linux had to add special code to the EFI framebuffer driver to copy with framebuffer BARs being relocated. DSM #5 has a long history of debate and misinterpretation. Link: https://lore.kernel.org/r/20210724185234.GA2265457@roeck-us.net/ Fixes: 0cf8882fd06 ("acpi/gpex: Inform os to keep firmware resource map") Reported-by: Guenter Roeck <linux@roeck-us.net> Suggested-by: Ard Biesheuvel <ardb@kernel.org> Acked-by: Ard Biesheuvel <ardb@kernel.org> Tested-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-08-03arm/acpi: allow DSDT changesMichael S. Tsirkin1-0/+5
We are going to commit ccee1a8140 ("acpi: Update _DSM method in expected files"). Allow changes to DSDT on ARM. Only configs with pci are affected thus all virt variants but for microvm only the pcie variant. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-08-03acpi: x86: pcihp: add support hotplug on multifunction bridgesIgor Mammedov1-14/+30
Commit [1] switched PCI hotplug from native to ACPI one by default. That however breaks hotplug on following CLI that used to work: -nodefaults -machine q35 \ -device pcie-root-port,id=pcie-root-port-0,multifunction=on,bus=pcie.0,addr=0x1,chassis=1 \ -device pcie-root-port,id=pcie-root-port-1,port=0x1,addr=0x1.0x1,bus=pcie.0,chassis=2 where PCI device is hotplugged to pcie-root-port-1 with error on guest side: ACPI BIOS Error (bug): Could not resolve symbol [^S0B.PCNT], AE_NOT_FOUND (20201113/psargs-330) ACPI Error: Aborting method \_SB.PCI0.PCNT due to previous error (AE_NOT_FOUND) (20201113/psparse-531) ACPI Error: Aborting method \_GPE._E01 due to previous error (AE_NOT_FOUND) (20201113/psparse-531) ACPI Error: AE_NOT_FOUND, while evaluating GPE method [_E01] (20201113/evgpe-515) cause is that QEMU's ACPI hotplug never supported functions other then 0 and due to bug it was generating notification entries for not described functions. Technically there is no reason not to describe cold-plugged bridges (root ports) on functions other then 0, as they similarly to bridge on function 0 are unpluggable. So since we need to describe multifunction devices iterate over fuctions as well. But describe only cold-plugged bridges[root ports] on functions other than 0 as well. 1) Fixes: 17858a169508609ca9063c544833e5a1adeb7b52 (hw/acpi/ich9: Set ACPI PCI hot-plug as default on Q35) Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reported-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20210723090424.2092226-1-imammedo@redhat.com> Fixes: 17858a169508609ca9063c544833e5a1adeb7b52 (hw/acpi/ich9: Set ACPI PCI hot-plug as default on Q35)<br> Signed-off-by: Igor Mammedov &lt;<a href="mailto:imammedo@redhat.com" target="_blank">imammedo@redhat.com</a>&gt;<br> Reported-by: Laurent Vivier &lt;<a href="mailto:lvivier@redhat.com" target="_blank">lvivier@redhat.com</a>&gt;<br> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-08-03hw/pcie-root-port: Fix hotplug for PCI devices requiring IOMarcel Apfelbaum1-0/+5
Q35 has now ACPI hotplug enabled by default for PCI(e) devices. As opposed to native PCIe hotplug, guests like Fedora 34 will not assign IO range to pcie-root-ports not supporting native hotplug, resulting into a regression. Reproduce by: qemu-bin -M q35 -device pcie-root-port,id=p1 -monitor stdio device_add e1000,bus=p1 In the Guest OS the respective pcie-root-port will have the IO range disabled. Fix it by setting the "reserve-io" hint capability of the pcie-root-ports so the firmware will allocate the IO range instead. Acked-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Message-Id: <20210802090057.1709775-1-marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-08-03hw/sd/sdcard: Fix assertion accessing out-of-range addresses with CMD30Philippe Mathieu-Daudé2-1/+37
OSS-Fuzz found sending illegal addresses when querying the write protection bits triggers the assertion added in commit 84816fb63e5 ("hw/sd/sdcard: Assert if accessing an illegal group"): qemu-fuzz-i386-target-generic-fuzz-sdhci-v3: ../hw/sd/sd.c:824: uint32_t sd_wpbits(SDState *, uint64_t): Assertion `wpnum < sd->wpgrps_size' failed. #3 0x7f62a8b22c91 in __assert_fail #4 0x5569adcec405 in sd_wpbits hw/sd/sd.c:824:9 #5 0x5569adce5f6d in sd_normal_command hw/sd/sd.c:1389:38 #6 0x5569adce3870 in sd_do_command hw/sd/sd.c:1737:17 #7 0x5569adcf1566 in sdbus_do_command hw/sd/core.c:100:16 #8 0x5569adcfc192 in sdhci_send_command hw/sd/sdhci.c:337:12 #9 0x5569adcfa3a3 in sdhci_write hw/sd/sdhci.c:1186:9 #10 0x5569adfb3447 in memory_region_write_accessor softmmu/memory.c:492:5 It is legal for the CMD30 to query for out-of-range addresses. Such invalid addresses are simply ignored in the response (write protection bits set to 0). In commit 84816fb63e5 ("hw/sd/sdcard: Assert if accessing an illegal group") we misplaced the assertion *before* we test the address is in range. Move it *after*. Include the qtest reproducer provided by Alexander Bulekov: $ make check-qtest-i386 ... Running test qtest-i386/fuzz-sdcard-test qemu-system-i386: ../hw/sd/sd.c:824: sd_wpbits: Assertion `wpnum < sd->wpgrps_size' failed. Cc: qemu-stable@nongnu.org Reported-by: OSS-Fuzz (Issue 29225) Suggested-by: Peter Maydell <peter.maydell@linaro.org> Fixes: 84816fb63e5 ("hw/sd/sdcard: Assert if accessing an illegal group") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/495 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210802235524.3417739-3-f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Alexander Bulekov <alxndr@bu.edu>
2021-08-03hw/sd/sdcard: Document out-of-range addresses for SEND_WRITE_PROTPhilippe Mathieu-Daudé1-1/+8
Per the 'Physical Layer Simplified Specification Version 3.01', Table 4-22: 'Block Oriented Write Protection Commands' SEND_WRITE_PROT (CMD30) If the card provides write protection features, this command asks the card to send the status of the write protection bits [1]. [1] 32 write protection bits (representing 32 write protect groups starting at the specified address) [...] The last (least significant) bit of the protection bits corresponds to the first addressed group. If the addresses of the last groups are outside the valid range, then the corresponding write protection bits shall be set to 0. Split the if() statement (without changing the behaviour of the code) to better position the description comment. Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210802235524.3417739-2-f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Alexander Bulekov <alxndr@bu.edu>
2021-08-03block: Fix in_flight leak in request padding error pathKevin Wolf1-3/+4
When bdrv_pad_request() fails in bdrv_co_preadv_part(), bs->in_flight has been increased, but is never decreased again. This leads to a hang when trying to drain the block node. This bug was observed with Windows guests which issue a request that fully uses IOV_MAX during installation, so that when padding is necessary (O_DIRECT with a 4k sector size block device on the host), adding another entry causes failure. Call bdrv_dec_in_flight() to fix this. There is a larger problem to solve here because this request shouldn't even fail, but Windows doesn't seem to care and with this minimal fix the installation succeeds. So given that we're already in freeze, let's take this minimal fix for 6.1. Fixes: 98ca45494fcd6bf0336ecd559e440b6de6ea4cd3 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1972079 Reported-by: Qing Wang <qinwang@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20210727154923.91067-1-kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-08-03tests/tcg: Test that compare-and-trap raises SIGFPEJonathan Albrecht2-1/+103
Signed-off-by: Jonathan Albrecht <jonathan.albrecht@linux.vnet.ibm.com> Message-Id: <20210709160459.4962-3-jonathan.albrecht@linux.vnet.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-08-03linux-user/s390x: signal with SIGFPE on compare-and-trapJonathan Albrecht1-20/+34
Currently when a compare-and-trap instruction is executed, qemu will always raise a SIGILL signal. On real hardware, a SIGFPE is raised. Change the PGM_DATA case in cpu_loop to follow the behavior in linux kernel /arch/s390/kernel/traps.c. * Only raise SIGILL if DXC == 0 * If DXC matches a non-simulated IEEE exception, raise SIGFPE with correct si_code * Raise SIGFPE with si_code == 0 for everything else When applied on 20210705210434.45824-2-iii@linux.ibm.com, this fixes crashes in the java jdk such as the linked bug. Signed-off-by: Jonathan Albrecht <jonathan.albrecht@linux.vnet.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Buglink: https://bugs.launchpad.net/qemu/+bug/1920913 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/319 Message-Id: <20210709160459.4962-2-jonathan.albrecht@linux.vnet.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-08-03target/s390x: Fix SIGILL and SIGFPE psw.addr reportingIlya Leoshkevich1-1/+11
For SIGILL, SIGFPE and SIGTRAP the PSW must point after the instruction, and at the instruction for other signals. Currently under qemu-user for SIGFILL and SIGFPE it points at the instruction. Fix by advancing psw.addr for these signals. Co-developed-by: Ulrich Weigand <ulrich.weigand@de.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Buglink: https://gitlab.com/qemu-project/qemu/-/issues/319 Message-Id: <20210705210434.45824-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-08-03Update libslirp to v4.6.1Marc-André Lureau2-0/+2
Switch from stable-4.2 branch to upstream v4.6.1 release + fixes. ## [Unreleased] ### Fixed - Haiku fixes. !98 !99 - Fix a minor DHCP regression introduced in 4.6.0. !97 ## [4.6.1] - 2021-06-18 ### Fixed - Fix DHCP regression introduced in 4.6.0. !95 ## [4.6.0] - 2021-06-14 ### Added - mbuf: Add debugging helpers for allocation. !90 ### Changed - Revert "Set macOS deployment target to macOS 10.4". !93 ### Fixed - mtod()-related buffer overflows (CVE-2021-3592 #44, CVE-2021-3593 #45, CVE-2021-3594 #47, CVE-2021-3595 #46). - poll_fd: add missing fd registration for UDP and ICMP - ncsi: make ncsi_calculate_checksum work with unaligned data. !89 - Various typos and doc fixes. !88 ## [4.5.0] - 2021-05-18 ### Added - IPv6 forwarding. !62 !75 !77 - slirp_neighbor_info() to dump the ARP/NDP tables. !71 ### Changed - Lazy guest address resolution for IPv6. !81 - Improve signal handling when spawning a child. !61 - Set macOS deployment target to macOS 10.4. !72 - slirp_add_hostfwd: Ensure all error paths set errno. !80 - More API documentation. ### Fixed - Assertion failure on unspecified IPv6 address. !86 - Disable polling for PRI on MacOS, fixing some closing streams issues. !73 - Various memory leak fixes on fastq/batchq. !68 - Memory leak on IPv6 fast-send. !67 - Slow socket response on Windows. !64 - Misc build and code cleanups. !60 !63 !76 !79 !84 ## [4.4.0] - 2020-12-02 ### Added - udp, udp6, icmp: handle TTL value. !48 - Enable forwarding ICMP errors. !49 - Add DNS resolving for iOS. !54 ### Changed - Improve meson subproject() support. !53 - Removed Makefile-based build system. !56 ### Fixed - socket: consume empty packets. !55 - check pkt_len before reading protocol header (CVE-2020-29129). !57 - ip_stripoptions use memmove (fixes undefined behaviour). !47 - various Coverity-related changes/fixes. ## [4.3.1] - 2020-07-08 ### Changed - A silent truncation could occur in `slirp_fmt()`, which will now print a critical message. See also #22. ### Fixed - CVE-2020-10756 - Drop bogus IPv6 messages that could lead to data leakage. See !44 and !42. - Fix win32 builds by using the SLIRP_PACKED definition. - Various coverity scan errors fixed. !41 - Fix new GCC warnings. !43 ## [4.3.0] - 2020-04-22 ### Added - `SLIRP_VERSION_STRING` macro, with the git sha suffix when building from git - `SlirpConfig.disable_dns`, to disable DNS redirection #16 ### Changed - `slirp_version_string()` now has the git sha suffix when building form git - Limit DNS redirection to port 53 #16 ### Fixed - Fix build regression with mingw & NetBSD - Fix use-afte-free in `ip_reass()` (CVE-2020-1983) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Doug Evans <dje@google.com>
2021-08-03qga-win/msi: fix missing libstdc++-6 DLL in MSI installerMichael Roth1-0/+4
libstdc++ is required for the qga-vss.dll that provides fsfreeze functionality. Currently it is not provided by the MSI installer, resulting in fsfreeze being disabled in guest environments where it has not been installed by other means. In the future this would be better handled via gcc-cpp ComponentGroup provided by msitools, but that would be better handled with a general rework of DLL dependency handling in the installer build. Keep it simple for now to fix this regression. Tested with Fedora 34 mingw build environment. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Kostiantyn Kostiuk <konstantin@daynix.com> Cc: Marc-André Lureau <marcandre.lureau@redhat.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Michael Roth <michael.roth@amd.com>
2021-08-02qemu-ga/msi: fix w32 libgcc nameGerd Hoffmann1-1/+1
This is what I find on my Fedora 34 mingw install. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael Roth <michael.roth@amd.com>
2021-08-02qga-win: Free GMatchInfo properlyKostiantyn Kostiuk1-2/+1
The g_regex_match function creates match_info even if it returns FALSE. So we should always call g_match_info_free. A better solution is using g_autoptr for match_info variable. Signed-off-by: Kostiantyn Kostiuk <konstantin@daynix.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Michael Roth <michael.roth@amd.com>
2021-08-02qga-win: Fix handle leak in ga_get_win_product_name()Basil Salman1-2/+7
In ga_get_win_product_name() a handle to Registry key was open but not closed. In this patch the handle is closed as part of the free routine. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1929144 Signed-off-by: Basil Salman <basil@daynix.com> Signed-off-by: Basil Salman <bsalman@redhat.com> Signed-off-by: Michael Roth <michael.roth@amd.com>
2021-08-02qga-win: Fix build_guest_fsinfo() close of nonexistentBasil Salman1-2/+4
On the current error path of build_guest_fsinfo(), a non existent handle is passed to CloseHandle(). This patch adds initialization of hLocalDiskHandle to INVALID_HANDLE_VALUE, and checks for handle validity before the handle is closed. Signed-off-by: Basil Salman <basil@daynix.com> Signed-off-by: Basil Salman <basil@redhat.com> Signed-off-by: Michael Roth <michael.roth@amd.com>
2021-08-02qga-win: Increase VSS freeze timeout to 60 secs instead of 10Basil Salman1-1/+1
Currently Requester freeze times out after 10 seconds, while the default timeout for Writer Freeze is 60 seconds. according to VSS Documentation [1]. [1]: https://docs.microsoft.com/en-us/windows/win32/vss/overview-of-processing-a-backup-under-vss Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1909073 Signed-off-by: Basil Salman <bsalman@daynix.com> Signed-off-by: Basil Salman <basil@daynix.com> Signed-off-by: Michael Roth <michael.roth@amd.com>
2021-08-02docs: Move user-facing barrier docs into system manualPeter Maydell3-48/+45
The remaining text in docs/barrier.txt is user-facing description of what the device is and how to use it. Move this into the system manual and rstify it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20210727204112.12579-4-peter.maydell@linaro.org
2021-08-02ui/input-barrier: Move TODOs from barrier.txt to a commentPeter Maydell2-4/+5
docs/barrier.txt has a couple of TODO notes about things to be implemented in this device; move them into a comment in the source code. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20210727204112.12579-3-peter.maydell@linaro.org
2021-08-02docs: Move the protocol part of barrier.txt into interopPeter Maydell3-318/+427
Most of docs/barrier.txt is describing the protocol implemented by the input-barrier device. Move this into the interop section of the manual, and rstify it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-id: 20210727204112.12579-2-peter.maydell@linaro.org
2021-08-02docs: Move bootindex.txt into system section and rstifyPeter Maydell3-52/+77
Move bootindex.txt into the system section of the manual and turn it into rST format. To make the document make more sense in the context of the system manual, expand the title and introductory paragraphs to give more context. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20210727194955.7764-1-peter.maydell@linaro.org
2021-08-02hw/arm/boot: Report error if there is no fw_cfg device in the machinePeter Maydell2-7/+9
If the user provides both a BIOS/firmware image and also a guest kernel filename, arm_setup_firmware_boot() will pass the kernel image to the firmware via the fw_cfg device. However we weren't checking whether there really was a fw_cfg device present, and if there wasn't we would crash. This crash can be provoked with a command line such as qemu-system-aarch64 -M raspi3 -kernel /dev/null -bios /dev/null -display none It is currently only possible on the raspi3 machine, because unless the machine sets info->firmware_loaded we won't call arm_setup_firmware_boot(), and the only machines which set that are: * virt (has a fw-cfg device) * sbsa-ref (checks itself for kernel_filename && firmware_loaded) * raspi3 (crashes) But this is an unfortunate beartrap to leave for future machine model implementors, so we should handle this situation in boot.c. Check in arm_setup_firmware_boot() whether the fw-cfg device exists before trying to load files into it, and if it doesn't exist then exit with a hopefully helpful error message. Because we now handle this check in a machine-agnostic way, we can remove the check from sbsa-ref. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/503 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210726163351.32086-1-peter.maydell@linaro.org
2021-08-02docs/tools/virtiofsd.rst: Delete stray backtickPeter Maydell1-1/+1
The documentation of the posix_acl option has a stray backtick at the end of the text (which is rendered literally into the HTML). Delete it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20210726142338.31872-11-peter.maydell@linaro.org